X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=isapi_shib%2Fisapi_shib.cpp;h=4dac1a79528f42e98894c7bc9fc7e6550969fcfc;hb=HEAD;hp=08351d12c2d2de734be2b59a693941560bf71088;hpb=bb3cdcc2421fb536bf042567d9675eeede290bb9;p=shibboleth%2Fsp.git diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp index 08351d1..4dac1a7 100644 --- a/isapi_shib/isapi_shib.cpp +++ b/isapi_shib/isapi_shib.cpp @@ -1,88 +1,107 @@ /* - * The Shibboleth License, Version 1. - * Copyright (c) 2002 - * University Corporation for Advanced Internet Development, Inc. - * All rights reserved + * Copyright 2001-2007 Internet2 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * + * http://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * - * Redistributions of source code must retain the above copyright notice, this - * list of conditions and the following disclaimer. - * - * Redistributions in binary form must reproduce the above copyright notice, - * this list of conditions and the following disclaimer in the documentation - * and/or other materials provided with the distribution, if any, must include - * the following acknowledgment: "This product includes software developed by - * the University Corporation for Advanced Internet Development - * Internet2 Project. Alternately, this acknowledegement - * may appear in the software itself, if and wherever such third-party - * acknowledgments normally appear. - * - * Neither the name of Shibboleth nor the names of its contributors, nor - * Internet2, nor the University Corporation for Advanced Internet Development, - * Inc., nor UCAID may be used to endorse or promote products derived from this - * software without specific prior written permission. For written permission, - * please contact shibboleth@shibboleth.org - * - * Products derived from this software may not be called Shibboleth, Internet2, - * UCAID, or the University Corporation for Advanced Internet Development, nor - * may Shibboleth appear in their name, without prior written permission of the - * University Corporation for Advanced Internet Development. - * - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A - * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK - * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. - * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY - * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ -/* isapi_shib.cpp - Shibboleth ISAPI filter - - Scott Cantor - 8/23/02 -*/ +/** + * isapi_shib.cpp + * + * Shibboleth ISAPI filter + */ +#define SHIBSP_LITE #include "config_win32.h" -// SAML Runtime -#include -#include -#include -#include - -#include - -#include -#include +#define _CRT_NONSTDC_NO_DEPRECATE 1 +#define _CRT_SECURE_NO_DEPRECATE 1 + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include #include -#include +#include +#include +#include #include #include +using namespace shibsp; +using namespace xmltooling; +using namespace xercesc; using namespace std; -using namespace log4cpp; -using namespace saml; -using namespace shibboleth; -using namespace shibtarget; // globals namespace { + static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h); + static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e); + static const XMLCh name[] = UNICODE_LITERAL_4(n,a,m,e); + static const XMLCh port[] = UNICODE_LITERAL_4(p,o,r,t); + static const XMLCh sslport[] = UNICODE_LITERAL_7(s,s,l,p,o,r,t); + static const XMLCh scheme[] = UNICODE_LITERAL_6(s,c,h,e,m,e); + static const XMLCh id[] = UNICODE_LITERAL_2(i,d); + static const XMLCh ISAPI[] = UNICODE_LITERAL_5(I,S,A,P,I); + static const XMLCh Alias[] = UNICODE_LITERAL_5(A,l,i,a,s); + static const XMLCh normalizeRequest[] = UNICODE_LITERAL_16(n,o,r,m,a,l,i,z,e,R,e,q,u,e,s,t); + static const XMLCh Site[] = UNICODE_LITERAL_4(S,i,t,e); + + struct site_t { + site_t(const DOMElement* e) + { + auto_ptr_char n(e->getAttributeNS(NULL,name)); + auto_ptr_char s(e->getAttributeNS(NULL,scheme)); + auto_ptr_char p(e->getAttributeNS(NULL,port)); + auto_ptr_char p2(e->getAttributeNS(NULL,sslport)); + if (n.get()) m_name=n.get(); + if (s.get()) m_scheme=s.get(); + if (p.get()) m_port=p.get(); + if (p2.get()) m_sslport=p2.get(); + e = XMLHelper::getFirstChildElement(e, Alias); + while (e) { + if (e->hasChildNodes()) { + auto_ptr_char alias(e->getFirstChild()->getNodeValue()); + m_aliases.insert(alias.get()); + } + e = XMLHelper::getNextSiblingElement(e, Alias); + } + } + string m_scheme,m_port,m_sslport,m_name; + set m_aliases; + }; + + struct context_t { + char* m_user; + bool m_checked; + }; + HINSTANCE g_hinstDLL; - ShibTargetConfig* g_Config = NULL; - map g_Sites; + SPConfig* g_Config = NULL; + map g_Sites; bool g_bNormalizeRequest = true; + string g_unsetHeaderValue; + bool g_checkSpoofing = true; + bool g_catchAll = false; + vector g_NoCerts; } BOOL LogEvent( @@ -111,8 +130,7 @@ extern "C" BOOL WINAPI GetExtensionVersion(HSE_VERSION_INFO* pVer) if (!pVer) return FALSE; - if (!g_Config) - { + if (!g_Config) { LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension mode startup not possible, is the DLL loaded as a filter?"); return FALSE; @@ -128,73 +146,82 @@ extern "C" BOOL WINAPI TerminateExtension(DWORD) return TRUE; // cleanup should happen when filter unloads } -static const XMLCh host[] = { chLatin_h, chLatin_o, chLatin_s, chLatin_t, chNull }; -static const XMLCh id[] = { chLatin_i, chLatin_d, chNull }; -static const XMLCh Implementation[] = -{ chLatin_I, chLatin_m, chLatin_p, chLatin_l, chLatin_e, chLatin_m, chLatin_e, chLatin_n, chLatin_t, chLatin_a, chLatin_t, chLatin_i, chLatin_o, chLatin_n, chNull }; -static const XMLCh ISAPI[] = { chLatin_I, chLatin_S, chLatin_A, chLatin_P, chLatin_I, chNull }; -static const XMLCh normalizeRequest[] = -{ chLatin_n, chLatin_o, chLatin_r, chLatin_m, chLatin_a, chLatin_l, chLatin_i, chLatin_z, chLatin_e, - chLatin_R, chLatin_e, chLatin_q, chLatin_u, chLatin_e, chLatin_s, chLatin_t, chNull -}; -static const XMLCh Site[] = { chLatin_S, chLatin_i, chLatin_t, chLatin_e, chNull }; - extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) { if (!pVer) return FALSE; + else if (g_Config) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Reentrant filter initialization, ignoring..."); + return TRUE; + } - try - { - LPCSTR schemadir=getenv("SHIBSCHEMAS"); - if (!schemadir) - schemadir=SHIB_SCHEMAS; - LPCSTR config=getenv("SHIBCONFIG"); - if (!config) - config=SHIB_CONFIG; - g_Config=&ShibTargetConfig::getConfig(); - g_Config->setFeatures( - ShibTargetConfig::Listener | - ShibTargetConfig::Metadata | - ShibTargetConfig::AAP | - ShibTargetConfig::RequestMapper | - ShibTargetConfig::SHIREExtensions | - ShibTargetConfig::Logging - ); - if (!g_Config->init(schemadir,config)) { - g_Config=NULL; - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, - "Filter startup failed during initialization, check shire log for help."); - return FALSE; - } - - // Access the implementation-specifics for site mappings. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - const IPropertySet* props=conf->getPropertySet("SHIRE"); + g_Config=&SPConfig::getConfig(); + g_Config->setFeatures( + SPConfig::Listener | + SPConfig::Caching | + SPConfig::RequestMapping | + SPConfig::InProcess | + SPConfig::Logging | + SPConfig::Handlers + ); + if (!g_Config->init()) { + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed during library initialization, check native log for help."); + return FALSE; + } + + LPCSTR config=getenv("SHIBSP_CONFIG"); + if (!config) + config=SHIBSP_CONFIG; + + try { + DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument(); + XercesJanitor docjanitor(dummydoc); + DOMElement* dummy = dummydoc->createElementNS(NULL,path); + auto_ptr_XMLCh src(config); + dummy->setAttributeNS(NULL,path,src.get()); + dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE); + + g_Config->setServiceProvider(g_Config->ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy)); + g_Config->getServiceProvider()->init(); + } + catch (exception& ex) { + g_Config->term(); + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, ex.what()); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed to load configuration, check native log for details."); + return FALSE; + } + + // Access implementation-specifics and site mappings. + ServiceProvider* sp=g_Config->getServiceProvider(); + Locker locker(sp); + const PropertySet* props=sp->getPropertySet("InProcess"); + if (props) { + pair unsetValue=props->getString("unsetHeaderValue"); + if (unsetValue.first) + g_unsetHeaderValue = unsetValue.second; + pair flag=props->getBool("checkSpoofing"); + g_checkSpoofing = !flag.first || flag.second; + flag=props->getBool("catchAll"); + g_catchAll = flag.first && flag.second; + + props = props->getPropertySet("ISAPI"); if (props) { - const DOMElement* impl=saml::XML::getFirstChildElement( - props->getElement(),ShibTargetConfig::SHIBTARGET_NS,Implementation - ); - if (impl && (impl=saml::XML::getFirstChildElement(impl,ShibTargetConfig::SHIBTARGET_NS,ISAPI))) { - const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest); - g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t); - impl=saml::XML::getFirstChildElement(impl,ShibTargetConfig::SHIBTARGET_NS,Site); - while (impl) { - auto_ptr_char id(impl->getAttributeNS(NULL,id)); - auto_ptr_char host(impl->getAttributeNS(NULL,host)); - if (id.get() && host.get()) - g_Sites[id.get()]=host.get(); - impl=saml::XML::getNextSiblingElement(impl,ShibTargetConfig::SHIBTARGET_NS,Site); - } + flag = props->getBool("normalizeRequest"); + g_bNormalizeRequest = !flag.first || flag.second; + const DOMElement* child = XMLHelper::getFirstChildElement(props->getElement(),Site); + while (child) { + auto_ptr_char id(child->getAttributeNS(NULL,id)); + if (id.get()) + g_Sites.insert(pair(id.get(),site_t(child))); + child=XMLHelper::getNextSiblingElement(child,Site); } } } - catch (...) - { - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter startup failed with an exception."); - return FALSE; - } pVer->dwFilterVersion=HTTP_FILTER_REVISION; strncpy(pVer->lpszFilterDesc,"Shibboleth ISAPI Filter",SF_MAX_FILTER_DESC_LEN); @@ -210,7 +237,7 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) extern "C" BOOL WINAPI TerminateFilter(DWORD) { if (g_Config) - g_Config->shutdown(); + g_Config->term(); g_Config = NULL; LogEvent(NULL, EVENTLOG_INFORMATION_TYPE, 7701, NULL, "Filter shut down..."); return TRUE; @@ -267,14 +294,12 @@ bool dynabuf::operator==(const char* s) const } void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) - { + while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -287,14 +312,12 @@ void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, } void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) - { + while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -308,14 +331,12 @@ void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dyna void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc, LPSTR lpszName, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (!pn->GetHeader(pfc,lpszName,s,&size)) - { + while (!pn->GetHeader(pfc,lpszName,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -327,37 +348,206 @@ void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc, throw ERROR_NO_DATA; } -IRequestMapper::Settings map_request( - PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, IRequestMapper* mapper, const char* hostname, string& target - ) +/****************************************************************************/ +// ISAPI Filter + +class ShibTargetIsapiF : public AbstractSPRequest { - dynabuf port(10); - dynabuf url(256); - GetServerVariable(pfc,"SERVER_PORT",port,10); - GetHeader(pn,pfc,"url",url,256,false); - - if (!url.empty()) - target=static_cast(url); - if (port!