QNetworkReply: add possibility to ignore specific SSL errors

the same method was also added to QSslSocket.
previously, it was only possible to ignore all SSL errors; now, it is
also possible to only ignore specific SSL errors, given by a QList of
QSslErrors.
Moreover, it is possible to call this newly added method right after
connecting, not just when we get the SSL error.

Reviewed-by: Thiago
Task-number: 257322

4 files changed, 57 insertions, 5 deletions

diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp
index fc297e4..df0afe3 100644
--- a/src/network/ssl/qsslsocket.cpp
+++ b/src/network/ssl/qsslsocket.cpp
@@ -356,7 +356,7 @@ QSslSocket::~QSslSocket()
     want to ignore the errors and continue connecting, you must call
     ignoreSslErrors(), either from inside a slot function connected to
     the sslErrors() signal, or prior to entering encrypted mode. If
-    ignoreSslErrors is not called, the connection is dropped, signal
+    ignoreSslErrors() is not called, the connection is dropped, signal
     disconnected() is emitted, and QSslSocket returns to the
     UnconnectedState.
 
@@ -1592,7 +1592,33 @@ void QSslSocket::startServerEncryption()
 void QSslSocket::ignoreSslErrors()
 {
     Q_D(QSslSocket);
-    d->ignoreSslErrors = true;
+    d->ignoreAllSslErrors = true;
+}
+
+/*!
+    \overload
+    \since 4.6
+
+    This method tells QSslSocket to ignore only the errors given in \a
+    errors.
+
+    Note that you can set the expected certificate in the SSL error:
+    If, for instance, you want to connect to a server that uses
+    a self-signed certificate, consider the following snippet:
+
+    \snippet doc/src/snippets/code/src_network_ssl_qsslsocket.cpp 6
+
+    Multiple calls to this function will replace the list of errors that
+    were passed in previous calls.
+    You can clear the list of errors you want to ignore by calling this
+    function with an empty list.
+
+    \sa sslErrors()
+*/
+void QSslSocket::ignoreSslErrors(const QList<QSslError> &errors)
+{
+    Q_D(QSslSocket);
+    d->ignoreErrorsList = errors;
 }
 
 /*!
@@ -1732,7 +1758,11 @@ void QSslSocketPrivate::init()
     mode = QSslSocket::UnencryptedMode;
     autoStartHandshake = false;
     connectionEncrypted = false;
-    ignoreSslErrors = false;
+    ignoreAllSslErrors = false;
+
+    // we don't want to clear the ignoreErrorsList, so
+    // that it is possible setting it before connecting
+//    ignoreErrorsList.clear();
 
     readBuffer.clear();
     writeBuffer.clear();
diff --git a/src/network/ssl/qsslsocket.h b/src/network/ssl/qsslsocket.h
index 785a083..cab0667 100644
--- a/src/network/ssl/qsslsocket.h
+++ b/src/network/ssl/qsslsocket.h
@@ -169,6 +169,7 @@ public:
     QList<QSslError> sslErrors() const;
 
     static bool supportsSsl();
+    void ignoreSslErrors(const QList<QSslError> &errors);
 
 public Q_SLOTS:
     void startClientEncryption();
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
index ea62a4d..130494e 100644
--- a/src/network/ssl/qsslsocket_openssl.cpp
+++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -839,7 +839,27 @@ bool QSslSocketBackendPrivate::startHandshake()
     if (!errors.isEmpty()) {
         sslErrors = errors;
         emit q->sslErrors(errors);
-        if (doVerifyPeer && !ignoreSslErrors) {
+
+        bool doEmitSslError;
+        if (!ignoreErrorsList.empty()) {
+            // check whether the errors we got are all in the list of expected errors
+            // (applies only if the method QSslSocket::ignoreSslErrors(const QList<QSslError> &errors)
+            // was called)
+            doEmitSslError = false;
+            for (int a = 0; a < errors.count(); a++) {
+                if (!ignoreErrorsList.contains(errors.at(a))) {
+                    doEmitSslError = true;
+                    break;
+                }
+            }
+        } else {
+            // if QSslSocket::ignoreSslErrors(const QList<QSslError> &errors) was not called and
+            // we get an SSL error, emit a signal unless we ignored all errors (by calling
+            // QSslSocket::ignoreSslErrors() )
+            doEmitSslError = !ignoreAllSslErrors;
+        }
+        // check whether we need to emit an SSL handshake error
+        if (doVerifyPeer && doEmitSslError) {
             q->setErrorString(sslErrors.first().errorString());
             q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
             emit q->error(QAbstractSocket::SslHandshakeFailedError);
diff --git a/src/network/ssl/qsslsocket_p.h b/src/network/ssl/qsslsocket_p.h
index dc8e4f5..8fd2154 100644
--- a/src/network/ssl/qsslsocket_p.h
+++ b/src/network/ssl/qsslsocket_p.h
@@ -79,7 +79,8 @@ public:
     QSslSocket::SslMode mode;
     bool autoStartHandshake;
     bool connectionEncrypted;
-    bool ignoreSslErrors;
+    bool ignoreAllSslErrors;
+    QList<QSslError> ignoreErrorsList;
     bool* readyReadEmittedPointer;
 
     QRingBuffer readBuffer;