/*
- * Copyright 2001-2005 Internet2
- *
+ * Copyright 2001-2009 Internet2
+ *
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
{ chLatin_n, chLatin_o, chLatin_r, chLatin_m, chLatin_a, chLatin_l, chLatin_i, chLatin_z, chLatin_e,
chLatin_R, chLatin_e, chLatin_q, chLatin_u, chLatin_e, chLatin_s, chLatin_t, chNull
};
+ static const XMLCh safeHeaderNames[] =
+ { chLatin_s, chLatin_a, chLatin_f, chLatin_e, chLatin_H, chLatin_e, chLatin_a, chLatin_d, chLatin_e, chLatin_r,
+ chLatin_N, chLatin_a, chLatin_m, chLatin_e, chLatin_s, chNull
+ };
static const XMLCh Site[] = { chLatin_S, chLatin_i, chLatin_t, chLatin_e, chNull };
struct site_t {
string m_scheme,m_port,m_sslport,m_name;
set<string> m_aliases;
};
-
- struct context_t {
- char* m_user;
- bool m_checked;
- };
-
+
HINSTANCE g_hinstDLL;
ShibTargetConfig* g_Config = NULL;
map<string,site_t> g_Sites;
bool g_bNormalizeRequest = true;
- string g_unsetHeaderValue;
+ string g_unsetHeaderValue,g_spoofKey;
+ set<string> g_allowedSchemes;
bool g_checkSpoofing = true;
bool g_catchAll = true;
+ bool g_bSafeHeaderNames = false;
}
BOOL LogEvent(
LPCSTR message)
{
LPCSTR messages[] = {message, NULL};
-
+
HANDLE hElog = RegisterEventSource(lpUNCServerName, "Shibboleth ISAPI Filter");
BOOL res = ReportEvent(hElog, wType, 0, dwEventID, lpUserSid, 1, 0, messages, NULL);
return (DeregisterEventSource(hElog) && res);
{
if (!pVer)
return FALSE;
-
+
if (!g_Config)
{
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
"Filter startup failed to load configuration, check native log for help.");
return FALSE;
}
-
+
// Access the implementation-specifics for site mappings.
IConfig* conf=g_Config->getINI();
Locker locker(conf);
const IPropertySet* props=conf->getPropertySet("Local");
if (props) {
- pair<bool,const char*> unsetValue=props->getString("unsetHeaderValue");
- if (unsetValue.first)
- g_unsetHeaderValue = unsetValue.second;
pair<bool,bool> flag=props->getBool("checkSpoofing");
g_checkSpoofing = !flag.first || flag.second;
flag=props->getBool("catchAll");
g_catchAll = !flag.first || flag.second;
-
+
+ pair<bool,const char*> str=props->getString("unsetHeaderValue");
+ if (str.first)
+ g_unsetHeaderValue = str.second;
+
+ str=props->getString("allowedSchemes");
+ if (str.first) {
+ string schemes=str.second;
+ unsigned int j=0;
+ for (unsigned int i=0; i < schemes.length(); i++) {
+ if (schemes.at(i)==' ') {
+ g_allowedSchemes.insert(schemes.substr(j, i-j));
+ j = i+1;
+ }
+ }
+ g_allowedSchemes.insert(schemes.substr(j, schemes.length()-j));
+ }
+
+ if (g_checkSpoofing) {
+ str = props->getString("spoofKey");
+ if (str.first)
+ g_spoofKey = str.second;
+ else {
+ LogEvent(NULL, EVENTLOG_WARNING_TYPE, 2100, NULL,
+ "Filter generating a pseudorandom anti-spoofing key, consider setting spoofKey yourself.");
+ srand(time(NULL));
+ ostringstream keystr;
+ keystr << rand() << rand() << rand() << rand();
+ g_spoofKey = keystr.str();
+ }
+ }
+
const DOMElement* impl=saml::XML::getFirstChildElement(
props->getElement(),shibtarget::XML::SHIBTARGET_NS,Implementation
);
if (impl && (impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,ISAPI))) {
const XMLCh* ch=impl->getAttributeNS(NULL,normalizeRequest);
g_bNormalizeRequest=(!ch || !*ch || *ch==chDigit_1 || *ch==chLatin_t);
+ ch=impl->getAttributeNS(NULL,safeHeaderNames);
+ g_bSafeHeaderNames=(ch && (*ch==chDigit_1 || *ch==chLatin_t));
impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,Site);
while (impl) {
auto_ptr_char id(impl->getAttributeNS(NULL,id));
}
}
}
+ if (g_allowedSchemes.empty()) {
+ g_allowedSchemes.insert("https");
+ g_allowedSchemes.insert("http");
+ }
}
catch (exception&) {
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter startup failed with an exception.");
PHTTP_FILTER_PREPROC_HEADERS m_pn;
string m_cookie;
dynabuf m_allhttp;
+ bool m_firsttime;
+
+ void checkString(const string& s, const char* msg) {
+ string::const_iterator e = s.end();
+ for (string::const_iterator i=s.begin(); i!=e; ++i) {
+ if (iscntrl(*i))
+ throw FatalProfileException(msg);
+ }
+ }
public:
ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site)
- : m_pfc(pfc), m_pn(pn), m_allhttp(4096) {
+ : m_pfc(pfc), m_pn(pn), m_allhttp(4096), m_firsttime(true) {
// URL path always come from IIS.