=(pfc->fIsSecurePort ? "443" : "80")) - target = ':' + static_cast(port) + target; + PHTTP_FILTER_CONTEXT m_pfc; + PHTTP_FILTER_PREPROC_HEADERS m_pn; + multimap m_headers; + int m_port; + string m_scheme,m_hostname; + mutable string m_remote_addr,m_content_type,m_method; + dynabuf m_allhttp; - if (g_bNormalizeRequest) { - target = string(pfc->fIsSecurePort ? "https://" : "http://") + hostname + target; +public: + ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_pfc(pfc), m_pn(pn), m_allhttp(4096) { + + // URL path always come from IIS. + dynabuf var(256); + GetHeader(pn,pfc,"url",var,256,false); + setRequestURI(var); + + // Port may come from IIS or from site def. + if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) { + GetServerVariable(pfc,"SERVER_PORT",var,10); + m_port = atoi(var); + } + else if (pfc->fIsSecurePort) { + m_port = atoi(site.m_sslport.c_str()); } else { - dynabuf name(64); - GetServerVariable(pfc,"SERVER_NAME",name,64); - target = string(pfc->fIsSecurePort ? "https://" : "http://") + static_cast(name) + target; + m_port = atoi(site.m_port.c_str()); } - return mapper->getSettingsFromParsedURL((pfc->fIsSecurePort ? "https" : "http"),hostname,strtoul(port,NULL,10),url); -} + + // Scheme may come from site def or be derived from IIS. + m_scheme=site.m_scheme; + if (m_scheme.empty() || !g_bNormalizeRequest) + m_scheme=pfc->fIsSecurePort ? "https" : "http"; + + GetServerVariable(pfc,"SERVER_NAME",var,32); + + // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name. + m_hostname = var; + if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end()) + m_hostname=site.m_name; + + if (!pfc->pFilterContext) { + pfc->pFilterContext = pfc->AllocMem(pfc, sizeof(context_t), NULL); + if (static_cast(pfc->pFilterContext)) { + static_cast(pfc->pFilterContext)->m_user = NULL; + static_cast(pfc->pFilterContext)->m_checked = false; + } + } + } + ~ShibTargetIsapiF() { } + + const char* getScheme() const { + return m_scheme.c_str(); + } + const char* getHostname() const { + return m_hostname.c_str(); + } + int getPort() const { + return m_port; + } + const char* getMethod() const { + if (m_method.empty()) { + dynabuf var(5); + GetServerVariable(m_pfc,"REQUEST_METHOD",var,5,false); + if (!var.empty()) + m_method = var; + } + return m_method.c_str(); + } + string getContentType() const { + if (m_content_type.empty()) { + dynabuf var(32); + GetServerVariable(m_pfc,"CONTENT_TYPE",var,32,false); + if (!var.empty()) + m_content_type = var; + } + return m_content_type; + } + long getContentLength() const { + return 0; + } + string getRemoteAddr() const { + if (m_remote_addr.empty()) { + dynabuf var(16); + GetServerVariable(m_pfc,"REMOTE_ADDR",var,16,false); + if (!var.empty()) + m_remote_addr = var; + } + return m_remote_addr; + } + void log(SPLogLevel level, const string& msg) { + AbstractSPRequest::log(level,msg); + if (level >= SPError) + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); + } + void clearHeader(const char* rawname, const char* cginame) { + if (g_checkSpoofing && m_pfc->pFilterContext && !static_cast(m_pfc->pFilterContext)->m_checked) { + if (m_allhttp.empty()) + GetServerVariable(m_pfc,"ALL_HTTP",m_allhttp,4096); + if (strstr(m_allhttp, cginame)) + throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, rawname)); + } + string hdr(!strcmp(rawname,"REMOTE_USER") ? "remote-user" : rawname); + hdr += ':'; + m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), const_cast(g_unsetHeaderValue.c_str())); + } + void setHeader(const char* name, const char* value) { + string hdr(name); + hdr += ':'; + m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), const_cast(value)); + } + string getHeader(const char* name) const { + string hdr(name); + hdr += ':'; + dynabuf buf(256); + GetHeader(m_pn, m_pfc, const_cast(hdr.c_str()), buf, 256, false); + return string(buf); + } + void setRemoteUser(const char* user) { + setHeader("remote-user", user); + if (m_pfc->pFilterContext) { + if (!user || !*user) + static_cast(m_pfc->pFilterContext)->m_user = NULL; + else if (static_cast(m_pfc->pFilterContext)->m_user = (char*)m_pfc->AllocMem(m_pfc, sizeof(char) * (strlen(user) + 1), NULL)) + strcpy(static_cast(m_pfc->pFilterContext)->m_user, user); + } + } + string getRemoteUser() const { + return getHeader("remote-user"); + } + void setResponseHeader(const char* name, const char* value) { + // Set for later. + if (value) + m_headers.insert(make_pair(name,value)); + else + m_headers.erase(name); + } + long sendResponse(istream& in, long status) { + string hdr = string("Connection: close\r\n"); + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + const char* codestr="200 OK"; + switch (status) { + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; + } + m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, (void*)codestr, (DWORD)hdr.c_str(), 0); + char buf[1024]; + while (in) { + in.read(buf,1024); + DWORD resplen = in.gcount(); + m_pfc->WriteClient(m_pfc, buf, &resplen, 0); + } + return SF_STATUS_REQ_FINISHED; + } + long sendRedirect(const char* url) { + // XXX: Don't support the httpRedirect option, yet. + string hdr=string("Location: ") + url + "\r\n" + "Content-Type: text/html\r\n" + "Content-Length: 40\r\n" + "Expires: 01-Jan-1997 12:00:00 GMT\r\n" + "Cache-Control: private,no-store,no-cache\r\n"; + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, "302 Please Wait", (DWORD)hdr.c_str(), 0); + static const char* redmsg="Redirecting..."; + DWORD resplen=40; + m_pfc->WriteClient(m_pfc, (LPVOID)redmsg, &resplen, 0); + return SF_STATUS_REQ_FINISHED; + } + long returnDecline() { + return SF_STATUS_REQ_NEXT_NOTIFICATION; + } + long returnOK() { + return SF_STATUS_REQ_NEXT_NOTIFICATION; + } + + const vector& getClientCertificates() const { + return g_NoCerts; + } + + // The filter never processes the POST, so stub these methods. + const char* getQueryString() const { throw IOException("getQueryString not implemented"); } + const char* getRequestBody() const { throw IOException("getRequestBody not implemented"); } +}; DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg) { LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg); - static const char* ctype="Content-Type: text/html\r\n"; - pfc->AddResponseHeaders(pfc,const_cast(ctype),0); - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",0,0); + static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n"; + pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",(DWORD)ctype,0); static const char* xmsg="Shibboleth Filter Error" "

