Andreas Stieger
16ae325256
- Add hkps-fix-host-name-verification-when-using-pools.patch to fix hkps support w/ pools. Upstream commit dc10d46. OBS-URL: https://build.opensuse.org/request/show/292435 OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=98
105 lines
3.4 KiB
Diff
105 lines
3.4 KiB
Diff
From dc10d466bff53821f23d2cb4814c259d40c5d9c5 Mon Sep 17 00:00:00 2001
|
|
From: Werner Koch <wk@gnupg.org>
|
|
Date: Thu, 19 Mar 2015 15:37:05 +0100
|
|
Subject: [PATCH] hkps: Fix host name verification when using pools.
|
|
|
|
* common/http.c (send_request): Set the requested for SNI.
|
|
* dirmngr/ks-engine-hkp.c (map_host): Return the poolname and not
|
|
the selecting a host.
|
|
--
|
|
|
|
GnuPG-bug-id: 1792
|
|
|
|
Thanks to davidw for figuring out the problem.
|
|
|
|
Signed-off-by: Werner Koch <wk@gnupg.org>
|
|
---
|
|
common/http.c | 6 ++++--
|
|
dirmngr/ks-engine-hkp.c | 25 ++++++++++++++++++-------
|
|
2 files changed, 22 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/common/http.c b/common/http.c
|
|
index 50c0692..12e3fcb 100644
|
|
--- a/common/http.c
|
|
+++ b/common/http.c
|
|
@@ -1443,7 +1443,8 @@ send_request (http_t hd, const char *httphost, const char *auth,
|
|
}
|
|
|
|
# if HTTP_USE_NTBTLS
|
|
- err = ntbtls_set_hostname (hd->session->tls_session, server);
|
|
+ err = ntbtls_set_hostname (hd->session->tls_session,
|
|
+ hd->session->servername);
|
|
if (err)
|
|
{
|
|
log_info ("ntbtls_set_hostname failed: %s\n", gpg_strerror (err));
|
|
@@ -1452,7 +1453,8 @@ send_request (http_t hd, const char *httphost, const char *auth,
|
|
# elif HTTP_USE_GNUTLS
|
|
rc = gnutls_server_name_set (hd->session->tls_session,
|
|
GNUTLS_NAME_DNS,
|
|
- server, strlen (server));
|
|
+ hd->session->servername,
|
|
+ strlen (hd->session->servername));
|
|
if (rc < 0)
|
|
log_info ("gnutls_server_name_set failed: %s\n", gnutls_strerror (rc));
|
|
# endif /*HTTP_USE_GNUTLS*/
|
|
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
|
|
index ea607cb..0568094 100644
|
|
--- a/dirmngr/ks-engine-hkp.c
|
|
+++ b/dirmngr/ks-engine-hkp.c
|
|
@@ -521,6 +521,14 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
|
|
hi = hosttable[idx];
|
|
if (hi->pool)
|
|
{
|
|
+ /* Deal with the pool name before selecting a host. */
|
|
+ if (r_poolname && hi->cname)
|
|
+ {
|
|
+ *r_poolname = xtrystrdup (hi->cname);
|
|
+ if (!*r_poolname)
|
|
+ return gpg_error_from_syserror ();
|
|
+ }
|
|
+
|
|
/* If the currently selected host is now marked dead, force a
|
|
re-selection . */
|
|
if (force_reselect)
|
|
@@ -536,6 +544,11 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
|
|
if (hi->poolidx == -1)
|
|
{
|
|
log_error ("no alive host found in pool '%s'\n", name);
|
|
+ if (r_poolname)
|
|
+ {
|
|
+ xfree (*r_poolname);
|
|
+ *r_poolname = NULL;
|
|
+ }
|
|
return gpg_error (GPG_ERR_NO_KEYSERVER);
|
|
}
|
|
}
|
|
@@ -548,6 +561,11 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
|
|
if (hi->dead)
|
|
{
|
|
log_error ("host '%s' marked as dead\n", hi->name);
|
|
+ if (r_poolname)
|
|
+ {
|
|
+ xfree (*r_poolname);
|
|
+ *r_poolname = NULL;
|
|
+ }
|
|
return gpg_error (GPG_ERR_NO_KEYSERVER);
|
|
}
|
|
|
|
@@ -564,13 +582,6 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
|
|
*r_httpflags |= HTTP_FLAG_IGNORE_IPv6;
|
|
}
|
|
|
|
- if (r_poolname && hi->pool && hi->cname)
|
|
- {
|
|
- *r_poolname = xtrystrdup (hi->cname);
|
|
- if (!*r_poolname)
|
|
- return gpg_error_from_syserror ();
|
|
- }
|
|
-
|
|
*r_host = xtrystrdup (hi->name);
|
|
if (!*r_host)
|
|
{
|
|
--
|
|
2.1.4
|
|
|