Comments (9)
We should figure out what we want to do about certificates here.
Original comment by [email protected]
on 3 Oct 2006 at 6:52
from google-breakpad.
This patch is better ;-)
What do you mean about certificates? I admit I don't know much about the Windows
networking layer; are we worried that it would submit data even if the
certificate
were invalid?
Original comment by [email protected]
on 3 Oct 2006 at 7:38
Attachments:
from google-breakpad.
Yes, exactly: certificate validation.
Original comment by [email protected]
on 3 Oct 2006 at 8:46
from google-breakpad.
Original comment by [email protected]
on 16 Oct 2006 at 10:20
- Added labels: Milestone-Release1.0
from google-breakpad.
Original comment by [email protected]
on 18 Oct 2006 at 1:44
- Added labels: Component-Client-Sender, OpSys-Windows
from google-breakpad.
All we need to do is pass INTERNET_FLAG_SECURE in the flags argument of
HttpOpenRequest when the scheme is https.
For certificate verification, wininet will at least verify that the server
certificate's CN matches the hostname and that the date range is valid (bypass
with
INTERNET_FLAG_IGNORE_CERT_CN_INVALID and
INTERNET_FLAG_IGNORE_CERT_DATE_INVALID).
I'm not sure if it validates the certificate's trustworthiness or if that's
something
else we'd need to do ourselves.
Original comment by [email protected]
on 18 Oct 2006 at 9:33
from google-breakpad.
I've verified that comment 6 contains all that we need to do. If we follow
those
guidelines and attempt to hit a server with SSL/TLS, and it doesn't have a
trusted
certificate, HttpSendRequest will fail and GetLastError() will return
ERROR_INTERNET_INVALID_CA.
Original comment by [email protected]
on 19 Oct 2006 at 8:00
from google-breakpad.
This allows HTTPUpload users to specify an https scheme in the URL. It also
fixes
the proxy thing (#46) and checks the HTTP status returned by the server (which
sort
of fixes part of #44). I've also made the file version optional, although a
warning
is printed when the version is missing, and the server's free to reject
versionless
uploads.
Original comment by [email protected]
on 19 Oct 2006 at 8:24
- Changed state: Accepted
Attachments:
from google-breakpad.
Checked in, revision [41] (for #41!)
Original comment by [email protected]
on 19 Oct 2006 at 9:49
- Changed state: Fixed
from google-breakpad.
Related Issues (20)
- Linux symbol dumper should discard the "age" field in the first line of symbol file HOT 2
- Wrong version of swprintf used with VS 7.1 CRT HOT 2
- dump_syms crashes in c++filt in some cases HOT 2
- Crash when processing file names less then 4 bytes HOT 2
- Build fails against the 10.3.9 sdk. HOT 3
- Minidump without context crashes the processor HOT 2
- mac dump_syms produces different module GUIDs for stripped Universal Binary vs. unstripped native binary HOT 4
- linux dump_syms should write to stdout HOT 3
- consider including MD5 code in breakpad source HOT 4
- OS X dump_syms produces bad sym file - line data after PUBLIC HOT 5
- OS X dump_syms could call __cxa_demangle directly instead of using c++filt HOT 4
- Allow crash report generation from other process on Mac HOT 2
- dynamic_images.h doesn't build on gcc 3 HOT 2
- Mac exception_handler calls exit() instead of _exit() HOT 2
- handle pure virtual function calls in VC++ HOT 5
- dynamic_images.cc doesn't build on 10.3.9 SDK HOT 1
- MACHINE_THREAD_STATE on older 10.4 versions. HOT 1
- Stacks truncated on win32 HOT 1
- dump_syms on Mac only has line numbers for __TEXT__text section HOT 2
- OSX: Process keeps running after the minidump is written, and triggers the mac crashreporter HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from google-breakpad.