Shibboleth Filter Error

"; DWORD resplen=strlen(xmsg); @@ -370,38 +560,12 @@ DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg) return SF_STATUS_REQ_FINISHED; } -DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const IApplication* app, const char* page, ShibMLP& mlp) -{ - const IPropertySet* props=app->getPropertySet("Errors"); - if (props) { - pair p=props->getString(page); - if (p.first) { - ifstream infile(p.second); - if (!infile.fail()) { - const char* res = mlp.run(infile,props); - if (res) { - static const char* ctype="Content-Type: text/html\r\n"; - pfc->AddResponseHeaders(pfc,const_cast(ctype),0); - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",0,0); - DWORD resplen=strlen(res); - pfc->WriteClient(pfc,(LPVOID)res,&resplen,0); - return SF_STATUS_REQ_FINISHED; - } - } - } - } - - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter unable to open error template."); - return WriteClientError(pfc,"Unable to open error template, check settings."); -} - extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificationType, LPVOID pvNotification) { // Is this a log notification? - if (notificationType==SF_NOTIFY_LOG) - { - if (pfc->pFilterContext) - ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast(pfc->pFilterContext); + if (notificationType==SF_NOTIFY_LOG) { + if (pfc->pFilterContext && static_cast(pfc->pFilterContext)->m_user) + ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast(pfc->pFilterContext)->m_user; return SF_STATUS_REQ_NEXT_NOTIFICATION; } @@ -413,343 +577,62 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat GetServerVariable(pfc,"INSTANCE_ID",buf,10); // Match site instance to host name, skip if no match. - map::const_iterator map_i=g_Sites.find(static_cast(buf)); + map::const_iterator map_i=g_Sites.find(static_cast(buf)); if (map_i==g_Sites.end()) return SF_STATUS_REQ_NEXT_NOTIFICATION; - const string& site=map_i->second; - ostringstream threadid; threadid << "[" << getpid() << "] isapi_shib" << '\0'; - saml::NDC ndc(threadid.str().c_str()); - - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - string targeturl; - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(pfc,pn,mapper,site.c_str(),targeturl); - pair application_id=settings.first->getString("applicationId"); - const IApplication* application=conf->getApplication(application_id.second); - if (!application) - return WriteClientError(pfc,"Unable to map request to application settings, check configuration."); - - // Declare SHIRE object for this request. - SHIRE shire(application); + xmltooling::NDC ndc(threadid.str().c_str()); - // If the user is accessing the SHIRE acceptance point, pass it on. - if (targeturl.find(shire.getShireURL(targeturl.c_str()))!=string::npos) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - - // Now check the policy for this request. - pair requireSession=settings.first->getBool("requireSession"); - pair shib_cookie=shire.getCookieNameProps(); - - // Check for session cookie. - const char* session_id=NULL; - GetHeader(pn,pfc,"Cookie:",buf,128,false); - Category::getInstance("isapi_shib.HttpFilterProc").debug("cookie header is {%s}",(const char*)buf); - if (!buf.empty() && (session_id=strstr(buf,shib_cookie.first))) { - session_id+=strlen(shib_cookie.first) + 1; /* Skip over the '=' */ - char* cookieend=strchr(session_id,';'); - if (cookieend) - *cookieend = '\0'; /* Ignore anyting after a ; */ - } - - if (!session_id || !*session_id) { - // If no session required, bail now. - if (!requireSession.second) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - - // No acceptable cookie, and we require a session. Generate an AuthnRequest. - string loc("Location: "); - loc+=shire.getAuthnRequest(targeturl.c_str()); - pfc->AddResponseHeaders(pfc,const_cast(loc.c_str()),0); - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"302 Please Wait",0,0); - return SF_STATUS_REQ_FINISHED; - } + ShibTargetIsapiF stf(pfc, pn, map_i->second); - // Make sure this session is still valid. - RPCError* status = NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl); - - dynabuf abuf(16); - GetServerVariable(pfc,"REMOTE_ADDR",abuf,16); - try { - status = shire.sessionIsValid(session_id, abuf); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "shire", markupProcessor); - } -#endif - - // Check the status - if (status->isError()) { - if (!requireSession.second) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - else if (status->isRetryable()) { - // Oops, session is invalid. Generate AuthnRequest. - delete status; - string loc("Location: "); - loc+=shire.getAuthnRequest(targeturl.c_str()); - pfc->AddResponseHeaders(pfc,const_cast(loc.c_str()),0); - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"302 Please Wait",0,0); - return SF_STATUS_REQ_FINISHED; - } - else { - // return the error page to the user - markupProcessor.insert(*status); - delete status; - return WriteClientError(pfc, application, "shire", markupProcessor); - } - } - delete