[git] GnuPG - branch, fix-1950, created. gnupg-2.1.9-145-geb54fca
by Justus Winter
cvs at cvs.gnupg.org
Wed Nov 18 15:17:11 CET 2015
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".
The branch, fix-1950 has been created
at eb54fca4bf3ef8e0cd50b01df5b40e0d6d318d7e (commit)
- Log -----------------------------------------------------------------
commit eb54fca4bf3ef8e0cd50b01df5b40e0d6d318d7e
Author: Justus Winter <justus at g10code.com>
Date: Wed Nov 18 15:06:48 2015 +0100
dirmngr: Gracefully handle premature termination of TLS streams.
* dirmngr/http.c (close_tls_session): New function.
(session_unref): Use the new function to close the TLS stream.
(cookie_read): If the stream terminated prematurely, close it and
return a short read.
--
With this patch, I was able to update all the keys in the Debian
keyring over hkps.
Signed-off-by: Justus Winter <justus at g10code.com>
GnuPG-bug-id: 1950
diff --git a/dirmngr/http.c b/dirmngr/http.c
index e33a594..60dc45f 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -511,6 +511,27 @@ http_register_tls_ca (const char *fname)
}
+#ifdef USE_TLS
+/* Free the TLS session associated with SESS, if any. */
+static void
+close_tls_session (http_session_t sess)
+{
+ if (sess->tls_session)
+ {
+# ifdef HTTP_USE_GNUTLS
+ my_socket_t sock = gnutls_transport_get_ptr (sess->tls_session);
+ my_socket_unref (sock, NULL, NULL);
+ gnutls_deinit (sess->tls_session);
+ if (sess->certcred)
+ gnutls_certificate_free_credentials (sess->certcred);
+# endif /*HTTP_USE_GNUTLS*/
+ xfree (sess->servername);
+ sess->tls_session = NULL;
+ }
+}
+#endif /*USE_TLS*/
+
+
/* Release a session. Take care not to release it while it is being
used by a http context object. */
static void
@@ -527,17 +548,7 @@ session_unref (int lnr, http_session_t sess)
return;
#ifdef USE_TLS
-# ifdef HTTP_USE_GNUTLS
- if (sess->tls_session)
- {
- my_socket_t sock = gnutls_transport_get_ptr (sess->tls_session);
- my_socket_unref (sock, NULL, NULL);
- gnutls_deinit (sess->tls_session);
- }
- if (sess->certcred)
- gnutls_certificate_free_credentials (sess->certcred);
-# endif /*HTTP_USE_GNUTLS*/
- xfree (sess->servername);
+ close_tls_session (sess);
#endif /*USE_TLS*/
xfree (sess);
@@ -2447,6 +2458,13 @@ cookie_read (void *cookie, void *buffer, size_t size)
}
if (nread == GNUTLS_E_REHANDSHAKE)
goto again; /* A client is allowed to just ignore this request. */
+ if (nread == GNUTLS_E_PREMATURE_TERMINATION)
+ {
+ /* The server terminated the connection. Close the TLS
+ session, and indicate EOF using a short read. */
+ close_tls_session (c->session);
+ return 0;
+ }
log_info ("TLS network read failed: %s\n", gnutls_strerror (nread));
gpg_err_set_errno (EIO);
return -1;
-----------------------------------------------------------------------
hooks/post-receive
--
The GNU Privacy Guard
http://git.gnupg.org
More information about the Gnupg-commits
mailing list