//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth ADFS Plugins\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "adfs\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "adfs.so\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Apache 1.3 Module\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "mod_shib_13\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "mod_shib_13.so\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Apache 2.0 Module\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "mod_shib_20\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "mod_shib_20.so\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Apache 2.2 Module\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "mod_shib_22\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "mod_shib_22.so\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
#define PACKAGE_NAME "shibboleth"
/* Define to the full name and version of this package. */
-#define PACKAGE_STRING "shibboleth 1.3.2"
+#define PACKAGE_STRING "shibboleth 1.3.3"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "shibboleth"
/* Define to the version of this package. */
-#define PACKAGE_VERSION "1.3.2"
+#define PACKAGE_VERSION "1.3.3"
/* Define to the necessary symbol if this constant uses a non-standard name on
your system. */
#define USE_OUR_ONCRPC 1
/* Version number of package */
-#define VERSION "1.3.2"
+#define VERSION "1.3.3"
/* Define to empty if `const' does not conform to ANSI C. */
/* #undef const */
AC_PREREQ([2.50])
-AC_INIT([shibboleth], [1.3.2], [shibboleth-users@internet2.edu], [shibboleth])
+AC_INIT([shibboleth], [1.3.3], [shibboleth-users@internet2.edu], [shibboleth])
AM_CONFIG_HEADER(config.h)
-AM_INIT_AUTOMAKE([shibboleth],[1.3.2])
+AM_INIT_AUTOMAKE([shibboleth],[1.3.3])
sinclude(acx_pthread.m4)
sinclude(acx_rpctest.m4)
//\r
\r
VS_VERSION_INFO VERSIONINFO\r
- FILEVERSION 1,3,2,0\r
- PRODUCTVERSION 1,3,2,0\r
+ FILEVERSION 1,3,3,0\r
+ PRODUCTVERSION 1,3,3,0\r
FILEFLAGSMASK 0x3fL\r
#ifdef _DEBUG\r
FILEFLAGS 0x1L\r
VALUE "Comments", "\0"\r
VALUE "CompanyName", "Internet2\0"\r
VALUE "FileDescription", "Shibboleth FastCGI Authorizer\0"\r
- VALUE "FileVersion", "1, 3, 2, 0\0"\r
+ VALUE "FileVersion", "1, 3, 3, 0\0"\r
VALUE "InternalName", "shibauthorizer\0"\r
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"\r
VALUE "LegalTrademarks", "\0"\r
VALUE "OriginalFilename", "shibauthorizer.exe\0"\r
VALUE "PrivateBuild", "\0"\r
VALUE "ProductName", "Shibboleth\0"\r
- VALUE "ProductVersion", "1, 3, 2, 0\0"\r
+ VALUE "ProductVersion", "1, 3, 3, 0\0"\r
VALUE "SpecialBuild", "\0"\r
END\r
END\r
//\r
\r
VS_VERSION_INFO VERSIONINFO\r
- FILEVERSION 1,3,2,0\r
- PRODUCTVERSION 1,3,2,0\r
+ FILEVERSION 1,3,3,0\r
+ PRODUCTVERSION 1,3,3,0\r
FILEFLAGSMASK 0x3fL\r
#ifdef _DEBUG\r
FILEFLAGS 0x1L\r
VALUE "Comments", "\0"\r
VALUE "CompanyName", "Internet2\0"\r
VALUE "FileDescription", "Shibboleth FastCGI Responder\0"\r
- VALUE "FileVersion", "1, 3, 2, 0\0"\r
+ VALUE "FileVersion", "1, 3, 3, 0\0"\r
VALUE "InternalName", "shibresponder\0"\r
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"\r
VALUE "LegalTrademarks", "\0"\r
VALUE "OriginalFilename", "shibresponder.exe\0"\r
VALUE "PrivateBuild", "\0"\r
VALUE "ProductName", "Shibboleth\0"\r
- VALUE "ProductVersion", "1, 3, 2, 0\0"\r
+ VALUE "ProductVersion", "1, 3, 3, 0\0"\r
VALUE "SpecialBuild", "\0"\r
END\r
END\r
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth ISAPI Filter / Extension\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "isapi_shib\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "isapi_shib.dll\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth NSAPI Extension\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "nsapi_shib\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "nsapi_shib.dll\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Daemon Service\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "shibd\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "shibd.exe\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
# this is different from the project version
# http://sources.redhat.com/autobook/autobook/autobook_91.html
-libshib_target_la_LDFLAGS = -version-info 5:1:0
+libshib_target_la_LDFLAGS = -version-info 5:3:0
/*
- * Copyright 2001-2005 Internet2
+ * Copyright 2001-2009 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
mutable IReplayCache* m_replayCache;
mutable vector<IAttributeFactory*> m_attrFactories;
};
+
+#ifdef WIN32
+ BOOL LogEvent(