dynabuf url(256);
strncpy(port,site.m_port.c_str(),10);
static_cast<char*>(port)[10]=0;
}
-
+
// Scheme may come from site def or be derived from IIS.
const char* scheme=site.m_scheme.c_str();
if (!scheme || !*scheme || !g_bNormalizeRequest)
host=site.m_name.c_str();
init(scheme, host, atoi(port), url, content_type, remote_addr, method);
- if (!pfc->pFilterContext) {
- pfc->pFilterContext = pfc->AllocMem(pfc, sizeof(context_t), NULL);
- if (static_cast<context_t*>(pfc->pFilterContext)) {
- static_cast<context_t*>(pfc->pFilterContext)->m_user = NULL;
- static_cast<context_t*>(pfc->pFilterContext)->m_checked = false;
- }
+
+ if (!g_spoofKey.empty()) {
+ GetHeader(pn, pfc, "ShibSpoofCheck:", url, 32, false);
+ if (!url.empty() && g_spoofKey == (char*)url)
+ m_firsttime = false;
}
+
+ if (!m_firsttime)
+ log(LogLevelDebug, "ISAPI filter running more than once");
}
~ShibTargetIsapiF() {}
GetHeader(m_pn, m_pfc, "Cookie:", buf, 128, false);
return buf.empty() ? "" : buf;
}
-
+ string makeSafeHeader(const char* rawname) const {
+ string hdr;
+ for (; *rawname; ++rawname) {
+ if (isalnum(*rawname))
+ hdr += *rawname;
+ }
+ return hdr + ':';
+ }
virtual void clearHeader(const string &name) {
- if (g_checkSpoofing && m_pfc->pFilterContext && !static_cast<context_t*>(m_pfc->pFilterContext)->m_checked) {
+ if (g_checkSpoofing && m_firsttime) {
if (m_allhttp.empty())
GetServerVariable(m_pfc,"ALL_HTTP",m_allhttp,4096);
// Map to the expected CGI variable name.
