July 2004 - Dillo-dev - lists.mailman3.com

Re: [Dillo-dev]More https goodness

by Jorge Arellano Cid

Hi Garret, On Wed, Jul 21, 2004 at 10:47:21AM -0400, Garrett Kajmowicz wrote: > On July 20, 2004 09:09 pm, Jorge Arellano Cid wrote: > > Hi Garret, > > > > OK, I reviewed it an made some changes (now on CVS). > > > > I pondered a long time whether to make a generic function for > > parsing dpip dialog answers. Something like: > > > > a_Dpiutil_dialog_parse_answer(...) > > I created a specific function because in this case a numerical response can be > expected, and thus returning a char answer requires the programmer to do more > work for this specific value. Modularizing functionality is usually a good > idea. Yes it is! This is sort of a tradeoff... For instance html.c does all its parsing with a function very much like Get_attr_value(). One alternative that I've been thinking of for a long time, is to just parse HTML tags once and return something like a: struct pair { char *attr_name; char *attr_value; }; struct pair *parsed_tag; Or the same pairs in a simple list: char **parsed_tag; with NULL marking the end. The advantage is that tag-parsing is done once, but now the caller has to go through the list to find out what attr_names are present. In the case of the dpip dialogs the current method looked simpler, at least by now... > > > > To me it seems that according to the simplicity principle of > > API design, sticking with Get_attr_value() instead of one custom > > parsing function per each dpip command is better... > > > > The same logic applies to the a_Dpip_build_command() I was > > thinking of. The interface for sending data may survive though. > > > > Anyway, the most important point of this patch is that after > > applying the patch, it seems not to trust even paypal! > > > > For instance: > > > > https://www.paypal.com/en_US/i/icon/secure_lock_2.gif > > I have checked this out. I have written a fair bit more code (now I have to > merge changes *ugh*). The issue is probably a lack of issuer certificates. > Currently the https module checks /etc/ssl/certs. > > I'm trying to think of a way to put the directory in the configure script, but > that will have to wait a little while. Don't worry, that can be done later. Let's test it first. > Right now I'm working on allowing > self-signed certificates to be accepted long-term. OpenSSL has some weird > ideas on how to do things. BTW, have you given a look to GnuTLS? (It has an OpenSSL compatibility layer and seems better documented). > > > > gives me the warning dialog. Is this OK? > > Warnings are OK. Yes, I meant to ask: Is really PayPal sending this image with a certificate that can't be trusted? > I'm adding more and more code in to handle all possible > error conditions. Previously there was no warning if there was a problem - > just a likely insecure connection. Now the system is warning on everything, > and hopefully will be able to deal with a large number of these problems in > code giving *useful* error messages. One thing at a time, though. > > Side question, do you have a regular Dillo mailing list > view-parse-evaluate-and-commit schedule? No. I try to work based on priorities. But sometimes something of higher priority steps in and things get rescheduled... > I know you prefer smaller patches > to larger patches, but it gets a little annoying for me when I submit > something and I don't know when it will be reviewed and commited. The time > doesn't bother me, but if I know your schedule I can schedule my work > appropriately. My schedule is very hard to predict. Different things come my way everyday, and I have to manage lots of things in different areas. Don't get scared though. This patch took some time to commit because I had to think of things that affect the other plugins. OTOH having a patch in the CVS doesn't give it a lot of exposure. The number of people using Dillo from CVS and testing is smaller than one expects. We usually tend to work on our local trees until something is stable enough for broader testing before making the commit. Things should go faster in the future... Cheers Jorge.-

July 21, 2004

Re: [Dillo-dev]More https goodness

by Garrett Kajmowicz

On July 20, 2004 09:09 pm, Jorge Arellano Cid wrote: > Hi Garret, > > OK, I reviewed it an made some changes (now on CVS). > > I pondered a long time whether to make a generic function for > parsing dpip dialog answers. Something like: > > a_Dpiutil_dialog_parse_answer(...) I created a specific function because in this case a numerical response can be expected, and thus returning a char answer requires the programmer to do more work for this specific value. Modularizing functionality is usually a good idea. > > To me it seems that according to the simplicity principle of > API design, sticking with Get_attr_value() instead of one custom > parsing function per each dpip command is better... > > The same logic applies to the a_Dpip_build_command() I was > thinking of. The interface for sending data may survive though. > > Anyway, the most important point of this patch is that after > applying the patch, it seems not to trust even paypal! > > For instance: > > https://www.paypal.com/en_US/i/icon/secure_lock_2.gif I have checked this out. I have written a fair bit more code (now I have to merge changes *ugh*). The issue is probably a lack of issuer certificates. Currently the https module checks /etc/ssl/certs. I'm trying to think of a way to put the directory in the configure script, but that will have to wait a little while. Right now I'm working on allowing self-signed certificates to be accepted long-term. OpenSSL has some weird ideas on how to do things. > > gives me the warning dialog. Is this OK? Warnings are OK. I'm adding more and more code in to handle all possible error conditions. Previously there was no warning if there was a problem - just a likely insecure connection. Now the system is warning on everything, and hopefully will be able to deal with a large number of these problems in code giving *useful* error messages. One thing at a time, though. Side question, do you have a regular Dillo mailing list view-parse-evaluate-and-commit schedule? I know you prefer smaller patches to larger patches, but it gets a little annoying for me when I submit something and I don't know when it will be reviewed and commited. The time doesn't bother me, but if I know your schedule I can schedule my work appropriately. Thanks. - Garrett Kajmowicz

