Mailing List Archive: WKD on http2 server

WKD on http2 server

Sep 19, 2019, 1:29 AM

Post #1 of 4 (802 views)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

we had trouble with our wkd on archlinux32.org.

gpg only said "gpg: error retrieving 'buildmaster@archlinux32.org' via
WKD: General error".

No (failed or successul) accesses were logged server side during a tried
`gpg --locate-key ...`.

We switched off http2 (removed "http2" parameter from nginx' "listen"
directive) and key location via wkd workes.

I now wonder, whether:

1. This is known.
2. This is documented.
3. It is intended to change this.

("this" = "key retrieval via wkd does not work with (some?) http2
servers")

Also, it would be nice to give a somewhat more detailed error message,
like "cannot connect to https://$domain".

regards,
Erich

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE3p92iMrPBP64GmxZCu7JB1Xae1oFAl2DPH0ACgkQCu7JB1Xa
e1oRzRAAuOpD8nLHhY1pOpr7TfTwk4zq7tfsd419dYe2JKnwucRr09RT1JrN9z7v
8EGJ4Bd9frzYKP3/5lZeSSVU3zEbtEYaFrsjiJgAKBo+8jDih8sZaGxpfJcQmz4+
1RHGvNZikN0fXbRZoBp/GaDz4orBXnbuH81GWJKzmEvAGdQA0YCMpSKh4xP38Tpz
mYikTs3BZdjo/WfpQlAeJSOvQIjC4cjTECw3UgTOUS7Qi71vhIoGRCS0LeeylAo3
Vq2UComLwFsRYVa7z72UbEjudmDW1Mb/L5XS3uvX/ZRrnp3iCarjiOVqCNjG8I34
BhyWWOfSA+Z02Ot5wpwU2f8N6j4OaHLosd+n80FC30I2ABdi3y6COuf+lkTiK1XH
SuHutfq5Pdheai9ZKBsoAGteS1sP7Dd7QvmEAQ5OVDaT6m/F5ZgnI3CTfQIcsInd
ALtrGPNte1znWDuvcKAsq+ctAlwrOAbQrS9k1dluQ3glN3y1uiOZ+MjtDE78W/ZZ
n6+q05bmF6V6mkprp0F+6YTHZTbeqYO+/MoZiEGUEtAX6UXbHODNd9CiPc2LeN11
MOPpWhZAe0HnvON0GO67ETDJS4U/HKp99Vbo0X3ljmwVgXSXDLj5nBoKjUAJrnVv
VoOj39wZOrJQyAx7rFl33hvpjf1GN9u47QPomLETeVRC1wFwvXU=
=pNNT
-----END PGP SIGNATURE-----

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

Re: WKD on http2 server [ In reply to ]

gnupg-devel at gnupg

Sep 19, 2019, 2:58 AM

Post #2 of 4 (802 views)

Permalink

On Thu, 19 Sep 2019 10:29, gnupg-devel@gnupg.org said:

> ("this" = "key retrieval via wkd does not work with (some?) http2
> servers")

Google HTTP does not work.

> Also, it would be nice to give a somewhat more detailed error message,
> like "cannot connect to https://$domain".

dirmngr should print such a message but given it is a daemon you will
only see them in the logs. We can of course add code to move common
errors up to gpg.

Would you mind to open a ticket at dev.gnupg.org?

Shalom-Salam,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Re: WKD on http2 server [ In reply to ]

gnupg-devel at gnupg

Sep 19, 2019, 4:02 PM

Post #3 of 4 (798 views)

Permalink

On 2019-09-19 at 10:29 +0200, Erich Eckner via Gnupg-devel wrote:
> We switched off http2 (removed "http2" parameter from nginx' "listen"
> directive) and key location via wkd workes.

I have nginx 1.16.1 (OpenSSL 1.1.1d) running on FreeBSD using `http2` in
the listen directives for `openpgpkey.spodhuis.org` and GnuPG (2.2.17)
works with it.

gpg -v --auto-key-locate clear,nodefault,wkd --locate-key phil.pennock@${ThatDomain}

Loosely, if a client doesn't speak HTTP/2 then it won't try to negotiate
it and so won't be affected by it. What _might_ happen is a client
built with a library which can speak HTTP/2 and the client making
something like case-sensitive header name assumptions.

But if there are bad interactions then it's not as simple as "GnuPG is
not compatible with nginx servers which enable HTTP/2 support". Since
that works for me.

-Phil

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

Re: WKD on http2 server [ In reply to ]

gnupg-devel at gnupg

Sep 30, 2019, 12:41 AM

Post #4 of 4 (793 views)

Permalink

Hi!

On Thu, 19 Sep 2019 19:02, Phil Pennock via gnupg-devel@gnupg.org said:

> But if there are bad interactions then it's not as simple as "GnuPG is
> not compatible with nginx servers which enable HTTP/2 support". Since
> that works for me.

We meanwhile solved the problem (https://dev.gnupg.org/T4708); it is due
to a misconfiguration of the server. Here is my comment from the
ticket:

It does not work either. Your problem is the use of a wildcard DNS for
archlinux32.org:

$ host foosomething.archlinux32.org
foosomething.archlinux32.org is an alias for archlinux32.org.

Now dirmngr does an initial DNS lookup for openpgpkey.archlinux32.org
and the wildcard DNS entry hits. dirmngr knows that the modern
subdomain lookup is possible and uses this. Because you don't have
that domain in your cert it fails. The solution to this is given in
the latest WKD draft:

Sites which do not use the advanced method but employ wildcard DNS
for their sub-domains MUST make sure that the ~openpgpkey~
sub-domain is not subject to the wildcarding. This can be done by
inserting an empty TXT RR for this sub-domain.

Now, why we have different results with HTTP/2 and without is not
clear to me. It could be a DNS caching issue but it might also be that
you are not running 2.2.17 but an older version of dirmngr. We changed
the way of looking up the openpgpkey sub-domain only in 2.2.17 to get
better error messages.

Given that the OP was indeed using 2.2.17 the problem is very likely
that of a DNS caching issue. I have changed the ticket to a
documentaion issue.

Shalom-Salam,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Mailing List Archive

Attached Files:

Attached Files: