aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr/ks-engine-http.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* dirmngr: New option --disable-ipv6Werner Koch2017-04-031-1/+2
| | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (struct opt): Add field 'disable_ipv6'. * dirmngr/dirmngr.c (oDisableIPv6): New const. (opts): New option --disable-ipv6. (parse_rereadable_options): Set that option. * dirmngr/dns-stuff.c (opt_disable_ipv6): New var. (set_dns_disable_ipv6): New. (resolve_name_standard): Make use of it. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Take care of OPT.DISABLE_IPV6. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New Assuan option "http-crl".Werner Koch2017-02-211-1/+3
| | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (server_control_s): New flag 'http_no_crl'. * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set this flag. * dirmngr/server.c (option_handler): New option "http-crl" * dirmngr/http.h (HTTP_FLAG_NO_CRL): New flag. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Consult this flag. * dirmngr/ks-engine-hkp.c (send_request): Set flag depending on CTRL. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): New option --no-crl. -- This new option can be used to enable CRL checks on a per session base. The default is not to use CRLs for https connections. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: First take on ntbtls cert verification.Werner Koch2017-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/http-ntbtls.c: New. * dirmngr/Makefile.am (dirmngr_SOURCES): Add file. * dirmngr/dirmngr.h (SERVER_CONTROL_MAGIC): New. (server_conrol_s): Add field 'magic', * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Set MAGIC. (dirmngr_deinit_default_ctrl): Set MAGIC to deadbeef. * dirmngr/http.c (my_ntbtls_verify_cb): New. (http_session_new) [HTTP_USE_NTBTLS]: Remove all CA setting code. (send_request) [HTTP_USE_NTBTLS]: Set the verify callback. Do not call the verify callback after the handshake. * dirmngr/ks-engine-hkp.c (send_request): Pass gnupg_http_tls_verify_cb to http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (my_http_tls_verify_cb): New. (main): Rename option --gnutls-debug to --tls-debug. (main) [HTTP_USE_NTBTLS]: Create a session. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add per-session verify callback to http.cWerner Koch2017-02-181-1/+2
| | | | | | | | | | | | | | | | | | | * dirmngr/http.h (http_verify_cb_t): New type. * dirmngr/http.c (http_session_s): Add fields flags, verify_cb, and verify_cb_value. (http_session_new): Remove arg tls_priority. Add args verify_cb and verify-cb_value. Store them in the session object. (send_request): Use per-session verify callback. (http_verify_server_credentials) [HTTP_USE_NTBTLS]: Return GPG_ERR_NOT_IMPLEMENTED. * dirmngr/ks-engine-hkp.c (send_request): Adjust for changed http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. * dirmngr/server.c (do_get_cert_local): Replace xmalloc by malloc. