[git] GnuPG - branch, STABLE-BRANCH-2-2, updated. gnupg-2.2.1-11-g1ba308a

[by Damien Goutte-Gattat]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  1ba308aa0356a57c21c4c8c2dac75b4d62b8aac3 (commit)
      from  d07de3862710d88bc80d6f6c5ca8da5cf38ff0eb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1ba308aa0356a57c21c4c8c2dac75b4d62b8aac3
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Sun Oct 8 17:30:52 2017 +0100

    dirmngr: Do not follow https-to-http redirects.
    
    * dirmngr/ks-engine-http.c (ks_http_fetch): Forbid redirects from
    a https URI to a http URI.
    --
    
    GnuPG-bug-id: 3436
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/dirmngr/ks-engine-http.c b/dirmngr/ks-engine-http.c
index 7fb7731..6492dda 100644
--- a/dirmngr/ks-engine-http.c
+++ b/dirmngr/ks-engine-http.c
@@ -73,12 +73,13 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
   estream_t fp = NULL;
   char *request_buffer = NULL;
   parsed_uri_t uri = NULL;
-  int is_onion;
+  int is_onion, is_https;
 
   err = http_parse_uri (&uri, url, 0);
   if (err)
     goto leave;
   is_onion = uri->onion;
+  is_https = uri->use_tls;
 
  once_more:
   /* Note that we only use the system provided certificates with the
@@ -152,17 +153,18 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
                   url, s?s:"[none]", http_get_status_code (http));
         if (s && *s && redirects_left-- )
           {
-            if (is_onion)
+            if (is_onion || is_https)
               {
                 /* Make sure that an onion address only redirects to
-                 * another onion address.  */
+                 * another onion address, or that a https address
+                 * only redirects to a https address. */
                 http_release_parsed_uri (uri);
                 uri = NULL;
                 err = http_parse_uri (&uri, s, 0);
                 if (err)
                   goto leave;
 
-                if (! uri->onion)
+                if ((is_onion && ! uri->onion) || (is_https && ! uri->use_tls))
                   {
                     err = gpg_error (GPG_ERR_FORBIDDEN);
                     goto leave;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/ks-engine-http.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org