security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Activity
gnupg/dirmngr
History
Werner Koch 4a4bb874f6
dirmngr: Avoid possible CSRF attacks via http redirects. 
* dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path.
(http_redir_info_t): New.
* dirmngr/http.c (do_parse_uri): Set new fields.
(same_host_p): New.
(http_prepare_redirect): New.
* dirmngr/t-http-basic.c: New test.
* dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect
instead of the open code.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
--

With this change a http query will not follow a redirect unless the
Location header gives the same host.  If the host is different only
the host and port is taken from the Location header and the original
path and query parts are kept.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit fa1b1eaa42)
 		2018-11-23 09:23:26 +01:00
..
ChangeLog-2011 Fix spelling. 2017-02-21 13:11:46 -05:00
ChangeLog-2011-ks Remove the obsolete keyserver directory from the repo. 2015-04-20 18:20:45 +02:00
Makefile.am dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
OAUTHORS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
ONEWS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
cdb.h Tweaks for gpgconf. 2010-12-14 19:17:58 +00:00
cdblib.c g10, sm, dirmngr, common: Add comment for fall through. 2017-05-10 11:13:12 +09:00
certcache.c dirmngr: Implement CRL fetching via https. 2018-04-25 12:38:04 +02:00
certcache.h dirmngr: Use system certs if --hkp-cacert is not used. 2017-09-18 22:49:05 +02:00
crlcache.c dirmngr: Add FLUSHCRLs command 2018-11-12 12:42:03 +01:00
crlcache.h move some file encodings to UTF-8 2016-09-17 15:57:31 +09:00
crlfetch.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
crlfetch.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
dirmngr-client.c Fix usage of ARGPARSE_OPTS. 2017-07-19 13:41:18 +09:00
dirmngr-err.h Some work on porting dirmngr (unfinished) 2010-07-16 13:19:45 +00:00
dirmngr.c dirmngr: Only print info for no ldapserver file 2018-10-24 09:17:39 +02:00
dirmngr.h dirmngr: Add a background task framework. 2017-12-11 11:30:45 +01:00
dirmngr_ldap.c dirmngr: Implement timeout for dirmngr_ldap under Windows. 2018-05-02 18:40:01 +02:00
dns-stuff.c dirmngr: Fix recursive resolver mode. 2018-06-18 17:23:31 +09:00
dns-stuff.h Spelling fixes in docs and comments. 2017-04-28 10:06:33 +09:00
dns.c libdns: For SOCKS connection, just fails. 2018-07-02 10:47:38 +09:00
dns.h dirmngr: New libdns snapshot 2016-12-14 15:56:58 +01:00
domaininfo.c dirmngr: Check for WKD support at session end 2017-12-11 11:31:15 +01:00
http-common.c dirmngr: Fix commit de6d8313 2017-03-03 17:17:26 +01:00
http-common.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
http-ntbtls.c dirmngr: Implement CRL fetching via https. 2018-04-25 12:38:04 +02:00
http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
http.h dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-action.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
ks-action.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ks-engine-finger.c dirmngr: Implement HTTP connect timeouts of 15 or 2 seconds. 2017-06-08 09:37:36 +02:00
ks-engine-hkp.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-engine-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-engine-kdns.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ks-engine-ldap.c dirmngr: Fix out of scope use of a var in the keyserver LDAP code. 2018-10-25 17:37:53 +02:00
ks-engine.h dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
ldap-parse-uri.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-parse-uri.h Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-url.c dirmngr: Simplify strtok macro. 2014-03-07 19:00:31 +01:00
ldap-url.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
ldap-wrapper-ce.c dirmngr: Use the LDAP wrapper process also for Windows. 2018-04-27 12:05:31 +02:00
ldap-wrapper.c dirmngr: Sleep in the ldap wrapper thread. 2018-04-30 08:46:03 +02:00
ldap-wrapper.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ldap.c dirmngr: Silence log output from dirmngr_ldap. 2018-04-27 11:57:08 +02:00
ldapserver.c Improve spelling and grammar of some comments. 2015-03-23 19:58:30 +01:00
ldapserver.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
loadswdb.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
misc.c dirmngr: Fix LDAP port parsing. 2018-11-05 09:04:32 +01:00
misc.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
ocsp.c dirmngr: In verbose mode print the OCSP responder id. 2018-11-05 09:19:39 +01:00
ocsp.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
server.c dirmngr: Add FLUSHCRLs command 2018-11-12 12:42:03 +01:00
sks-keyservers.netCA.pem dirmngr: Add support for hkps keyservers. 2014-05-05 16:23:37 +02:00
t-dns-stuff.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
t-http-basic.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
t-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
t-ldap-parse-uri.c Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
t-support.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
tls-ca.pem Move http module from common/ to dirmngr/. 2015-10-18 20:08:26 +02:00
validate.c Spelling fixes in docs and comments. 2017-04-28 10:06:33 +09:00
validate.h dirmngr: Add special treatment for the standard hkps pool to ntbtls. 2017-02-21 14:55:04 +01:00
w32-ldap-help.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
workqueue.c dirmngr: Add a background task framework. 2017-12-11 11:30:45 +01:00