aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr/http.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* dirmngr: Fix problems with the getsrv function.Werner Koch2016-12-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (opt_debug, opt_verbose): New vars. (set_dns_verbose): New func. (libdns_switch_port_p): Add debug output. (resolve_dns_name): Ditto. (get_dns_cert): Ditto. (get_dns_cname): Ditto. (getsrv_libdns, getsrv_standard): Change SRVCOUNT to an unsigend int. (getsrv): Rename to ... ((get_dns_srv): this. Add arg R_COUNT and return an error. Add debug output. * dirmngr/http.c: Adjust for chnaged getsrv(). * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/t-dns-stuff.c (main): Ditto. Call set_dns_verbose. * dirmngr/dirmngr.c (parse_rereadable_options): Call set_dns_verbose. -- Due to our switch to Libdns getsrv didn't worked correctly because it returned -1 for an NXDOMAIN. However, it is perfectly okay to have no SRV record and thus we change the way this function is called to be aligned with the other functions and also map NXDOMAIN to a zero SRV record count. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve ntbtls support.NIIBE Yutaka2016-12-141-4/+71
| | | | | | | | | * dirmngr/http.c [HTTP_USE_NTBTLS] (close_tls_session): Release. (send_request): Call ntbtls_set_transport. (cookie_read, cookie_write): Implement. (cookie_close): Add initial implementation for ntbtls. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Add option --standard-resolver.Werner Koch2016-12-011-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oStandardResolver): New constant. (opts): New option --standard-resolver. (parse_rereadable_options): Set option. * dirmngr/dns-stuff.c: Refactor all code to support the new option. (standard_resolver): New var. (enable_standard_resolver, standard_resolver_p): New func. * dirmngr/http.c (connect_server): Remove USE_DNS_SRV build conditional. * dirmngr/ks-engine-hkp.c (map_host): Ditto. * dirmngr/server.c (cmd_getinfo) <dnsinfo>: Take care of new option * configure.ac (HAVE_ADNS_IF_TORMODE): Remove var ADNSLIB. ac_define USE_ADNS in the adns checking code. Remove options --disable-dns-srv and --disable-dns-cert. Always look for the system resolver. Print warning if no system resolver was found. (USE_DNS_CERT, USE_DNS_SRV): Remove ac_defines. (HAVE_SYSTEM_RESOLVER): New ac_define. (USE_DNS_SRV): Remove am_conditional; not used anyway. -- This option allows for runtime switching to the system's standard resolver. This is mainly useful to work around possible bugs in the optional resolver libraries (as of now ADNS). Note that on Windows there is no code to use systems's resolver and thus for full functionality dirmngr must be build with a separate resolver. This patch also does way with configure options to disable the use of CERT and SRV records. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add system CAs if no hkp-cacert is givenDaniel Kahn Gillmor2016-11-171-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (http_session_new): If the user isn't talking to the HKPS pool, and they have not specified any hkp-cacert, then we should default to the system CAs, rather than nothing. * doc/dirmngr.texi: Document choice of CAs. -- Consider three possible classes of dirmngr configuration: a) no hkps:// keyserver URLs at all (communication with keyservers is entirely in the clear) b) hkps:// keyserver URLs, but no hkp-cacert directives c) hkps:// keyserver URLs, and at least one hkp-cacert directive class (a) provides no confidentiality of requests. class (b) currently will never work because the server certificate cannot be validated. class (c) is currently supported as intended. This patch allows users with configurations in class (b) to work as most users expect (relying on the system certificate authorities), without affecting users in classes (a) or (c). Signed-off-by: Daniel Kahn Gillmor <[email protected]> o minor indentation fix - wk
