mirrors/nextcloud-desktop
1
0
Fork 0
mirror of https://github.com/nextcloud/desktop.git synced 2024-12-19 20:32:03 +03:00
Code Issues Projects Releases Packages Wiki Activity
nextcloud-desktop/src/gui/sslerrordialog.cpp

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

227 lines
7.6 KiB
C++
Raw Normal View History

SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
/*
* Copyright (C) by Klaas Freitag <freitag@kde.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
Fix header names
2014-11-10 01:25:57 +03:00
#include "configfile.h"
Split into three separate projects: library, gui and cmd
2014-07-11 02:31:24 +04:00
#include "sslerrordialog.h"
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
#include <QtGui>
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
#include <QtNetwork>
Compile with Qt5
2013-08-28 22:58:22 +04:00
#include <QtWidgets>
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
#include "ui_sslerrordialog.h"
Adjust namespaces
2014-11-10 00:34:07 +03:00
namespace OCC {
Compile with Qt5
2013-08-28 22:58:22 +04:00
Prepend "nextcloud" for all logging categories Thus making easier to exclude logging from kio, qt and only enable "nextcloud.*"
2017-12-28 22:33:10 +03:00
Q_LOGGING_CATEGORY(lcSslErrorDialog, "nextcloud.gui.sslerrordialog", QtInfoMsg)
Use Qt logging categories for logging This gives more insight about the logs and allow setting fine-tuned logging rules. The categories are set to only output Info by default so this allows us to provide more concise logging while keeping the ability to extract more information for a specific category when developping or debugging customer issues. Issue #5647
2017-05-09 15:24:11 +03:00
Compile with Qt5
2013-08-28 22:58:22 +04:00
namespace Utility {
// Used for QSSLCertificate::subjectInfo which returns a QStringList in Qt5, but a QString in Qt4
QString escape(const QStringList &l) { return escape(l.join(';')); }
}
AbstractSslErrorHandler: Also give QSslConfiguration
2015-04-06 22:46:03 +03:00
bool SslDialogErrorHandler::handleErrors(QList<QSslError> errors, const QSslConfiguration &conf, QList<QSslCertificate> *certs, AccountPtr account)
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
{
AbstractSslErrorHandler: Also give QSslConfiguration
2015-04-06 22:46:03 +03:00
(void)conf;
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
if (!certs) {
Upgrade some qCDebug to qCInfo or qCWarning Use qCInfo for anything that has general value for support and development. Use qCWarning for any recoverable error and qCCritical for anything that could result in data loss or would identify a serious issue with the code. Issue #5647
2017-03-30 14:46:20 +03:00
qCCritical(lcSslErrorDialog) << "Certs parameter required but is NULL!";
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
return false;
}
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
SslErrorDialog dlg(account);
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
// whether the failing certs have previously been accepted
if (dlg.checkFailingCertsKnown(errors)) {
*certs = dlg.unknownCerts();
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
return true;
}
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
// whether the user accepted the certs
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
if (dlg.exec() == QDialog::Accepted) {
if (dlg.trustConnection()) {
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
*certs = dlg.unknownCerts();
return true;
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
}
}
return false;
}
Compile with Qt5
2013-08-28 22:58:22 +04:00
Use global Account/AccountState less. * Use a shared pointer to Account everywhere to ensure the instance stays alive long enough for a sync to terminate * Folder is now tied to an AccountState * SyncEngine and OwncloudPropagator tie to an Account and use that for all jobs they run Issue: Since the setup wizard currently always replaces the account, it will always wipe all folder definitions, even when the actual changes to the account were minor.
