Compare commits

...

10 Commits

Author SHA1 Message Date
openeuler-ci-bot
7c02d8c68d
!41 [sync] PR-40: Remove Unuse files due to upgrading to 1.6.4
From: @openeuler-sync-bot 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001
2024-03-14 08:06:05 +00:00
cherry530
13781035af Remove unuse file
Signed-off-by: cherry530 <707078654@qq.com>
(cherry picked from commit 525c6ead220428b87f41f84df584698a52ee75f1)
2024-03-13 14:12:25 +08:00
openeuler-ci-bot
827aa993ef
!37 修复meson升级导致的编译失败
From: @lyn1001 
Reviewed-by: @caodongxia 
Signed-off-by: @caodongxia
2024-02-21 01:48:55 +00:00
lyn1001
bae3c92665 fix build error 2024-02-18 16:40:12 +08:00
openeuler-ci-bot
f41c201d6f
!16 Upgrade version to 1.6.4
From: @cherry530 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001
2023-08-07 09:14:10 +00:00
cherry530
44fe2cd48c Upgrade version to 1.6.4
Signed-off-by: cherry530 <707078654@qq.com>
2023-08-07 16:18:01 +08:00
openeuler-ci-bot
f07b2f1a37
!14 Fix python script shebang
From: @xing_xing1992 
Reviewed-by: @Charlie_li 
Signed-off-by: @Charlie_li
2023-01-20 09:58:16 +00:00
xing_xing1992
5083de63b8 Fix python script shebang 2023-01-19 14:45:08 +08:00
openeuler-ci-bot
139a1c2f7c
!10 Update to 1.4.3
From: @zhang__3125 
Reviewed-by: @licihua 
Signed-off-by: @licihua
2022-06-02 12:31:49 +00:00
zhang__3125
e54d0b5711 Update to 1.4.3 2022-04-13 19:13:55 +08:00
5 changed files with 52 additions and 139 deletions

View File

@ -0,0 +1,11 @@
diff -Nur a/subprojects/gssdp-1.6.wrap b/subprojects/gssdp-1.6.wrap
--- a/subprojects/gssdp-1.6.wrap 2023-07-01 23:39:34.000000000 +0800
+++ b/subprojects/gssdp-1.6.wrap 2024-02-18 16:27:23.490690860 +0800
@@ -3,6 +3,6 @@
revision = master
depth = 1
-[provides]
+[provide]
dependency_name = gssdp-1.6

View File

@ -1,118 +0,0 @@
From 697ab5b579debf4b9e0f39143b352877e8af3aad Mon Sep 17 00:00:00 2001
From: Jens Georg <mail@jensge.org>
Date: Mon, 10 May 2021 10:34:36 +0200
Subject: [PATCH] service: Validate host header
Make sure that the host header matches the ip:port of the context.
This is in line with UDA (Host header is required and must match the
location url) and DLNA 7.2.24.1 (All communication has to use ip
addresses and not names)
Prevents DNS rebinding attacs against agains UPnP services
---
libgupnp/gupnp-context-private.h | 3 ++
libgupnp/gupnp-context.c | 51 ++++++++++++++++++++++++++++++++
libgupnp/gupnp-service.c | 13 ++++++++
3 files changed, 67 insertions(+)
diff --git a/libgupnp/gupnp-context-private.h b/libgupnp/gupnp-context-private.h
index 6aa1acd..2657c71 100644
--- a/libgupnp/gupnp-context-private.h
+++ b/libgupnp/gupnp-context-private.h
@@ -36,6 +36,9 @@ _gupnp_context_add_server_handler_with_data (GUPnPContext *context,
const char *path,
AclServerHandler *data);
+G_GNUC_INTERNAL gboolean
+gupnp_context_validate_host_header (GUPnPContext *context, const char *host);
+
G_GNUC_INTERNAL SoupURI *
gupnp_context_rewrite_uri_to_uri (GUPnPContext *context,
const char *uri);
diff --git a/libgupnp/gupnp-context.c b/libgupnp/gupnp-context.c
index 460179e..1901798 100644
--- a/libgupnp/gupnp-context.c
+++ b/libgupnp/gupnp-context.c
@@ -1609,6 +1609,57 @@ gupnp_context_remove_server_handler (GUPnPContext *context, const char *path)
soup_server_remove_handler (priv->server, path);
}
+gboolean
+gupnp_context_validate_host_header (GUPnPContext *context,
+ const char *host_header)
+{
+ gboolean retval = FALSE;
+ // Be lazy and let GUri do the heavy lifting here, such as stripping the
+ // [] from v6 addresses, splitting of the port etc.
+ char *uri_from_host = g_strconcat ("http://", host_header, NULL);
+
+ char *host = NULL;
+ int port = 0;
+ GError *error = NULL;
+
+ g_uri_split_network (uri_from_host,
+ G_URI_FLAGS_NONE,
+ NULL,
+ &host,
+ &port,
+ &error);
+
+ if (error != NULL) {
+ g_debug ("Failed to parse HOST header from request: %s",
+ error->message);
+ goto out;
+ }
+
+ const char *host_ip = gssdp_client_get_host_ip (GSSDP_CLIENT (context));
+ gint context_port = gupnp_context_get_port (context);
+
+ if (!g_str_equal (host, host_ip)) {
+ g_debug ("Mismatch between host header and host IP (%s, "
+ "expected: %s)",
+ host,
+ host_ip);
+ }
+
+ if (port != context_port) {
+ g_debug ("Mismatch between host header and host port (%d, "
+ "expected %d)",
+ port,
+ context_port);
+ }
+
+ retval = g_str_equal (host, host_ip) && port == context_port;
+
+out:
+ g_clear_error (&error);
+ g_free (uri_from_host);
+ return retval;
+}
+
/**
* gupnp_context_rewrite_uri:
* @context: a #GUPnPContext
diff --git a/libgupnp/gupnp-service.c b/libgupnp/gupnp-service.c
index b061c34..ad9d40d 100644
--- a/libgupnp/gupnp-service.c
+++ b/libgupnp/gupnp-service.c
@@ -954,6 +954,19 @@ control_server_handler (SoupServer *server,
context = gupnp_service_info_get_context (GUPNP_SERVICE_INFO (service));
+ const char *host_header =
+ soup_message_headers_get_one (msg->request_headers, "Host");
+
+ if (!gupnp_context_validate_host_header (context, host_header)) {
+ g_warning ("Host header mismatch, expected %s:%d, got %s",
+ gssdp_client_get_host_ip (GSSDP_CLIENT (context)),
+ gupnp_context_get_port (context),
+ host_header);
+
+ soup_message_set_status (msg, SOUP_STATUS_PRECONDITION_FAILED);
+ return;
+ }
+
/* Get action name */
soap_action = soup_message_headers_get_one (msg->request_headers,
"SOAPAction");

