X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=nsapi_shib%2Fnsapi_shib.cpp;h=bbceda74dfaa483045e886c4ec7c7105320a3035;hb=c51bfd77603cf0ddb0b5e374c35586a8435895d6;hp=c42c849b30076ac9728c82407b2c1cc0fcc68653;hpb=0b05be8eae31991d66668b3beb601bce09e28318;p=shibboleth%2Fcpp-sp.git diff --git a/nsapi_shib/nsapi_shib.cpp b/nsapi_shib/nsapi_shib.cpp index c42c849..bbceda7 100644 --- a/nsapi_shib/nsapi_shib.cpp +++ b/nsapi_shib/nsapi_shib.cpp @@ -1,23 +1,27 @@ -/* - * Copyright 2001-2007 Internet2 +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * http://www.apache.org/licenses/LICENSE-2.0 * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * nsapi_shib.cpp * - * Shibboleth NSAPI filter + * Shibboleth NSAPI filter. */ #define SHIBSP_LITE @@ -31,12 +35,20 @@ #ifdef WIN32 # define _CRT_NONSTDC_NO_DEPRECATE 1 # define _CRT_SECURE_NO_DEPRECATE 1 +# define _CRT_RAND_S #endif +#include #include #include #include #include + +#include +#include +#include +#include +#include #include #include #include @@ -44,11 +56,6 @@ #include #include -#include -#include -#include -#include - #ifdef WIN32 # include # define XP_WIN32 @@ -66,6 +73,7 @@ extern "C" using namespace shibsp; using namespace xmltooling; +using namespace boost; using namespace std; // macros to output text to client @@ -73,9 +81,8 @@ using namespace std; if (IO_ERROR==net_write(sn->csd,str,strlen(str))) return REQ_EXIT namespace { - SPConfig* g_Config=NULL; + SPConfig* g_Config=nullptr; string g_ServerName; - string g_ServerScheme; string g_unsetHeaderValue; string g_spoofKey; bool g_checkSpoofing = true; @@ -83,6 +90,16 @@ namespace { static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h); static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e); + + void _my_invalid_parameter_handler( + const wchar_t * expression, + const wchar_t * function, + const wchar_t * file, + unsigned int line, + uintptr_t pReserved + ) { + return; + } } PluginManager::Factory SunRequestMapFactory; @@ -91,7 +108,7 @@ extern "C" NSAPI_PUBLIC void nsapi_shib_exit(void*) { if (g_Config) g_Config->term(); - g_Config = NULL; + g_Config = nullptr; } extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, ::Session* sn, Request* rq) @@ -116,9 +133,6 @@ extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, ::Session* sn, Request* } } } - name=pblock_findval("server-scheme",pb); - if (name) - g_ServerScheme=name; log_error(LOG_INFORM,"nsapi_shib_init",sn,rq,"nsapi_shib loaded for host (%s)",g_ServerName.c_str()); @@ -135,7 +149,7 @@ extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, ::Session* sn, Request* SPConfig::Handlers ); if (!g_Config->init(schemadir,prefix)) { - g_Config=NULL; + g_Config=nullptr; pblock_nvinsert("error","unable to initialize Shibboleth libraries",pb); return REQ_ABORTED; } @@ -146,31 +160,51 @@ extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, ::Session* sn, Request* if (!g_Config->instantiate(pblock_findval("shib-config",pb), true)) throw runtime_error("unknown error"); } - catch (exception& ex) { + catch (std::exception& ex) { pblock_nvinsert("error",ex.what(),pb); g_Config->term(); - g_Config=NULL; + g_Config=nullptr; return REQ_ABORTED; } - daemon_atrestart(nsapi_shib_exit,NULL); + daemon_atrestart(nsapi_shib_exit,nullptr); ServiceProvider* sp=g_Config->getServiceProvider(); Locker locker(sp); const PropertySet* props=sp->getPropertySet("InProcess"); if (props) { + pair flag=props->getBool("checkSpoofing"); + g_checkSpoofing = !flag.first || flag.second; + flag=props->getBool("catchAll"); + g_catchAll = flag.first && flag.second; + pair unsetValue=props->getString("unsetHeaderValue"); if (unsetValue.first) g_unsetHeaderValue = unsetValue.second; - pair flag=props->getBool("checkSpoofing"); - g_checkSpoofing = !flag.first || flag.second; if (g_checkSpoofing) { unsetValue=props->getString("spoofKey"); if (unsetValue.first) g_spoofKey = unsetValue.second; +#ifdef WIN32 + else { + _invalid_parameter_handler old = _set_invalid_parameter_handler(_my_invalid_parameter_handler); + unsigned int randkey=0,randkey2=0,randkey3=0,randkey4=0; + if (rand_s(&randkey) == 0 && rand_s(&randkey2) == 0 && rand_s(&randkey3) == 0 && rand_s(&randkey4) == 0) { + _set_invalid_parameter_handler(old); + g_spoofKey = lexical_cast(randkey) + lexical_cast(randkey2) + + lexical_cast(randkey3) + lexical_cast(randkey4); + } + else { + _set_invalid_parameter_handler(old); + pblock_nvinsert("error", "module failed to generate a random anti-spoofing key (if this is Windows 2000 set one manually)", pb); + locker.assign(); // pops lock on SP config + g_Config->term(); + g_Config=nullptr; + return REQ_ABORTED; + } + } +#endif } - flag=props->getBool("catchAll"); - g_catchAll = flag.first && flag.second; } return REQ_PROCEED; } @@ -182,6 +216,8 @@ class ShibTargetNSAPI : public AbstractSPRequest { mutable string m_body; mutable bool m_gotBody,m_firsttime; + bool m_security_active; + int m_server_portnum; mutable vector m_certs; set m_allhttp; @@ -191,10 +227,34 @@ public: Request* m_rq; ShibTargetNSAPI(pblock* pb, ::Session* sn, Request* rq) - : AbstractSPRequest(SHIBSP_LOGCAT".NSAPI"), m_gotBody(false), m_firsttime(true), m_pb(pb), m_sn(sn), m_rq(rq) { + : AbstractSPRequest(SHIBSP_LOGCAT ".NSAPI"), + m_gotBody(false), m_firsttime(true), m_security_active(false), m_server_portnum(0), m_pb(pb), m_sn(sn), m_rq(rq) { + + // To determine whether SSL is active or not, we're supposed to rely + // on the security_active macro. For iPlanet 4.x, this works. + // For Sun 7.x, it's useless and appears to be on or off based + // on whether ANY SSL support is enabled for a vhost. Sun 6.x is unknown. + // As a fix, there's a conf variable called $security that can be mapped + // into a function parameter: security_active="$security" + // We check for this parameter, and rely on the macro if it isn't set. + // This doubles as a scheme virtualizer for load balanced scenarios + // since you can set the parameter to 1 or 0 as needed. + const char* sa = pblock_findval("security_active", m_pb); + if (sa) + m_security_active = (*sa == '1'); + else if (security_active) + m_security_active = true; + else + m_security_active = false; + + // A similar issue exists for the port. server_portnum is no longer + // working on at least Sun 7.x, and returns the first listener's port + // rather than whatever port is actually used for the request. Nice job, Sun. + sa = pblock_findval("server_portnum", m_pb); + m_server_portnum = (sa && *sa) ? atoi(sa) : server_portnum; - const char* uri=pblock_findval("uri", rq->reqpb); - const char* qstr=pblock_findval("query", rq->reqpb); + const char* uri = pblock_findval("uri", rq->reqpb); + const char* qstr = pblock_findval("query", rq->reqpb); if (qstr) { string temp = string(uri) + '?' + qstr; @@ -216,7 +276,7 @@ public: ~ShibTargetNSAPI() { } const char* getScheme() const { - return security_active ? "https" : "http"; + return m_security_active ? "https" : "http"; } const char* getHostname() const { #ifdef vs_is_default_vs @@ -231,25 +291,28 @@ public: return g_ServerName.c_str(); } int getPort() const { - return server_portnum; + return m_server_portnum; } const char* getMethod() const { return pblock_findval("method", m_rq->reqpb); } string getContentType() const { - char* content_type = ""; - request_header("content-type", &content_type, m_sn, m_rq); - return content_type; + char* content_type = nullptr; + if (request_header("content-type", &content_type, m_sn, m_rq) != REQ_PROCEED) + return ""; + return content_type ? content_type : ""; } long getContentLength() const { if (m_gotBody) return m_body.length(); - char* content_length=""; - request_header("content-length", &content_length, m_sn, m_rq); - return atoi(content_length); + char* content_length=nullptr; + if (request_header("content-length", &content_length, m_sn, m_rq) != REQ_PROCEED) + return 0; + return content_length ? atoi(content_length) : 0; } string getRemoteAddr() const { - return pblock_findval("ip", m_sn->client); + string ret = AbstractSPRequest::getRemoteAddr(); + return ret.empty() ? pblock_findval("ip", m_sn->client) : ret; } void log(SPLogLevel level, const string& msg) const { AbstractSPRequest::log(level,msg); @@ -262,8 +325,12 @@ public: const char* getRequestBody() const { if (m_gotBody) return m_body.c_str(); - char* content_length=NULL; - if (request_header("content-length", &content_length, m_sn, m_rq)!