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New option --no-use-tor and internal changes.Werner Koch2017-02-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (disable_dns_tormode): New. * dirmngr/dirmngr.c (oNoUseTor): New const. (opts): New option --no-use-tor. (tor_mode): New var. (parse_rereadable_options): Change to use TOR_MODE. (dirmngr_use_tor): New. (set_tor_mode): Call disable_dns_tormode. Implement oNoUseTor. * dirmngr/dirmngr.h (opt): Remove field 'use_tor'. Replace all references by a call to dirmngr_use_tor(). * dirmngr/server.c (cmd_getinfo): Distinguish between default and enforced TOR_MODE. -- This patch replaces the global variable opt.use_tar by a function testing a file local mode flag. This patch prepares for a use-tor-if-available mode. GnuPG-bug-id: 2935 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New option --disable-ipv4.Werner Koch2017-01-241-1/+2
| | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (oDisableIPv4): New const. (opts): New option --disable-ipv4. (parse_rereadable_options): Set that option. * dirmngr/dirmngr.h (opt): New field 'disable_ipv4'. * dirmngr/dns-stuff.c (opt_disable_ipv4): bew var. (set_dns_disable_ipv4): New. (resolve_name_standard): Skip v4 addresses when OPT_DISABLE_IPV4 is set. * dirmngr/ks-engine-hkp.c (map_host): Ditto. (send_request): Pass HTTP_FLAG_IGNORE_IPv4 if opt.disable_v4 is set. * dirmngr/crlfetch.c (crl_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Signed-off-by: Werner Koch <[email protected]>
* Fix format string errors and some missing error case initialization.Werner Koch2017-01-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * common/logging.c (do_logv): Remove extra parentheses in comparison. * dirmngr/dns-stuff.c (resolve_addr_libdns): Init RES so that dns_res_close is given a defined value in the error case. * dirmngr/http.c (cookie_read, cookie_write) [HTTP_USE_NTBTLS]: Fix format string char. * dirmngr/ks-engine-hkp.c (ks_hkp_help): Remove duplicate "const". * dirmngr/ks-engine-http.c (ks_http_help): Ditto. * dirmngr/ks-engine-kdns.c (ks_kdns_help): Ditto. * dirmngr/ks-engine-ldap.c (ks_ldap_help): Ditto. * scd/app-p15.c (send_keypairinfo, do_getattr): Fix format string char. * tools/gpgconf-comp.c (gpg_agent_runtime_change): Init PID for the error case. (scdaemon_runtime_change): Ditto. (dirmngr_runtime_change): Ditto. * tools/gpgconf.c (query_swdb): Init VALUE_SIZE_UL. Signed-off-by: Werner Koch <[email protected]>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* dirmngr: fix handling of HTTP redirectionsDamien Goutte-Gattat2016-07-141-1/+2
| | | | | | | * dirmngr/ks-engine-http.c (ks_http_fetch): Reinitialize HTTP session when following a HTTP redirection. Signed-off-by: Damien Goutte-Gattat <[email protected]>
* dirmngr: Use system provided root CAs with KS_FETCH.Werner Koch2016-04-271-1/+3
| | | | | | * dirmngr/ks-engine-http.c (ks_http_fetch): Use HTTP_FLAG_TRUST_SYS. Signed-off-by: Werner Koch <[email protected]>
* http: Allow to request system defined CAs for TLS.Werner Koch2016-04-261-1/+1
| | | | | | | | | | | | * dirmngr/http.h (HTTP_FLAG_TRUST_DEF, HTTP_FLAG_TRUST_SYS): New. * dirmngr/http.c (http_session_new): Add arg "flags". * dirmngr/ks-engine-hkp.c (send_request): Use new flag HTTP_FLAG_TRUST_DEF for the new arg of http_session_new. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/t-http.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix https never reported in general helpAndre Heinecke2016-04-151-1/+7
| | | | | | | | * dirmngr/ks-engine-http.c (ks_hkp_help): Also print https when supported and no uri provided. -- Wrong reporting was pointed out by K_F, again.