Binary file not shown.

BIN
gupnp-1.6.4.tar.xz Normal file

Binary file not shown.

View File

@ -1,15 +1,19 @@
%global apiver 1.6
%global gssdp_version 1.6.3
Name: gupnp
Version: 1.2.4
Release: 2
Version: 1.6.4
Release: 3
Summary: UPnP devices & control points creation framework
License: LGPLv2+
URL: http://www.gupnp.org/
Source0: http://download.gnome.org/sources/%{name}/1.2/%{name}-%{version}.tar.xz
Patch0: CVE-2021-33516.patch
URL: https://www.gupnp.org/
Source0: https://download.gnome.org/sources/%{name}/1.6/%{name}-%{version}.tar.xz
Patch0001: 0001-build-properly-spell-provide-in-.wrap-files.patch
BuildRequires: gssdp-devel >= 1.2.3 gtk-doc gobject-introspection-devel >= 1.36 glib2-devel >= 2.66
BuildRequires: libsoup-devel libxml2-devel libuuid-devel vala meson
BuildRequires: gssdp-devel >= %{gssdp_version} gtk-doc gobject-introspection-devel docbook-style-xsl
BuildRequires: libsoup-devel libxml2-devel libuuid-devel vala meson cmake gi-docgen
Requires: dbus
Requires: gssdp%{?_isa} >= %{gssdp_version}
%description
GUPnP is an elegant, object-oriented open source framework for creating UPnP
@ -40,7 +44,9 @@ This package contains help file and developer documentation for gupnp.
%build
%meson \
-Dcontext_manager=network-manager \
-Dgtk_doc=true
-Dgtk_doc=true \
-Dexamples=false \
%{nil}
%meson_build
%install
@ -55,25 +61,39 @@ This package contains help file and developer documentation for gupnp.
%postun -p /sbin/ldconfig
%files
%license COPYING
%doc AUTHORS
%{_libdir}/libgupnp-1.2.so.*
%{_libdir}/girepository-1.0/GUPnP-1.2.typelib
%license COPYING
%{_libdir}/libgupnp-%{apiver}.so.0*
%{_libdir}/girepository-1.0/GUPnP-%{apiver}.typelib
%files devel
%{_bindir}/gupnp-binding-tool-1.2
%{_libdir}/pkgconfig/gupnp-1.2.pc
%{_libdir}/libgupnp-1.2.so
%{_includedir}/gupnp-1.2
%{_datadir}/gir-1.0/GUPnP-1.2.gir
%files devel
%{_bindir}/gupnp-binding-tool-%{apiver}
%{_includedir}/gupnp-%{apiver}/
%{_libdir}/libgupnp-%{apiver}.so
%{_libdir}/pkgconfig/gupnp-%{apiver}.pc
%{_datadir}/gir-1.0/GUPnP-%{apiver}.gir
%{_datadir}/vala/vapi/gupnp*
%files help
%doc README
%doc %{_datadir}/gtk-doc/html/gupnp
%files help
%doc AUTHORS README.md
%{_mandir}/man1/gupnp-binding-tool-*
%{_docdir}/gupnp-%{apiver}/
%changelog
* Thu Mar 07 2024 xu_ping <707078654@qq.com> - 1.6.4-3
- Remove Unuse files due to upgrading to 1.6.4
* Sun Feb 18 2024 liyanan <liyanan61@h-partners.com> - 1.6.4-2
- Fix build error
* Mon Aug 07 2023 xu_ping <707078654@qq.com> - 1.6.4-1
- Upgrade version to 1.6.4
* Thu Jan 18 2023 xingxing <xingxing@xfusion.com> - 1.4.3-2
- Fix python script shebang
* Mon Mar 28 2022 lin zhang <lin.zhang@turbolinux.com.cn> - 1.4.3-1
- Update to 1.4.3
* Wed Jul 14 2021 Wenlong Ding <wenlong.ding@turbolinux.com.cn> - 1.2.4-2
- Add missing BuildRequires version: glib2-devel >= 2.66