summaryrefslogtreecommitdiffstats
path: root/dirmngr/t-http.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* dirmngr: Rework of the LDAP code, part 1.Werner Koch2019-11-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (struct parsed_uri_s): Add flag is_ldap. * dirmngr/http.c (do_parse_uri): Set flag. Do not error out for a missing slashes in an http scheme if NO_SCHEME_CHECK is active. * dirmngr/t-http.c (main): Print new flag. * dirmngr/ks-engine-ldap.c (ks_ldap_help): Use flag instead of checking the scheme. * dirmngr/ldap-parse-uri.c (ldap_uri_p): Re-implement using http_parse_uri. * dirmngr/t-ldap-parse-uri.c (main): Add option --verbose. -- This patch merely remove the separate parser for checking for an LDAP scheme. It is better to let our generic URI parser handle this. Also fixes this bug || url[4] == 'i' || url[4] == 'i') to make the rarely used ldapi scheme case-insensitive. More changes to the LDAP code are planned. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Avoid possible CSRF attacks via http redirects.Werner Koch2018-11-221-2/+2
| | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path. (http_redir_info_t): New. * dirmngr/http.c (do_parse_uri): Set new fields. (same_host_p): New. (http_prepare_redirect): New. * dirmngr/t-http-basic.c: New test. * dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect instead of the open code. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. -- With this change a http query will not follow a redirect unless the Location header gives the same host. If the host is different only the host and port is taken from the Location header and the original path and query parts are kept. Signed-off-by: Werner Koch <wk@gnupg.org>
* all: fix spelling and typosDaniel Kahn Gillmor2018-10-241-1/+1
| | | | Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* dirmngr: Print a WARNING status for DNS config problems.Werner Koch2018-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr-status.h: New. * dirmngr/dirmngr.h: Include dirmngr-status.h and move some prototypes to that file. * dirmngr/t-support.c: New. * dirmngr/Makefile.am (dirmngr_SOURCES): Add dirmngr-status.h. (t_common_src): Add t-support.c. * dirmngr/server.c (dirmngr_status_printf): Bypass if CTRL is NULL. * dirmngr/dns-stuff.c: Include dirmngr-status.h. (libdns_init): Print WARNING status line. Change call callers to take and pass a CTRL argument. * g10/call-dirmngr.c (ks_status_cb): Print info for new WARNING status. -- To test this you can change RESOLV_CONF_NAME in dns-stuff.c and run gpg --recv-key -v SOMETHING. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Do not use a blocking connect in Tor mode.Werner Koch2017-07-261-0/+17
| | | | | | | * dirmngr/http.c (http_raw_connect): Disable the timeout in Tor mode. (send_request): Ditto. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Allow a timeout for HTTP and other TCP connects.Werner Koch2017-06-081-0/+14
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.c: Include fcntl.h. (http_session_s): Add field 'connect_timeout'. (http_session_new): Clear that. (http_session_set_timeout): New function. (my_wsagetlasterror) [W32]: New. (connect_with_timeout): New function. (connect_server): Add arg 'timeout' and call connect_with_timeout. (send_request): Add arg 'timeout' and pass it to connect_server. (http_raw_connect): Add arg 'timeout'. (http_open): Pass TIMEOUT from the session to connect_server. -- Note that the non-blocking connect we implement is traditional a pretty non-portable thing due to slighly different semantics. The code uses the strategy W. Richard Stevens suggested in 1998. Hopefully current OS versions got it all right. The code has not been tested on Windows. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: More fix for test program.NIIBE Yutaka2017-04-141-0/+4
| | | | | | * dirmngr/t-http.c (main): Care about no TLS. Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* Remove -I option to common.NIIBE Yutaka2017-03-071-2/+2
| | | | | | | | | | | | | * dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr: Avoid warnings during non-ntbtls build.Daniel Kahn Gillmor2017-02-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/t-http.c (my_http_tls_verify_cb): Avoid warnings when not using ntbtls. -- Without this patch, when building without ntbtls, we see the following warnings during "make check": t-http.c: In function ‘my_http_tls_verify_cb’: t-http.c:141:16: warning: implicit declaration of function ‘ntbtls_x509_get_peer_cert’ [-Wimplicit-function-declaration] (cert = ntbtls_x509_get_peer_cert (tls_context, idx)); idx++) ^~~~~~~~~~~~~~~~~~~~~~~~~ t-http.c:141:14: warning: assignment makes pointer from integer without a cast -Wint-conversion] (cert = ntbtls_x509_get_peer_cert (tls_context, idx)); idx++) ^ At top level: t-http.c:123:1: warning: ‘my_http_tls_verify_cb’ defined but not used [-Wunused-function] my_http_tls_verify_cb (void *opaque, ^~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* dirmngr: New Assuan option "http-crl".Werner Koch2017-02-211-3/+15
| | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (server_control_s): New flag 'http_no_crl'. * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set this flag. * dirmngr/server.c (option_handler): New option "http-crl" * dirmngr/http.h (HTTP_FLAG_NO_CRL): New flag. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Consult this flag. * dirmngr/ks-engine-hkp.c (send_request): Set flag depending on CTRL. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): New option --no-crl. -- This new option can be used to enable CRL checks on a per session base. The default is not to use CRLs for https connections. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Add a magic field to the http structs.Werner Koch2017-02-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.c (HTTP_SESSION_MAGIC): New. (http_session_s): New field 'magic'. (HTTP_CONTEXT_MAGIC): New. (http_context_s): New field 'magic'. (my_ntbtls_verify_cb): Assert MAGIC. (fp_onclose_notification): Ditto. (session_unref): Ditto. Reset MAGIC. (http_session_new): Set MAGIC. (http_open): Ditto. (http_raw_connect): Ditto. (http_close): Assert MAGIC. Reset MAGIC. * dirmngr/t-http.c (my_http_tls_verify_cb): MArk HTTP_FLAGS unused. -- We pass those handles through opaque pointers. The magic numbers will help to detect wrong use. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Make t-http.c work again with gnutls - second tryWerner Koch2017-02-201-0/+1
| | | | | | * dirmngr/t-http.c: Always include ksba.h. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: First take on ntbtls cert verification.Werner Koch2017-02-191-8/+58
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/http-ntbtls.c: New. * dirmngr/Makefile.am (dirmngr_SOURCES): Add file. * dirmngr/dirmngr.h (SERVER_CONTROL_MAGIC): New. (server_conrol_s): Add field 'magic', * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set MAGIC. (dirmngr_deinit_default_ctrl): Set MAGIC to deadbeef. * dirmngr/http.c (my_ntbtls_verify_cb): New. (http_session_new) [HTTP_USE_NTBTLS]: Remove all CA setting code. (send_request) [HTTP_USE_NTBTLS]: Set the verify callback. Do not call the verify callback after the handshake. * dirmngr/ks-engine-hkp.c (send_request): Pass gnupg_http_tls_verify_cb to http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (my_http_tls_verify_cb): New. (main): Rename option --gnutls-debug to --tls-debug. (main) [HTTP_USE_NTBTLS]: Create a session. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Add per-session verify callback to http.cWerner Koch2017-02-181-1/+1
| | | | | | | | | | | | | | | | | | | * dirmngr/http.h (http_verify_cb_t): New type. * dirmngr/http.c (http_session_s): Add fields flags, verify_cb, and verify_cb_value. (http_session_new): Remove arg tls_priority. Add args verify_cb and verify-cb_value. Store them in the session object. (send_request): Use per-session verify callback. (http_verify_server_credentials) [HTTP_USE_NTBTLS]: Return GPG_ERR_NOT_IMPLEMENTED. * dirmngr/ks-engine-hkp.c (send_request): Adjust for changed http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. * dirmngr/server.c (do_get_cert_local): Replace xmalloc by malloc. Signed-off-by: Werner Koch <wk@gnupg.org>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* Call log_set_prefix() with human-readable labels.Daniel Kahn Gillmor2016-08-121-1/+1
