July 2004 - Dillo-dev - lists.mailman3.com

Re: [Dillo-dev]https patch

by Jorge Arellano Cid

On Fri, 16 Jul 2004, Garrett Kajmowicz wrote: > This patch allows the https dpi to release the memory used by the X509 > certificate. This is a trivial patch. The call used to check the > certificate increases a reference count, but it is never decreased, causing > the memory not to be freed at the optimum time. This is not actually needed > on a Linux system because of the MMU, but in the event this is converted to a > server or run on a MMU-less processor, this could cause problems - I'm not > familiar enough with the internals of OpenSSL to be certain. > > Anyways, please apply the following patch to CVS. Done! Jorge.- Return-path: <gkajmowi(a)tbaytel.net> Received: from front1.tbaytel.net ([216.211.26.100]) by free.wearlab.de with esmtp (Exim 3.35 #1 (Debian)) id 1Blcez-0000pp-00 for <dillo-dev(a)lists.auriga.wearlab.de>; Sat, 17 Jul 2004 02:02:37 +0200 Received: from [216.211.55.127] (HELO gkajmowicz.garrett.dyndns.biz) by front1.tbaytel.net (CommuniGate Pro SMTP 4.1.8) with ESMTP id 10289746 for dillo-dev(a)lists.auriga.wearlab.de; Fri, 16 Jul 2004 20:02:05 -0400 From: Garrett Kajmowicz <gkajmowi(a)tbaytel.net> Reply-To: gkajmowi(a)tbaytel.net To: Dillo mailing list <dillo-dev(a)lists.auriga.wearlab.de> Date: Fri, 16 Jul 2004 20:05:43 -0400 User-Agent: KMail/1.6.82 MIME-Version: 1.0 Content-Type: Multipart/Mixed; boundary="Boundary-00=_X1G+Azi/XGRRdxA" Message-Id: <200407162005.43310.gkajmowi(a)tbaytel.net> Subject: [Dillo-dev]More https goodness Sender: dillo-dev-admin(a)lists.auriga.wearlab.de Errors-To: dillo-dev-admin(a)lists.auriga.wearlab.de X-BeenThere: dillo-dev(a)lists.auriga.wearlab.de X-Mailman-Version: 2.0.11 Precedence: bulk List-Help: <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=help> List-Post: <mailto:dillo-dev@lists.auriga.wearlab.de> List-Subscribe: <http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev>, <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=subscribe> List-Id: For dillo web browser developers <dillo-dev.lists.auriga.wearlab.de> List-Unsubscribe: <http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev>, <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=unsubscribe> List-Archive: <http://lists.auriga.wearlab.de/pipermail/dillo-dev/> --Boundary-00=_X1G+Azi/XGRRdxA Content-Type: text/plain; charset="us-ascii"; boundary="" Content-Transfer-Encoding: 7bit Content-Disposition: inline I am going to start by appologizing: this diff contains two separate items. I needed to do one to get the other to work, and I didn't want to risk having one patch getting applied before the other. Anyways, two things done: 1) Added a function to dpiutils which does the complete read in from stdin for the dpi response tag and returns the option number selected. Please feel free to add comments about error return values and so forth. 2) Added *preliminary* error checking in the https dpi which notifies the user in the event that no certificate is presented or that the certificate is not verified. I will do a more thorough breakdown and other options once I know that this meets spec. Let me know if you prefer different wording on the messages as well. In short, please review and commit. - Garrett --Boundary-00=_X1G+Azi/XGRRdxA Content-Type: text/x-diff; charset="us-ascii"; name="dillo-initial-https-prompting.diff" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="dillo-initial-https-prompting.diff" diff -pur dillo-cvs/dillo/dpi/dpiutil.c dillo-dev/dillo/dpi/dpiutil.c --- dillo-cvs/dillo/dpi/dpiutil.c 2004-07-16 22:19:00.000000000 +0000 +++ dillo-dev/dillo/dpi/dpiutil.c 2004-07-16 23:43:54.000000000 +0000 @@ -11,6 +11,7 @@ */ #include "dpiutil.h" +#include <unistd.h> #include <stdio.h> #include <string.h> #include <glib.h> @@ -143,3 +144,22 @@ gint send_stream_mode(FILE *in_stream, g return -1; } +gint dpi_message_response_number(){ + gint response_number; + gint rd_len; + gchar buf[4096]; + gchar * response = 0; + + /*Read in user responce*/ + rd_len = read(STDIN_FILENO, buf, 4096); + response = Get_attr_value(buf, rd_len, "msg" ); + + if(response == NULL){ + return -1; + } + + sscanf(response, "%d", &response_number); + g_free(response); + response = NULL; + return response_number; +} diff -pur dillo-cvs/dillo/dpi/dpiutil.h dillo-dev/dillo/dpi/dpiutil.h --- dillo-cvs/dillo/dpi/dpiutil.h 2004-07-13 21:42:22.000000000 +0000 +++ dillo-dev/dillo/dpi/dpiutil.h 