From 5aa14a2d0ba838aafe26f69bf870b7a03988d04f Mon Sep 17 00:00:00 2001
From: Tamas Domok <tamas.domok@balabit.com>
Date: Wed, 31 Mar 2021 09:12:54 +0200
Subject: [PATCH] extra: debugs

---
 .../network/access/qhttpnetworkconnection.cpp |  4 +++
 .../access/qhttpnetworkconnectionchannel.cpp  |  5 ++++
 .../network/access/qhttpthreaddelegate.cpp    |  2 ++
 .../network/access/qnetworkreplyhttpimpl.cpp  |  4 +++
 .../src/network/access/qnetworkreplyimpl.cpp  |  2 ++
 qtbase/src/network/ssl/qsslsocket.cpp         |  2 ++
 qtbase/src/network/ssl/qsslsocket_openssl.cpp | 28 +++++++++++++++++++
 7 files changed, 47 insertions(+)

diff --git a/qtbase/src/network/access/qhttpnetworkconnection.cpp b/qtbase/src/network/access/qhttpnetworkconnection.cpp
index b0116319b0..76ec7ff12e 100644
--- a/qtbase/src/network/access/qhttpnetworkconnection.cpp
+++ b/qtbase/src/network/access/qhttpnetworkconnection.cpp
@@ -1511,10 +1511,12 @@ void QHttpNetworkConnection::ignoreSslErrors(int channel)
         // We need to ignore for all channels, even the ones that are not in use just in case they
         // will be in the future.
         for (int i = 0; i < d->channelCount; ++i) {
+            qDebug() << Q_FUNC_INFO << __LINE__;
             d->channels[i].ignoreSslErrors();
         }
 
     } else {
+        qDebug() << Q_FUNC_INFO << __LINE__;
         d->channels[channel].ignoreSslErrors();
     }
 }
@@ -1529,10 +1531,12 @@ void QHttpNetworkConnection::ignoreSslErrors(const QList<QSslError> &errors, int
         // We need to ignore for all channels, even the ones that are not in use just in case they
         // will be in the future.
         for (int i = 0; i < d->channelCount; ++i) {
+            qDebug() << Q_FUNC_INFO << __LINE__;
             d->channels[i].ignoreSslErrors(errors);
         }
 
     } else {
+        qDebug() << Q_FUNC_INFO << __LINE__;
         d->channels[channel].ignoreSslErrors(errors);
     }
 }
diff --git a/qtbase/src/network/access/qhttpnetworkconnectionchannel.cpp b/qtbase/src/network/access/qhttpnetworkconnectionchannel.cpp
index 9325787d5f..5dbad604f8 100644
--- a/qtbase/src/network/access/qhttpnetworkconnectionchannel.cpp
+++ b/qtbase/src/network/access/qhttpnetworkconnectionchannel.cpp
@@ -185,9 +185,11 @@ void QHttpNetworkConnectionChannel::init()
                          this, SLOT(_q_encryptedBytesWritten(qint64)),
                          Qt::DirectConnection);
 
+        qDebug() << Q_FUNC_INFO << __LINE__ << ignoreAllSslErrors;
         if (ignoreAllSslErrors)
             sslSocket->ignoreSslErrors();
 
+        qDebug() << Q_FUNC_INFO << __LINE__ << ignoreSslErrorsList;
         if (!ignoreSslErrorsList.isEmpty())
             sslSocket->ignoreSslErrors(ignoreSslErrorsList);
 
@@ -410,6 +412,7 @@ bool QHttpNetworkConnectionChannel::ensureConnection()
 
             sslSocket->setPeerVerifyName(connection->d_func()->peerVerifyName);
             sslSocket->connectToHostEncrypted(connectHost, connectPort, QIODevice::ReadWrite, networkLayerPreference);
+            qDebug() << Q_FUNC_INFO << __LINE__ << ignoreAllSslErrors << ignoreSslErrorsList;
             if (ignoreAllSslErrors)
                 sslSocket->ignoreSslErrors();
             sslSocket->ignoreSslErrors(ignoreSslErrorsList);
@@ -726,6 +729,7 @@ void QHttpNetworkConnectionChannel::setProxy(const QNetworkProxy &networkProxy)
 
 void QHttpNetworkConnectionChannel::ignoreSslErrors()
 {
+  qDebug() << Q_FUNC_INFO << __LINE__ << ignoreAllSslErrors << ignoreSslErrorsList << socket;
     if (socket)
         static_cast<QSslSocket *>(socket)->ignoreSslErrors();
 
