From 1068d579ee848edf08db5ac611b292c76c30a39b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5rten=20Nordheim?= <marten.nordheim@qt.io>
Date: Mon, 23 Sep 2019 14:51:14 +0200
Subject: QSslConfiguration: Add functions for adding CA certificates

The QSslSocket versions of these will be deprecated.

Change-Id: I88c788f88e13f190e015d6a78b958e81c2d483a1
Reviewed-by: Jesus Fernandez <jsfdez@gmail.com>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
---
 src/network/ssl/qsslconfiguration.cpp | 78 ++++++++++++++++++++++++++++++++---
 src/network/ssl/qsslconfiguration.h   |  5 +++
 2 files changed, 77 insertions(+), 6 deletions(-)

(limited to 'src/network')

diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp
index 7e92d3a526..a2e694ec92 100644
--- a/src/network/ssl/qsslconfiguration.cpp
+++ b/src/network/ssl/qsslconfiguration.cpp
@@ -631,11 +631,10 @@ QList<QSslCipher> QSslConfiguration::supportedCiphers()
   Returns this connection's CA certificate database. The CA certificate
   database is used by the socket during the handshake phase to
   validate the peer's certificate. It can be modified prior to the
-  handshake with setCaCertificates(), or with \l{QSslSocket}'s
-  \l{QSslSocket::}{addCaCertificate()} and
-  \l{QSslSocket::}{addCaCertificates()}.
+  handshake with setCaCertificates(), or with addCaCertificate() and
+  addCaCertificates().
 
-  \sa setCaCertificates()
+  \sa setCaCertificates(), addCaCertificate(), addCaCertificates()
 */
 QList<QSslCertificate> QSslConfiguration::caCertificates() const
 {
@@ -652,7 +651,7 @@ QList<QSslCertificate> QSslConfiguration::caCertificates() const
   that is not available (as is commonly the case on iOS), the default database
   is empty.
 
-  \sa caCertificates()
+  \sa caCertificates(), addCaCertificates(), addCaCertificate()
 */
 void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certificates)
 {
@@ -660,6 +659,72 @@ void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certific
     d->allowRootCertOnDemandLoading = false;
 }
 
+/*!
+  Searches all files in the \a path for certificates encoded in the
+  specified \a format and adds them to this socket's CA certificate
+  database. \a path must be a file or a pattern matching one or more
+  files, as specified by \a syntax. Returns \c true if one or more
+  certificates are added to the socket's CA certificate database;
+  otherwise returns \c false.
+
+  The CA certificate database is used by the socket during the
+  handshake phase to validate the peer's certificate.
+
+  For more precise control, use addCaCertificate().
+
+  \sa addCaCertificate(), QSslCertificate::fromPath()
+*/
+bool QSslConfiguration::addCaCertificates(const QString &path, QSsl::EncodingFormat format,
+                                          QRegExp::PatternSyntax syntax)
+{
+    QList<QSslCertificate> certs = QSslCertificate::fromPath(path, format, syntax);
+    if (certs.isEmpty())
+        return false;
+
+    d->caCertificates += certs;
+    return true;
+}
+
+/*!
+    \since 5.15
+
+    Adds \a certificate to this configuration's CA certificate database.
+    The certificate database must be set prior to the SSL handshake.
+    The CA certificate database is used by the socket during the
+    handshake phase to validate the peer's certificate.
+
+    \note The default configuration uses the system CA certificate database. If
+    that is not available (as is commonly the case on iOS), the default database
+    is empty.
+
+  \sa caCertificates(), setCaCertificates(), addCaCertificates()
+*/
+void QSslConfiguration::addCaCertificate(const QSslCertificate &certificate)
+{
+    d->caCertificates += certificate;
+    d->allowRootCertOnDemandLoading = false;
+}
+
+/*!
+    \since 5.15
+
+    Adds \a certificates to this configuration's CA certificate database.
+    The certificate database must be set prior to the SSL handshake.
+    The CA certificate database is used by the socket during the
+    handshake phase to validate the peer's certificate.
+
+    \note The default configuration uses the system CA certificate database. If
+    that is not available (as is commonly the case on iOS), the default database
+    is empty.
+
+  \sa caCertificates(), setCaCertificates(), addCaCertificate()
+*/
+void QSslConfiguration::addCaCertificates(const QList<QSslCertificate> &certificates)
+{
+    d->caCertificates += certificates;
+    d->allowRootCertOnDemandLoading = false;
+}
+
 /*!
     \since 5.5
 
@@ -668,7 +733,8 @@ void QSslConfiguration::setCaCertificates(const QList<QSslCertificate> &certific
     returned by this function is used to initialize the database
     returned by caCertificates() on the default QSslConfiguration.
 
-    \sa caCertificates(), setCaCertificates(), defaultConfiguration()
+    \sa caCertificates(), setCaCertificates(), defaultConfiguration(),
+    addCaCertificate(), addCaCertificates()
 */
 QList<QSslCertificate> QSslConfiguration::systemCaCertificates()
 {
diff --git a/src/network/ssl/qsslconfiguration.h b/src/network/ssl/qsslconfiguration.h
index c25c2686de..247f3aecc9 100644
--- a/src/network/ssl/qsslconfiguration.h
+++ b/src/network/ssl/qsslconfiguration.h
@@ -131,6 +131,11 @@ public:
     // Certificate Authority (CA) settings
     QList<QSslCertificate> caCertificates() const;
     void setCaCertificates(const QList<QSslCertificate> &certificates);
+    bool addCaCertificates(const QString &path, QSsl::EncodingFormat format = QSsl::Pem,
+                           QRegExp::PatternSyntax syntax = QRegExp::FixedString);
+    void addCaCertificate(const QSslCertificate &certificate);
+    void addCaCertificates(const QList<QSslCertificate> &certificates);
+
     static QList<QSslCertificate> systemCaCertificates();
 
     void setSslOption(QSsl::SslOption option, bool on);
-- 
cgit v1.2.3