2004-07-16 23:35:27.000000000 +0000 @@ -66,3 +66,9 @@ gint send_stream_4(FILE *in_stream, gcha #define SEND_STREAM_MODE_COARSE_FAST 4 gint send_stream_mode(FILE *in_stream, gchar *url, int mode); + + +/* + * Get dialog response number + */ +gint dpi_message_response_number(); diff -pur dillo-cvs/dillo/dpi/https.c dillo-dev/dillo/dpi/https.c --- dillo-cvs/dillo/dpi/https.c 2004-07-13 21:42:22.000000000 +0000 +++ dillo-dev/dillo/dpi/https.c 2004-07-16 23:57:09.000000000 +0000 @@ -329,7 +329,56 @@ int get_network_connection(gchar * url) */ int handle_certificate_problem(SSL * ssl_connection) { - + gint response_number; + int retval; + FILE * fp; + + X509 * remote_cert; + + remote_cert = SSL_get_peer_certificate(ssl_connection); + if(remote_cert == NULL){ + /*Inform user that remote system cannot be trusted*/ + printf("<dpi cmd='dialog' msg='%s' alt1='%s' alt2='%s'>", + "The remote system is not presenting a certificate and cannot be trused", + "Continue", "Cancel" + ); + fflush(stdout); + + /*Read in user responce*/ + response_number = dpi_message_response_number(); + + switch(response_number){ + case 1: /*Continue*/ + return 0; + case 2: /*Cancel*/ + return -1; + default: /*Safety - abort*/ + return -1; + } + }else{ + X509_free(remote_cert); + /*Figure out why (and if) the remote system can't be trusted*/ + retval = SSL_get_verify_result(ssl_connection); + switch (retval){ + case X509_V_OK: /*Everything is Kosher*/ + return 0; + default: /*Need to add more options later*/ + printf("<dpi cmd='dialog' msg='%s' alt1='%s' alt2='%s'>", + "The remote certificate cannot be verified", + "Continue", "Cancel" + ); + fflush(stdout); + response_number = dpi_message_response_number(); + switch(response_number){ + case 1: + return 0; + case 2: + return -1; + default: + return -1; + } + } + } return 0; } --Boundary-00=_X1G+Azi/XGRRdxA-- Return-path: <lists(a)clausconrad.com> Received: from 62.79.172.2.adsl.brh.tiscali.dk ([62.79.173.2] helo=CLAUS2) by free.wearlab.de with esmtp (Exim 3.35 #1 (Debian)) id 1Blma9-0002qd-00 for <dillo-dev(a)lists.auriga.wearlab.de>; Sat, 17 Jul 2004 12:38:18 +0200 Received: from CLAUS2 ([127.0.0.1]) by CLAUS2 with Microsoft SMTPSVC(6.0.3790.0); Sat, 17 Jul 2004 12:38:31 +0200 From: "Claus Conrad" <lists(a)clausconrad.com> To: <dillo-dev(a)lists.auriga.wearlab.de> Date: Sat, 17 Jul 2004 12:38:31 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.181 Thread-Index: AcRr4r/tMjm9VSHvSAaMiR/YmFGcTAABNXwA In-Reply-To: <20040717094502.7683.47919.Mailman(a)free.wearlab.de> Message-ID: <CLAUS2CoyRwKBEK0ZMC00000002@CLAUS2> X-OriginalArrivalTime: 17 Jul 2004 10:38:31.0671 (UTC) FILETIME=[34459070:01C46BEA] Subject: [Dillo-dev]Cookie problem Sender: dillo-dev-admin(a)lists.auriga.wearlab.de Errors-To: dillo-dev-admin(a)lists.auriga.wearlab.de X-BeenThere: dillo-dev(a)lists.auriga.wearlab.de X-Mailman-Version: 2.0.11 Precedence: bulk List-Help: <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=help> List-Post: <mailto:dillo-dev@lists.auriga.wearlab.de> List-Subscribe: <http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev>, <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=subscribe> List-Id: For dillo web browser developers <dillo-dev.lists.auriga.wearlab.de> List-Unsubscribe: <http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev>, <mailto:dillo-dev-request@lists.auriga.wearlab.de?subject=unsubscribe> List-Archive: <http://lists.auriga.wearlab.de/pipermail/dillo-dev/> Dear dillo community, I have subscribed to this list because I'm developing a PHP-based = website which I want to be compatible with dillo. The site is located at http://www.kabbeleje.dk/vask/ . It uses PHP's session management, = sending a cookie named PHPSESSID to the browser on login. This works great in most other browsers I tried, but somehow not in dillo. The PHP code I'm using looks something like if (login_successful) { session_start(); // ... header("Location: http://" . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . "/index.php?PHPSESSID" . strip_tags(session_id())); } I added the get parameter to the redirect URL after trying without; both ways seem to work in e. g. Mozilla, but it doesn't change anything in = dillo. The redirect works, but the user isn't logged in. I guess it's just a = minor erroneous piece in the code, but don't know where to look. Any help = would be very much appreciated. A test login is available on request, if = necessary. Thanks a lot in advance. Regards, Claus