@@ -735,6 +739,7 @@ void QHttpNetworkConnectionChannel::ignoreSslErrors()
 
 void QHttpNetworkConnectionChannel::ignoreSslErrors(const QList<QSslError> &errors)
 {
+  qDebug() << Q_FUNC_INFO << __LINE__ << ignoreAllSslErrors << ignoreSslErrorsList << socket;
     if (socket)
         static_cast<QSslSocket *>(socket)->ignoreSslErrors(errors);
 
diff --git a/qtbase/src/network/access/qhttpthreaddelegate.cpp b/qtbase/src/network/access/qhttpthreaddelegate.cpp
index dcc8c9337e..86549ab924 100644
--- a/qtbase/src/network/access/qhttpthreaddelegate.cpp
+++ b/qtbase/src/network/access/qhttpthreaddelegate.cpp
@@ -725,6 +725,8 @@ void QHttpThreadDelegate::sslErrorsSlot(const QList<QSslError> &errors)
     bool ignoreAll = false;
     QList<QSslError> specificErrors;
     emit sslErrors(errors, &ignoreAll, &specificErrors);
+
+    qDebug() << Q_FUNC_INFO << __LINE__ << ignoreAll << specificErrors << httpReply;
     if (ignoreAll)
         httpReply->ignoreSslErrors();
     if (!specificErrors.isEmpty())
diff --git a/qtbase/src/network/access/qnetworkreplyhttpimpl.cpp b/qtbase/src/network/access/qnetworkreplyhttpimpl.cpp
index 21916f53f1..8520cf0360 100644
--- a/qtbase/src/network/access/qnetworkreplyhttpimpl.cpp
+++ b/qtbase/src/network/access/qnetworkreplyhttpimpl.cpp
@@ -402,11 +402,13 @@ void QNetworkReplyHttpImpl::ignoreSslErrors()
     Q_D(QNetworkReplyHttpImpl);
     Q_ASSERT(d->managerPrivate);
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << d->pendingIgnoreAllSslErrors;
     if (d->managerPrivate->stsEnabled && d->managerPrivate->stsCache.isKnownHost(url())) {
         // We cannot ignore any Security Transport-related errors for this host.
         return;
     }
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << d->pendingIgnoreAllSslErrors;
     d->pendingIgnoreAllSslErrors = true;
 }
 
@@ -415,11 +417,13 @@ void QNetworkReplyHttpImpl::ignoreSslErrorsImplementation(const QList<QSslError>
     Q_D(QNetworkReplyHttpImpl);
     Q_ASSERT(d->managerPrivate);
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << d->pendingIgnoreAllSslErrors << d->pendingIgnoreSslErrorsList;
     if (d->managerPrivate->stsEnabled && d->managerPrivate->stsCache.isKnownHost(url())) {
         // We cannot ignore any Security Transport-related errors for this host.
         return;
     }
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << d->pendingIgnoreAllSslErrors << d->pendingIgnoreSslErrorsList;
     // the pending list is set if QNetworkReply::ignoreSslErrors(const QList<QSslError> &errors)
     // is called before QNetworkAccessManager::get() (or post(), etc.)
     d->pendingIgnoreSslErrorsList = errors;
diff --git a/qtbase/src/network/access/qnetworkreplyimpl.cpp b/qtbase/src/network/access/qnetworkreplyimpl.cpp
index bcdf6ee2f1..cb2b172dbf 100644
--- a/qtbase/src/network/access/qnetworkreplyimpl.cpp
+++ b/qtbase/src/network/access/qnetworkreplyimpl.cpp
@@ -1015,6 +1015,7 @@ void QNetworkReplyImpl::setSslConfigurationImplementation(const QSslConfiguratio
 void QNetworkReplyImpl::ignoreSslErrors()
 {
     Q_D(QNetworkReplyImpl);
+    qDebug() << Q_FUNC_INFO << __LINE__;
     if (d->backend)
         d->backend->ignoreSslErrors();
 }
@@ -1022,6 +1023,7 @@ void QNetworkReplyImpl::ignoreSslErrors()
 void QNetworkReplyImpl::ignoreSslErrorsImplementation(const QList<QSslError> &errors)
 {
     Q_D(QNetworkReplyImpl);
+    qDebug() << Q_FUNC_INFO << __LINE__ << errors;
     if (d->backend)
         d->backend->ignoreSslErrors(errors);
 }
diff --git a/qtbase/src/network/ssl/qsslsocket.cpp b/qtbase/src/network/ssl/qsslsocket.cpp
index fbeb9de18b..440171e4d4 100644
--- a/qtbase/src/network/ssl/qsslsocket.cpp
+++ b/qtbase/src/network/ssl/qsslsocket.cpp
@@ -2055,6 +2055,7 @@ void QSslSocket::startServerEncryption()
 void QSslSocket::ignoreSslErrors()
 {
     Q_D(QSslSocket);
+    qDebug() << Q_FUNC_INFO << __LINE__;
     d->ignoreAllSslErrors = true;
 }
 
