Allow Windows sender to use HTTPS about google-breakpad

[GoogleCodeExporter]

We should figure out what we want to do about certificates here.

Original comment by [email protected] on 3 Oct 2006 at 6:52

[GoogleCodeExporter]

This patch is better ;-)

What do you mean about certificates? I admit I don't know much about the Windows
networking layer; are we worried that it would submit data even if the 
certificate
were invalid?

Original comment by [email protected] on 3 Oct 2006 at 7:38

Attachments:

• airbag-https.patch

[GoogleCodeExporter]

Yes, exactly: certificate validation.

Original comment by [email protected] on 3 Oct 2006 at 8:46

[GoogleCodeExporter]

Original comment by [email protected] on 16 Oct 2006 at 10:20

• Added labels: Milestone-Release1.0

[GoogleCodeExporter]

Original comment by [email protected] on 18 Oct 2006 at 1:44

• Added labels: Component-Client-Sender, OpSys-Windows

[GoogleCodeExporter]

All we need to do is pass INTERNET_FLAG_SECURE in the flags argument of
HttpOpenRequest when the scheme is https.

For certificate verification, wininet will at least verify that the server
certificate's CN matches the hostname and that the date range is valid (bypass 
with
INTERNET_FLAG_IGNORE_CERT_CN_INVALID and 
INTERNET_FLAG_IGNORE_CERT_DATE_INVALID). 
I'm not sure if it validates the certificate's trustworthiness or if that's 
something
else we'd need to do ourselves.

Original comment by [email protected] on 18 Oct 2006 at 9:33

[GoogleCodeExporter]

I've verified that comment 6 contains all that we need to do.  If we follow 
those
guidelines and attempt to hit a server with SSL/TLS, and it doesn't have a 
trusted
certificate, HttpSendRequest will fail and GetLastError() will return
ERROR_INTERNET_INVALID_CA.

Original comment by [email protected] on 19 Oct 2006 at 8:00

[GoogleCodeExporter]

This allows HTTPUpload users to specify an https scheme in the URL.  It also 
fixes
the proxy thing (#46) and checks the HTTP status returned by the server (which 
sort
of fixes part of #44).  I've also made the file version optional, although a 
warning
is printed when the version is missing, and the server's free to reject 
versionless
uploads.

Original comment by [email protected] on 19 Oct 2006 at 8:24

• Changed state: Accepted

Attachments:

• airbag.41.1.patch

[GoogleCodeExporter]

Checked in, revision [41] (for #41!)

Original comment by [email protected] on 19 Oct 2006 at 9:49

• Changed state: Fixed