[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Torbjorn SVENSSON]

Hi Andrew,

On 2026-10-08 11:56, Andrew Gallagher via Gnupg-devel wrote:
> On 10/09/2026 09:40, Torbjorn SVENSSON via Gnupg-devel wrote:
>> Kind regards,
>> Torbjörn
> 
> Hi, Torbjörn.
> 
> (Keyserver hat on)
> 
> I'd like to better understand the modified control flow here - does this patch skip SRV lookups entirely when a proxy is in use, or will the proxy do it eventually? This has subtle implications...

I'd say that it depends on the proxy server implementation.
In the scenario that I've set up in my reproducer (my real use-case also require authentication), the host that is acting as a keyserver client has no means to lookup any public records, including any SRV records.
The clients are "air gaped" in the sense that only the proxy server has a way out to the Internet.

I understand that some proxy solutions might allow DNS lookup, but the scenario that I have does not.

Does this make sense to you?

Kind regards,
Torbjörn

> 
> Thanks,
> A
> 
>> -- 
>>
>> * dirmngr/ks-engine-hkp.c (make_host_part): Skip SRV lookups when
>> using an HTTP proxy.
>> (send_request): Do not apply keyserver address-family restrictions to
>> the proxy connection.
>> -- 
>>
>> This lets the proxy resolve the destination and avoids restricting the
>> proxy connection based on the selected keyserver's address family.
>>
>> Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson at foss.st.com>
>> ---
>>   dirmngr/ks-engine-hkp.c | 10 ++++++++++
>>   1 file changed, 10 insertions(+)
>>
>> diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
>> index 617b01a9f..320cd9057 100644
>> --- a/dirmngr/ks-engine-hkp.c
>> +++ b/dirmngr/ks-engine-hkp.c
>> @@ -1075,6 +1075,11 @@ make_host_part (ctrl_t ctrl,
>>         protocol = KS_PROTOCOL_HKP;
>>       }
>>
>> +  /* Let the proxy resolve the destination; an SRV lookup here would
>> +   * require working local DNS before the proxy can be used.  */
>> +  if (ctrl->http_proxy || opt.honor_http_proxy)
>> +    srvtag = NULL;
>> +
>>     if (npth_mutex_lock (&hosttable_lock))
>>       log_fatal ("failed to acquire mutex\n");
>>
>> @@ -1256,6 +1261,11 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
>>     http_session_set_log_cb (session, cert_log_cb);
>>     http_session_set_timeout (session, ctrl->timeout);
>>
>> +  /* These flags describe the keyserver, but http_open applies them to
>> +   * the proxy connection.  Explicitly disabled families are added below.  */
>> +  if (ctrl->http_proxy || opt.honor_http_proxy)
>> +    httpflags &= ~(HTTP_FLAG_IGNORE_IPv4 | HTTP_FLAG_IGNORE_IPv6);
>> +
>>     err = http_open (ctrl, &http,
>>                      post_cb? HTTP_REQ_POST : HTTP_REQ_GET,
>>                      request,
>> -- 
>> 2.43.0
> 
> 
> _______________________________________________
> Gnupg-devel mailing list
> Gnupg-devel at gnupg.org
> https://lists.gnupg.org/mailman/listinfo/gnupg-devel