* dirmngr: Fix https incorrectly reported in helpAndre Heinecke2016-04-151-0/+2
| | | | | | | | | * dirmngr/ks-engine-http.c (ks_hkp_help): Only print https if tls is supported. -- Wrong reporting was pointed out by K_F. Check is the same as in ks-engine-hkp.c
* dirmngr: Use sks-keyservers CA by default for the hkps pool.Daniel Kahn Gillmor2016-01-221-1/+1
| | | | | | | | | | | | | | | | | | * dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem. * dirmngr/http.c (http_session_new): Add optional arg intended_hostname and set a default cert. * dirmngr/ks-engine-hkp.c (send_request): Pass httphost to http_session_new. -- Ship the certificate for the sks-keyservers hkps pool. If the user has specified that they want to use hkps://hkps.pool.sks-keyservers.net, and they have not specified any hkp-cacert explicitly, then initialize the trust path with this specific trust anchor. Co-authored-by: [email protected] Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add option --use-tor as a stub.Werner Koch2015-09-181-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (opt): Add field "use_tor". * dirmngr/dirmngr.c (oUseTor): New. (opts): Add --use-tor. (parse_rereadable_options): Set option. (main): Tell gpgconf about that option. * dirmngr/crlfetch.c (crl_fetch): Pass TOR flag to the http module and return an error if LDAP is used in TOR mode. (ca_cert_fetch): Return an error in TOR mode. (start_cert_fetch): Ditto. * dirmngr/ks-engine-finger.c (ks_finger_fetch): Pass TOR flag to the http module. * dirmngr/ks-engine-hkp.c (send_request): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ks-engine-ldap.c (ks_ldap_get): Return an error in TOR mode. (ks_ldap_search): Ditto. (ks_ldap_put): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. Also pass TOR flag to the http module. * dirmngr/server.c (option_handler): Add "honor-keyserver-url-used". (cmd_dns_cert): Return an error in TOR mode. (cmd_getinfo): Add subcommand "tor" * tools/gpgconf-comp.c (gc_options_dirmngr): Add TOR group. -- More work is required to actually make --use-tor useful. For now it returns an error for almost all network access but as soon as we have added the TOR feature to the http module some parts will start to work. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add http proxy support for keyservers.Werner Koch2015-04-211-2/+2
| | | | | | | | | | | | | | | | * dirmngr/dirmngr.h (server_control_s): Add field http_proxy. * dirmngr/dirmngr.c (dirmngr_init_default_ctrl): Copy http_proxy value from OPT. (dirmngr_deinit_default_ctrl): New. (main): Call dirmngr_deinit_default_ctrl. * dirmngr/server.c (start_command_handler): Ditto. (option_handler): Add option "http-proxy". * dirmngr/crlfetch.c (crl_fetch): Take http_proxy from CTRL. * dirmngr/ocsp.c (do_ocsp_request): Ditto. * dirmngr/ks-engine-hkp.c (send_request): Add proxy support. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Support https for KS_FETCH.Werner Koch2014-09-101-1/+11
| | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (cert_log_cb): Move to ... * dirmngr/misc.c (cert_log_cb): here. * dirmngr/ks-engine-http.c (ks_http_fetch): Support 307-redirection and https. -- Note that this requires that the root certificates are registered using the --hkp-cacert option. Eventually we may introduce a separate option to allow using different CAs for KS_FETCH and keyserver based requests.
* http: Allow overriding of the Host header.Werner Koch2014-05-161-0/+1
| | | | | | | | | | | | | * common/http.c (http_open): Add arg httphost. (http_open_document): Pass NULL for httphost. (send_request): Add arg httphost. If given, use HTTPHOST instead of SERVER. Use https with a proxy if requested. (http_verify_server_credentials): Do not stop at the first error message. * dirmngr/ocsp.c (do_ocsp_request): Adjust call to http_open. * keyserver/curl-shim.c (curl_easy_perform): Ditto. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ks-engine-hkp.c (ks_hkp_help): Ditto.
* Change all quotes in strings and comments to the new GNU standard.Werner Koch2012-06-051-4/+4
| | | | | | | | | | | | | | | | | | | The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
* Make HKP keyserver engine work again.Werner Koch2011-11-241-1/+1
| | | | | | | | | | | | | We had some debug code here which prevented it from working. The host selection code still needs a review! * ks-engine-http.c (ks_http_help): Do not print help for hkp. * ks-engine-hkp.c (ks_hkp_help): Print help only for hkp. (send_request): Remove test code. (map_host): Use xtrymalloc. * certcache.c (classify_pattern): Remove unused variable and make explicit substring search work.
* Add framework to print keyserver engine informationWerner Koch2011-02-091-0/+20
|
* Support key fetching using HTTP.Werner Koch2011-02-091-0/+141
A simple test case is: gpg2 --fetch-key http://werner.eifelkommune.de/mykey.asc
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-01 05:05:28 +0000