Re: [Flightgear-devel] METAR http to https

[Florent R. <f.r...@fr...>]

Hi Torsten,

Torsten Dreyer <to...@t3...> wrote:

> Fun fact: this /shouldl/ beworking since commit 69b127e2e from 2016-08-04
> when Alessandro Menti added the "follow redirect" option to our HTTPClient.
> GET http://tgftp.nws.noaa.gov/data/observations/metar/stations/ returns
> "302 Object moved" and the curl commandline follows nicely:
> curl -Lv http://tgftp.nws.noaa.gov/data/observations/metar/stations/

This might be due to the tester not having the appropriate certificates
in his trust store (the one use by the libcurl linked into FG). At
least, that's exactly what happens with FFGo, modulo the fact that FFGo
uses Python's urllib instead of libcurl:

 - First, I noticed: “Oh crap, METAR fetching doesn't work anymore.”
 - Then I changed the URL in ffgo/gui/metar.py to use https, and
   concluded: “Oh crap, it still doesn't work.”
 - Then I investigated to discover where urllib from Debian's Python 3
   interpreter gets its certificates from, and the answer is “from the
   system store” (/etc/ssl/certs/).
 - Using Ctrl-I in Firefox showed that the cert sent by
   tgftp.nws.noaa.gov was signed by “Go Daddy” certs (two of them are
   needed to reach a root certificate).
 - I subsequently declared these two as trusted with
   'dpkg-reconfigure ca-certificates' (run as root):

     mozilla/Go_Daddy_Class_2_CA.crt
     mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt

 - At this point, METAR fetching worked fine again in FFGo.
 - Then, I changed the URL in ffgo/gui/metar.py back to http to see the
   error message again and, surprise! METAR fetching was still working.
   But trying the HTTP URL in Firefox revealed that it was working *due
   to automatic redirection* (http -> https). Which suggests that
   Python's urllib module obeys such redirections by default.

Morality: if people have problems fetching METAR (be it with FG or with
FFGo), the first thing to check IMHO would be: do they have the
aforementioned two certificates in their trust store (the one use by the
libcurl linked into FG)?

Regards

-- 
Florent