status; - - // Move to RM phase. - RM rm(application); - vector assertions; - SAMLAuthenticationStatement* sso_statement=NULL; - - try { - status = rm.getAssertions(session_id, abuf, assertions, &sso_statement); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - #ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - #endif - - if (status->isError()) { - markupProcessor.insert(*status); - delete status; - return WriteClientError(pfc, application, "rm", markupProcessor); - } - delete status; - - // Do we have an access control plugin? - if (settings.second) { - Locker acllock(settings.second); - if (!settings.second->authorized(assertions)) { - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - return WriteClientError(pfc, application, "access", markupProcessor); - } - } + // "false" because we don't override the Shib settings + pair res = stf.getServiceProvider().doAuthentication(stf); + if (pfc->pFilterContext) + static_cast(pfc->pFilterContext)->m_checked = true; + if (res.first) return res.second; - // Get the AAP providers, which contain the attribute policy info. - Iterator provs=application->getAAPProviders(); - - // Clear out the list of mapped attributes - while (provs.hasNext()) { - IAAP* aap=provs.next(); - aap->lock(); - try { - Iterator rules=aap->getAttributeRules(); - while (rules.hasNext()) { - const char* header=rules.next()->getHeader(); - if (header) { - string hname=string(header) + ':'; - pn->SetHeader(pfc,const_cast(hname.c_str()),""); - } - } - } - catch(...) { - aap->unlock(); - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - aap->unlock(); - } - provs.reset(); - - // Maybe export the first assertion. - pn->SetHeader(pfc,"remote-user:",""); - pn->SetHeader(pfc,"Shib-Attributes:",""); - pair exp=settings.first->getBool("exportAssertion"); - if (exp.first && exp.second && assertions.size()) { - string assertion; - RM::serialize(*(assertions[0]), assertion); - string::size_type lfeed; - while ((lfeed=assertion.find('\n'))!=string::npos) - assertion.erase(lfeed,1); - pn->SetHeader(pfc,"Shib-Attributes:",const_cast(assertion.c_str())); - } - - pn->SetHeader(pfc,"Shib-Origin-Site:",""); - pn->SetHeader(pfc,"Shib-Authentication-Method:",""); - pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",""); - - // Export the SAML AuthnMethod and the origin site name. - if (sso_statement) { - auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier()); - auto_ptr_char am(sso_statement->getAuthMethod()); - pn->SetHeader(pfc,"Shib-Origin-Site:", const_cast(os.get())); - pn->SetHeader(pfc,"Shib-Authentication-Method:", const_cast(am.get())); - - // Export NameID? - AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI); - if (!wrapper.fail() && wrapper->getHeader()) { - auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat()); - auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName()); - pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",const_cast(form.get())); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) { - char* principal=const_cast(nameid.get()); - pn->SetHeader(pfc,"remote-user:",principal); - pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0); - if (pfc->pFilterContext) - strcpy(static_cast(pfc->pFilterContext),principal); - } - else { - string hname=string(wrapper->getHeader()) + ':'; - pn->SetHeader(pfc,const_cast(wrapper->getHeader()),const_cast(nameid.get())); - } - } - } + // "false" because we don't override the Shib settings + res = stf.getServiceProvider().doExport(stf); + if (res.first) return res.second; - pn->SetHeader(pfc,"Shib-Application-ID:",""); - pn->SetHeader(pfc,"Shib-Application-ID:",const_cast(application_id.second)); - - // Export the attributes. - Iterator a_iter(assertions); - while (a_iter.hasNext()) { - SAMLAssertion* assert=a_iter.next(); - Iterator statements=assert->getStatements(); - while (statements.hasNext()) { - SAMLAttributeStatement* astate=dynamic_cast(statements.next()); - if (!astate) - continue; - Iterator attrs=astate->getAttributes(); - while (attrs.hasNext()) { - SAMLAttribute* attr=attrs.next(); - - // Are we supposed to export it? - AAP wrapper(provs,attr->getName(),attr->getNamespace()); - if (wrapper.fail() || !wrapper->getHeader()) - continue; - - Iterator vals=attr->getSingleByteValues(); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER") && vals.hasNext()) { - char* principal=const_cast(vals.next().c_str()); - pn->SetHeader(pfc,"remote-user:",principal); - pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0); - if (pfc->pFilterContext) - strcpy(static_cast(pfc->pFilterContext),principal); - } - else { - int it=0; - string header; - string hname=string(wrapper->getHeader()) + ':'; - GetHeader(pn,pfc,const_cast(hname.c_str()),buf,256,false); - if (!buf.empty()) { - header=buf; - it++; - } - for (; vals.hasNext(); it++) { - string value = vals.next(); - for (string::size_type pos = value.find_first_of(";", string::size_type(0)); - pos != string::npos; - pos = value.find_first_of(";", pos)) { - value.insert(pos, "\\"); - pos += 2; - } - if (it == 0) - header=value; - else - header=header + ';' + value; - } - pn->SetHeader(pfc,const_cast(hname.c_str()),const_cast(header.c_str())); - } - } - } - } - - // clean up memory - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; + res = stf.getServiceProvider().doAuthorization(stf); + if (res.first) return res.second; return SF_STATUS_REQ_NEXT_NOTIFICATION; } catch(bad_alloc) { return WriteClientError(pfc,"Out of Memory"); } - catch(DWORD e) { + catch(long e) { if (e==ERROR_NO_DATA) return WriteClientError(pfc,"A required variable or header was empty."); else - return WriteClientError(pfc,"Server detected unexpected IIS error."); + return WriteClientError(pfc,"Shibboleth Filter detected unexpected IIS