← Back to branch summary

~ubuntu-branches/ubuntu/natty/qt4-x11/natty

« back to all changes in this revision

Viewing changes to debian/patches/kubuntu_30_blacklist_ssl_certificates.diff

  • Committer: Bazaar Package Importer
  • Author(s): Jonathan Riddell
  • Date: 2011-03-25 17:31:29 UTC
  • Revision ID: james.westby@ubuntu.com-20110325173129-5re0ix4zv4y92olo
Tags: 4:4.7.2-0ubuntu6
https://launchpad.net/bugs/742377
* SECURITY UPDATE: Fake SSL certificates produced by Comodo, LP: #742377
* Update kubuntu_30_blacklist_ssl_certificates.diff from upstream staging
  - in qsslsocket_openssl.cpp block bad certificates
  - http://qt.gitorious.org/+qt-developers/qt/staging/commit/b87528a71b66e786c11804d7b79e408aae612748
  - http://bugreports.qt.nokia.com/browse/QTBUG-18338
  - http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/kubuntu_30_blacklist_ssl_certificates.diff
14
14
 src/network/ssl/qsslcertificate.cpp                |   34 +++++++++++++++++--
15
15
 src/network/ssl/qsslcertificate_p.h                |    1 +
16
16
 
17
 
diff --git a/src/network/ssl/qsslcertificate.cpp b/src/network/ssl/qsslcertificate.cpp
18
 
index 618ac79..a5cdf01 100644
19
 
--- a/src/network/ssl/qsslcertificate.cpp
20
 
+++ b/src/network/ssl/qsslcertificate.cpp
21
 
@@ -219,17 +219,19 @@ bool QSslCertificate::isNull() const
 
17
Index: qt4-x11-4.7.2/src/network/ssl/qsslcertificate.cpp
 
18
===================================================================
 
19
--- qt4-x11-4.7.2.orig/src/network/ssl/qsslcertificate.cpp      2011-03-25 17:30:38.059644389 +0000
 
20
+++ qt4-x11-4.7.2/src/network/ssl/qsslcertificate.cpp   2011-03-25 17:31:17.879644378 +0000
 
21
@@ -219,17 +219,19 @@
22
22
     Returns true if this certificate is valid; otherwise returns
23
23
     false.
24
24
 
42
42
 }
43
43
 
44
44
 /*!
45
 
@@ -798,6 +800,30 @@ QList<QSslCertificate> QSslCertificatePrivate::certificatesFromDer(const QByteAr
 
45
@@ -798,6 +800,30 @@
46
46
     return certificates;
47
47
 }
48
48
 
73
73
 #ifndef QT_NO_DEBUG_STREAM
74
74
 QDebug operator<<(QDebug debug, const QSslCertificate &certificate)
75
75
 {
76
 
diff --git a/src/network/ssl/qsslcertificate_p.h b/src/network/ssl/qsslcertificate_p.h
77
 
index cdceb0f..1ce33d3 100644
78
 
--- a/src/network/ssl/qsslcertificate_p.h
79
 
+++ b/src/network/ssl/qsslcertificate_p.h
80
 
@@ -96,6 +96,7 @@ public:
 
76
Index: qt4-x11-4.7.2/src/network/ssl/qsslcertificate_p.h
 
77
===================================================================
 
78
--- qt4-x11-4.7.2.orig/src/network/ssl/qsslcertificate_p.h      2011-03-25 17:30:38.039644389 +0000
 
79
+++ qt4-x11-4.7.2/src/network/ssl/qsslcertificate_p.h   2011-03-25 17:31:17.889644378 +0000
 
80
@@ -96,6 +96,7 @@
81
81
     static QSslCertificate QSslCertificate_from_X509(X509 *x509);
82
82
     static QList<QSslCertificate> certificatesFromPem(const QByteArray &pem, int count = -1);
83
83
     static QList<QSslCertificate> certificatesFromDer(const QByteArray &der, int count = -1);
85
85
 
86
86
     friend class QSslSocketBackendPrivate;
87
87
 
 
88
Index: qt4-x11-4.7.2/src/network/ssl/qsslsocket_openssl.cpp
 
89
===================================================================
 
90
--- qt4-x11-4.7.2.orig/src/network/ssl/qsslsocket_openssl.cpp   2011-02-22 12:04:00.000000000 +0000
 
91
+++ qt4-x11-4.7.2/src/network/ssl/qsslsocket_openssl.cpp        2011-03-25 17:31:17.899644378 +0000
 
92
@@ -1183,6 +1183,13 @@
 
93
     X509 *x509 = q_SSL_get_peer_certificate(ssl);
 
94
     configuration.peerCertificate = QSslCertificatePrivate::QSslCertificate_from_X509(x509);
 
95
     q_X509_free(x509);
 
96
+    if (QSslCertificatePrivate::isBlacklisted(configuration.peerCertificate)) {
 
97
+        q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));
 
98
+        q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
 
99
+        emit q->error(QAbstractSocket::SslHandshakeFailedError);
 
100
+        plainSocket->disconnectFromHost();
 
101
+        return false;
 
102
+    }
 
103
 
 
104
     // Start translating errors.
 
105
     QList<QSslError> errors;