security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

dirmngr: Use sks-keyservers CA by default for the hkps pool.

Browse source 
* dirmngr/Makefile.am (dist_pkgdata_DATA): Add sks-keyservers.netCA.pem.
* dirmngr/http.c (http_session_new): Add optional arg
intended_hostname and set a default cert.
* dirmngr/ks-engine-hkp.c (send_request): Pass httphost to
http_session_new.
--

Ship the certificate for the sks-keyservers hkps pool.  If the user
has specified that they want to use
hkps://hkps.pool.sks-keyservers.net, and they have not specified any
hkp-cacert explicitly, then initialize the trust path with this
specific trust anchor.

Co-authored-by: wk@gnupg.org
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Daniel Kahn Gillmor 2015-10-19 23:48:30 -04:00 • committed by Werner Koch
parent 361820a3be
commit afb8696126
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
6 changed files with 36 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

31
dirmngr/http.c
View file

@ -562,7 +562,8 @@ http_session_release (http_session_t sess)
/* Create a new session object which is currently used to enable TLS
support. It may eventually allow reusing existing connections. */
gpg_error_t
http_session_new (http_session_t *r_session, const char *tls_priority)
http_session_new (http_session_t *r_session, const char *tls_priority,
const char *intended_hostname)
{
gpg_error_t err;
http_session_t sess;
@ -600,6 +601,34 @@ http_session_new (http_session_t *r_session, const char *tls_priority)
goto leave;
}
/* If the user has not specified a CA list, and they are looking
* for the hkps pool from sks-keyservers.net, then default to
* Kristian's certificate authority: */
if (!tls_ca_certlist
&& intended_hostname
&& !ascii_strcasecmp (intended_hostname,
"hkps.pool.sks-keyservers.net"))
{
char *pemname = make_filename_try (gnupg_datadir (),
"sks-keyservers.netCA.pem", NULL);
if (!pemname)
{
err = gpg_error_from_syserror ();
log_error ("setting CA from file '%s' failed: %s\n",
pemname, gpg_strerror (err));
}
else
{
rc = gnutls_certificate_set_x509_trust_file
(sess->certcred, pemname, GNUTLS_X509_FMT_PEM);
if (rc < 0)
log_info ("setting CA from file '%s' failed: %s\n",
pemname, gnutls_strerror (rc));
xfree (pemname);
}
}
/* Add configured certificates to the session. */
for (sl = tls_ca_certlist; sl; sl = sl->next)
{
rc = gnutls_certificate_set_x509_trust_file