string transformed("HTTP_");
- const char* pch = name.c_str();
- while (*pch) {
- transformed += (isalnum(*pch) ? toupper(*pch) : '_');
- pch++;
+ if (g_bSafeHeaderNames) {
+ string temp = makeSafeHeader(name.c_str());
+ for (const char* pch = temp.c_str(); *pch; ++pch) {
+ if (isalnum(*pch))
+ transformed += toupper(*pch);
+ }
+ }
+ else {
+ for (const char* pch = name.c_str(); *pch; ++pch)
+ transformed += (isalnum(*pch) ? toupper(*pch) : '_');
+ transformed += ':';
}
- transformed += ':';
if (strstr(m_allhttp, transformed.c_str()))
- throw SAMLException("Attempt to spoof header ($1) was detected.", params(1, name.c_str()));
+ throw SAMLException("Attempt to spoof header ($1) was detected.", params(1, transformed.c_str()));
+ }
+ if (g_bSafeHeaderNames) {
+ string hdr = makeSafeHeader(name.c_str());
+ m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(g_unsetHeaderValue.c_str()));
+ }
+ else if (name == "REMOTE_USER") {
+ m_pn->SetHeader(m_pfc, "remote-user:", const_cast<char*>(g_unsetHeaderValue.c_str()));
+ m_pn->SetHeader(m_pfc, "remote_user:", const_cast<char*>(g_unsetHeaderValue.c_str()));
+ }
+ else {
+ string hdr = name + ':';
+ m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(g_unsetHeaderValue.c_str()));
}
- string hdr = (name=="REMOTE_USER" ? "remote-user" : name) + ":";
- m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(g_unsetHeaderValue.c_str()));
}
virtual void setHeader(const string &name, const string &value) {
- string hdr = name + ":";
- m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()),
- const_cast<char*>(value.c_str()));
+ string hdr = g_bSafeHeaderNames ? makeSafeHeader(name.c_str()) : (name + ':');
+ m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(value.c_str()));
}
virtual string getHeader(const string &name) {
- string hdr = name + ":";
- dynabuf buf(1024);
+ string hdr = g_bSafeHeaderNames ? makeSafeHeader(name.c_str()) : (name + ':');
+ dynabuf buf(256);
GetHeader(m_pn, m_pfc, const_cast<char*>(hdr.c_str()), buf, 1024, false);
- return string(buf);
+ return string(buf.empty() ? "" : buf);
}
virtual void setRemoteUser(const string &user) {
setHeader(string("remote-user"), user);
if (m_pfc->pFilterContext) {
if (user.empty())
- static_cast<context_t*>(m_pfc->pFilterContext)->m_user = NULL;
- else if (static_cast<context_t*>(m_pfc->pFilterContext)->m_user = (char*)m_pfc->AllocMem(m_pfc, sizeof(char) * (user.length() + 1), NULL))
- strcpy(static_cast<context_t*>(m_pfc->pFilterContext)->m_user, user.c_str());
+ m_pfc->pFilterContext = NULL;
+ else if (m_pfc->pFilterContext = m_pfc->AllocMem(m_pfc, sizeof(char) * (user.length() + 1), NULL))
+ strcpy(reinterpret_cast<char*>(m_pfc->pFilterContext), user.c_str());
}
}
virtual string getRemoteUser(void) {
int code=200,
const string& content_type="text/html",
const Iterator<header_t>& headers=EMPTY(header_t)) {
+ checkString(content_type, "Detected control character in a response header.");
string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n";
while (headers.hasNext()) {
const header_t& h=headers.next();
+ checkString(h.first, "Detected control character in a response header.");
+ checkString(h.second, "Detected control character in a response header.");
hdr += h.first + ": " + h.second + "\r\n";
}
hdr += "\r\n";
return (void*)SF_STATUS_REQ_FINISHED;
}
virtual void* sendRedirect(const string& url) {
+ checkString(url, "Detected control character in an attempted redirect.");
+ if (g_allowedSchemes.find(url.substr(0, url.find(':'))) == g_allowedSchemes.end())
+ throw FatalProfileException("Invalid scheme in attempted redirect.");
// XXX: Don't support the httpRedirect option, yet.
string hdrs=m_cookie + string("Location: ") + url + "\r\n"
"Content-Type: text/html\r\n"
{
// Is this a log notification?
