Refuse to redirect to a non-https URL

Not good:
$ ./openconnect www.cam.ac.uk
Attempting to connect to 131.111.8.46:443
SSL negotiation with www.cam.ac.uk
Connected to HTTPS on www.cam.ac.uk
GET https://www.cam.ac.uk/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/

OK, I asked it to do a stupid thing, but a polite refusal is much better.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/http.c b/http.c
index b603201..2ae4b01 100644 (file)
--- a/http.c
+++ b/http.c
@@ -716,6 +716,7 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
                                             _("Failed to parse redirected URL '%s': %s\n"),
                                             vpninfo->redirect_url, strerror(-ret));
                                free(vpninfo->redirect_url);
+                               vpninfo->redirect_url = NULL;
                                free(form_buf);
                                return ret;
                        }
@@ -750,6 +751,14 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
                        vpninfo->redirect_url = NULL;
 
                        goto retry;
+               } else if (strstr(vpninfo->redirect_url, "://")) {
+                       vpn_progress(vpninfo, PRG_ERR,
+                                    _("Cannot follow redirection to non-https URL '%s'\n"),
+                                    vpninfo->redirect_url);
+                       free(vpninfo->redirect_url);
+                       vpninfo->redirect_url = NULL;
+                       free(form_buf);
+                       return -EINVAL;
                } else if (vpninfo->redirect_url[0] == '/') {
                        /* Absolute redirect within same host */
                        free(vpninfo->urlpath);