Changeset 11126 in ntrip for trunk/BNC/src/upload/bncuploadcaster.cpp

Timestamp:

Oct 24, 2026, 11:14:36 PM (2 weeks ago)

Author:

stuerze

Message:

Some fixes from security point of view

File:

• trunk/BNC/src/upload/bncuploadcaster.cpp (modified) (4 diffs)

trunk/BNC/src/upload/bncuploadcaster.cpp

@@ -80 +80 @@
   if (_ntripVersion == "2s") {
     if (!QSslSocket::supportsSsl()) {
-      emit(newMessage(
-          "For SSL support please install OpenSSL run-time libraries: Ntrip Version 2 is tried",
-          true));
-      _ntripVersion == "2";
+      // no fallback to Ntrip Version 2: user name and password would be sent
+      // unencrypted although an encrypted connection was configured
+      emit(newMessage(_mountpoint.toLatin1() + "@" + _casterOutHost.toLatin1() +
+          ": No SSL support, please install OpenSSL run-time libraries: no upload", true));
     } else {
       _secure = true;
@@ -150 +150 @@
       const QSslError& err = it.next();
       msg += err.errorString();
-    }
-    emit(newMessage(msg.toLatin1(), true));
+      if (it.hasNext()) {
+        msg += "; ";
+      }
+    }
+    if (_sslIgnoreErrors) {
+      _outSocket->ignoreSslErrors();
+      msg += " (ignored as configured)";
+    }
+    emit(newMessage(_mountpoint.toLatin1() + "@" + _casterOutHost.toLatin1() + ": " + msg.toLatin1(), true));
   }
 }
@@ -203 +210 @@
   }
 
+  if (_ntripVersion == "2s" && !_secure) { // no SSL support, see constructor
+    return;
+  }
+
   if (_outSocket != 0 &&
       _outSocket->state() == QAbstractSocket::ConnectedState) {
@@ -224 +235 @@
   _outSocket->setProxy(QNetworkProxy::NoProxy);
 
-  if (_sslIgnoreErrors) {
-    _outSocket->ignoreSslErrors();
-  } else {
-    bncSslConfig sslConfig = BNC_SSL_CONFIG;
-    QFile clientCrtFile(_crtFileName);
-    QFile privateKeyFile(_keyFileName);
-    if ( clientCrtFile.exists() && privateKeyFile.exists()) {
-      // set local certificate
-      clientCrtFile.open(QIODevice::ReadOnly);
-      QSslCertificate clientCrt(&clientCrtFile);
-      sslConfig.setLocalCertificate(clientCrt);
-      // set private key if available
-      privateKeyFile.open(QIODevice::ReadOnly);
-      QSslKey privateKey(&privateKeyFile, QSsl::Rsa);
-      sslConfig.setPrivateKey(privateKey);
-    }
-    _outSocket->setSslConfiguration(sslConfig);
-    connect(_outSocket, SIGNAL(sslErrors(QList<QSslError>)), this, SLOT(slotSslErrors(QList<QSslError>)));
-  }
+  bncSslConfig sslConfig = BNC_SSL_CONFIG;
+  QFile clientCrtFile(_crtFileName);
+  QFile privateKeyFile(_keyFileName);
+  if ( clientCrtFile.exists() && privateKeyFile.exists()) {
+    // set local certificate
+    clientCrtFile.open(QIODevice::ReadOnly);
+    QSslCertificate clientCrt(&clientCrtFile);
+    sslConfig.setLocalCertificate(clientCrt);
+    // set private key if available
+    privateKeyFile.open(QIODevice::ReadOnly);
+    QSslKey privateKey(&privateKeyFile, QSsl::Rsa);
+    sslConfig.setPrivateKey(privateKey);
+  }
+  _outSocket->setSslConfiguration(sslConfig);
+  // Direct connection: the socket lives in this thread, the caster object in
+  // the main thread. The slot must run during the handshake, both for
+  // ignoreSslErrors() to take effect and to access _outSocket safely.
+  connect(_outSocket, SIGNAL(sslErrors(QList<QSslError>)), this, SLOT(slotSslErrors(QList<QSslError>)),
+          Qt::DirectConnection);
 
   if (!_proxy) {