Use QSslConfiguration to setup an ssl connection

[ejvr]

2 changes:

• Added an extra constructor to QMQTT::Client which allows a QSslConfiguration to be used when setting up an ssl connection, allowing users to change ssl options, add ca-certificates, etc... The original constructor to set up an ssl connection is still present, but I would not recommend using it, because some unexpected stuff happens, like loading certificates from the current working directory.
• If the ignoreSelfSigned flag is set, only ssl errors related to self signed certificates will be ignored. In the current implementation all ssl errors will be ignored, which is not what the user asked for, and may cause security issues.

This patch incorporates patch #88 from @wiebeytec. I had to move the code involved, so merging his patch later would be quite hard.

[wiebeytec]

I think there is a bug? When I set ignoreSelfSigned to false, it still accepts the connection. I'm not quite sure what's going in (edit: I mean going on).

In this code:

void QMQTT::SslSocket::sslErrors(const QList<QSslError> &errors)
{
    if (!_ignoreSelfSigned)
        return;
    for (QSslError error: errors)
    {
        if (error.error() != QSslError::SelfSignedCertificate ||
            error.error() != QSslError::SelfSignedCertificateInChain)
        {
            return;
        }
    }
    _socket->ignoreSslErrors();
}

It should return out of the method right away.

BTW, shouldn't that be && instead of ||? This way, the if is always true.

[mwallnoefer]

Also according to me || should be substituted with &&: the first error from errors which is not SelfSignedCertificate and also not SelfSignedCertificateInChain means that something other (= more impacting, like an expired certificate) got wrong. In this case we should return and hence NOT call ignoreSslErrors().

@ejvr @wiebeytec True?

[ejvr]

I agree. On Feb 21, 2017 21:06, "Matthias Dieter Wallnöfer" <notifications@github.com> wrote: Also according to me || should be substituted with &&: the first error from errors which is not SelfSignedCertificate and also not SelfSignedCertificateInChain means that something other (= more impacting, like an expired certificate) got wrong. In this case we should return and hence NOT call ignoreSslErrors(). @ejvr <https://github.com/ejvr> @wiebeytec <https://github.com/wiebeytec> True? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#90 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ARpGJTQzLBOCt4-AbLWffrqQmoDuNk9Kks5re0PAgaJpZM4MFgYR> .

[mwallnoefer]

@ejvr Would you like to provide a follow-up patch?