aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr/ks-engine-hkp.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-07-20dirmngr: Avoid need for hkp housekeeping.Daniel Kahn Gillmor1-37/+35
* dirmngr/ks-engine-hkp.c (host_is_alive): New function. Test whether host is alive and resurrects it if it has been dead long enough. (select_random_host, map_host, ks_hkp_mark_host): Use host_is_alive instead of testing hostinfo_t->dead directly. (ks_hkp_housekeeping): Remove function, no longer needed. * dirmngr/dirmngr.c (housekeeping_thread): Remove call to ks_hkp_housekeeping. -- Rather than resurrecting hosts upon scheduled resurrection times, test whether hosts should be resurrected as they're inspected for being dead. This removes the need for explicit housekeeping, and makes host resurrections happen "just in time", rather than being clustered on HOUSEKEEPING_INTERVAL seconds. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic dirmngr-idling Gbp-Pq: Name dirmngr-Avoid-need-for-hkp-housekeeping.patch
2019-07-20dirmngr: hkp: Avoid potential race condition when some hosts die.Daniel Kahn Gillmor1-13/+10
* dirmngr/ks-engine-hkp.c (select_random_host): Use atomic pass through the host table instead of risking out-of-bounds write. -- Multiple threads may write to hosttable[x]->dead while select_random_host() is running. For example, a housekeeping thread might clear the ->dead bit on some entries, or another connection to dirmngr might manually mark a host as alive. If one or more hosts are resurrected between the two loops over a given table in select_random_host(), then the allocation of tbl might not be large enough, resulting in a write past the end of tbl on the second loop. This change collapses the two loops into a single loop to avoid this discrepancy: each host's "dead" bit is now only checked once. As Werner points out, this isn't currently strictly necessary, since npth will not switch threads unless a blocking system call is made, and no blocking system call is made in these two loops. However, in a subsequent change in this series, we will call a function in this loop, and that function may sometimes write(2), or call other functions, which may themselves block. Keeping this as a single-pass loop avoids the need to keep track of what might block and what might not. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic dirmngr-idling Gbp-Pq: Name dirmngr-hkp-Avoid-potential-race-condition-when-some.patch
2019-07-04dirmngr: fix handling of HTTPS redirections during HKPDaniel Kahn Gillmor1-1/+3
* dirmngr/ks-engine-hkp.c (send_request): Reinitialize HTTP session when following a HTTP redirection. -- inspired by patch from Damien Goutte-Gattat <[email protected]> GnuPG-Bug_id: 4566 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2019-07-03dirmngr: Avoid endless loop in case of HTTP error 503.Werner Koch1-10/+33
* dirmngr/ks-engine-hkp.c (SEND_REQUEST_EXTRA_RETRIES): New. (handle_send_request_error): Use it for 503 and 504. (ks_hkp_search, ks_hkp_get, ks_hkp_put): Pass a new var for extra_tries. -- This is a pretty stupid fix but one which works without much risk of regressions. We could have used the existing TRIES but in that case the fallback to other host would have been too limited. With the used value we can have several fallbacks to other hosts. Note that the TRIES is still cumulative and not per host. GnuPG-bug-id: 4600 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 8b113bb148f273524682252233b3c65954e1419e)
2019-04-02dirmngr: Better error code for http status 413.Werner Koch1-0/+4
* dirmngr/ks-engine-hkp.c (send_request): New case for 413. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
2018-12-11dirmngr: Retry another server from the pool on 502, 503, 504.Werner Koch1-7/+33