July 16, 2004

Re: [Dillo-dev]https patch

by Jorge Arellano Cid

On Fri, 16 Jul 2004, Garrett Kajmowicz wrote: > This patch allows the https dpi to release the memory used by the X509 > certificate. This is a trivial patch. The call used to check the > certificate increases a reference count, but it is never decreased, causing > the memory not to be freed at the optimum time. This is not actually needed > on a Linux system because of the MMU, but in the event this is converted to a > server or run on a MMU-less processor, this could cause problems - I'm not > familiar enough with the internals of OpenSSL to be certain. > > Anyways, please apply the following patch to CVS. OK, I'll review it. > > btw, my configuration script diff seems not to have been applied yet. Are > there any standards that I should be complying with that I am not? It got in while you were writting this email! > Thanks. More stuff to follow tonight. Great. BTW, here's an old email of mine with regard to GnuTLS. It comes with some interesting information: http://article.gmane.org/gmane.comp.web.dillo.devel/2093/match=gnutls Cheers Jorge.-

July 16, 2004

Re: [Dillo-dev]Configure script patch

by Jorge Arellano Cid

On Wed, 14 Jul 2004, Garrett Kajmowicz wrote: > This patch updates the configuration system to chack for OpenSSL libraries, > and compile appropriately. I have tested to make sure that the system work > with both ssl enabled and disabled, though I do not know how well it will > react to not have OpenSSL present at all. > > Along wwith those changes go changes to the https.c file to take advantage of > this newly available information. In the event that it is compiled without > ssl support, an error page will come back indicating that the dpi was > compiled without ssl support, and link to the openssl website. Commmited. It'd be interesting to know whether it detects GnuTLS. This library is under the GPL, implements SSL and even has a wrapper for OpenSSL. It'd not be rare if it worked out of the box. BTW, some time ago I made a little skim on it and it had a good session caching scheme (almost transparent to the API), done internally. Cheers Jorge.-

July 16, 2004

[Dillo-dev]https patch

by Garrett Kajmowicz

This patch allows the https dpi to release the memory used by the X509 certificate. This is a trivial patch. The call used to check the certificate increases a reference count, but it is never decreased, causing the memory not to be freed at the optimum time. This is not actually needed on a Linux system because of the MMU, but in the event this is converted to a server or run on a MMU-less processor, this could cause problems - I'm not familiar enough with the internals of OpenSSL to be certain. Anyways, please apply the following patch to CVS. btw, my configuration script diff seems not to have been applied yet. Are there any standards that I should be complying with that I am not? Thanks. More stuff to follow tonight. - Garrett