July 21, 2004

Re: [Dillo-dev]More https goodness

by Jorge Arellano Cid

Hi Garret, On Fri, Jul 16, 2004 at 08:05:43PM -0400, Garrett Kajmowicz wrote: > I am going to start by appologizing: this diff contains two separate items. I > needed to do one to get the other to work, and I didn't want to risk having > one patch getting applied before the other. > > Anyways, two things done: > 1) Added a function to dpiutils which does the complete read in from stdin > for the dpi response tag and returns the option number selected. Please feel > free to add comments about error return values and so forth. > > 2) Added *preliminary* error checking in the https dpi which notifies the > user in the event that no certificate is presented or that the certificate is > not verified. I will do a more thorough breakdown and other options once I > know that this meets spec. Let me know if you prefer different wording on > the messages as well. > > In short, please review and commit. OK, I reviewed it an made some changes (now on CVS). I pondered a long time whether to make a generic function for parsing dpip dialog answers. Something like: a_Dpiutil_dialog_parse_answer(...) To me it seems that according to the simplicity principle of API design, sticking with Get_attr_value() instead of one custom parsing function per each dpip command is better... The same logic applies to the a_Dpip_build_command() I was thinking of. The interface for sending data may survive though. Anyway, the most important point of this patch is that after applying the patch, it seems not to trust even paypal! For instance: https://www.paypal.com/en_US/i/icon/secure_lock_2.gif gives me the warning dialog. Is this OK? Cheers Jorge.- PS: For those using CVS, you can avoid the dialogs by setting 'retval = 0' in https.c.

July 21, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Brian Hechinger

On Fri, Jul 16, 2004 at 04:48:01PM -0400, Jorge Arellano Cid wrote: > > Hi Brian, hi there! > Well, now you need to wait a bit for Garret to hook the dpip > dialog to https and thus enable GUI dialogs through Dillo. ok, cvs is setup and going here, so as soon as things are checked in, i can grab the changes. > Excellent. It needs careful review, particularly from crypto > savvy guys. i'm not super savvy, but i've got a pretty good clue as to what i'm doing. i'll run it through its paces. > Those are m4 macros for other programs that need polishing. > It's unrelated to Dillo. ahh, ok, good!! -brian -- "Suits, man. They are as incapable of logical thought as they are of honesty." -- Dave McGuire --

July 19, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Brian Hechinger

On Fri, Jul 16, 2004 at 04:49:09PM -0400, Jorge Arellano Cid wrote: > > Oh, I almost forgot: > > It's not necessary to CC' me, I do read dillo-dev! :) i'm lazy, if i just hit r for reply, it goes to you, but if i hit g for group reply, it goes to both you and the list (notice that you are in the To: field and the list is in the CC: field) i believe mutt has some sort of fancy list groking, and maybe i should look into setting that up and using it. :) -brian -- "Suits, man. They are as incapable of logical thought as they are of honesty." -- Dave McGuire --

July 19, 2004

[Dillo-dev]cookies giving me problems

by Brian Hechinger

The cookies file has a file lock: disabling cookies in this dillo! this worked great on my NetBSD/macppc box (NetBSD 2.0 BETA) but does not work on my NetBSD/i386 box (NetBSD 1.6.2). any hints? -brian -- "Suits, man. They are as incapable of logical thought as they are of honesty." -- Dave McGuire --

July 19, 2004

[Dillo-dev]any documents about html parser?

by Calvin Yu

Hello everyone: Are there any documents about html parser in Dillo? It seems HtmlParser.txt is too brief. And it is not easy to analyse the code about html parser. Thanks a lot!

July 19, 2004

Re: [Dillo-dev]Cookie problem

by Brian Hechinger

On Sun, Jul 18, 2004 at 01:49:57PM -0400, Todd Slater wrote: > Try > > .ebay.com ACCEPT > > Todd bingo!! that's it, thanks!! -brian -- "Suits, man. They are as incapable of logical thought as they are of honesty." -- Dave McGuire --

July 18, 2004

Re: [Dillo-dev]Cookie problem

by Todd Slater

On Sun, Jul 18, 2004 at 11:11:08AM -0400, Brian Hechinger wrote: > i told him about cookiesrc, he's going to try that. but that brings me to a > cookie issue of my own. i have: > > ebay.com ACCEPT > > in my cookiesrc, but ebay keeps telling me that my browser is rejecting cookies. > am i doing something silly? > > -brian Try .ebay.com ACCEPT Todd

July 18, 2004

Re: [Dillo-dev]Cookie problem

by Brian Hechinger

i told him about cookiesrc, he's going to try that. but that brings me to a cookie issue of my own. i have: ebay.com ACCEPT in my cookiesrc, but ebay keeps telling me that my browser is rejecting cookies. am i doing something silly? -brian On Sat, Jul 17, 2004 at 12:38:31PM +0200, Claus Conrad wrote: > Dear dillo community, > > I have subscribed to this list because I'm developing a PHP-based website > which I want to be compatible with dillo. The site is located at > http://www.kabbeleje.dk/vask/ . It uses PHP's session management, sending a > cookie named PHPSESSID to the browser on login. This works great in most > other browsers I tried, but somehow not in dillo. > > The PHP code I'm using looks something like > if (login_successful) { > session_start(); > // ... > header("Location: http://" . $_SERVER['HTTP_HOST'] . > dirname($_SERVER['PHP_SELF']) . "/index.php?PHPSESSID" . > strip_tags(session_id())); > } > > I added the get parameter to the redirect URL after trying without; both > ways seem to work in e. g. Mozilla, but it doesn't change anything in dillo. > The redirect works, but the user isn't logged in. I guess it's just a minor > erroneous piece in the code, but don't know where to look. Any help would be > very much appreciated. A test login is available on request, if necessary. > Thanks a lot in advance. > > Regards, > Claus > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)lists.auriga.wearlab.de > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev -- "Suits, man. They are as incapable of logical thought as they are of honesty." -- Dave McGuire --

July 18, 2004