* dirmngr/ks-engine-hkp.c (handle_send_request_error): Add arg http_status and handle it. (ks_hkp_search): Get http_status froms end_request and pass on to handle_send_request_error. (ks_hkp_get): Ditto. (ks_hkp_put): Ditto. -- GnuPG-bug-id: 4175 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 05ef6282784495a77f4faf76c0de5bc85dfecf06)
2018-11-23dirmngr: Avoid possible CSRF attacks via http redirects.Werner Koch1-40/+16
* dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path. (http_redir_info_t): New. * dirmngr/http.c (do_parse_uri): Set new fields. (same_host_p): New. (http_prepare_redirect): New. * dirmngr/t-http-basic.c: New test. * dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect instead of the open code. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. -- With this change a http query will not follow a redirect unless the Location header gives the same host. If the host is different only the host and port is taken from the Location header and the original path and query parts are kept. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit fa1b1eaa4241ff3f0634c8bdf8591cbc7c464144)
2018-11-05dirmngr: Emit SOURCE status also on NO_DATA.Werner Koch1-2/+10
* dirmngr/ks-engine-hkp.c (ks_hkp_search): Send SOURCE status also on NO DATA error. (ks_hkp_get): Ditto. * g10/call-dirmngr.c (gpg_dirmngr_ks_search): Print "data source" info also on error. (gpg_dirmngr_ks_get): Ditto. -- If a keyserver does not return any data it can be useful to know which keyserver out of the pool answered. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit bee65edfbc8cc2c369e5941cc9d1a01a0519b388)
2018-04-26dirmngr: Lower the dead host resurrection time to 1.5hWerner Koch1-2/+2
* dirmngr/ks-engine-hkp.c (RESURRECT_INTERVAL): Decrease. (INITIAL_HOSTTABLE_SIZE): Increase because the old values was likely for development. Signed-off-by: Werner Koch <[email protected]>
2018-04-26dirmngr: Fix handling of CNAMEed keyserver pools.Werner Koch1-1/+1
* dirmngr/ks-engine-hkp.c (map_host): Don't use the cname for HTTPHOST. * dirmngr/server.c (make_keyserver_item): Map keys.gnupg.net. -- For a description of the problem see the comment in make_keyserver_item. GnuPG-bug-id: 3755 Signed-off-by: Werner Koch <[email protected]>
2018-02-22dirmngr: Handle failures related to missing IPv6 gracefullyMichał Górny1-0/+2
* dirmngr/ks-engine-hkp.c (handle_send_request_error): Handle two more error codes. -- Handle the two possible connect failures related to missing IPv6 support gracefully by marking the host dead and retrying with another one. If IPv6 is disabled via procfs, connect() will return EADDRNOTAVAIL. If IPv6 is not compiled into the kernel, it will return EAFNOSUPPORT. This makes it possible to use dual-stack hkp servers on hosts not having IPv6 without random connection failures. GnuPG-bug-id: 3331 -- The above description seems to be for Linux, so it is possible that other systems might behave different. However, it is worth to try this patch. Signed-off-by: Werner Koch <[email protected]>
2017-07-19dirmngr: Forbid redirects from .onion to clearnet URIs.Justus Winter1-0/+25
* dirmngr/ks-engine-hkp.c (send_request): Forbid redirects from .onion to clearnet URIs. * dirmngr/ks-engine-http.c (ks_http_fetch): Likewise. -- This protects users from misconfigured .onion services. GnuPG-bug-id: 3087 Signed-off-by: Justus Winter <[email protected]>
2017-06-20dirmngr: Properly handle SRV records.Justus Winter1-51/+72