* dirmngr: Register hkp-cacert even if the file doesn't exist yetDaniel Kahn Gillmor2016-11-171-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (parse_readable_options): If we're unable to turn an argument for hkp-cacert into an absolute filename, terminate completely. * dirmngr/http.c (http_register_tls_ca): Show a warning if file is not immediately accessible, but register it anyway. -- Without this changeset, the condition of the filesystem when dirmngr is initialized will have an effect on later activities of dirmngr. For example, if a file identified by a hkp-cacert directive doesn't exist when dirmngr starts, dirmngr will behave as though it simply didn't have the hkp-cacert directive set at all, even if the file should appear later. dirmngr currently behaves differently if no hkp-cacert directives have been set then it does when at least one hkp-cacert directive has been set. For example, its choice of CA cert for hkps://hkps.pool.sks-keyservers.net depends on whether a TLS CA file has been registered. That behavior shouldn't additionally depend on the state of the filesystem at the time of dirmngr launch. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Prepare to trigger jobs by network activity.Werner Koch2016-11-111-1/+28
| | | | | | | | | | | * dirmngr/http.c (netactivity_cb): New. (http_register_netactivity_cb): New. (notify_netactivity): New. (connect_server): Call that function. * dirmngr/dirmngr.c (main): Call http_register_netactivity_cb. (netactivity_action): New stub handler. Signed-off-by: Werner Koch <[email protected]>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* common: New function string_to_u64.Werner Koch2016-08-111-11/+2
| | | | | | | | | | | | | * common/stringhelp.c (string_to_u64): New. * dirmngr/http.c (longcounter_t): Remove. (struct cookie_s): Change content_length to uint64_t. (parse_response): Use string_to_u64. -- Meanwhile we allow some C99 features including stdint.h. Thus we can simplify things now. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix typo.Daniel Kahn Gillmor2016-07-121-1/+1
| | | | | -- Signed-off-by: Justus Winter <[email protected]>
* doc: Consistently use 'keyserver'.Werner Koch2016-06-141-1/+1
| | | | | | | -- GnuPG-bug-id: 2383 Signed-off-by: Werner Koch <[email protected]>
* http: Allow to request system defined CAs for TLS.Werner Koch2016-04-261-8/+32
| | | | | | | | | | | | * dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New. * dirmngr/http.c (http_session_new): Add arg "flags". * dirmngr/ks-engine-hkp.c (send_request): Use new flag HTTP_FLAG_TRUST_DEF for the new arg of http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Use sks-keyservers CA by default for the hkps pool.Daniel Kahn Gillmor2016-01-221-1/+30
| | | | | | | | | | | | | | | | | | * dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem. * dirmngr/http.c (http_session_new): Add optional arg intended_hostname and set a default cert. * dirmngr/ks-engine-hkp.c (send_request): Pass httphost to http_session_new. -- Ship the certificate for the sks-keyservers hkps pool. If the user has specified that they want to use hkps://hkps.pool.sks-keyservers.net, and they have not specified any hkp-cacert explicitly, then initialize the trust path with this specific trust anchor. Co-authored-by: [email protected] Signed-off-by: Werner Koch <[email protected]>
* build: Require at least Libassuan 2.4.1.Werner Koch2015-12-021-4/+0
