https://issues.shibboleth.net/jira/browse/CPPOST-47

[shibboleth/cpp-opensaml.git] / saml / saml2 / metadata / impl / AbstractMetadataProvider.cpp

diff --git a/saml/saml2/metadata/impl/AbstractMetadataProvider.cpp b/saml/saml2/metadata/impl/AbstractMetadataProvider.cpp
index 4c89489..3c404e1 100644 (file)
--- a/saml/saml2/metadata/impl/AbstractMetadataProvider.cpp
+++ b/saml/saml2/metadata/impl/AbstractMetadataProvider.cpp
@@ -75,10 +75,13 @@ void AbstractMetadataProvider::emitChangeEvent() const
     ObservableMetadataProvider::emitChangeEvent();
 }
 
-void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil, bool replace) const
+void AbstractMetadataProvider::indexEntity(EntityDescriptor* site, time_t& validUntil, bool replace) const
 {
+    // If child expires later than input, reset child, otherwise lower input to match.
     if (validUntil < site->getValidUntilEpoch())
         site->setValidUntil(validUntil);
+    else
+        validUntil = site->getValidUntilEpoch();
 
     auto_ptr_char id(site->getEntityID());
     if (id.get()) {
@@ -99,16 +102,16 @@ void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil,
     }
     
     // Process each IdP role.
-    const vector<IDPSSODescriptor*>& roles=const_cast<const EntityDescriptor*>(site)->getIDPSSODescriptors();
-    for (vector<IDPSSODescriptor*>::const_iterator i=roles.begin(); i!=roles.end(); i++) {
+    const vector<IDPSSODescriptor*>& roles = const_cast<const EntityDescriptor*>(site)->getIDPSSODescriptors();
+    for (vector<IDPSSODescriptor*>::const_iterator i = roles.begin(); i != roles.end(); i++) {
         // SAML 1.x?
         if ((*i)->hasSupport(samlconstants::SAML10_PROTOCOL_ENUM) || (*i)->hasSupport(samlconstants::SAML11_PROTOCOL_ENUM)) {
             // Check for SourceID extension element.
-            const Extensions* exts=(*i)->getExtensions();
+            const Extensions* exts = (*i)->getExtensions();
             if (exts && exts->hasChildren()) {
-                const vector<XMLObject*>& children=exts->getUnknownXMLObjects();
-                for (vector<XMLObject*>::const_iterator ext=children.begin(); ext!=children.end(); ++ext) {
-                    SourceID* sid=dynamic_cast<SourceID*>(*ext);
+                const vector<XMLObject*>& children = exts->getUnknownXMLObjects();
+                for (vector<XMLObject*>::const_iterator ext = children.begin(); ext != children.end(); ++ext) {
+                    SourceID* sid = dynamic_cast<SourceID*>(*ext);
                     if (sid) {
                         auto_ptr_char sourceid(sid->getID());
                         if (sourceid.get()) {
@@ -123,8 +126,8 @@ void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil,
             m_sources.insert(sitemap_t::value_type(SecurityHelper::doHash("SHA1", id.get(), strlen(id.get())),site));
                 
             // Load endpoints for type 0x0002 artifacts.
-            const vector<ArtifactResolutionService*>& locs=const_cast<const IDPSSODescriptor*>(*i)->getArtifactResolutionServices();
-            for (vector<ArtifactResolutionService*>::const_iterator loc=locs.begin(); loc!=locs.end(); loc++) {
+            const vector<ArtifactResolutionService*>& locs = const_cast<const IDPSSODescriptor*>(*i)->getArtifactResolutionServices();
+            for (vector<ArtifactResolutionService*>::const_iterator loc = locs.begin(); loc != locs.end(); loc++) {
                 auto_ptr_char location((*loc)->getLocation());
                 if (location.get())
                     m_sources.insert(sitemap_t::value_type(location.get(),site));
@@ -139,23 +142,53 @@ void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil,
     }
 }
 
-void AbstractMetadataProvider::index(EntitiesDescriptor* group, time_t validUntil) const
+void AbstractMetadataProvider::indexGroup(EntitiesDescriptor* group, time_t& validUntil) const
 {
+    // If child expires later than input, reset child, otherwise lower input to match.
     if (validUntil < group->getValidUntilEpoch())
         group->setValidUntil(validUntil);
+    else
+        validUntil = group->getValidUntilEpoch();
 
     auto_ptr_char name(group->getName());
     if (name.get()) {
         m_groups.insert(groupmap_t::value_type(name.get(),group));
     }
     
-    const vector<EntitiesDescriptor*>& groups=const_cast<const EntitiesDescriptor*>(group)->getEntitiesDescriptors();
-    for (vector<EntitiesDescriptor*>::const_iterator i=groups.begin(); i!=groups.end(); i++)
-        index(*i,group->getValidUntilEpoch());
+    // Track the smallest validUntil amongst the children.
+    time_t minValidUntil = validUntil;
+
+    const vector<EntitiesDescriptor*>& groups = const_cast<const EntitiesDescriptor*>(group)->getEntitiesDescriptors();
+    for (vector<EntitiesDescriptor*>::const_iterator i = groups.begin(); i != groups.end(); i++) {
+        // Use the current validUntil fence for each child, but track the smallest we find.
+        time_t subValidUntil = validUntil;
+        indexGroup(*i, subValidUntil);
+        if (subValidUntil < minValidUntil)
+            minValidUntil = subValidUntil;
+    }
+
+    const vector<EntityDescriptor*>& sites = const_cast<const EntitiesDescriptor*>(group)->getEntityDescriptors();
+    for (vector<EntityDescriptor*>::const_iterator j = sites.begin(); j != sites.end(); j++) {
+        // Use the current validUntil fence for each child, but track the smallest we find.
+        time_t subValidUntil = validUntil;
+        indexEntity(*j, subValidUntil);
+        if (subValidUntil < minValidUntil)
+            minValidUntil = subValidUntil;
+    }
 
-    const vector<EntityDescriptor*>& sites=const_cast<const EntitiesDescriptor*>(group)->getEntityDescriptors();
-    for (vector<EntityDescriptor*>::const_iterator j=sites.begin(); j!=sites.end(); j++)
-        index(*j,group->getValidUntilEpoch());
+    // Pass back up the smallest child we found.
+    if (minValidUntil < validUntil)
+        validUntil = minValidUntil;
+}
+
+void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil, bool replace) const
+{
+    indexEntity(site, validUntil, replace);
+}
+
+void AbstractMetadataProvider::index(EntitiesDescriptor* group, time_t validUntil) const
+{
+    indexGroup(group, validUntil);
 }
 
 void AbstractMetadataProvider::clearDescriptorIndex(bool freeSites)