* dirmngr/ks-engine-hkp.c (enum ks_protocol): New type. (struct hostinfo_s): New flags indicating whether we already did a A lookup, or a SRV lookup per protocol. Turn 'port' into an array. (create_new_hostinfo): Initialize new fields. (add_host): Update the port for the given protocol. (map_host): Simplify hosttable lookup misses. Check the SRV records for both protocols on demand, do the A lookup just once. Return the correct port. -- Previously, if a host had both a SRV record for hkp and hkps, the wrong port was used for the protocol that was used second, because the hostinfo did not store a port per protocol, and the hosttable does not discriminate between hosts using the protocol. Fix this by querying the SRV records on demand, storing a port per protocol, and returning the right port. GnuPG-bug-id: 3033 Signed-off-by: Justus Winter <[email protected]>
2017-06-20dirmngr: Refactor variable-sized array code.Justus Winter1-55/+74
* dirmngr/ks-engine-hkp.c (struct hostinfo_s): Add explicit length and size fields. (MAX_POOL_SIZE): New macro. (create_new_hostinfo): Initialize new fields. (host_in_pool_p): Adapt. (select_random_host): Likewise. (add_host): Likewise. Move the resizing logic here. (hostinfo_sort_pool): New function. (map_host): Simplify. Move the resizing logic away from here. (ks_hkp_mark_host): Adapt. (ks_hkp_print_hosttable): Likewise. -- The current code assumes that the pool array is only filled when the hostinfo object is created. This patch removes that limitation. GnuPG-bug-id: 3033 Signed-off-by: Justus Winter <[email protected]>
2017-06-20dirmngr: Fix typo.Justus Winter1-1/+1
-- Signed-off-by: Justus Winter <[email protected]>
2017-06-08dirmngr: Implement HTTP connect timeouts of 15 or 2 seconds.Werner Koch1-0/+1
* dirmngr/dirmngr.c (oConnectTimeout, oConnectQuickTimeout): New enums. (opts): New options --connect-timeout and --connect-quick-timeout. (DEFAULT_CONNECT_TIMEOUT): New. (DEFAULT_CONNECT_QUICK_TIMEOUT): New. (parse_rereadable_options): Handle new options. (post_option_parsing): New. Use instead of direct calls to set_debug() and set_tor_mode (). (main): Setup default timeouts. (dirmngr_init_default_ctrl): Set standard connect timeout. * dirmngr/dirmngr.h (opt): New fields connect_timeout and connect_quick_timeout. (server_control_s): New field timeout. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass timeout to http_raw_connect. * dirmngr/ks-engine-hkp.c (send_request): Call http_session_set_timeout. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/server.c (cmd_wkd_get, cmd_ks_search, cmd_ks_get) (cmd_ks_fetch): Implement --quick option. -- The standard connect timeouts are way to long so we add a timeout to the connect calls. Also implement the --quick option which is already used by gpg for non-important requests (e.g. looking up a key for verification). Signed-off-by: Werner Koch <[email protected]>
2017-05-10g10, sm, dirmngr, common: Add comment for fall through.NIIBE Yutaka1-0/+1
* common/b64dec.c (b64dec_proc): Comment to clarify. * dirmngr/cdblib.c (cdb_make_put): Use same pattern to clarify. * dirmngr/dirmngr-client.c (read_pem_certificate): Likewise. * dirmngr/ks-engine-hkp.c (ks_hkp_get): Likewise. * g10/armor.c (unarmor_pump): Likewise. * g10/gpg.c (main): Likewise. * g10/import.c (read_block): Likewise. * g10/keygen.c (make_backsig): Likewise. * g10/pkclist.c (check_signatures_trust): Likewise. * sm/gpgsm.c (main): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
2017-04-03dirmngr: New option --disable-ipv6Werner Koch1-2/+5
* dirmngr/dirmngr.h (struct opt): Add field 'disable_ipv6'. * dirmngr/dirmngr.c (oDisableIPv6): New const. (opts): New option --disable-ipv6. (parse_rereadable_options): Set that option. * dirmngr/dns-stuff.c (opt_disable_ipv6): New var. (set_dns_disable_ipv6): New. (resolve_name_standard): Make use of it. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Take care of OPT.DISABLE_IPV6. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <[email protected]>
2017-04-03dirmngr: Handle EIO which is sometimes returned by cookie functions.Werner Koch1-0/+1