July 16, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Jorge Arellano Cid

Oh, I almost forgot: It's not necessary to CC' me, I do read dillo-dev! :) Cheers Jorge.-

July 16, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Jorge Arellano Cid

Hi Brian, > On Fri, Jul 16, 2004 at 10:24:20AM -0400, Jorge Arellano Cid wrote: >> >> The changes are now in the CVS. > > gotten. :) Well, now you need to wait a bit for Garret to hook the dpip dialog to https and thus enable GUI dialogs through Dillo. > >> Brian: unless you're interested in dpi development, or want to >> alpha test the https dpi, I'd recommend 0.8.2 as an upgrade. > > i'm interested in https. i will do my best to break it. :) Excellent. It needs careful review, particularly from crypto savvy guys. > > i run into this issue running autogen.sh though: > > wonko@zaphod$ ./autogen.sh > aclocal found > autoheader found > autoconf found > automake found > [Checks passed] > Generating... > /usr/pkg/share/aclocal/pkg.m4:5: warning: underquoted definition of PKG_CHECK_MODULES > run info '(automake)Extending aclocal' > or see http://sources.redhat.com/automake/automake.html#Extending%20aclocal > /usr/pkg/share/aclocal/libtasn1.m4:12: warning: underquoted definition of AM_PATH_LIBTASN1 > /usr/pkg/share/aclocal/libgnutls.m4:12: warning: underquoted definition of AM_PATH_LIBGNUTLS > /usr/pkg/share/aclocal/libgnutls-extra.m4:12: warning: underquoted definition of AM_PATH_LIBGNUTLS_EXTRA > /usr/pkg/share/aclocal/libgcrypt.m4:23: warning: underquoted definition of AM_PATH_LIBGCRYPT > /usr/pkg/share/aclocal/gtk.m4:7: warning: underquoted definition of AM_PATH_GTK > /usr/pkg/share/aclocal/gpg-error.m4:7: warning: underquoted definition of AM_PATH_GPG_ERROR > /usr/pkg/share/aclocal/glib.m4:8: warning: underquoted definition of AM_PATH_GLIB > /usr/pkg/share/aclocal/audiofile.m4:12: warning: underquoted definition of AM_PATH_AUDIOFILE > /usr/pkg/share/aclocal/ao.m4:9: warning: underquoted definition of XIPH_PATH_AO > configure.in: installing `./install-sh' > configure.in: installing `./missing' > configure.in:6: installing `./config.guess' > configure.in:6: installing `./config.sub' > dpi/Makefile.am: installing `./depcomp' > > just warnings, but i thought you should know. 'info automake' (or autoconf) explains this. Those are m4 macros for other programs that need polishing. It's unrelated to Dillo. Cheers Jorge.-

July 16, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Brian Hechinger

On Fri, Jul 16, 2004 at 10:24:20AM -0400, Jorge Arellano Cid wrote: > > The changes are now in the CVS. gotten. > Brian: unless you're interested in dpi development, or want to > alpha test the https dpi, I'd recommend 0.8.2 as an upgrade. i'm interested in https. i will do my best to break it. :) i run into this issue running autogen.sh though: wonko@zaphod$ ./autogen.sh aclocal found autoheader found autoconf found automake found [Checks passed] Generating... /usr/pkg/share/aclocal/pkg.m4:5: warning: underquoted definition of PKG_CHECK_MODULES run info '(automake)Extending aclocal' or see http://sources.redhat.com/automake/automake.html#Extending%20aclocal /usr/pkg/share/aclocal/libtasn1.m4:12: warning: underquoted definition of AM_PATH_LIBTASN1 /usr/pkg/share/aclocal/libgnutls.m4:12: warning: underquoted definition of AM_PATH_LIBGNUTLS /usr/pkg/share/aclocal/libgnutls-extra.m4:12: warning: underquoted definition of AM_PATH_LIBGNUTLS_EXTRA /usr/pkg/share/aclocal/libgcrypt.m4:23: warning: underquoted definition of AM_PATH_LIBGCRYPT /usr/pkg/share/aclocal/gtk.m4:7: warning: underquoted definition of AM_PATH_GTK /usr/pkg/share/aclocal/gpg-error.m4:7: warning: underquoted definition of AM_PATH_GPG_ERROR /usr/pkg/share/aclocal/glib.m4:8: warning: underquoted definition of AM_PATH_GLIB /usr/pkg/share/aclocal/audiofile.m4:12: warning: underquoted definition of AM_PATH_AUDIOFILE /usr/pkg/share/aclocal/ao.m4:9: warning: underquoted definition of XIPH_PATH_AO configure.in: installing `./install-sh' configure.in: installing `./missing' configure.in:6: installing `./config.guess' configure.in:6: installing `./config.sub' dpi/Makefile.am: installing `./depcomp' just warnings, but i thought you should know. -brian -- "Performing a Google search on the fairly unique name you've chosen weeks ago for a piece of software you're writing, only to discover that the sole occurance of that name is as a pen-name for someone who spends his spare time writing X-rated PowerPuff Girls fan fiction is pretty-much a buzzkill." -- Jonathan Patschke --