2014-12-18 14:09:48 +03:00
SslErrorDialog::SslErrorDialog(AccountPtr account, QWidget *parent)
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
: QDialog(parent)
, _allTrusted(false)
, _ui(new Ui::SslErrorDialog)
, _account(account)
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
{
Hint the OS to not show [?] in Wizards and Dialogs Fixes #1156
2013-11-13 23:12:56 +04:00
setWindowFlags(windowFlags() & ~Qt::WindowContextHelpButtonHint);
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
_ui->setupUi(this);
SSL Certificate Error Dialog: show account name #3729 Change the wording of the certificate error dialog to include the account URL and be a bit more accurate. (Do not mention "SSL" in user facing messages)
2015-09-03 17:14:14 +03:00
setWindowTitle(tr("Untrusted Certificate"));
Make SSL error dialog more intuitive
2012-10-27 19:03:48 +04:00
QPushButton *okButton =
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
_ui->_dialogButtonBox->button(QDialogButtonBox::Ok);
Make SSL error dialog more intuitive
2012-10-27 19:03:48 +04:00
QPushButton *cancelButton =
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
_ui->_dialogButtonBox->button(QDialogButtonBox::Cancel);
Make SSL error dialog more intuitive
2012-10-27 19:03:48 +04:00
okButton->setEnabled(false);
Use the Qt5 connection syntax (automated with clazy) This is motivated by the fact that QMetaObject::noralizeSignature takes 7.35% CPU of the LargeSyncBench. (Mostly from ABstractNetworkJob::setupConnections and PropagateUploadFileV1::startNextChunk). It could be fixed by using normalized signature in the connection statement, but i tought it was a good oportunity to modernize the code. This commit only contains calls that were automatically converted with clazy.
2017-09-20 11:14:48 +03:00
connect(_ui->_cbTrustConnect, &QAbstractButton::clicked,
okButton, &QWidget::setEnabled);
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
if (okButton) {
okButton->setDefault(true);
Use the Qt5 connection syntax (automated with clazy) This is motivated by the fact that QMetaObject::noralizeSignature takes 7.35% CPU of the LargeSyncBench. (Mostly from ABstractNetworkJob::setupConnections and PropagateUploadFileV1::startNextChunk). It could be fixed by using normalized signature in the connection statement, but i tought it was a good oportunity to modernize the code. This commit only contains calls that were automatically converted with clazy.
2017-09-20 11:14:48 +03:00
connect(okButton, &QAbstractButton::clicked, this, &QDialog::accept);
connect(cancelButton, &QAbstractButton::clicked, this, &QDialog::reject);
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
}
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
SslErrorDialog::~SslErrorDialog()
{
delete _ui;
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
QString SslErrorDialog::styleSheet() const
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
{
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
const QString style = QLatin1String(
"#cert {margin-left: 5px;} "
"#ca_error { color:#a00011; margin-left:5px; margin-right:5px; }"
"#ca_error p { margin-top: 2px; margin-bottom:2px; }"
"#ccert { margin-left: 5px; }"
"#issuer { margin-left: 5px; }"
Show hashes of unknown certs
2012-10-24 03:42:25 +04:00
"tt { font-size: small; }");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
return style;
}
#define QL(x) QLatin1String(x)
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
bool SslErrorDialog::checkFailingCertsKnown(const QList<QSslError> &errors)
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
{
// check if unknown certs caused errors.
_unknownCerts.clear();
QStringList errorStrings;
Use the certificateChain() in the SSL error dialog This includes the self-signed certificate anyway, and the previous behavior led to funny side-effects.
2013-03-20 18:53:55 +04:00
Bring back proper ssl handling
2013-10-24 02:29:08 +04:00
QList<QSslCertificate> trustedCerts = _account->approvedCerts();
Unbreak self-signed certificate handling
2013-04-02 17:14:56 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
for (int i = 0; i < errors.count(); ++i) {
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
QSslError error = errors.at(i);
if (trustedCerts.contains(error.certificate()) || _unknownCerts.contains(error.certificate())) {
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
continue;
Fix approved SSL certificates being forgotten
2013-11-07 15:04:45 +04:00
}
errorStrings += error.errorString();
if (!error.certificate().isNull()) {
_unknownCerts.append(error.certificate());
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
}
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
// if there are no errors left, all Certs were known.