* dirmngr/ks-engine-hkp.c (handle_send_request_error): Handle EIO. -- Suggested-by: Andre Heinecke Signed-off-by: Werner Koch <[email protected]>
2017-03-07Remove -I option to common.NIIBE Yutaka1-1/+1
* dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
2017-02-21dirmngr: New Assuan option "http-crl".Werner Koch1-1/+3
* dirmngr/dirmngr.h (server_control_s): New flag 'http_no_crl'. * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set this flag. * dirmngr/server.c (option_handler): New option "http-crl" * dirmngr/http.h (HTTP_FLAG_NO_CRL): New flag. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Consult this flag. * dirmngr/ks-engine-hkp.c (send_request): Set flag depending on CTRL. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): New option --no-crl. -- This new option can be used to enable CRL checks on a per session base. The default is not to use CRLs for https connections. Signed-off-by: Werner Koch <[email protected]>
2017-02-19dirmngr: First take on ntbtls cert verification.Werner Koch1-1/+1
* dirmngr/http-ntbtls.c: New. * dirmngr/Makefile.am (dirmngr_SOURCES): Add file. * dirmngr/dirmngr.h (SERVER_CONTROL_MAGIC): New. (server_conrol_s): Add field 'magic', * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set MAGIC. (dirmngr_deinit_default_ctrl): Set MAGIC to deadbeef. * dirmngr/http.c (my_ntbtls_verify_cb): New. (http_session_new) [HTTP_USE_NTBTLS]: Remove all CA setting code. (send_request) [HTTP_USE_NTBTLS]: Set the verify callback. Do not call the verify callback after the handshake. * dirmngr/ks-engine-hkp.c (send_request): Pass gnupg_http_tls_verify_cb to http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (my_http_tls_verify_cb): New. (main): Rename option --gnutls-debug to --tls-debug. (main) [HTTP_USE_NTBTLS]: Create a session. Signed-off-by: Werner Koch <[email protected]>
2017-02-18dirmngr: Add per-session verify callback to http.cWerner Koch1-1/+2
* dirmngr/http.h (http_verify_cb_t): New type. * dirmngr/http.c (http_session_s): Add fields flags, verify_cb, and verify_cb_value. (http_session_new): Remove arg tls_priority. Add args verify_cb and verify-cb_value. Store them in the session object. (send_request): Use per-session verify callback. (http_verify_server_credentials) [HTTP_USE_NTBTLS]: Return GPG_ERR_NOT_IMPLEMENTED. * dirmngr/ks-engine-hkp.c (send_request): Adjust for changed http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. * dirmngr/server.c (do_get_cert_local): Replace xmalloc by malloc. Signed-off-by: Werner Koch <[email protected]>
2017-02-15dirmngr: Do PTR lookups only for 'keyserver --hosttable'.Werner Koch1-46/+79
* dirmngr/ks-engine-hkp.c (hostinfo_s): Remove fields v4addr and v5addr and add fields iporname and iporname_valid. (create_new_hostinfo): Clear them. (add_host): Remove the code to set the v4addr and v6addr fields. (ks_hkp_print_hosttable): Remove printing of the fields. Compute the iporname field and display it. (ks_hkp_reload): Force re-computing of the iporname field in ks_hkp_print_hosttable. -- GnuPG-bug-id: 2928 Signed-off-by: Werner Koch <[email protected]>
2017-02-15dirmngr: Avoid PTR lookup for hosts in a poolWerner Koch1-5/+18
* dirmngr/ks-engine-hkp.c (add_host): Don't to a PTR lookup for hosts in a pool. -- GnuPG-bug-id: 2928 Signed-off-by: Werner Koch <[email protected]>
2017-02-01dirmngr: New option --no-use-tor and internal changes.Werner Koch1-3/+3
