From 9f524c4a040db97382cf3523bf53a422cf1eaa8e Mon Sep 17 00:00:00 2001 From: David Shaw Date: Tue, 14 Mar 2006 03:16:21 +0000 Subject: [PATCH] * keyserver-internal.h, keyserver.c (keyserver_import_pka): Use the same API as the other auto-key-locate fetchers. * getkey.c (get_pubkey_byname): Use the fingerprint of the key that we actually fetched. This helps prevent problems where the key that we fetched doesn't have the same name that we used to fetch it. In the case of CERT and PKA, this is an actual security requirement as the URL might point to a key put in by an attacker. By forcing the use of the fingerprint, we won't use the attacker's key here. --- g10/ChangeLog | 11 +++++++ g10/getkey.c | 67 ++++++++++++++++++++++++---------------- g10/keyserver-internal.h | 2 +- g10/keyserver.c | 12 +++++-- 4 files changed, 61 insertions(+), 31 deletions(-) diff --git a/g10/ChangeLog b/g10/ChangeLog index 2f7bee308..d3df2552b 100644 --- a/g10/ChangeLog +++ b/g10/ChangeLog @@ -1,5 +1,16 @@ 2006-03-13 David Shaw + * keyserver-internal.h, keyserver.c (keyserver_import_pka): Use + the same API as the other auto-key-locate fetchers. + + * getkey.c (get_pubkey_byname): Use the fingerprint of the key + that we actually fetched. This helps prevent problems where the + key that we fetched doesn't have the same name that we used to + fetch it. In the case of CERT and PKA, this is an actual security + requirement as the URL might point to a key put in by an attacker. + By forcing the use of the fingerprint, we won't use the attacker's + key here. + * keyserver-internal.h, keyserver.c (keyserver_spawn, keyserver_work, keyserver_import_cert, keyserver_import_name, keyserver_import_ldap): Pass fingerprint info through. diff --git a/g10/getkey.c b/g10/getkey.c index 1805eb041..8594ad9e6 100644 --- a/g10/getkey.c +++ b/g10/getkey.c @@ -922,11 +922,14 @@ get_pubkey_byname (PKT_public_key *pk, for(akl=opt.auto_key_locate;akl;akl=akl->next) { + unsigned char *fpr; + size_t fpr_len; + switch(akl->type) { case AKL_CERT: glo_ctrl.in_auto_key_retrieve++; - res=keyserver_import_cert(name,NULL,NULL); + res=keyserver_import_cert(name,&fpr,&fpr_len); glo_ctrl.in_auto_key_retrieve--; if(res==0) @@ -935,35 +938,17 @@ get_pubkey_byname (PKT_public_key *pk, break; case AKL_PKA: - { - unsigned char fpr[MAX_FINGERPRINT_LEN]; + glo_ctrl.in_auto_key_retrieve++; + res=keyserver_import_pka(name,&fpr,&fpr_len); - glo_ctrl.in_auto_key_retrieve++; - res=keyserver_import_pka(name,fpr); - glo_ctrl.in_auto_key_retrieve--; - - if(res==0) - { - int i; - char fpr_string[MAX_FINGERPRINT_LEN*2+1]; - - log_info(_("Automatically retrieved `%s' via %s\n"), - name,"PKA"); - - free_strlist(namelist); - namelist=NULL; - - for(i=0;ispec); glo_ctrl.in_auto_key_retrieve++; - res=keyserver_import_name(name,NULL,NULL,keyserver); + res=keyserver_import_name(name,&fpr,&fpr_len,keyserver); glo_ctrl.in_auto_key_retrieve--; if(res==0) @@ -1004,6 +989,34 @@ get_pubkey_byname (PKT_public_key *pk, break; } + /* Use the fingerprint of the key that we actually fetched. + This helps prevent problems where the key that we fetched + doesn't have the same name that we used to fetch it. In + the case of CERT and PKA, this is an actual security + requirement as the URL might point to a key put in by an + attacker. By forcing the use of the fingerprint, we + won't use the attacker's key here. */ + if(res==0 && fpr) + { + int i; + char fpr_string[MAX_FINGERPRINT_LEN*2+1]; + + assert(fpr_len<=MAX_FINGERPRINT_LEN); + + free_strlist(namelist); + namelist=NULL; + + for(i=0;i