if (errorStrings.isEmpty()) {
_allTrusted = true;
return true;
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
QString msg = QL("<html><head>");
msg += QL("<link rel='stylesheet' type='text/css' href='format.css'>");
msg += QL("</head><body>");
SSL Certificate Error Dialog: show account name #3729 Change the wording of the certificate error dialog to include the account URL and be a bit more accurate. (Do not mention "SSL" in user facing messages)
2015-09-03 17:14:14 +03:00
auto host = _account->url().host();
msg += QL("<h3>") + tr("Cannot connect securely to <i>%1</i>:").arg(host) + QL("</h3>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
// loop over the unknown certs and line up their errors.
msg += QL("<div id=\"ca_errors\">");
A lot of krazy2 (codechecker) fixes.
2012-05-21 18:48:49 +04:00
foreach (const QSslCertificate &cert, _unknownCerts) {
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("<div id=\"ca_error\">");
// add the errors for this cert
foreach (QSslError err, errors) {
if (err.certificate() == cert) {
Fix QLatin1String issues.
2012-08-17 19:13:17 +04:00
msg += QL("<p>") + err.errorString() + QL("</p>");
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
}
}
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("</div>");
msg += certDiv(cert);
if (_unknownCerts.count() > 1) {
msg += QL("<hr/>");
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
}
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("</div></body></html>");
Use auto to avoiding repeating type names Signed-off-by: Kevin Ottens <kevin.ottens@nextcloud.com>
2020-05-18 21:54:23 +03:00
auto *doc = new QTextDocument(nullptr);
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
QString style = styleSheet();
Fix QLatin1String issues.
2012-08-17 19:13:17 +04:00
doc->addResource(QTextDocument::StyleSheetResource, QUrl(QL("format.css")), style);
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
doc->setHtml(msg);
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
_ui->_tbErrors->setDocument(doc);
_ui->_tbErrors->show();
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
return false;
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
}
QString SslErrorDialog::certDiv(QSslCertificate cert) const
{
QString msg;
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("<div id=\"cert\">");
Compile with Qt5
2013-08-28 22:58:22 +04:00
msg += QL("<h3>") + tr("with Certificate %1").arg(Utility::escape(cert.subjectInfo(QSslCertificate::CommonName))) + QL("</h3>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("<div id=\"ccert\">");
QStringList li;
Show hashes of unknown certs
2012-10-24 03:42:25 +04:00
Initial changes to also build on Qt5, doesn't compile yet
2013-08-24 16:57:55 +04:00
QString org = Utility::escape(cert.subjectInfo(QSslCertificate::Organization));
QString unit = Utility::escape(cert.subjectInfo(QSslCertificate::OrganizationalUnitName));
QString country = Utility::escape(cert.subjectInfo(QSslCertificate::CountryName));
Show hashes of unknown certs
2012-10-24 03:42:25 +04:00
if (unit.isEmpty())
unit = tr("&lt;not specified&gt;");
if (org.isEmpty())
org = tr("&lt;not specified&gt;");
if (country.isEmpty())
country = tr("&lt;not specified&gt;");
li << tr("Organization: %1").arg(org);
li << tr("Unit: %1").arg(unit);
li << tr("Country: %1").arg(country);
Fix QLatin1String issues.