| | | | | | | | | | | | | | | | | | * agent/preset-passphrase.c, agent/protect-tool.c, dirmngr/dirmngr.c * dirmngr/t-http.c, g10/gpg.c, g10/gpgv.c, g13/g13-syshelp.c * g13/g13.c, kbx/kbxutil.c, scd/scdaemon.c, sm/gpgsm.c * tests/gpgscm/main.c, tools/gpg-check-pattern.c * tools/gpg-connect-agent.c, tools/gpgconf.c, tools/gpgtar.c * tools/symcryptrun.c: Invoke log_set_prefix() with human-readable labels. -- Some invocations of log_set_prefix() were done with raw numeric values instead of values that humans can understand. Use symbolic representations instead of numeric for better readability. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* http: Allow to request system defined CAs for TLS.Werner Koch2016-04-261-1/+1
| | | | | | | | | | | | * dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New. * dirmngr/http.c (http_session_new): Add arg "flags". * dirmngr/ks-engine-hkp.c (send_request): Use new flag HTTP_FLAG_TRUST_DEF for the new arg of http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. -- Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Use sks-keyservers CA by default for the hkps pool.Daniel Kahn Gillmor2016-01-221-1/+1
| | | | | | | | | | | | | | | | | | * dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem. * dirmngr/http.c (http_session_new): Add optional arg intended_hostname and set a default cert. * dirmngr/ks-engine-hkp.c (send_request): Pass httphost to http_session_new. -- Ship the certificate for the sks-keyservers hkps pool. If the user has specified that they want to use hkps://hkps.pool.sks-keyservers.net, and they have not specified any hkp-cacert explicitly, then initialize the trust path with this specific trust anchor. Co-authored-by: wk@gnupg.org Signed-off-by: Werner Koch <wk@gnupg.org>
* http: Enhance parser to detect .onion addresses.Werner Koch2015-12-021-0/+5
| | | | | | | | * dirmngr/http.h (parsed_uri_s): Add flag 'onion'. * dirmngr/http.c (do_parse_uri): Set that flag. * dirmngr/t-http.c (main): Print flags. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Add workaround for broken getaddrinfo.Werner Koch2015-10-251-0/+1
| | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (resolve_name_standard): On failure retry by first resolving the CNAME. (get_dns_cname): New. * dirmngr/t-dns-stuff.c (main): Add option --cname. -- At least the getaddrinfo implementation in glibc 2.19-13 from Debian returns EAI_NONAME if the CNAME points to a too long list of A/AAAA addresses. Looking at the wire the data is correctly returned from the server but getaddrinfo seems to get confused by truncation and retry. To fix this we resolve the CNAME again and call getaddrinfo again with the canonical name. Signed-off-by: Werner Koch <wk@gnupg.org>
* dirmngr: Use the new DNS wrapper for the HTTP module.Werner Koch2015-10-211-0/+3
| | | | | | | | | * dirmngr/t-http.c (main): Init assuan sockets. * dirmngr/http.c: Include dns-stuff.h. (connect_server)[!HAVE_GETADDRINFO]: Remove all code. (connect_server): Change to use resolve_dns_name. Signed-off-by: Werner Koch <wk@gnupg.org>
* Move http module from common/ to dirmngr/.Werner Koch2015-10-181-0/+389
* common/http.c: Move to ../dirmngr/. * common/http.h: Move to ../dirmngr/. * common/t-http.c: Move to ../dirmngr/. * common/tls-ca.pem: Move to ../dirmngr/. * common/Makefile.am: Do not build libcommontls.a libcommontlsnpth.a. Remove http.c related stuff. * po/POTFILES.in: Move http.c to dirmngr/. * dirmngr/Makefile.am (EXTRA_DIST): Add tls-ca.pem. (module_maint_tests): New. (noinst_PROGRAMS): Add module_maint_tests. (dirmngr_SOURCES): Add http.c and http.h. (dirmngr_LDADD): Remove libcommontlsnpth. (t_common_ldadd): Ditto. (t_http_SOURCES, t_http_CFLAGS, t_http_LDADD): New. (t_ldap_parse_uri_SOURCES): Add http.c. (t_ldap_parse_uri_CFLAGS): Build without npth. ($(PROGRAMS)): Do not require libcommontls.a libcommontlsnpth.a. * dirmngr/dirmngr.h, dirmngr/ks-engine.h: Fix include of http.h. -- All network access is done via dirmngr and thus http.c should be there. Signed-off-by: Werner Koch <wk@gnupg.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 01:12:26 +0100