| | | | | | | | | | | | | | | * configure.ac (NEED_LIBASSUAN_VERSION): Set to 2.4.1. * agent/gpg-agent.c (create_server_socket): Remove check for libassuan >= 2.3.0 and >= 2.1.4. (main): Remove check for libassuan >= 2.1.4. * scd/scdaemon.c (create_server_socket): Remove check for libassuan >= 2.1.4. * dirmngr/dirmngr.c (set_tor_mode): Remove check for libassuan >= 2.3.0. * dirmngr/http.c (http_raw_connect, send_request): Remove checks for libassuan >= 2.3.0. Signed-off-by: Werner Koch <[email protected]>
* http: Enhance parser to detect .onion addresses.Werner Koch2015-12-021-33/+39
| | | | | | | | * dirmngr/http.h (parsed_uri_s): Add flag 'onion'. * dirmngr/http.c (do_parse_uri): Set that flag. * dirmngr/t-http.c (main): Print flags. Signed-off-by: Werner Koch <[email protected]>
* Avoid incompatible pointer assignment warnings on Windows.Werner Koch2015-11-271-6/+7
| | | | | | | | | | | | | | * common/logging.c (fun_writer): Use gpgrt_ssize_t instead of ssize_t. * dirmngr/server.c (data_line_cookie_write): Ditto. * sm/certdump.c (format_name_writer): Ditto. * sm/server.c (data_line_cookie_write): Ditto. * dirmngr/http.c (cookie_read, cookie_write): Ditto. -- See the release notes of libgpg-error 1.15 for background info on gpgrt_ssize_t. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Let Libassuan employ nPth wrappers for connect.Werner Koch2015-11-261-9/+0
| | | | | | | | | | | | * dirmngr/http.c (my_unprotect, my_protect): Remove. (connect_server): Do not use these wrappers. -- Since Libassuan version 2.4.2 the macro ASSUAN_SYSTEM_NPTH_IMPL protects the low-level connect calls with npth_unprotect and npth_protect. This is better than the high-level kludge we used here. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Gracefully handle premature termination of TLS streams.fix-1950Justus Winter2015-11-181-11/+29
| | | | | | | | | | | | | * dirmngr/http.c (close_tls_session): New function. (session_unref): Use the new function to close the TLS stream. (cookie_read): If the stream terminated prematurely, close it and return a short read. -- With this patch, I was able to update all the keys in the Debian keyring over hkps. Signed-off-by: Justus Winter <[email protected]> GnuPG-bug-id: 1950
* Fix typos found using codespell.Justus Winter2015-11-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/cache.c: Fix typos. * agent/call-pinentry.c: Likewise. * agent/call-scd.c: Likewise. * agent/command-ssh.c: Likewise. * agent/command.c: Likewise. * agent/divert-scd.c: Likewise. * agent/findkey.c: Likewise. * agent/gpg-agent.c: Likewise. * agent/w32main.c: Likewise. * common/argparse.c: Likewise. * common/audit.c: Likewise. * common/audit.h: Likewise. * common/convert.c: Likewise. * common/dotlock.c: Likewise. * common/exechelp-posix.c: Likewise. * common/exechelp-w32.c: Likewise. * common/exechelp-w32ce.c: Likewise. * common/exechelp.h: Likewise. * common/helpfile.c: Likewise. * common/i18n.h: Likewise. * common/iobuf.c: Likewise. * common/iobuf.h: Likewise. * common/localename.c: Likewise. * common/logging.c: Likewise. * common/openpgp-oid.c: Likewise. * common/session-env.c: Likewise. * common/sexputil.c: Likewise. * common/sysutils.c: Likewise. * common/t-sexputil.c: Likewise. * common/ttyio.c: Likewise. * common/util.h: Likewise. * dirmngr/cdblib.c: Likewise. * dirmngr/certcache.c: Likewise. * dirmngr/crlcache.c: Likewise. * dirmngr/dirmngr-client.c: Likewise. * dirmngr/dirmngr.c: Likewise. * dirmngr/dirmngr_ldap.c: Likewise. * dirmngr/dns-stuff.c: Likewise. * dirmngr/http.c: Likewise. * dirmngr/ks-engine-hkp.c: Likewise. * dirmngr/ks-engine-ldap.c: Likewise. * dirmngr/ldap-wrapper.c: Likewise. * dirmngr/ldap.c: Likewise. * dirmngr/misc.c: Likewise. * dirmngr/ocsp.c: Likewise. * dirmngr/validate.c: Likewise. * g10/encrypt.c: Likewise. * g10/getkey.c: Likewise. * g10/gpg.c: Likewise. * g10/gpgv.c: Likewise. * g10/import.c: Likewise. * g10/keydb.c: Likewise. * g10/keydb.h: Likewise. * g10/keygen.c: Likewise. * g10/keyid.c: Likewise. * g10/keylist.c: Likewise. * g10/keyring.c: Likewise. * g10/mainproc.c: Likewise. * g10/misc.c: Likewise. * g10/options.h: Likewise. * g10/packet.h: Likewise. * g10/parse-packet.c: Likewise. * g10/pkclist.c: Likewise. * g10/pkglue.c: Likewise. * g10/plaintext.c: Likewise. * g10/server.c: Likewise. * g10/sig-check.c: Likewise. * g10/sqlite.c: Likewise. * g10/tdbio.c: Likewise. * g10/test-stubs.c: Likewise. * g10/tofu.c: Likewise. * g10/trust.c: Likewise. * g10/trustdb.c: Likewise. * g13/create.c: Likewise. * g13/mountinfo.c: Likewise. * kbx/keybox-blob.c: Likewise. * kbx/keybox-file.c: Likewise. * kbx/keybox-init.c: Likewise. * kbx/keybox-search-desc.h: Likewise. * kbx/keybox-search.c: Likewise. * kbx/keybox-update.c: Likewise. * scd/apdu.c: Likewise. * scd/app-openpgp.c: Likewise. * scd/app-p15.c: Likewise. * scd/app.c: Likewise. * scd/ccid-driver.c: Likewise. * scd/command.c: Likewise. * scd/iso7816.c: Likewise. * sm/base64.c: Likewise. * sm/call-agent.c: Likewise. * sm/call-dirmngr.c: Likewise. * sm/certchain.c: Likewise. * sm/gpgsm.c: Likewise. * sm/import.c: Likewise. * sm/keydb.c: Likewise. * sm/minip12.c: Likewise. * sm/qualified.c: Likewise. * sm/server.c: Likewise. * tools/gpg-check-pattern.c: Likewise. * tools/gpgconf-comp.c: Likewise. * tools/gpgkey2ssh.c: Likewise. * tools/gpgparsemail.c: Likewise. * tools/gpgtar.c: Likewise. * tools/rfc822parse.c: Likewise. * tools/symcryptrun.c: Likewise. Signed-off-by: Justus Winter <[email protected]>
* dirmngr: Support Tor hidden services.Werner Koch2015-10-261-0/+26
| | | | | | | | | | | | | | * dirmngr/dns-stuff.c (is_onion_address): New. * dirmngr/ks-engine-hkp.c (hostinfo_s): Add field "onion". (map_host): Special case onion addresses. (ks_hkp_print_hosttable): Print an 'O' for an onion address. * dirmngr/http.c (connect_server): Special case onion addresses. -- Note that this requires the latest libassuan from git. Onion addresses are always support regardless of the --use-tor flag. Signed-off-by: Werner Koch <[email protected]>
* dirmngr,w32: Remove gethostbyname hack and make it build again.Werner Koch2015-10-261-36/+2
| | | | | | | | | * dirmngr/http.c (connect_server) [W32]: Remove gethostbyname hack; we require getaddrinfo anyway. * dirmngr/dns-stuff.c (AI_ADDRCONFIG): Add replacement if not defined. (map_eai_to_gpg_error) [W32]: Take care of unsupported codes. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not use MAXDNAME.Werner Koch2015-10-221-7/+17
| | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (getsrv): Replace MAXDNAME. * dirmngr/dns-stuff.h (MAXDNAME): Remove. (struct srventry): Use a fixed value instead of MAXDNAME. * dirmngr/http.c (connect_server): Use DIMof instead of MAXDNAME. Malloc a helper array. -- Depending on the order of included headers it might be that we allocate the array with a different size than what we test against in another module. To make it more robust we use the actual known size of checking. A better would be to use a linked list and avoid these large arrays. Signed-off-by: Werner Koch <[email protected]>
* Move SRV RR code from common/ to dirmngr/.Werner Koch2015-10-221-17/+0
| | | | | | | | | | | | * common/srv.c: Merge into dirmngr/dns-stuff.c. Delete file. * common/srv.h: Merge into dirmngr/dns-stuff.h. Delete file. * common/Makefile.am (common_sources): Remove srv.c and srv.h. * g10/keyserver.c: Do not include srv.h. The code using it is anyway disabled. * dirmngr/http.c: Remove header srv.h and stubs. * dirmngr/t-dns-stuff.c: Add option --srv. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Use the new DNS wrapper for the HTTP module.Werner Koch2015-10-211-78/+18
| | | | | | | | | * dirmngr/t-http.c (main): Init assuan sockets. * dirmngr/http.c: Include dns-stuff.h. (connect_server)[!HAVE_GETADDRINFO]: Remove all code. (connect_server): Change to use resolve_dns_name. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Allow use of http.c if USE_NPTH is not defined.Werner Koch2015-10-211-8/+14