* dirmngr/dns-stuff.c (disable_dns_tormode): New. * dirmngr/dirmngr.c (oNoUseTor): New const. (opts): New option --no-use-tor. (tor_mode): New var. (parse_rereadable_options): Change to use TOR_MODE. (dirmngr_use_tor): New. (set_tor_mode): Call disable_dns_tormode. Implement oNoUseTor. * dirmngr/dirmngr.h (opt): Remove field 'use_tor'. Replace all references by a call to dirmngr_use_tor(). * dirmngr/server.c (cmd_getinfo): Distinguish between default and enforced TOR_MODE. -- This patch replaces the global variable opt.use_tar by a function testing a file local mode flag. This patch prepares for a use-tor-if-available mode. GnuPG-bug-id: 2935 Signed-off-by: Werner Koch <[email protected]>
2017-01-24gpg: Print a warning on Tor problems.Werner Koch1-15/+45
* dirmngr/ks-engine-hkp.c (tor_not_running_p): New. (map_host): Call that to print a warning. (handle_send_request_error): Ditto and avoid marking the host dead. Also print a tor_config_problem warning. Add arg CTRL; adjust callers to pass that new arg. * g10/call-dirmngr.c (ks_status_cb): Detect and print the new warnings. Signed-off-by: Werner Koch <[email protected]>
2017-01-24dirmngr: New option --disable-ipv4.Werner Koch1-2/+6
* dirmngr/dirmngr.c (oDisableIPv4): New const. (opts): New option --disable-ipv4. (parse_rereadable_options): Set that option. * dirmngr/dirmngr.h (opt): New field 'disable_ipv4'. * dirmngr/dns-stuff.c (opt_disable_ipv4): bew var. (set_dns_disable_ipv4): New. (resolve_name_standard): Skip v4 addresses when OPT_DISABLE_IPV4 is set. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Pass HTTP_FLAG_IGNORE_IPv4 if opt.disable_v4 is set. * dirmngr/crlfetch.c (crl_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <[email protected]>
2017-01-23Fix format string errors and some missing error case initialization.Werner Koch1-1/+1
* common/logging.c (do_logv): Remove extra parentheses in comparison. * dirmngr/dns-stuff.c (resolve_addr_libdns): Init RES so that dns_res_close is given a defined value in the error case. * dirmngr/http.c (cookie_read, cookie_write) [HTTP_USE_NTBTLS]: Fix format string char. * dirmngr/ks-engine-hkp.c (ks_hkp_help): Remove duplicate "const". * dirmngr/ks-engine-http.c (ks_http_help): Ditto. * dirmngr/ks-engine-kdns.c (ks_kdns_help): Ditto. * dirmngr/ks-engine-ldap.c (ks_ldap_help): Ditto. * scd/app-p15.c (send_keypairinfo, do_getattr): Fix format string char. * tools/gpgconf-comp.c (gpg_agent_runtime_change): Init PID for the error case. (scdaemon_runtime_change): Ditto. (dirmngr_runtime_change): Ditto. * tools/gpgconf.c (query_swdb): Init VALUE_SIZE_UL. Signed-off-by: Werner Koch <[email protected]>
2017-01-23dirmngr: On SIGHUP mark all keyservers alive.Werner Koch1-0/+23
* dirmngr/ks-engine-hkp.c (ks_hkp_reload): New. * dirmngr/dirmngr.c (dirmngr_sighup_action): Call it. Signed-off-by: Werner Koch <[email protected]>
2017-01-16dirmngr: Implement hkps lookups using literal addresses.Werner Koch1-1/+29
* dirmngr/ks-engine-hkp.c (map_host): For literal addresses do a reverse lookup. Signed-off-by: Werner Koch <[email protected]>
2017-01-16dirmngr: Fix URL creation for literal IPv6 addresses in HKP.Werner Koch1-26/+32
* dirmngr/dns-stuff.c (is_ip_address): Make the return value depend on the address family. * dirmngr/ks-engine-hkp.c (map_host): Rename arg R_POOLNAME to R_HTTPHOST because that is its purpose. Note that the former behaviour of storing a NULL to indicate that it is not a pool has not been used. (make_host_part): Ditto. (make_host_part): Make sure that literal v6 addresses are correclty marked in the constructed URL. Signed-off-by: Werner Koch <[email protected]>
2017-01-11dirmngr: After a connection failure log a hint if Tor is not running.Werner Koch1-0/+11
* dirmngr/ks-engine-hkp.c (handle_send_request_error): Check whether Tor is running. Signed-off-by: Werner Koch <[email protected]>
2017-01-11dirmngr: Mark hosts dead on ENETDOWN.Werner Koch1-0/+5
* dirmngr/ks-engine-hkp.c (handle_send_request_error): Take care of ENETDOWN. Signed-off-by: Werner Koch <[email protected]>
2017-01-09dirmngr: Use "pgpkey-hkps" and "pgpkey-hkp" for SRV record lookups.Werner Koch1-29/+34