error."); + } + catch (exception& e) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); + return WriteClientError(pfc,"Shibboleth Filter caught an exception, check Event Log for details."); } -#ifndef _DEBUG catch(...) { - return WriteClientError(pfc,"Server caught an unknown exception."); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Filter threw an unknown exception."); + if (g_catchAll) + return WriteClientError(pfc,"Shibboleth Filter threw an unknown exception."); + throw; } -#endif - return WriteClientError(pfc,"Server reached unreachable code, save my walrus!"); + return WriteClientError(pfc,"Shibboleth Filter reached unreachable code, save my walrus!"); } + -IRequestMapper::Settings map_request( - LPEXTENSION_CONTROL_BLOCK lpECB, IRequestMapper* mapper, const char* hostname, string& target - ) -{ - dynabuf ssl(5); - dynabuf port(10); - dynabuf url(256); - GetServerVariable(lpECB,"HTTPS",ssl,5); - GetServerVariable(lpECB,"SERVER_PORT",port,10); - GetServerVariable(lpECB,"URL",url,255); - bool SSL=(ssl=="on"); - - if (!url.empty()) - target=static_cast(url); - if (port!=(SSL ? "443" : "80")) - target = ':' + static_cast(port) + target; - - if (g_bNormalizeRequest) { - target = string(SSL ? "https://" : "http://") + hostname + target; - return mapper->getSettingsFromParsedURL(lpECB->lpszMethod,hostname,strtoul(port,NULL,10),url); - } - else { - dynabuf name(64); - GetServerVariable(lpECB,"SERVER_NAME",name,64); - target = string(SSL ? "https://" : "http://") + static_cast(name) + target; - return mapper->getSettingsFromParsedURL((SSL ? "https" : "http"),name,strtoul(port,NULL,10),url); - } -} +/****************************************************************************/ +// ISAPI Extension DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg) { LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg); - static const char* ctype="Content-Type: text/html\r\n"; + static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n"; lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)ctype); static const char* xmsg="Shibboleth Error

Shibboleth Error

"; DWORD resplen=strlen(xmsg); @@ -762,215 +645,304 @@ DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg) return HSE_STATUS_SUCCESS; } -DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const IApplication* app, const char* page, ShibMLP& mlp) + +class ShibTargetIsapiE : public AbstractSPRequest { - const IPropertySet* props=app->getPropertySet("Errors"); - if (props) { - pair p=props->getString(page); - if (p.first) { - ifstream infile(p.second); - if (!infile.fail()) { - const char* res = mlp.run(infile,props); - if (res) { - static const char* ctype="Content-Type: text/html\r\n"; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)ctype); - DWORD resplen=strlen(res); - lpECB->WriteClient(lpECB->ConnID,(LPVOID)res,&resplen,0); - return HSE_STATUS_SUCCESS; - } - } + LPEXTENSION_CONTROL_BLOCK m_lpECB; + multimap m_headers; + mutable vector m_certs; + mutable string m_body; + mutable bool m_gotBody; + int m_port; + string m_scheme,m_hostname,m_uri; + mutable string m_remote_addr,m_remote_user; + +public: + ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_lpECB(lpECB), m_gotBody(false) { + dynabuf ssl(5); + GetServerVariable(lpECB,"HTTPS",ssl,5); + bool SSL=(ssl=="on" || ssl=="ON"); + + // Scheme may come from site def or be derived from IIS. + m_scheme=site.m_scheme; + if (m_scheme.empty() || !g_bNormalizeRequest) + m_scheme = SSL ? "https" : "http"; + + // URL path always come from IIS. + dynabuf url(256); + GetServerVariable(lpECB,"URL",url,255); + + // Port may come from IIS or from site def. + dynabuf port(11); + if (!g_bNormalizeRequest || (SSL && site.m_sslport.empty()) || (!SSL && site.m_port.empty())) + GetServerVariable(lpECB,"SERVER_PORT",port,10); + else if (SSL) { + strncpy(port,site.m_sslport.c_str(),10); + static_cast(port)[10]=0; + } + else { + strncpy(port,site.m_port.c_str(),10); + static_cast(port)[10]=0; + } + m_port = atoi(port); + + dynabuf var(32); + GetServerVariable(lpECB, "SERVER_NAME", var, 32); + + // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name. + m_hostname=var; + if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end()) + m_hostname=site.m_name; + + /* + * IIS screws us over on PATH_INFO (the hits keep on coming). We need to figure out if + * the server is set up for proper PATH_INFO handling, or "IIS sucks rabid weasels mode", + * which is the default. No perfect way to tell, but we can take a good guess by checking + * whether the URL is a substring of the PATH_INFO: + * + * e.g. for /Shibboleth.sso/SAML/POST + * + * Bad mode (default): + * URL: /Shibboleth.sso + * PathInfo: /Shibboleth.sso/SAML/POST + * + * Good mode: + * URL: /Shibboleth.sso + * PathInfo: /SAML/POST + */ + + string uri; + + // Clearly we're only in bad mode if path info exists at all. + if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) { + if (strstr(lpECB->lpszPathInfo,url)) + // Pretty good chance we're in bad mode, unless the PathInfo repeats the path itself. + uri = lpECB->lpszPathInfo; + else { + uri = url; + uri += lpECB->lpszPathInfo; } } - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension unable to open error template."); - return WriteClientError(lpECB,"Unable to open error template, check settings."); -} + else { + uri = url; + } + + // For consistency with Apache, let's add the query string. + if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) { + uri += '?'; + uri += lpECB->lpszQueryString; + } + + setRequestURI(uri.c_str()); + } + ~ShibTargetIsapiE() { } + + const char* getScheme() const { + return m_scheme.c_str(); + } + const char* getHostname() const { + return m_hostname.c_str(); + } + int getPort() const { + return m_port; + } + const char* getMethod() const { + return