@@ -2082,6 +2083,7 @@ void QSslSocket::ignoreSslErrors()
 void QSslSocket::ignoreSslErrors(const QList<QSslError> &errors)
 {
     Q_D(QSslSocket);
+    qDebug() << Q_FUNC_INFO << __LINE__ << d->ignoreAllSslErrors << errors;
     d->ignoreErrorsList = errors;
 }
 
diff --git a/qtbase/src/network/ssl/qsslsocket_openssl.cpp b/qtbase/src/network/ssl/qsslsocket_openssl.cpp
index 277037e59c..e8c2c4dafe 100644
--- a/qtbase/src/network/ssl/qsslsocket_openssl.cpp
+++ b/qtbase/src/network/ssl/qsslsocket_openssl.cpp
@@ -466,6 +466,8 @@ bool qt_OCSP_certificate_match(OCSP_SINGLERESP *singleResponse, X509 *peerCert,
 
 int q_X509Callback(int ok, X509_STORE_CTX *ctx)
 {
+    QSslErrorEntry entry = QSslErrorEntry::fromStoreContext(ctx);
+    qDebug() << Q_FUNC_INFO << __LINE__ << ok << "verify fromStoreContext" << entry.code << entry.depth;
     if (!ok) {
         // Store the error and at which depth the error was detected.
 
@@ -588,6 +590,7 @@ bool QSslSocketBackendPrivate::initSslContext()
         sslContextPointer = QSslContext::sharedFromConfiguration(mode, configurationCopy, allowRootCertOnDemandLoading);
     }
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << "sslContextPointer->error()" << sslContextPointer->error();
     if (sslContextPointer->error() != QSslError::NoError) {
         setErrorAndEmit(QAbstractSocket::SslInvalidUserDataError, sslContextPointer->errorString());
         sslContextPointer.clear(); // deletes the QSslContext
@@ -646,6 +649,16 @@ bool QSslSocketBackendPrivate::initSslContext()
 
     q_SSL_set_ex_data(ssl, s_indexForSSLExtraData, this);
 
+    {
+      QVector<QSslErrorEntry> lastErrors;
+      q_SSL_set_ex_data(ssl, s_indexForSSLExtraData + 1, &lastErrors);
+      qDebug() << Q_FUNC_INFO << __LINE__ << "size" << lastErrors.size();
+      for (const auto &error : qAsConst(lastErrors))
+        {
+          qDebug() << Q_FUNC_INFO << __LINE__ << "lastErrors" << error.code << error.depth;
+        }
+    }
+
 #ifndef OPENSSL_NO_PSK
     // Set the client callback for PSK
     if (mode == QSslSocket::SslClientMode)
@@ -1280,6 +1293,11 @@ bool QSslSocketBackendPrivate::startHandshake()
 
     QVector<QSslErrorEntry> lastErrors;
     q_SSL_set_ex_data(ssl, s_indexForSSLExtraData + 1, &lastErrors);
+    qDebug() << Q_FUNC_INFO << __LINE__ << "lastErrors" << lastErrors.size();
+    for (const auto &error : qAsConst(lastErrors))
+      {
+        qDebug() << Q_FUNC_INFO << __LINE__ << "errorList" << error.code << error.depth;
+      }
     int result = (mode == QSslSocket::SslClientMode) ? q_SSL_connect(ssl) : q_SSL_accept(ssl);
     q_SSL_set_ex_data(ssl, s_indexForSSLExtraData + 1, nullptr);
 
@@ -1293,6 +1311,11 @@ bool QSslSocketBackendPrivate::startHandshake()
     }
 
     errorList << lastErrors;
+    qDebug() << Q_FUNC_INFO << __LINE__ << "errorList.size" << errorList.size();
+    for (const auto &error : qAsConst(errorList))
+      {
+        qDebug() << Q_FUNC_INFO << __LINE__ << "errorList" << error.code << error.depth;
+      }
 
     // Connection aborted during handshake phase.
     if (q->state() != QAbstractSocket::ConnectedState)
@@ -2138,6 +2161,11 @@ QList<QSslError> QSslSocketBackendPrivate::verify(const QList<QSslCertificate> &
         return errors;
     }
 
+    qDebug() << Q_FUNC_INFO << __LINE__ << "size" << lastErrors.size();
+    for (const auto &error : qAsConst(lastErrors))
+      {
+        qDebug() << Q_FUNC_INFO << __LINE__ << "lastErrors" << error.code << error.depth;
+      }
     // Register a custom callback to get all verification errors.
     q_X509_STORE_set_verify_cb(certStore, q_X509Callback);
 
-- 
2.31.0