=REQ_PROCEED || atoi(content_length) > 1024*1024) // 1MB? + char* content_length=nullptr; + if (request_header("content-length", &content_length, m_sn, m_rq) != REQ_PROCEED || !content_length) { + m_gotBody = true; + return nullptr; + } + else if (atoi(content_length) > 1024*1024) // 1MB? throw opensaml::SecurityPolicyException("Blocked request body exceeding 1M size limit."); else { char ch=IO_EOF+1; @@ -319,7 +386,7 @@ public: } string getHeader(const char* name) const { // NSAPI headers tend to be lower case. We'll special case "cookie" since it's used a lot. - char* hdr = NULL; + char* hdr = nullptr; int cookie = strcmp(name, "Cookie"); if (cookie == 0) name = "cookie"; @@ -344,8 +411,25 @@ public: const char* ru = pblock_findval("auth-user", m_rq->vars); return ru ? ru : ""; } + void setAuthType(const char* authtype) { + param_free(pblock_remove("auth-type", m_rq->vars)); + if (authtype) + pblock_nvinsert("auth-type", authtype, m_rq->vars); + } + string getAuthType() const { + const char* at = pblock_findval("auth-type", m_rq->vars); + return at ? at : ""; + } + void setContentType(const char* type) { + // iPlanet seems to have a case folding problem. + param_free(pblock_remove("content-type", m_rq->srvhdrs)); + setResponseHeader("Content-Type", type); + } void setResponseHeader(const char* name, const char* value) { - pblock_nvinsert(name, value, m_rq->srvhdrs); + HTTPResponse::setResponseHeader(name, value); + if (name) { + pblock_nvinsert(name, value, m_rq->srvhdrs); + } } long sendResponse(istream& in, long status) { @@ -357,19 +441,20 @@ public: } pblock_nvinsert("connection","close",m_rq->srvhdrs); pblock_nninsert("content-length", msg.length(), m_rq->srvhdrs); - protocol_status(m_sn, m_rq, status, NULL); + protocol_status(m_sn, m_rq, status, nullptr); protocol_start_response(m_sn, m_rq); net_write(m_sn->csd,const_cast(msg.c_str()),msg.length()); return REQ_EXIT; } long sendRedirect(const char* url) { + HTTPResponse::sendRedirect(url); param_free(pblock_remove("content-type", m_rq->srvhdrs)); pblock_nninsert("content-length", 0, m_rq->srvhdrs); - pblock_nvinsert("expires", "01-Jan-1997 12:00:00 GMT", m_rq->srvhdrs); - pblock_nvinsert("cache-control", "private,no-store,no-cache", m_rq->srvhdrs); + pblock_nvinsert("expires", "Wed, 01 Jan 1997 12:00:00 GMT", m_rq->srvhdrs); + pblock_nvinsert("cache-control", "private,no-store,no-cache,max-age=0", m_rq->srvhdrs); pblock_nvinsert("location", url, m_rq->srvhdrs); pblock_nvinsert("connection","close",m_rq->srvhdrs); - protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, NULL); + protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, nullptr); protocol_start_response(m_sn, m_rq); return REQ_ABORTED; } @@ -398,9 +483,9 @@ int WriteClientError(::Session* sn, Request* rq, char* func, char* msg) #define FUNC "shibboleth" extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, ::Session* sn, Request* rq) { - ostringstream threadid; - threadid << "[" << getpid() << "] nsapi_shib" << '\0'; - xmltooling::NDC ndc(threadid.str().c_str()); + string threadid("["); + threadid += lexical_cast(getpid()) + "] nsapi_shib"; + xmltooling::NDC ndc(threadid.c_str()); try { ShibTargetNSAPI stn(pb, sn, rq); @@ -417,10 +502,6 @@ extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, ::Session* sn, Request* rq) // user authN was okay -- export the assertions now param_free(pblock_remove("auth-user",rq->vars)); - // This seems to be required in order to eventually set - // the auth-user var. - pblock_nvinsert("auth-type","shibboleth",rq->vars); - res = stn.getServiceProvider().doExport(stn); if (res.first) return (int)res.second; @@ -431,7 +512,7 @@ extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, ::Session* sn, Request* rq) // this user is ok. return REQ_PROCEED; } - catch (exception& e) { + catch (std::exception& e) { log_error(LOG_FAILURE,FUNC,sn,rq,const_cast(e.what())); return WriteClientError(sn, rq, FUNC, "Shibboleth module threw an exception, see web server log for error."); } @@ -448,9 +529,9 @@ extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, ::Session* sn, Request* rq) #define FUNC "shib_handler" extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, ::Session* sn, Request* rq) { - ostringstream threadid; - threadid << "[" << getpid() << "] shib_handler" << '\0'; - xmltooling::NDC ndc(threadid.str().c_str()); + string threadid("["); + threadid += lexical_cast(getpid()) + "] shib_handler"; + xmltooling::NDC ndc(threadid.c_str()); try { ShibTargetNSAPI stn(pb, sn, rq); @@ -460,7 +541,7 @@ extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, ::Session* sn, Request* rq) return