m_lpECB->lpszMethod; + } + string getContentType() const { + return m_lpECB->lpszContentType ? m_lpECB->lpszContentType : ""; + } + long getContentLength() const { + return m_lpECB->cbTotalBytes; + } + string getRemoteUser() const { + if (m_remote_user.empty()) { + dynabuf var(16); + GetServerVariable(m_lpECB, "REMOTE_USER", var, 32, false); + if (!var.empty()) + m_remote_user = var; + } + return m_remote_user; + } + string getRemoteAddr() const { + if (m_remote_addr.empty()) { + dynabuf var(16); + GetServerVariable(m_lpECB, "REMOTE_ADDR", var, 16, false); + if (!var.empty()) + m_remote_addr = var; + } + return m_remote_addr; + } + void log(SPLogLevel level, const string& msg) const { + AbstractSPRequest::log(level,msg); + if (level >= SPError) + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); + } + string getHeader(const char* name) const { + string hdr("HTTP_"); + for (; *name; ++name) { + if (*name=='-') + hdr += '_'; + else + hdr += toupper(*name); + } + dynabuf buf(128); + GetServerVariable(m_lpECB, const_cast(hdr.c_str()), buf, 128, false); + return buf.empty() ? "" : buf; + } + void setResponseHeader(const char* name, const char* value) { + // Set for later. + if (value) + m_headers.insert(make_pair(name,value)); + else + m_headers.erase(name); + } + const char* getQueryString() const { + return m_lpECB->lpszQueryString; + } + const char* getRequestBody() const { + if (m_gotBody) + return m_body.c_str(); + if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB? + throw opensaml::SecurityPolicyException("Size of request body exceeded 1M size limit."); + else if (m_lpECB->cbTotalBytes > m_lpECB->cbAvailable) { + m_gotBody=true; + char buf[8192]; + DWORD datalen=m_lpECB->cbTotalBytes; + while (datalen) { + DWORD buflen=8192; + BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen); + if (!ret || !buflen) + throw IOException("Error reading request body from browser."); + m_body.append(buf, buflen); + datalen-=buflen; + } + } + else if (m_lpECB->cbAvailable) { + m_gotBody=true; + m_body.assign(reinterpret_cast(m_lpECB->lpbData),m_lpECB->cbAvailable); + } + return m_body.c_str(); + } + long sendResponse(istream& in, long status) { + string hdr = string("Connection: close\r\n"); + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + const char* codestr="200 OK"; + switch (status) { + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; + } + m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, (void*)codestr, 0, (LPDWORD)hdr.c_str()); + char buf[1024]; + while (in) { + in.read(buf,1024); + DWORD resplen = in.gcount(); + m_lpECB->WriteClient(m_lpECB->ConnID, buf, &resplen, HSE_IO_SYNC); + } + return HSE_STATUS_SUCCESS; + } + long sendRedirect(const char* url) { + string hdr=string("Location: ") + url + "\r\n" + "Content-Type: text/html\r\n" + "Content-Length: 40\r\n" + "Expires: 01-Jan-1997 12:00:00 GMT\r\n" + "Cache-Control: private,no-store,no-cache\r\n"; + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, "302 Moved", 0, (LPDWORD)hdr.c_str()); + static const char* redmsg="Redirecting..."; + DWORD resplen=40; + m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)redmsg, &resplen, HSE_IO_SYNC); + return HSE_STATUS_SUCCESS; + } + // Decline happens in the POST processor if this isn't the shire url + // Note that it can also happen with HTAccess, but we don't support that, yet. + long returnDecline() { + return WriteClientError( + m_lpECB, + "ISAPI extension can only be invoked to process Shibboleth protocol requests." + "Make sure the mapped file extension doesn't match actual content." + ); + } + long returnOK() { + return HSE_STATUS_SUCCESS; + } + + const vector& getClientCertificates() const { + if (m_certs.empty()) { + char CertificateBuf[8192]; + CERT_CONTEXT_EX ccex; + ccex.cbAllocated = sizeof(CertificateBuf); + ccex.CertContext.pbCertEncoded = (BYTE*)CertificateBuf; + DWORD dwSize = sizeof(ccex); + + if (m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_GET_CERT_INFO_EX, (LPVOID)&ccex, (LPDWORD)dwSize, NULL)) { + if (ccex.CertContext.cbCertEncoded) { + unsigned int outlen; + XMLByte* serialized = Base64::encode(reinterpret_cast(CertificateBuf), ccex.CertContext.cbCertEncoded, &outlen); + m_certs.push_back(reinterpret_cast(serialized)); + XMLString::release(&serialized); + } + } + } + return m_certs; + } + + // Not used in the extension. + void clearHeader(const char* rawname, const char* cginame) { throw runtime_error("clearHeader not implemented"); } + void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); } + void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); } +}; extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) { - string targeturl; - const IApplication* application=NULL; - try - { + try { ostringstream threadid; - threadid << "[" << getpid() << "] shire_handler" << '\0'; - saml::NDC ndc(threadid.str().c_str()); + threadid << "[" << getpid() << "] isapi_shib_extension" << '\0'; + xmltooling::NDC ndc(threadid.str().c_str()); // Determine web site number. This can't really fail, I don't think. dynabuf buf(128); GetServerVariable(lpECB,"INSTANCE_ID",buf,10); // Match site instance to host name, skip if no match. - map::const_iterator map_i=g_Sites.find(static_cast(buf)); + map::const_iterator map_i=g_Sites.find(static_cast(buf)); if (map_i==g_Sites.end()) - return WriteClientError(lpECB,"Shibboleth filter not configured for this web site."); - - const string& site=map_i->second; + return WriteClientError(lpECB, "Shibboleth Extension not configured for web site (check mappings in configuration)."); - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - string targeturl; - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(lpECB,mapper,site.c_str(),targeturl); - pair application_id=settings.first->getString("applicationId"); - application=conf->getApplication(application_id.second); - const IPropertySet* sessionProps=application ? application->getPropertySet("Sessions") : NULL; - if (!application || !sessionProps) - return WriteClientError(lpECB,"Unable to map request to application session settings, check configuration."); - - SHIRE shire(application); - - // Make sure we only process the SHIRE requests. - if (!strstr(targeturl.c_str(),shire.getShireURL(targeturl.c_str()))) - return WriteClientError(lpECB,"The request's application and associated shireURL setting are inconsistent.");; - - pair shib_cookie=shire.getCookieNameProps(); - - // Make sure this is SSL, if it should be - pair shireSSL=sessionProps->getBool("shireSSL"); - if (!shireSSL.first || shireSSL.second) { - GetServerVariable(lpECB,"HTTPS",buf,10); - if (buf!