Handle non-existent creds.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@1588 cb58f699-b61c-0410-a6fe-9272a202ed29

diff --git a/shib-target/shib-ccache.cpp b/shib-target/shib-ccache.cpp
index 26ee250..d700e0a 100644 (file)
--- a/shib-target/shib-ccache.cpp
+++ b/shib-target/shib-ccache.cpp
@@ -720,6 +720,7 @@ pair<SAMLResponse*,SAMLResponse*> InternalCCacheEntry::getNewResponse()
     const IPropertySet* credUse=application->getCredentialUse(site);
     pair<bool,bool> signRequest=credUse ? credUse->getBool("signRequest") : make_pair(false,false);
     pair<bool,bool> signedResponse=credUse ? credUse->getBool("signedResponse") : make_pair(false,false);
+    pair<bool,const char*> signingCred=credUse ? credUse->getString("Signing") : pair<bool,const char*>(false,NULL);
     
     SAMLResponse* response = NULL;
     try {
@@ -732,10 +733,13 @@ pair<SAMLResponse*,SAMLResponse*> InternalCCacheEntry::getNewResponse()
         auto_ptr<SAMLRequest> req(new SAMLRequest(q));
         
         // Sign it? Highly doubtful we'll ever use this, but just for fun...
-        if (signRequest.first && signRequest.second) {
+        if (signRequest.first && signRequest.second && signingCred.first) {
             Credentials creds(conf->getCredentialsProviders());
-            const ICredResolver* signingCred=creds.lookup(credUse->getString("Signing").second);
-            req->sign(SIGNATURE_RSA,signingCred->getKey(),signingCred->getCertificates());
+            const ICredResolver* cr=creds.lookup(signingCred.second);
+            if (cr)
+                req->sign(SIGNATURE_RSA,cr->getKey(),cr->getCertificates());
+            else
+                log->error("unable to sign attribute query, specified credential (%) was not found",signingCred.second);
         }
             
         log->debug("trying to query an AA...");

diff --git a/shib/ShibHTTPHook.cpp b/shib/ShibHTTPHook.cpp
index b71d604..a8aeebd 100644 (file)
--- a/shib/ShibHTTPHook.cpp
+++ b/shib/ShibHTTPHook.cpp
@@ -65,46 +65,44 @@ using namespace log4cpp;
 using namespace shibboleth;
 using namespace saml;
 
-extern "C" {
-    /*
-     * Our verifier callback is a front-end for invoking each trust plugin until
-     * success, or we run out of plugins.
-     */
-    int verify_callback(X509_STORE_CTX* x509_ctx, void* arg)
-    {
-        Category::getInstance("OpenSSL").debug("invoking default X509 verify callback");
+/*
+ * Our verifier callback is a front-end for invoking each trust plugin until
+ * success, or we run out of plugins.
+ */
+static int verify_callback(X509_STORE_CTX* x509_ctx, void* arg)
+{
+    Category::getInstance("OpenSSL").debug("invoking default X509 verify callback");
 #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-        ShibHTTPHook::ShibHTTPHookCallContext* ctx = reinterpret_cast<ShibHTTPHook::ShibHTTPHookCallContext*>(arg);
+    ShibHTTPHook::ShibHTTPHookCallContext* ctx = reinterpret_cast<ShibHTTPHook::ShibHTTPHookCallContext*>(arg);
 #else
-        // Yes, this sucks. I'd use TLS, but there's no really obvious spot to put the thread key
-        // and global variables suck too.
-        ShibHTTPHook::ShibHTTPHookCallContext* ctx =
-            reinterpret_cast<ShibHTTPHook::ShibHTTPHookCallContext*>(x509_ctx->depth);
+    // Yes, this sucks. I'd use TLS, but there's no really obvious spot to put the thread key
+    // and global variables suck too.
+    ShibHTTPHook::ShibHTTPHookCallContext* ctx =
+        reinterpret_cast<ShibHTTPHook::ShibHTTPHookCallContext*>(x509_ctx->depth);
 #endif
 
-        // Instead of using the supplied verifier, we let the plugins do whatever they want to do
-        // with the untrusted certificates we find in the object. We can save a bit of memory by
-        // just building a vector that points at them inside the supplied structure.
-        vector<void*> chain;
-        for (int i=0; i<sk_X509_num(x509_ctx->untrusted); i++)
-            chain.push_back(sk_X509_value(x509_ctx->untrusted,i));
-        
-        Trust t(ctx->getHook()->getTrustProviders());
-        if (!t.validate(x509_ctx->cert,chain,ctx->getRoleDescriptor(),false)) { // bypass name check (handled for us)
-            x509_ctx->error=X509_V_ERR_APPLICATION_VERIFICATION;     // generic error, check log for plugin specifics
-            return 0;
-        }
-        
-        // Signal success. Hopefully it doesn't matter what's actually in the structure now.
-        return 1;
+    // Instead of using the supplied verifier, we let the plugins do whatever they want to do
+    // with the untrusted certificates we find in the object. We can save a bit of memory by
+    // just building a vector that points at them inside the supplied structure.
+    vector<void*> chain;
+    for (int i=0; i<sk_X509_num(x509_ctx->untrusted); i++)
+        chain.push_back(sk_X509_value(x509_ctx->untrusted,i));
+    
+    Trust t(ctx->getHook()->getTrustProviders());
+    if (!t.validate(x509_ctx->cert,chain,ctx->getRoleDescriptor(),false)) { // bypass name check (handled for us)
+        x509_ctx->error=X509_V_ERR_APPLICATION_VERIFICATION;     // generic error, check log for plugin specifics
+        return 0;
     }
+    
+    // Signal success. Hopefully it doesn't matter what's actually in the structure now.
+    return 1;
 }
 
 /*
  * OpenSAML callback is invoked during SSL context setup, before the handshake.
  * We use it to attach credentials and our own certificate verifier callback above.
  */
-bool ssl_ctx_callback(void* ssl_ctx, void* userptr)
+static bool ssl_ctx_callback(void* ssl_ctx, void* userptr)
 {
 #ifdef _DEBUG
     saml::NDC("ssl_ctx_callback");
@@ -114,13 +112,15 @@ bool ssl_ctx_callback(void* ssl_ctx, void* userptr)
     try {
         log.debug("OpenSAML invoked SSL context callback");
         ShibHTTPHook::ShibHTTPHookCallContext* ctx = reinterpret_cast<ShibHTTPHook::ShibHTTPHookCallContext*>(userptr);
-        Credentials c(ctx->getHook()->getCredentialProviders());
-        const ICredResolver* cr=c.lookup(ctx->getCredResolverId());
-        if (cr)
-            cr->attach(ssl_ctx);
-        else {
-            log.error("unable to attach credentials to request");
-            return false;
+        if (ctx->getCredResolverId()) {
+            Credentials c(ctx->getHook()->getCredentialProviders());
+            const ICredResolver* cr=c.lookup(ctx->getCredResolverId());
+            if (cr)
+                cr->attach(ssl_ctx);
+            else {
+                log.error("unable to attach credentials to request");
+                return false;
+            }
         }
         
         SSL_CTX_set_verify(reinterpret_cast<SSL_CTX*>(ssl_ctx),SSL_VERIFY_PEER,NULL);