[PATCH] Ssl: Copy the on-demand cert loading bool from default config
authorMårten Nordheim <marten.nordheim@qt.io>
Thu, 25 May 2023 12:40:29 +0000 (14:40 +0200)
committerBenjamin Drung <bdrung@debian.org>
Thu, 29 Feb 2024 21:45:27 +0000 (21:45 +0000)
commit68c9210e56e4117de41461c0fb56b196387a20be
tree92395fe3be2e9b4b24f2c5ec2a57a62ab23ce6e7
parent96cbf70bb8e9675fe9ec276ed0dbf95fadfd0d9d
[PATCH] Ssl: Copy the on-demand cert loading bool from default config

Otherwise individual sockets will still load system certificates when
a chain doesn't match against the configured CA certificates.
That's not intended behavior, since specifically setting the CA
certificates means you don't want the system certificates to be used.

Follow-up to/amends ada2c573c1a25f8d96577734968fe317ddfa292a

This is potentially a breaking change because now, if you ever add a
CA to the default config, it will disable loading system certificates
on demand for all sockets. And the only way to re-enable it is to
create a null-QSslConfiguration and set it as the new default.

Pick-to: 6.5 6.2 5.15
Change-Id: Ic3b2ab125c0cdd58ad654af1cb36173960ce2d1e
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Gbp-Pq: Name cve-2023-34410-57ba626.diff
src/network/ssl/qsslsocket.cpp