QSslConfiguration: toggle on demand loading of root certs properly

make sure we keep track of when we can load root certs and when we
cannot (we cannot when the developer set the certs explicitly). This is
implemented the same way for QSslSocket already, and needs to be
duplicated because we have 2 methods for setting CA certificates: one in
QSslSocket and one in QSslConfiguration.
In addition, adapt the auto test which checks whether setting a default
QSslConfiguration works: There is no way to set on demand loading
through the API, so it should be enabled by default.

Task-number: QTBUG-29103
Change-Id: I5146128aaa385dfcc0ad1e0ef81a92d9350ec5f2
Reviewed-by: Richard J. Moore <rich@kde.org>

2 files changed, 44 insertions, 1 deletions

diff --git a/tests/manual/qnetworkreply/main.cpp b/tests/manual/qnetworkreply/main.cpp
index b8b20ec4da..feb07b4c7d 100644
--- a/tests/manual/qnetworkreply/main.cpp
+++ b/tests/manual/qnetworkreply/main.cpp
@@ -46,8 +46,13 @@
 #include <QtNetwork/qnetworkreply.h>
 #include <QtNetwork/qnetworkrequest.h>
 #include <QtNetwork/qnetworkaccessmanager.h>
+#include <QtNetwork/qsslconfiguration.h>
 #include "../../auto/network-settings.h"
 
+#ifdef QT_BUILD_INTERNAL
+#include "private/qsslsocket_p.h"
+#endif
+
 #define BANDWIDTH_LIMIT_BYTES (1024*100)
 #define TIME_ESTIMATION_SECONDS (97)
 
@@ -58,6 +63,8 @@ private slots:
     void initTestCase();
     void limiting_data();
     void limiting();
+    void setSslConfiguration_data();
+    void setSslConfiguration();
 };
 
 QNetworkReply *reply;
@@ -129,6 +136,42 @@ void tst_qnetworkreply::limiting()
     QVERIFY(!QTestEventLoop::instance().timeout());
 }
 
+void tst_qnetworkreply::setSslConfiguration_data()
+{
+    QTest::addColumn<QUrl>("url");
+    QTest::addColumn<bool>("works");
+
+    QTest::newRow("codereview.qt-project.org") << QUrl("https://codereview.qt-project.org") << true;
+    QTest::newRow("test-server") << QUrl("https://" + QtNetworkSettings::serverName() + "/") << false;
+}
+
+void tst_qnetworkreply::setSslConfiguration()
+{
+    QFETCH(QUrl, url);
+    QNetworkRequest request(url);
+    QSslConfiguration conf = request.sslConfiguration();
+    conf.setProtocol(QSsl::TlsV1_0); // TLS 1.0 will be used anyway, just make sure we change the configuration
+    request.setSslConfiguration(conf);
+    QNetworkAccessManager manager;
+    reply = manager.get(request);
+    QObject::connect(reply, SIGNAL(finished()), &QTestEventLoop::instance(), SLOT(exitLoop()));
+    QTestEventLoop::instance().enterLoop(15);
+    QVERIFY(!QTestEventLoop::instance().timeout());
+#ifdef QT_BUILD_INTERNAL
+    QFETCH(bool, works);
+    bool rootCertLoadingAllowed = QSslSocketPrivate::rootCertOnDemandLoadingSupported();
+#if defined(Q_OS_LINUX) || defined (Q_OS_BLACKBERRY)
+    QCOMPARE(rootCertLoadingAllowed, true);
+#elif defined(Q_OS_MAC)
+    QCOMPARE(rootCertLoadingAllowed, false);
+#endif // other platforms: undecided (Windows: depends on the version)
+    if (works) {
+        QCOMPARE(reply->error(), QNetworkReply::NoError);
+    } else {
+        QCOMPARE(reply->error(), QNetworkReply::SslHandshakeFailedError);
+    }
+#endif
+}
 
 QTEST_MAIN(tst_qnetworkreply)
 
diff --git a/tests/manual/qnetworkreply/qnetworkreply.pro b/tests/manual/qnetworkreply/qnetworkreply.pro
index 3d98ee429f..64666103a0 100644
--- a/tests/manual/qnetworkreply/qnetworkreply.pro
+++ b/tests/manual/qnetworkreply/qnetworkreply.pro
@@ -2,7 +2,7 @@ TEMPLATE = app
 TARGET = tst_qnetworkreply
 
 QT -= gui
-QT += network testlib
+QT += core-private network network-private testlib
 
 SOURCES += main.cpp
 DEFINES += QT_DISABLE_DEPRECATED_BEFORE=0