From e119f50f148de5f617c284ab60c1c05fa0d4a93f Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Mon, 6 Aug 2012 15:00:51 -0700
Subject: [PATCH 1/2] Explain the tree a bit; note some debian dependencies

---
 README | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/README b/README
index 05edd4989..b3b35b17e 100644
--- a/README
+++ b/README
@@ -1,2 +1,22 @@
 The Chocolate project to implement sweet automatic encryption for webservers.
 
+There are two portions to the Chocoate protocol.
+
+client-webserver/ contains code that can be run on any webserver (eventually,
+email, XMPP and other SSL-securable servers too); it is used to automatically
+request and install a CA-signed certificate for that server's public names.
+
+server-ca/ contains a reference implementation for CAs to receive requests for
+certs, set challenges for the requesting servers to prove that they really
+control the names, and issue certificates.
+
+Debian dependencies:
+
+build deps:
+swig
+protobuf-compiler
+python-dev
+
+others:
+gnutls-bin # for make cert requests
+python-protobuf

From 84eb5058c66e4c62d3a2b0411914d7682d36158e Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Mon, 6 Aug 2012 15:27:05 -0700
Subject: [PATCH 2/2] Disable raw IPv6 addresses by default

(they're scarier than I thought, and a bit dangerous in Web and maybe Windows
shell contexts)
---
 client-webserver/client.py | 22 +++++++++++++++++++---
 m3crypto                   |  2 +-
 server-ca/chocolate.py     |  2 ++
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/client-webserver/client.py b/client-webserver/client.py
index fb3dac2a9..e508e2763 100755
--- a/client-webserver/client.py
+++ b/client-webserver/client.py
@@ -17,15 +17,31 @@ if len(sys.argv) > 1:
 else:
     server = os.environ["CHOCOLATESERVER"]
 
+# it's weird to point to chocolate servers via raw IPv6 addresses, and such
+# addresses can be %SCARY in some contexts, so out of paranoia let's disable
+# them by default
+allow_raw_ipv6_server = False
+
 def is_hostname_sane(hostname):
     """
-    Do just enough to ensure to avoid shellcode from the environment.  There's
+    Do enough to avoid shellcode from the environment.  There's
     no need to do more.
     """
     import string as s
     allowed = s.ascii_letters + s.digits + "-."  # hostnames & IPv4
-    allowed += "[]:"                             # IPv6
-    return all([c in allowed for c in hostname])
+    if all([c in allowed for c in hostname])
+      return True
+    
+    if not allow_raw_ipv6_server: return False
+
+    # ipv6 is messy and complicated, can contain %zoneindex etc.  
+    import socket
+    try:
+      # is this a valid IPv6 address?
+      socket.getaddrinfo(hostname,443,socket.AF_INET6)
+      return True
+    except:
+      return False
 
 assert is_hostname_sane(server), `server` + " is an impossible hostname"
 
diff --git a/m3crypto b/m3crypto
index d4e8a6c42..c63d9b1b3 160000
--- a/m3crypto
+++ b/m3crypto
@@ -1 +1 @@
-Subproject commit d4e8a6c42a63219113099b8611197622c0d24294
+Subproject commit c63d9b1b36d537338719c96a6757aed4bf1283c3
diff --git a/server-ca/chocolate.py b/server-ca/chocolate.py
index 913493fc4..090165065 100755
--- a/server-ca/chocolate.py
+++ b/server-ca/chocolate.py
@@ -378,3 +378,5 @@ class session(object):
 if __name__ == "__main__":
     app = web.application(urls, globals())
     app.run()
+
+# vim: set tabstop=4 shiftwidth=4 expandtab