/*
- * Copyright 2001-2005 Internet2
+ * Copyright 2001-2009 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
char* g_szSHIBConfig = NULL;
char* g_szSchemaDir = NULL;
ShibTargetConfig* g_Config = NULL;
- string g_unsetHeaderValue;
+ string g_unsetHeaderValue,g_spoofKey;
+ set<string> g_allowedSchemes;
bool g_checkSpoofing = true;
bool g_catchAll = true;
static const char* g_UserDataKey = "_shib_check_user_";
class ShibTargetApache : public ShibTarget
{
public:
- ShibTargetApache(request_rec* req, bool handler) : m_handler(handler) {
+ ShibTargetApache(request_rec* req, bool handler, bool shib_check_user) : m_handler(handler), m_firsttime(true) {
m_sc = (shib_server_config*)ap_get_module_config(req->server->module_config, &mod_shib);
m_dc = (shib_dir_config*)ap_get_module_config(req->per_dir_config, &mod_shib);
m_rc = (shib_request_config*)ap_get_module_config(req->request_config, &mod_shib);
+ m_req = req;
+
+ if (shib_check_user && m_dc->bUseHeaders != 0) {
+ // Try and see if this request was already processed, to skip spoof checking.
+ if (!ap_is_initial_req(m_req)) {
+ m_firsttime = false;
+ }
+ else if (!g_spoofKey.empty()) {
+ const char* hdr = ap_table_get(m_req->headers_in, "Shib-Spoof-Check");
+ if (hdr && g_spoofKey == hdr)
+ m_firsttime=false;
+ }
+
+ if (!m_firsttime)
+ log(LogLevelDebug, "shib_check_user running more than once");
+ }
init(
m_sc->szScheme ? m_sc->szScheme : ap_http_method(req),
req->connection->remote_ip,
req->method
);
-
- m_req = req;
}
~ShibTargetApache() { }
}
if (m_dc->bUseHeaders != 0) {
// ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,SH_AP_R(m_req), "shib_clear_header: hdr");
- if (g_checkSpoofing && ap_is_initial_req(m_req)) {
+ if (g_checkSpoofing && m_firsttime) {
if (m_allhttp.empty()) {
// First time, so populate set with "CGI" versions of client-supplied headers.
#ifdef SHIB_APACHE_13
const string& content_type="text/html",
const Iterator<header_t>& headers=EMPTY(header_t)
) {
+ checkString(content_type, "Detected control character in a response header.");
m_req->content_type = ap_psprintf(m_req->pool, content_type.c_str());
while (headers.hasNext()) {
const header_t& h=headers.next();
+ checkString(h.first, "Detected control character in a response header.");
+ checkString(h.second, "Detected control character in a response header.");
ap_table_set(m_req->headers_out, h.first.c_str(), h.second.c_str());
}
ap_send_http_header(m_req);
return (void*)((code==200) ? DONE : code);
}
virtual void* sendRedirect(const string& url) {
+ checkString(url, "Detected control character in an attempted redirect.");
+ if (g_allowedSchemes.find(url.substr(0, url.find(':'))) == g_allowedSchemes.end())
+ throw FatalProfileException("Invalid scheme in attempted redirect.");
ap_table_set(m_req->headers_out, "Location", url.c_str());
return (void*)REDIRECT;
}
virtual void* returnDecline(void) { return (void*)DECLINED; }
virtual void* returnOK(void) { return (void*)OK; }
- bool m_handler;
+ bool m_handler,m_firsttime;;
request_rec* m_req;
shib_dir_config* m_dc;
shib_server_config* m_sc;
shib_request_config* m_rc;
set<string> m_allhttp;
+
+private:
+ void checkString(const string& s, const char* msg) {
+ string::const_iterator e = s.end();
+ for (string::const_iterator i=s.begin(); i!=e; ++i) {
+ if (iscntrl(*i))
+ throw FatalProfileException(msg);
+ }
+ }
};
/********************************************************************************/
saml::NDC ndc(threadid.str().c_str());
try {
- ShibTargetApache sta(r, false);
+ ShibTargetApache sta(r, false, true);
// Check user authentication and export information, then set the handler bypass
pair<bool,void*> res = sta.doCheckAuthN(true);
apr_pool_userdata_setn((const void*)42,g_UserDataKey,NULL,r->pool);
+ // If directed, install a spoof key to recognize when we've already cleared headers.
+ if (!g_spoofKey.empty() && (((shib_dir_config*)ap_get_module_config(r->per_dir_config, &mod_shib))->bUseHeaders!=0))
+ ap_table_set(r->headers_in, "Shib-Spoof-Check", g_spoofKey.c_str());
if (res.first) return (int)(long)res.second;
// user auth was okay -- export the assertions now
ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,SH_AP_R(r),"shib_handler(%d): ENTER: %s", (int)getpid(), r->handler);
try {
- ShibTargetApache sta(r, true);
+ ShibTargetApache sta(r, true, false);
pair<bool,void*> res = sta.doHandler();
if (res.first) return (int)(long)res.second;
saml::NDC ndc(threadid.str().c_str());
try {
- ShibTargetApache sta(r, false);
+ ShibTargetApache sta(r, false, false);
pair<bool,void*> res = sta.doCheckAuthZ();
if (res.first) return (int)(long)res.second;
saml::Locker locker(conf);
const IPropertySet* props=conf->getPropertySet("Local");
if (props) {
- pair<bool,const char*> unsetValue=props->getString("unsetHeaderValue");
- if (unsetValue.first)
- g_unsetHeaderValue = unsetValue.second;
+ pair<bool,const char*> str=props->getString("unsetHeaderValue");
+ if (str.first)
+ g_unsetHeaderValue = str.second;
+ str=props->getString("allowedSchemes");
+ if (str.first) {
+ string schemes=str.second;
+ unsigned int j=0;
+ for (unsigned int i=0; i < schemes.length(); i++) {
+ if (schemes.at(i)==' ') {
+ g_allowedSchemes.insert(schemes.substr(j, i-j));
+ j = i+1;
+ }
+ }
+ g_allowedSchemes.insert(schemes.substr(j, schemes.length()-j));
+ }
pair<bool,bool> flag=props->getBool("checkSpoofing");
g_checkSpoofing = !flag.first || flag.second;
flag=props->getBool("catchAll");
g_catchAll = !flag.first || flag.second;
}
+ if (g_allowedSchemes.empty()) {
+ g_allowedSchemes.insert("https");
+ g_allowedSchemes.insert("http");
+ }
}
catch (exception&) {
ap_log_error(APLOG_MARK,APLOG_CRIT|APLOG_NOERRNO,SH_AP_R(s),"shib_child_init() failed to initialize system");
projects / shibboleth / cpp-sp.git / blobdiff