2012-08-17 19:13:17 +04:00
msg += QL("<p>") + li.join(QL("<br/>")) + QL("</p>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("<p>");
Show hashes of unknown certs
2012-10-24 03:42:25 +04:00
Use newer digest algorithms in TLS error dialog MD5 has been broken for a long time now and SHA1 has been deprecated as well. SHA1 is not used when issuing new publicly trusted certificates since 1 January 2016[1] and there are more and more effective attacks[2][3] against it, so display SHA1 fingerprint only for old certificates to encourage use of safer digests by users. So, we display SHA-256 and SHA-512 fingerprints instead in the common case. [1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.6.5.pdf [2] https://shattered.io/static/shattered.pdf [3] https://eprint.iacr.org/2019/459.pdf Signed-off-by: Martin Sucha <git@mm.ms47.eu>
2019-09-01 12:11:59 +03:00
if (cert.effectiveDate() < QDateTime(QDate(2016, 1, 1), QTime(), Qt::UTC)) {
QString sha1sum = Utility::formatFingerprint(cert.digest(QCryptographicHash::Sha1).toHex());
msg += tr("Fingerprint (SHA1): <tt>%1</tt>").arg(sha1sum) + QL("<br/>");
}
QString sha256sum = Utility::formatFingerprint(cert.digest(QCryptographicHash::Sha256).toHex());
QString sha512sum = Utility::formatFingerprint(cert.digest(QCryptographicHash::Sha512).toHex());
msg += tr("Fingerprint (SHA-256): <tt>%1</tt>").arg(sha256sum) + QL("<br/>");
msg += tr("Fingerprint (SHA-512): <tt>%1</tt>").arg(sha512sum) + QL("<br/>");
Show hashes of unknown certs
2012-10-24 03:42:25 +04:00
msg += QL("<br/>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += tr("Effective Date: %1").arg(cert.effectiveDate().toString()) + QL("<br/>");
Use am. eng. since brit. eng. is handled on transifex See https://github.com/owncloud/core/pull/10025#issuecomment-50855986 for info.
2014-08-02 06:05:10 +04:00
msg += tr("Expiration Date: %1").arg(cert.expiryDate().toString()) + QL("</p>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("</div>");
Compile with Qt5
2013-08-28 22:58:22 +04:00
msg += QL("<h3>") + tr("Issuer: %1").arg(Utility::escape(cert.issuerInfo(QSslCertificate::CommonName))) + QL("</h3>");
Fix QLatin1String issues.
2012-08-17 19:13:17 +04:00
msg += QL("<div id=\"issuer\">");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
li.clear();
Compile with Qt5
2013-08-28 22:58:22 +04:00
li << tr("Organization: %1").arg(Utility::escape(cert.issuerInfo(QSslCertificate::Organization)));
li << tr("Unit: %1").arg(Utility::escape(cert.issuerInfo(QSslCertificate::OrganizationalUnitName)));
li << tr("Country: %1").arg(Utility::escape(cert.issuerInfo(QSslCertificate::CountryName)));
Fix QLatin1String issues.
2012-08-17 19:13:17 +04:00
msg += QL("<p>") + li.join(QL("<br/>")) + QL("</p>");
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
msg += QL("</div>");
msg += QL("</div>");
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
return msg;
}
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
bool SslErrorDialog::trustConnection()
{
if (_allTrusted)
return true;
Commit squashed refactoring branch - introduce settings dialog - general settings for general / proxy settings - standalone proxy settings dialog removed - standalone status dialog removed - moved status dialog into settings dialog - radically cut down links in context menu - add help link to context menu This needs more cleanup and testing. Known issues: - When the wizard is called while the settings dialog is open, it will not show old information (see FIXME) - Some settings are not implemented yet (greyed out) - The counter in the FileItemDialog is not correct the first time around. Based on the discussion done with Jan and Klaas during the Nuenberg workshop.
2013-07-04 21:59:40 +04:00
bool stat = (_ui->_cbTrustConnect->checkState() == Qt::Checked);
Upgrade some qCDebug to qCInfo or qCWarning Use qCInfo for anything that has general value for support and development. Use qCWarning for any recoverable error and qCCritical for anything that could result in data loss or would identify a serious issue with the code. Issue #5647
2017-03-30 14:46:20 +03:00
qCInfo(lcSslErrorDialog) << "SSL-Connection is trusted: " << stat;
SSL Connection Warning dialog working.
2012-04-12 13:37:48 +04:00
return stat;
}
SSL Support WIP - not yet functionable.
2012-04-06 10:53:57 +04:00
} // end namespace
Reference in a new issue Copy permalink