| | | | | | | | | | | | | | | * dirmngr/http.c (send_request): Always set the gnutls pull/push functions. (my_npth_read): Rename to ... (my_gnutls_read) .. this. Use system read if !USE_NPTH. (my_npth_write): Rename to ... (my_gnutls_write) .. this. Use system write if !USE_NPTH. -- This is necessary to run t-http because we once switched to a ref counted object with the socket descriptor. Signed-off-by: Werner Koch <[email protected]>
* Change capitalization of TOR to Tor.Werner Koch2015-10-211-2/+2
| | | | --
* dirmngr: Allow building with libassuan < 2.3.Neal H. Walfield2015-10-211-0/+2
| | | | | | | | | * dirmngr/http.c (send_request): Use newer assuan function only if available. -- Signed-off-by: Neal H. Walfield <[email protected]> Regression-due-to: 4e42ad30
* w32: Allow building again.Werner Koch2015-10-201-1/+1
| | | | | | * dirmngr/http.c (connect_server): Fix called function name. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Allow building with libassuan < 2.3.Werner Koch2015-10-191-0/+2
| | | | | | | | | | * dirmngr/dirmngr.c (set_tor_mode): Use newer assuan function only if available. * dirmngr/http.c (http_raw_connect): Ditto. -- Frankly we should require that but we can also wait for 2.4.0 and switch then.
* dirmngr: Make --use-tor work - still leaks DNS.Werner Koch2015-10-191-4/+14
| | | | | | | | | | | | | * dirmngr/dirmngr.c (set_tor_mode): New. (main, reread_configuration): Call it. * dirmngr/http.c (http_raw_connect, send_request): Check whether TOR mode is enabled if the FORCE_TOR flag is given. -- The patch for http.c is a sanity check because tor mode is anyway global as long as the Assuan socket wrappers are used. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Use Assuan socket wrappers for http.cWerner Koch2015-10-191-55/+73
| | | | | | | | | | | | | | | | * dirmngr/http.c: Include assuan.h. Changed all code taking a socket descriptor from int to assuan_fd_t. (my_unprotect, my_protect): New. (my_connect): Remove. (_my_socket_new, _my_socket_unref): use assuan_sock_close. (connect_server): Use assuan_sock_connect, assuan_sock_new, and assuan_sock_close. * dirmngr/Makefile.am (t_common_ldadd): Add LIBASSUAN_LIBS. -- This change prepares for the use of SOCKS5 with http. Signed-off-by: Werner Koch <[email protected]>
* Move http module from common/ to dirmngr/.Werner Koch2015-10-181-0/+2777
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/http.c: Move to ../dirmngr/. * common/http.h: Move to ../dirmngr/. * common/t-http.c: Move to ../dirmngr/. * common/tls-ca.pem: Move to ../dirmngr/. * common/Makefile.am: Do not build libcommontls.a libcommontlsnpth.a. Remove http.c related stuff. * po/POTFILES.in: Move http.c to dirmngr/. * dirmngr/Makefile.am (EXTRA_DIST): Add tls-ca.pem. (module_maint_tests): New. (noinst_PROGRAMS): Add module_maint_tests. (dirmngr_SOURCES): Add http.c and http.h. (dirmngr_LDADD): Remove libcommontlsnpth. (t_common_ldadd): Ditto. (t_http_SOURCES, t_http_CFLAGS, t_http_LDADD): New. (t_ldap_parse_uri_SOURCES): Add http.c. (t_ldap_parse_uri_CFLAGS): Build without npth. ($(PROGRAMS)): Do not require libcommontls.a libcommontlsnpth.a. * dirmngr/dirmngr.h, dirmngr/ks-engine.h: Fix include of http.h. -- All network access is done via dirmngr and thus http.c should be there. Signed-off-by: Werner Koch <[email protected]>
* Some work on porting dirmngr (unfinished)Werner Koch2010-07-161-1863/+0
| | | | | Ported gpgtar to W32.
* Avoid using the protect-tool to import pkcs#12.Werner Koch2010-06-171-0/+2
|
* Merged Dirmngr with GnuPG.Werner Koch2010-06-091-0/+1861
A few code changes to support dirmngr.
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-29 00:28:40 +0000