* dirmngr/ks-engine-hkp.c (map_host): Chnage arg NO_SRV to SRVTAG. (make_host_part): Rewrite. -- This fixes a regression from 2.0 and 1.4 where these tags have been in used since 2009. For whatever reason this was not ported to 2.1 and "hkp" was always used. GnuPG-bug-id: 2451 Signed-off-by: Werner Koch <[email protected]>
2017-01-09dirmngr: Do not use a SRV record for HKP if a port was specified.Werner Koch1-28/+37
* dirmngr/http.h (parsed_uri_s): Add field EXPLICIT_PORT. * dirmngr/http.c (do_parse_uri): That it. * dirmngr/ks-engine-hkp.c (map_host): Add arg NO_SRV. (make_host_part): Ditto. (ks_hkp_resolve): Set NO_SRV from EXPLICIT_PORT. (ks_hkp_search): Ditto. (ks_hkp_get): Ditto. (ks_hkp_put): Ditto. -- This implements the behaviour of the keyserver helpers from 1.4 and 2.0. Signed-off-by: Werner Koch <[email protected]>
2017-01-08dirmngr: Change internal SRV lookup API.Werner Koch1-11/+1
* dirmngr/dns-stuff.c (get_dns_srv): Add args SERVICE and PROTO. * dirmngr/http.c (connect_server): Simplify SRV lookup. * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/t-dns-stuff.c (main): Adjust for changed get_dns_srv. -- This new API is more convenient because it includes commonly used code. Note that right now http.c's SRV record code is not used. Signed-off-by: Werner Koch <[email protected]>
2016-12-19dirmngr: Fix problems with the getsrv function.Werner Koch1-4/+3
* dirmngr/dns-stuff.c (opt_debug, opt_verbose): New vars. (set_dns_verbose): New func. (libdns_switch_port_p): Add debug output. (resolve_dns_name): Ditto. (get_dns_cert): Ditto. (get_dns_cname): Ditto. (getsrv_libdns, getsrv_standard): Change SRVCOUNT to an unsigend int. (getsrv): Rename to ... ((get_dns_srv): this. Add arg R_COUNT and return an error. Add debug output. * dirmngr/http.c: Adjust for chnaged getsrv(). * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/t-dns-stuff.c (main): Ditto. Call set_dns_verbose. * dirmngr/dirmngr.c (parse_rereadable_options): Call set_dns_verbose. -- Due to our switch to Libdns getsrv didn't worked correctly because it returned -1 for an NXDOMAIN. However, it is perfectly okay to have no SRV record and thus we change the way this function is called to be aligned with the other functions and also map NXDOMAIN to a zero SRV record count. Signed-off-by: Werner Koch <[email protected]>
2016-12-01dirmngr: Add option --standard-resolver.Werner Koch1-4/+0
* dirmngr/dirmngr.c (oStandardResolver): New constant. (opts): New option --standard-resolver. (parse_rereadable_options): Set option. * dirmngr/dns-stuff.c: Refactor all code to support the new option. (standard_resolver): New var. (enable_standard_resolver, standard_resolver_p): New func. * dirmngr/http.c (connect_server): Remove USE_DNS_SRV build conditional. * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/server.c (cmd_getinfo) <dnsinfo>: Take care of new option * configure.ac (HAVE_ADNS_IF_TORMODE): Remove var ADNSLIB. ac_define USE_ADNS in the adns checking code. Remove options --disable-dns-srv and --disable-dns-cert. Always look for the system resolver. Print warning if no system resolver was found. (USE_DNS_CERT, USE_DNS_SRV): Remove ac_defines. (HAVE_SYSTEM_RESOLVER): New ac_define. (USE_DNS_SRV): Remove am_conditional; not used anyway. -- This option allows for runtime switching to the system's standard resolver. This is mainly useful to work around possible bugs in the optional resolver libraries (as of now ADNS). Note that on Windows there is no code to use systems's resolver and thus for full functionality dirmngr must be build with a separate resolver. This patch also does way with configure options to disable the use of CERT and SRV records. Signed-off-by: Werner Koch <[email protected]>
