- ShibTargetNSAPI(pblock* pb, Session* sn, Request* rq) : m_gotBody(false) {
- m_pb = pb;
- m_sn = sn;
- m_rq = rq;
-
- // Get everything but hostname...
- const char* uri=pblock_findval("uri", rq->reqpb);
- const char* qstr=pblock_findval("query", rq->reqpb);
- int port=server_portnum;
- const char* scheme=security_active ? "https" : "http";
- const char* host=NULL;
-
- string url;
- if (uri)
- url=uri;
- if (qstr)
- url=url + '?' + qstr;
-
+ pblock* m_pb;
+ ::Session* m_sn;
+ Request* m_rq;
+
+ ShibTargetNSAPI(pblock* pb, ::Session* sn, Request* rq)
+ : AbstractSPRequest(SHIBSP_LOGCAT ".NSAPI"),
+ m_gotBody(false), m_firsttime(true), m_security_active(false), m_server_portnum(0), m_pb(pb), m_sn(sn), m_rq(rq) {
+
+ // To determine whether SSL is active or not, we're supposed to rely
+ // on the security_active macro. For iPlanet 4.x, this works.
+ // For Sun 7.x, it's useless and appears to be on or off based
+ // on whether ANY SSL support is enabled for a vhost. Sun 6.x is unknown.
+ // As a fix, there's a conf variable called $security that can be mapped
+ // into a function parameter: security_active="$security"
+ // We check for this parameter, and rely on the macro if it isn't set.
+ // This doubles as a scheme virtualizer for load balanced scenarios
+ // since you can set the parameter to 1 or 0 as needed.
+ const char* sa = pblock_findval("security_active", m_pb);
+ if (sa)
+ m_security_active = (*sa == '1');
+ else if (security_active)
+ m_security_active = true;
+ else
+ m_security_active = false;
+
+ // A similar issue exists for the port. server_portnum is no longer
+ // working on at least Sun 7.x, and returns the first listener's port
+ // rather than whatever port is actually used for the request. Nice job, Sun.
+ sa = pblock_findval("server_portnum", m_pb);
+ m_server_portnum = (sa && *sa) ? atoi(sa) : server_portnum;
+
+ const char* uri = pblock_findval("uri", rq->reqpb);
+ const char* qstr = pblock_findval("query", rq->reqpb);
+
+ if (qstr) {
+ string temp = string(uri) + '?' + qstr;
+ setRequestURI(temp.c_str());
+ }
+ else {
+ setRequestURI(uri);
+ }
+
+ // See if this is the first time we've run.
+ if (!g_spoofKey.empty()) {
+ qstr = pblock_findval("Shib-Spoof-Check", rq->headers);
+ if (qstr && g_spoofKey == qstr)
+ m_firsttime = false;
+ }
+ if (!m_firsttime || rq->orig_rq)
+ log(SPDebug, "nsapi_shib function running more than once");
+ }
+ ~ShibTargetNSAPI() { }
+
+ const char* getScheme() const {
+ return m_security_active ? "https" : "http";
+ }
+ const char* getHostname() const {