WriteClientError(sn, rq, FUNC, "Shibboleth handler did not do anything."); } - catch (exception& e) { + catch (std::exception& e) { log_error(LOG_FAILURE,FUNC,sn,rq,const_cast(e.what())); return WriteClientError(sn, rq, FUNC, "Shibboleth handler threw an exception, see web server log for error."); } @@ -477,26 +558,25 @@ class SunRequestMapper : public virtual RequestMapper, public virtual PropertySe { public: SunRequestMapper(const xercesc::DOMElement* e); - ~SunRequestMapper() { delete m_mapper; delete m_stKey; delete m_propsKey; } + ~SunRequestMapper() {} Lockable* lock() { return m_mapper->lock(); } - void unlock() { m_stKey->setData(NULL); m_propsKey->setData(NULL); m_mapper->unlock(); } + void unlock() { m_stKey->setData(nullptr); m_propsKey->setData(nullptr); m_mapper->unlock(); } Settings getSettings(const HTTPRequest& request) const; - const PropertySet* getParent() const { return NULL; } + const PropertySet* getParent() const { return nullptr; } void setParent(const PropertySet*) {} - pair getBool(const char* name, const char* ns=NULL) const; - pair getString(const char* name, const char* ns=NULL) const; - pair getXMLString(const char* name, const char* ns=NULL) const; - pair getUnsignedInt(const char* name, const char* ns=NULL) const; - pair getInt(const char* name, const char* ns=NULL) const; + pair getBool(const char* name, const char* ns=nullptr) const; + pair getString(const char* name, const char* ns=nullptr) const; + pair getXMLString(const char* name, const char* ns=nullptr) const; + pair getUnsignedInt(const char* name, const char* ns=nullptr) const; + pair getInt(const char* name, const char* ns=nullptr) const; void getAll(map& properties) const; const PropertySet* getPropertySet(const char* name, const char* ns=shibspconstants::ASCII_SHIB2SPCONFIG_NS) const; const xercesc::DOMElement* getElement() const; private: - RequestMapper* m_mapper; - ThreadKey* m_stKey; - ThreadKey* m_propsKey; + scoped_ptr m_mapper; + scoped_ptr m_stKey, m_propsKey; }; RequestMapper* SunRequestMapFactory(const xercesc::DOMElement* const & e) @@ -504,11 +584,11 @@ RequestMapper* SunRequestMapFactory(const xercesc::DOMElement* const & e) return new SunRequestMapper(e); } -SunRequestMapper::SunRequestMapper(const xercesc::DOMElement* e) : m_mapper(NULL), m_stKey(NULL), m_propsKey(NULL) +SunRequestMapper::SunRequestMapper(const xercesc::DOMElement* e) + : m_mapper(SPConfig::getConfig().RequestMapperManager.newPlugin(XML_REQUEST_MAPPER,e)), + m_stKey(ThreadKey::create(nullptr)), + m_propsKey(ThreadKey::create(nullptr)) { - m_mapper = SPConfig::getConfig().RequestMapperManager.newPlugin(XML_REQUEST_MAPPER,e); - m_stKey=ThreadKey::create(NULL); - m_propsKey=ThreadKey::create(NULL); } RequestMapper::Settings SunRequestMapper::getSettings(const HTTPRequest& request) const @@ -546,13 +626,13 @@ pair SunRequestMapper::getString(const char* name, const char* return make_pair(true,param); } } - return s ? s->getString(name,ns) : pair(false,NULL); + return s ? s->getString(name,ns) : pair(false,nullptr); } pair SunRequestMapper::getXMLString(const char* name, const char* ns) const { const PropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getXMLString(name,ns) : pair(false,NULL); + return s ? s->getXMLString(name,ns) : pair(false,nullptr); } pair SunRequestMapper::getUnsignedInt(const char* name, const char* ns) const @@ -562,8 +642,14 @@ pair SunRequestMapper::getUnsignedInt(const char* name, const if (stn && !ns && name) { // Override int properties. const char* param=pblock_findval(name,stn->m_pb); - if (param) - return pair(true,strtol(param,NULL,10)); + if (param) { + try { + return pair(true,lexical_cast(param)); + } + catch (bad_lexical_cast&) { + return pair(false,0); + } + } } return s ? s->getUnsignedInt(name,ns) : pair(false,0); } @@ -603,11 +689,11 @@ void SunRequestMapper::getAll(map& properties) const const PropertySet* SunRequestMapper::getPropertySet(const char* name, const char* ns) const { const PropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getPropertySet(name,ns) : NULL; + return s ? s->getPropertySet(name,ns) : nullptr; } const xercesc::DOMElement* SunRequestMapper::getElement() const { const PropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getElement() : NULL; + return s ? s->getElement() : nullptr; }