="on") - throw ShibTargetException(SHIBRPC_OK,"blocked non-SSL access to SHIRE POST processor"); - } + ShibTargetIsapiE ste(lpECB, map_i->second); + pair res = ste.getServiceProvider().doHandler(ste); + if (res.first) return res.second; - // If this is a GET, we manufacture an AuthnRequest. - if (!stricmp(lpECB->lpszMethod,"GET")) { - const char* areq=lpECB->lpszQueryString ? shire.getLazyAuthnRequest(lpECB->lpszQueryString) : NULL; - if (!areq) - throw ShibTargetException(SHIBRPC_OK, "malformed arguments to request a new session"); - targeturl = string("Location: ") + areq + "\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n" - "Connection: close\r\n"; - HSE_SEND_HEADER_EX_INFO hinfo; - hinfo.pszStatus="302 Moved"; - hinfo.pszHeader=targeturl.c_str(); - hinfo.cchStatus=9; - hinfo.cchHeader=targeturl.length(); - hinfo.fKeepConn=FALSE; - if (lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER_EX,&hinfo,0,0)) - return HSE_STATUS_SUCCESS; - return HSE_STATUS_ERROR; - } - else if (stricmp(lpECB->lpszMethod,"POST")) - throw ShibTargetException(SHIBRPC_OK,"blocked non-POST to SHIRE POST processor"); + return WriteClientError(lpECB, "Shibboleth Extension failed to process request"); - // Sure sure this POST is an appropriate content type - if (!lpECB->lpszContentType || stricmp(lpECB->lpszContentType,"application/x-www-form-urlencoded")) - throw ShibTargetException(SHIBRPC_OK,"blocked bad content-type to SHIRE POST processor"); - - // Read the data. - pair elements=pair(NULL,NULL); - if (lpECB->cbTotalBytes > 1024*1024) // 1MB? - throw ShibTargetException(SHIBRPC_OK,"blocked too-large a post to SHIRE POST processor"); - else if (lpECB->cbTotalBytes!=lpECB->cbAvailable) { - string cgistr; - char buf[8192]; - DWORD datalen=lpECB->cbTotalBytes; - while (datalen) { - DWORD buflen=8192; - BOOL ret=lpECB->ReadClient(lpECB->ConnID,buf,&buflen); - if (!ret || !buflen) - throw ShibTargetException(SHIBRPC_OK,"error reading POST data from browser"); - cgistr.append(buf,buflen); - datalen-=buflen; - } - elements=shire.getFormSubmission(cgistr.c_str(),cgistr.length()); - } + } + catch(bad_alloc) { + return WriteClientError(lpECB,"Out of Memory"); + } + catch(long e) { + if (e==ERROR_NO_DATA) + return WriteClientError(lpECB,"A required variable or header was empty."); else - elements=shire.getFormSubmission(reinterpret_cast(lpECB->lpbData),lpECB->cbAvailable); - - // Make sure the SAML Response parameter exists - if (!elements.first || !*elements.first) - throw ShibTargetException(SHIBRPC_OK, "SHIRE POST failed to find SAMLResponse form element"); - - // Make sure the target parameter exists - if (!elements.second || !*elements.second) - throw ShibTargetException(SHIBRPC_OK, "SHIRE POST failed to find TARGET form element"); - - GetServerVariable(lpECB,"REMOTE_ADDR",buf,16); - - // Process the post. - string cookie; - RPCError* status=NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - try { - status = shire.sessionCreate(elements.first,buf,cookie); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB, application, "shire", markupProcessor); - } -#endif - - if (status->isError()) { - if (status->isRetryable()) { - delete status; - const char* loc=shire.getAuthnRequest(elements.second); - DWORD len=strlen(loc); - if (lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_URL_REDIRECT_RESP,(LPVOID)loc,&len,0)) - return HSE_STATUS_SUCCESS; - return HSE_STATUS_ERROR; - } - - // Return this error to the user. - markupProcessor.insert(*status); - delete status; - return WriteClientError(lpECB,application,"shire",markupProcessor); - } - delete status; - - // We've got a good session, set the cookie and redirect to target. - cookie = string("Set-Cookie: ") + shib_cookie.first + '=' + cookie + shib_cookie.second + "\r\n" - "Location: " + elements.second + "\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n" - "Connection: close\r\n"; - HSE_SEND_HEADER_EX_INFO hinfo; - hinfo.pszStatus="302 Moved"; - hinfo.pszHeader=cookie.c_str(); - hinfo.cchStatus=9; - hinfo.cchHeader=cookie.length(); - hinfo.fKeepConn=FALSE; - if (lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER_EX,&hinfo,0,0)) - return HSE_STATUS_SUCCESS; - } - catch (ShibTargetException &e) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB,application,"shire",markupProcessor); - } + return WriteClientError(lpECB,"Server detected unexpected IIS error."); } -#ifndef _DEBUG - catch (...) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB,application,"shire",markupProcessor); - } + catch (exception& e) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); + return WriteClientError(lpECB,"Shibboleth Extension caught an exception, check Event Log for details."); } -#endif - + catch(...) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Extension threw an unknown exception."); + if (g_catchAll) + return WriteClientError(lpECB,"Shibboleth Extension threw an unknown exception."); + throw; + } + + // If we get here we've got an error. return HSE_STATUS_ERROR; }