2016-11-10dirmngr: Improve concurrency in the non-adns case.Werner Koch1-33/+36
* dirmngr/dns-stuff.c (map_adns_status_to_gpg_error): New. (resolve_name_adns, get_dns_cert, get_dns_cname): Use that function. (getsrv) [!USE_ADNS]: Call res_query outside of nPth. Signed-off-by: Werner Koch <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-07-14gpg: Fix regression since 2.1 in --search-key with a fingerprint.Werner Koch1-2/+6
* dirmngr/ks-engine-hkp.c (ks_hkp_search): Prefix fingerprint with 0x. -- pre-2.1 made sure that the 0x prefix was put before the fingerprint so that the search command works. Actually --recv-key should be used with a fingerprint but some users are using --search-key, probably to use the interactive mode. GnuPG-bug-id: 2412 Signed-off-by: Werner Koch <[email protected]>
2016-04-26http: Allow to request system defined CAs for TLS.Werner Koch1-1/+1
* dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New. * dirmngr/http.c (http_session_new): Add arg "flags". * dirmngr/ks-engine-hkp.c (send_request): Use new flag HTTP_FLAG_TRUST_DEF for the new arg of http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
2016-01-22dirmngr: Provide the keyserver pool name even if there is no CNAME.Werner Koch1-2/+2
* dirmngr/ks-engine-hkp.c (map_host): Fix setting of r_poolname. -- map_host is intended to return the name of the pool as an additional information. However this broke some time ago and a pool name was only retrained if the pool name was retrieved from a DNS CNAME. Signed-off-by: Werner Koch <[email protected]>
2016-01-22dirmngr: Use sks-keyservers CA by default for the hkps pool.Daniel Kahn Gillmor1-1/+1
* dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem. * dirmngr/http.c (http_session_new): Add optional arg intended_hostname and set a default cert. * dirmngr/ks-engine-hkp.c (send_request): Pass httphost to http_session_new. -- Ship the certificate for the sks-keyservers hkps pool. If the user has specified that they want to use hkps://hkps.pool.sks-keyservers.net, and they have not specified any hkp-cacert explicitly, then initialize the trust path with this specific trust anchor. Co-authored-by: [email protected] Signed-off-by: Werner Koch <[email protected]>
2015-12-04dirmngr: Stricter handling of http error codes.Justus Winter1-7/+13
* dirmngr/ks-action.c (ks_action_search): Only retry if the keyserver responded with a '404 Not Found'. * dirmngr/ks-engine-hkp.c (send_request): Return http status code. (ks_hkp_search): Likewise. (ks_hkp_{get,put}): Adapt call to 'send_request'. * dirmngr/ks-engine.h (ks_hkp_search): Update prototype. Signed-off-by: Justus Winter <[email protected]>
2015-12-04dirmngr: Handle http status '501 Not Implemented'.Justus Winter1-0/+4
* dirmngr/ks-engine-hkp.c (send_request): Handle status 501 and return GPG_ERR_NOT_IMPLEMENTED. Signed-off-by: Justus Winter <[email protected]> GnuPG-bug-id: 1221
2015-11-23dirmngr: Honor ports specified in SRV records.Justus Winter1-14/+32
* dirmngr/ks-engine-hkp.c (struct hostinfo_s): New field 'port'. (create_new_hostinfo): Initialize 'port'. (add_host): Add host parameter and update the hosttable entry. (map_host): Return port if known, adjust calls to 'add_host'. (make_host_part): Let 'map_host' specify the port if known. Signed-off-by: Justus Winter <[email protected]>
2015-11-23dirmngr: Support hkp server pools using SRV records.Justus Winter1-1/+46
* dirmngr/ks-engine-hkp.c (map_host): Handle SRV records. -- Signed-off-by: Justus Winter <[email protected]> GnuPG-bug-id: 1788
2015-11-23dirmngr: Refactor 'map_host'.Justus Winter1-99/+110
* dirmngr/ks-engine-hkp.c (add_host): New function. (map_host): Use the new function. Signed-off-by: Justus Winter <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-09 07:44:55 +0000