if (notificationType==SF_NOTIFY_LOG) {
- if (pfc->pFilterContext && static_cast<context_t*>(pfc->pFilterContext)->m_user)
- ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast<context_t*>(pfc->pFilterContext)->m_user;
+ if (pfc->pFilterContext)
+ ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=reinterpret_cast<char*>(pfc->pFilterContext);
return SF_STATUS_REQ_NEXT_NOTIFICATION;
}
map<string,site_t>::const_iterator map_i=g_Sites.find(static_cast<char*>(buf));
if (map_i==g_Sites.end())
return SF_STATUS_REQ_NEXT_NOTIFICATION;
-
+
ostringstream threadid;
threadid << "[" << getpid() << "] isapi_shib" << '\0';
saml::NDC ndc(threadid.str().c_str());
// "false" because we don't override the Shib settings
pair<bool,void*> res = stf.doCheckAuthN();
- if (pfc->pFilterContext)
- static_cast<context_t*>(pfc->pFilterContext)->m_checked = true;
+ if (!g_spoofKey.empty())
+ pn->SetHeader(pfc, "ShibSpoofCheck:", const_cast<char*>(g_spoofKey.c_str()));
if (res.first) return (DWORD)res.second;
-
+
// "false" because we don't override the Shib settings
res = stf.doExportAssertions();
if (res.first) return (DWORD)res.second;
return WriteClientError(pfc,"Shibboleth Filter reached unreachable code, save my walrus!");
}
-
+
/****************************************************************************/
// ISAPI Extension
{
LPEXTENSION_CONTROL_BLOCK m_lpECB;
string m_cookie;
-
+
+ void checkString(const string& s, const char* msg) {
+ string::const_iterator e = s.end();
+ for (string::const_iterator i=s.begin(); i!=e; ++i) {
+ if (iscntrl(*i))
+ throw FatalProfileException(msg);
+ }
+ }
+
public:
ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) {
dynabuf ssl(5);
* the server is set up for proper PATH_INFO handling, or "IIS sucks rabid weasels mode",
* which is the default. No perfect way to tell, but we can take a good guess by checking
* whether the URL is a substring of the PATH_INFO:
- *
+ *
* e.g. for /Shibboleth.sso/SAML/POST
- *
+ *
* Bad mode (default):
* URL: /Shibboleth.sso
* PathInfo: /Shibboleth.sso/SAML/POST
- *
+ *
* Good mode:
* URL: /Shibboleth.sso
* PathInfo: /SAML/POST
*/
-
+
string fullurl;
-
+
// Clearly we're only in bad mode if path info exists at all.
if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) {
if (strstr(lpECB->lpszPathInfo,url))
else {
fullurl = url;
}
-
+
// For consistency with Apache, let's add the query string.
if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) {
fullurl+='?';
virtual void log(ShibLogLevel level, const string &msg) {
ShibTarget::log(level,msg);
- if (level == LogLevelError)
- LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
}
virtual string getCookies() const {
dynabuf buf(128);
virtual string getPostData(void) {
if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB?
throw FatalProfileException("Blocked too-large a submission to profile endpoint.");
- else if (m_lpECB->cbTotalBytes != m_lpECB->cbAvailable) {
- string cgistr;
+ else if (m_lpECB->cbTotalBytes > m_lpECB->cbAvailable) {
+ string cgistr(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
char buf[8192];
- DWORD datalen=m_lpECB->cbTotalBytes;
+ DWORD datalen=m_lpECB->cbTotalBytes - m_lpECB->cbAvailable;
while (datalen) {
DWORD buflen=8192;
BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen);
}
return cgistr;
}
- else
+ else {
return string(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
+ }
}
virtual void* sendPage(
const string &msg,
int code=200,
const string& content_type="text/html",
const Iterator<header_t>& headers=EMPTY(header_t)) {
+ checkString(content_type, "Detected control character in a response header.");
string hdr = m_cookie + "Connection: close\r\nContent-type: " + content_type + "\r\n";
for (int k = 0; k < headers.size(); k++) {
+ checkString(headers[k].first, "Detected control character in a response header.");
+ checkString(headers[k].second, "Detected control character in a response header.");
hdr += headers[k].first + ": " + headers[k].second + "\r\n";
}
hdr += "\r\n";
}
virtual void* sendRedirect(const string& url) {
// XXX: Don't support the httpRedirect option, yet.
+ checkString(url, "Detected control character in an attempted redirect.");
+ if (g_allowedSchemes.find(url.substr(0, url.find(':'))) == g_allowedSchemes.end())
+ throw FatalProfileException("Invalid scheme in attempted redirect.");
string hdrs = m_cookie + "Location: " + url + "\r\n"
"Content-Type: text/html\r\n"
"Content-Length: 40\r\n"
ShibTargetIsapiE ste(lpECB, map_i->second);
pair<bool,void*> res = ste.doHandler();
if (res.first) return (DWORD)res.second;
-
+
return WriteClientError(lpECB, "Shibboleth Extension failed to process request");
}
projects / shibboleth / cpp-sp.git / blobdiff