[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Torbjorn SVENSSON]

Hi,

It's currently not possible to download a key from a key server when the client has to go though a proxy server to reach the key server.
Below patch addresses this issue. I've confirmed that below patch fixes the issue in 2.4.5, 2.5.22 and on master branch. A prerequisite to this fix is that bug 6997 is already fixed.

Attached is a setup in docker that demonstrates the scenario where the only path, from a client to a key server, is through a proxy server.

Without below patch, this is the output that I get from running the attached test:

$ ./run_test.sh ~/dev/gnupg
...
Attaching to client-1, proxy-1
Container gnupg-docker-proxy-1 Waiting
proxy-1  | Testing HTTPS through upstream proxy: success
proxy-1  | Connection to 127.0.0.1 3128 port [tcp/*] succeeded!
proxy-1  | Testing HTTPS through local Squid: success
proxy-1  | 1789018431.099      0 127.0.0.1 NONE_NONE/000 0 - error:transaction-end-before-headers - HIER_NONE/- -
proxy-1  | 1789018436.382    272 127.0.0.1 TCP_TUNNEL/200 15536 CONNECT keyserver.ubuntu.com:443 - FIRSTUP_PARENT/10.129.92.5 -
proxy-1  | 1789018436.691      0 127.0.0.1 NONE_NONE/000 0 - error:transaction-end-before-headers - HIER_NONE/- -
Container gnupg-docker-proxy-1 Healthy
proxy-1  | 1789018437.529    265 172.28.0.3 TCP_TUNNEL/200 15536 CONNECT keyserver.ubuntu.com:443 - FIRSTUP_PARENT/10.129.92.5 -
client-1  | Testing HTTPS through http://172.28.0.2:3128: success
client-1  | gpg: keybox '/tmp/tmp.eYh9NPisxm/pubring.kbx' created
client-1  | gpg: keyserver receive failed: Server indicated a failure
client-1 exited with code 2


With the below patch applied on top of master:
$ ./run_test.sh ~/dev/gnupg
...
Attaching to client-1, proxy-1
Container gnupg-docker-proxy-1 Waiting
proxy-1  | Testing HTTPS through upstream proxy: success
proxy-1  | Connection to 127.0.0.1 3128 port [tcp/*] succeeded!
proxy-1  | Testing HTTPS through local Squid: success
proxy-1  | 1789018692.733      0 127.0.0.1 NONE_NONE/000 0 - error:transaction-end-before-headers - HIER_NONE/- -
proxy-1  | 1789018698.059    309 127.0.0.1 TCP_TUNNEL/200 15536 CONNECT keyserver.ubuntu.com:443 - FIRSTUP_PARENT/10.129.92.5 -
proxy-1  | 1789018698.284      0 127.0.0.1 NONE_NONE/000 0 - error:transaction-end-before-headers - HIER_NONE/- -
Container gnupg-docker-proxy-1 Healthy
proxy-1  | 1789018699.170    288 172.28.0.3 TCP_TUNNEL/200 15536 CONNECT keyserver.ubuntu.com:443 - FIRSTUP_PARENT/10.129.92.5 -
client-1  | Testing HTTPS through http://172.28.0.2:3128: success
client-1  | gpg: keybox '/tmp/tmp.JKE6pJjt6k/pubring.kbx' created
proxy-1   | 1789018699.688    457 172.28.0.3 TCP_TUNNEL/200 6559 CONNECT keyserver.ubuntu.com:443 - FIRSTUP_PARENT/10.129.92.5 -
client-1  | gpg: /tmp/tmp.JKE6pJjt6k/trustdb.gpg: trustdb created
client-1  | gpg: key 3ADF34EBDBB200A4: public key "GnuPG.com (Release Signing Key 2026)" imported
client-1  | gpg: Total number processed: 1
client-1  | gpg:               imported: 1
client-1 exited with code 0


Kind regards,
Torbjörn

--

* dirmngr/ks-engine-hkp.c (make_host_part): Skip SRV lookups when
using an HTTP proxy.
(send_request): Do not apply keyserver address-family restrictions to
the proxy connection.
--

This lets the proxy resolve the destination and avoids restricting the
proxy connection based on the selected keyserver's address family.

Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson at foss.st.com>
---
  dirmngr/ks-engine-hkp.c | 10 ++++++++++
  1 file changed, 10 insertions(+)

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 617b01a9f..320cd9057 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -1075,6 +1075,11 @@ make_host_part (ctrl_t ctrl,
        protocol = KS_PROTOCOL_HKP;
      }

+  /* Let the proxy resolve the destination; an SRV lookup here would
+   * require working local DNS before the proxy can be used.  */
+  if (ctrl->http_proxy || opt.honor_http_proxy)
+    srvtag = NULL;
+
    if (npth_mutex_lock (&hosttable_lock))
      log_fatal ("failed to acquire mutex\n");

@@ -1256,6 +1261,11 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
    http_session_set_log_cb (session, cert_log_cb);
    http_session_set_timeout (session, ctrl->timeout);

+  /* These flags describe the keyserver, but http_open applies them to
+   * the proxy connection.  Explicitly disabled families are added below.  */
+  if (ctrl->http_proxy || opt.honor_http_proxy)
+    httpflags &= ~(HTTP_FLAG_IGNORE_IPv4 | HTTP_FLAG_IGNORE_IPv6);
+
    err = http_open (ctrl, &http,
                     post_cb? HTTP_REQ_POST : HTTP_REQ_GET,
                     request,
--
2.43.0
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gnupg-proxy-demo.tar.gz
Type: application/x-gzip
Size: 2494 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20260910/9674bcc4/attachment.bin>