July 16, 2004

Re: [Dillo-dev]dpip dialog for https (and dpis in general)

by Jorge Arellano Cid

Garret, Brian, CC: anyone interested ;) On Fri, 16 Jul 2004, Brian Hechinger wrote: > On Thu, Jul 15, 2004 at 11:31:12PM -0400, Jorge Arellano Cid wrote: >> >> I'll test and upload tomorrow. > > let us know, i'd love to test it. i just setup a new machine, and the latest > dillo in NetBSD's packages collection is 0.8.1, so i'm ready to upgrade > anyway. ;) The changes are now in the CVS. Example code can be find in the hello dpi (and also in nav.c). For instance, after upgrading the dpi binaries, launch Dillo and load this url "dpi:/hello/world". It will pop up a dialog, make a choice and look at the answer. repeat the test by going Back and Forward (the hello dpi is set to always reload). The relevant code is well commented. Look inside the hello dpi and you can also review the new dpiapi.[ch] files. Nav.c has an example of use for a_Interface_question_dialog() too. This should be enough for asking the user about certificates that can't be authenticated. Note that the code is not final, i.e. it needs some polishing and extensions. The good news is that in clearly illustrates the process and now is much easier to do it so. even the data structures and interface was thought to be extensible. Cheers Jorge.- Brian: unless you're interested in dpi development, or want to alpha test the https dpi, I'd recommend 0.8.2 as an upgrade.

July 16, 2004

[Dillo-dev]dpip dialog for https (and dpis in general)

by Jorge Arellano Cid

Hi there, In the afternoon I had a prototype working, wich BTW was very pleasing to see working, after living a long time as an abstract design. It needed some touches, and while working on them, some hidden bugs outside its scope showed in nav.c's repost dialog. Short story, I decided to integrate some code in interface.c with the new dialog renderer, use a more flexible design and fix the bugs. I'll test and upload tomorrow. Cheers Jorge.-

July 16, 2004

Re: [Dillo-dev]Configure script patch

by Jorge Arellano Cid

On Wed, 14 Jul 2004, Garrett Kajmowicz wrote: > This patch updates the configuration system to chack for OpenSSL libraries, > and compile appropriately. I have tested to make sure that the system work > with both ssl enabled and disabled, though I do not know how well it will > react to not have OpenSSL present at all. > > Along wwith those changes go changes to the https.c file to take advantage of > this newly available information. In the event that it is compiled without > ssl support, an error page will come back indicating that the dpi was > compiled without ssl support, and link to the openssl website. Ok, I'll check it after copding the dpip dialog. Yesterday some seasickness and stomach aches kept me away from the computer. I hope it gets better today... > btw, is there any easy command which will delete all of the non CVS files? > make distclean seems to keep the configure script around, along with other > cache information. I don't know! ;) BTW, I made a shell script to do it... Just in case you want to generate patches easily, keep a CVS repository tree and a working copy, that way: diff -pru dillo-cvs dillo-wc > Mydiff works very well. Cheers Jorge.-

July 15, 2004