ETM-Schurig/powersync-app
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge PR #517: Extract certificate data before disconnecting

Browse Source
This commit is contained in:
Jenkins nymea 2021-01-30 23:22:01 +01:00
commit aa0f0d7483
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libnymea-app/jsonrpc/jsonrpcclient.cpp
View File

@ -152,7 +152,7 @@ void JsonRpcClient::disconnectFromHost()
void JsonRpcClient::acceptCertificate(const QString &serverUuid, const QByteArray &pem) void JsonRpcClient::acceptCertificate(const QString &serverUuid, const QByteArray &pem)
{ {
qDebug() << "Pinning new certificate for" << serverUuid; qDebug() << "Pinning new certificate for" << serverUuid << pem;
storePem(serverUuid, pem); storePem(serverUuid, pem);
} }
@ -654,25 +654,27 @@ void JsonRpcClient::helloReply(int /*commandId*/, const QVariantMap &params)
// Verify SSL certificate // Verify SSL certificate
if (m_connection->isEncrypted()) { if (m_connection->isEncrypted()) {
QByteArray pem; QByteArray oldPem;
if (!loadPem(m_serverUuid, pem)) { QSslCertificate certificate = m_connection->sslCertificate();
if (!loadPem(m_serverUuid, oldPem)) {
qDebug() << "No SSL certificate for this host stored. Accepting and pinning new certificate."; qDebug() << "No SSL certificate for this host stored. Accepting and pinning new certificate.";
// No certificate yet! Inform ui about it. // No certificate yet! Inform ui about it.
emit newSslCertificate(); emit newSslCertificate();
storePem(m_serverUuid, m_connection->sslCertificate().toPem()); storePem(m_serverUuid, m_connection->sslCertificate().toPem());
} else { } else {
// We have a certificate pinned already. Check if it's the same // We have a certificate pinned already. Check if it's the same
if (m_connection->sslCertificate().toPem() != pem) { if (certificate.toPem() != oldPem) {
// Uh oh, the certificate has changed // Uh oh, the certificate has changed
qWarning() << "This connections certificate has changed!"; qWarning() << "This connections certificate has changed!";
qWarning() << "Old PEM:" << pem; qWarning() << "Old PEM:" << oldPem;
qWarning() << "New PEM:" << m_connection->sslCertificate().toPem(); qWarning() << "New PEM:" << certificate.toPem();
// Extract certificate info before disconnecting.
QVariantMap issuerInfo = certificateIssuerInfo();
// Reject the connection until the UI explicitly accepts this... // Reject the connection until the UI explicitly accepts this...
m_connection->disconnectFromHost(); m_connection->disconnectFromHost();
QSslCertificate certificate = m_connection->sslCertificate();
QVariantMap issuerInfo = certificateIssuerInfo();
emit verifyConnectionCertificate(m_serverUuid, issuerInfo, certificate.toPem()); emit verifyConnectionCertificate(m_serverUuid, issuerInfo, certificate.toPem());
return; return;
} }