Authentication-Results: mail-b.sr.ht; dkim=pass header.d=volny.cz header.i=@volny.cz

Authentication-Results: mail-b.sr.ht; dkim=pass header.d=volny.cz header.i=@volny.cz Received: from gmmr-4.centrum.cz (gmmr-4.centrum.cz [46.255.227.205]) by mail-b.sr.ht (Postfix) with ESMTPS id 76C4511EEE1 for ~sircmpwn/gmni-devel@lists.sr.ht; Thu, 15 Dec 2022 20:55:29 +0000 (UTC) Received: from gmmr-4.centrum.cz (localhost [127.0.0.1]) by gmmr-4.centrum.cz (Postfix) with ESMTP id 4CB435AEDB5; Thu, 15 Dec 2022 21:55:27 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=volny.cz; s=mail; t=1671137727; bh=0GsNY/yAZb8i8mvNfiJx9t/BrdmNfYorDRKz88GK0v0=; h=From:To:Cc:Subject:Date:From; b=CWKUSfFj8ncx141b1bJkm0KC0A+YKblclbmDoNI5BnhpfZpXoOgCQbHNqjRXU7AUb AuRvAxQFHqjQAHa1JTuFhf3ILE8Yws9sFNtzBAfVlxFU27NgkIMPvW52WZZRU8gDNc B9l2+e76HmdPZntP5Lia+CHI0pgR9K2sPSHDPYUM= Received: from vm1.excello.cz (vm1.excello.cz [185.145.37.174]) by gmmr-4.centrum.cz (Postfix) with QMQP id 4AAD0202E1BE; Thu, 15 Dec 2022 21:55:27 +0100 (CET) Received: from vm1.excello.cz by vm1.excello.cz (VF-Scanner: Clear:RC:0(46.255.225.205):SC:0(0.3/5.0):CC:0:; processed in 0.4 s); 15 Dec 2022 20:55:27 +0000 X-VF-Scanner-ID: 20221215205526.837175.25508.vm1.excello.cz.0 X-Spam-Status: No, hits=0.3, required=5.0 Received: from gmmr-3.centrum.cz (46.255.225.205) by out2.virusfree.cz with ESMTPS (TLSv1.3, TLS_AES_256_GCM_SHA384); 15 Dec 2022 21:55:26 +0100 Received: from gm-smtp10.centrum.cz (envoy-stl.cent [10.32.56.18]) by gmmr-3.centrum.cz (Postfix) with ESMTP id C12A8205AACF; Thu, 15 Dec 2022 21:55:26 +0100 (CET) Received: from localhost.localdomain (unknown [94.199.96.206]) by gm-smtp10.centrum.cz (Postfix) with ESMTPA id A97C7B2AC2; Thu, 15 Dec 2022 21:55:26 +0100 (CET) From: =?UTF-8?q?Ond=C5=99ej=20Fiala?= temp.xanomes@volny.cz To: ~sircmpwn/gmni-devel@lists.sr.ht Cc: =?UTF-8?q?Ond=C5=99ej=20Fiala?= temp.xanomes@volny.cz Subject: [PATCH gmni v2] gmnlm: treat invalid cert and cert mismatch similarly Date: Thu, 15 Dec 2022 21:55:16 +0100 Message-Id: 20221215205516.2704-1-temp.xanomes@volny.cz X-Mailer: git-send-email 2.39.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit

gmnlm already allows overriding invalid cert error, so it makes little sense not to allow the same for cert mismatch one. I have also reversed the offered options for both to reflect the suggested course of action and added a warning for invalid cert as the possibility of MitM is quite similar to cert mismatch.

Missed replacing fprintf with snprintf in original version, resulting in the previous prompt being printed out along with the current one. (That's just in case anyone else was using this patch, I notice it wasn't upstreamed.)

src/gmnlm.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/gmnlm.c b/src/gmnlm.c index b773b37..a0cdd2d 100644 --- a/src/gmnlm.c +++ b/src/gmnlm.c @@ -1185,9 +1185,11 @@ tofu_callback(enum tofu_error error, const char *fingerprint, assert(0); // Invariant case TOFU_INVALID_CERT: snprintf(prompt, sizeof(prompt),

"The server presented an invalid certificate. If you choose to proceed, "
"you should not disclose personal information or trust the contents of the page.\n"
"trust [o]nce; [a]bort\n"
"The certificate offered by this server IS INVALID.\n"
"/!\ Someone may be eavesdropping on or manipulating this connection. /!\\n"
"If you choose to proceed, you should not disclose personal information or trust "
"the contents of the page.\n"
"[a]bort; trust [o]nce\n" "=> "); break; case TOFU_UNTRUSTED_CERT:; @@ -1208,17 +1210,18 @@ tofu_callback(enum tofu_error error, const char *fingerprint, free(host); break; case TOFU_FINGERPRINT_MISMATCH:
fprintf(browser->tty,
snprintf(prompt, sizeof(prompt), "The certificate offered by this server DOES NOT MATCH the one we have on file.\n" "/!\ Someone may be eavesdropping on or manipulating this connection. /!\\n" "The unknown certificate's fingerprint is:\n" "%s\n\n" "The expected fingerprint is:\n" "%s\n\n"
"If you're certain that this is correct, edit %s:%d\n",
fingerprint, khost->fingerprint,
browser->tofu.known_hosts_path, khost->lineno);
return TOFU_FAIL;
"If you choose to proceed, you should not disclose personal information or trust "
"the contents of the page.\n"
"[a]bort; trust [o]nce; [t]rust anyway\n"
"=> ", fingerprint, khost->fingerprint);
break; }

bool prompting = true; -- 2.39.0

Originally posted by @Setting-Bunny in https://github.com/Setting-Bunny/desktop-tutorial/issues/1

OpenTechSchool / python-beginners

Authentication-Results: mail-b.sr.ht; dkim=pass header.d=volny.cz header.i=@volny.cz #112