[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Andrew Gallagher]

On 10/09/2026 09:40, Torbjorn SVENSSON via Gnupg-devel wrote:
> Kind regards,
> Torbjörn

Hi, Torbjörn.

(Keyserver hat on)

I'd like to better understand the modified control flow here - does this 
patch skip SRV lookups entirely when a proxy is in use, or will the 
proxy do it eventually? This has subtle implications...

Thanks,
A

> -- 
> 
> * dirmngr/ks-engine-hkp.c (make_host_part): Skip SRV lookups when
> using an HTTP proxy.
> (send_request): Do not apply keyserver address-family restrictions to
> the proxy connection.
> -- 
> 
> This lets the proxy resolve the destination and avoids restricting the
> proxy connection based on the selected keyserver's address family.
> 
> Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson at foss.st.com>
> ---
>   dirmngr/ks-engine-hkp.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
> index 617b01a9f..320cd9057 100644
> --- a/dirmngr/ks-engine-hkp.c
> +++ b/dirmngr/ks-engine-hkp.c
> @@ -1075,6 +1075,11 @@ make_host_part (ctrl_t ctrl,
>         protocol = KS_PROTOCOL_HKP;
>       }
> 
> +  /* Let the proxy resolve the destination; an SRV lookup here would
> +   * require working local DNS before the proxy can be used.  */
> +  if (ctrl->http_proxy || opt.honor_http_proxy)
> +    srvtag = NULL;
> +
>     if (npth_mutex_lock (&hosttable_lock))
>       log_fatal ("failed to acquire mutex\n");
> 
> @@ -1256,6 +1261,11 @@ send_request (ctrl_t ctrl, const char *request, 
> const char *hostportstr,
>     http_session_set_log_cb (session, cert_log_cb);
>     http_session_set_timeout (session, ctrl->timeout);
> 
> +  /* These flags describe the keyserver, but http_open applies them to
> +   * the proxy connection.  Explicitly disabled families are added 
> below.  */
> +  if (ctrl->http_proxy || opt.honor_http_proxy)
> +    httpflags &= ~(HTTP_FLAG_IGNORE_IPv4 | HTTP_FLAG_IGNORE_IPv6);
> +
>     err = http_open (ctrl, &http,
>                      post_cb? HTTP_REQ_POST : HTTP_REQ_GET,
>                      request,
> -- 
> 2.43.0