security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

dirmngr: Do not follow https-to-http redirects. 

* dirmngr/ks-engine-http.c (ks_http_fetch): Forbid redirects from
a https URI to a http URI.
--

GnuPG-bug-id: 3436
Signed-off-by: Damien Goutte-Gattat <dgouttegattat@incenp.org>
This commit is contained in:
Damien Goutte-Gattat 2017-10-08 17:30:52 +01:00 committed by Werner Koch
parent d07de38627
commit 1ba308aa03
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
dirmngr/ks-engine-http.c
View File

@ -73,12 +73,13 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
estream_t fp = NULL; estream_t fp = NULL;
char *request_buffer = NULL; char *request_buffer = NULL;
parsed_uri_t uri = NULL; parsed_uri_t uri = NULL;
int is_onion; int is_onion, is_https;
err = http_parse_uri (&uri, url, 0); err = http_parse_uri (&uri, url, 0);
if (err) if (err)
goto leave; goto leave;
is_onion = uri->onion; is_onion = uri->onion;
is_https = uri->use_tls;
once_more: once_more:
/* Note that we only use the system provided certificates with the /* Note that we only use the system provided certificates with the
@ -152,17 +153,18 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
url, s?s:"[none]", http_get_status_code (http)); url, s?s:"[none]", http_get_status_code (http));
if (s && *s && redirects_left-- ) if (s && *s && redirects_left-- )
{ {
if (is_onion) if (is_onion || is_https)
{ {
/* Make sure that an onion address only redirects to /* Make sure that an onion address only redirects to
* another onion address. */ * another onion address, or that a https address
* only redirects to a https address. */
http_release_parsed_uri (uri); http_release_parsed_uri (uri);
uri = NULL; uri = NULL;
err = http_parse_uri (&uri, s, 0); err = http_parse_uri (&uri, s, 0);
if (err) if (err)
goto leave; goto leave;
if (! uri->onion) if ((is_onion && ! uri->onion) || (is_https && ! uri->use_tls))
{ {
err = gpg_error (GPG_ERR_FORBIDDEN); err = gpg_error (GPG_ERR_FORBIDDEN);
goto leave; goto leave;