+ LPCSTR lpUNCServerName,
+ WORD wType,
+ DWORD dwEventID,
+ PSID lpUserSid,
+ LPCSTR message)
+ {
+ LPCSTR messages[] = {message, NULL};
+
+ HANDLE hElog = RegisterEventSource(lpUNCServerName, "Shibboleth SP Library");
+ BOOL res = ReportEvent(hElog, wType, 0, dwEventID, lpUserSid, 1, 0, messages, NULL);
+ return (DeregisterEventSource(hElog) && res);
+ }
+#endif
}
IConfig* STConfig::ShibTargetConfigFactory(const DOMElement* e)
PropertyConfigurator::configure(logpath.get());
}
catch (ConfigureFailure& e) {
- log.error("Error reading logging configuration: %s",e.what());
+ string msg = string("Error loading logging configuration: ") + e.what();
+ log.crit(msg);
+ #ifdef WIN32
+ LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
+ #endif
}
}
}
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 5,2,0,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 5,3,0,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth SP Library\0"
- VALUE "FileVersion", "5, 2, 0, 0\0"
+ VALUE "FileVersion", "5, 3, 0, 0\0"
#ifdef _DEBUG
VALUE "InternalName", "shibtarget_5D\0"
#else
#endif
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386
-# ADD LINK32 wsock32.lib libeay32.lib ssleay32.lib xerces-c_2.lib log4shib1.lib saml_5.lib /nologo /dll /machine:I386 /out:"Release/shibtarget_5.dll" /libpath:"..\..\cpp-opensaml1\saml\Release"
+# ADD LINK32 libeay32.lib ssleay32.lib xerces-c_2.lib log4shib1.lib saml_5.lib wsock32.lib advapi32.lib /nologo /dll /machine:I386 /out:"Release/shibtarget_5.dll" /libpath:"..\..\cpp-opensaml1\saml\Release"
# SUBTRACT LINK32 /pdb:none
!ELSEIF "$(CFG)" == "shibtarget - Win32 Debug"
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 wsock32.lib libeay32D.lib ssleay32D.lib xerces-c_2D.lib log4shib1D.lib saml_5D.lib /nologo /dll /debug /machine:I386 /out:"Debug/shibtarget_5D.dll" /pdbtype:sept /libpath:"..\..\cpp-opensaml1\saml\Debug"
+# ADD LINK32 libeay32D.lib ssleay32D.lib xerces-c_2D.lib log4shib1D.lib saml_5D.lib wsock32.lib advapi32.lib /nologo /dll /debug /machine:I386 /out:"Debug/shibtarget_5D.dll" /pdbtype:sept /libpath:"..\..\cpp-opensaml1\saml\Debug"
# SUBTRACT LINK32 /pdb:none
!ENDIF
# this is different from the project version
# http://sources.redhat.com/autobook/autobook/autobook_91.html
-libshib_la_LDFLAGS = -version-info 6:1:0
+libshib_la_LDFLAGS = -version-info 6:3:0
install-exec-hook:
for la in $(lib_LTLIBRARIES) ; do rm -f $(DESTDIR)$(libdir)/$$la ; done
/*
- * Copyright 2001-2005 Internet2
+ * Copyright 2001-2009 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
auto_ptr<char> kn(toUTF8(role->getEntityDescriptor()->getId()));
keynames.push_back(kn.get());
- char buf[256];
X509* x=(X509*)certEE;
X509_NAME* subject=X509_get_subject_name(x);
if (subject) {
// Seems that the way to do the compare is to write the X509_NAME into a BIO.
BIO* b = BIO_new(BIO_s_mem());
BIO* b2 = BIO_new(BIO_s_mem());
- BIO_set_mem_eof_return(b, 0);
- BIO_set_mem_eof_return(b2, 0);
// The flags give us LDAP order instead of X.500, with a comma separator.
int len=X509_NAME_print_ex(b,subject,0,XN_FLAG_RFC2253);
- string subjectstr,subjectstr2;
BIO_flush(b);
- while ((len = BIO_read(b, buf, 255)) > 0) {
- buf[len] = '\0';
- subjectstr+=buf;
- }
- if (log.isDebugEnabled())
- log.debugStream() << "certificate subject: " << subjectstr << logging::eol;
// The flags give us LDAP order instead of X.500, with a comma plus space separator.
len=X509_NAME_print_ex(b2,subject,0,XN_FLAG_RFC2253 + XN_FLAG_SEP_CPLUS_SPC - XN_FLAG_SEP_COMMA_PLUS);
BIO_flush(b2);
- while ((len = BIO_read(b2, buf, 255)) > 0) {
- buf[len] = '\0';
- subjectstr2+=buf;
+
+ BUF_MEM* bptr=NULL;
+ BUF_MEM* bptr2=NULL;
+ BIO_get_mem_ptr(b, &bptr);
+ BIO_get_mem_ptr(b2, &bptr2);
+
+ if (bptr && bptr->length > 0 && log.isDebugEnabled()) {
+ string subjectstr(bptr->data, bptr->length);
+ log.debug("certificate subject: %s", subjectstr.c_str());
}
// Check each keyname.
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if (!strcasecmp(n->c_str(),subjectstr.c_str()) || !strcasecmp(n->c_str(),subjectstr2.c_str())) {
+ if ((n->length() == bptr->length && !strncasecmp(n->c_str(), bptr->data, bptr->length)) ||
+ (n->length() == bptr2->length && !strncasecmp(n->c_str(), bptr2->data, bptr2->length))) {
#else
- if (!stricmp(n->c_str(),subjectstr.c_str()) || !stricmp(n->c_str(),subjectstr2.c_str())) {
+ if ((n->length() == bptr->length && !strnicmp(n->c_str(), bptr->data, bptr->length)) ||
+ (n->length() == bptr2->length && !strnicmp(n->c_str(), bptr2->data, bptr2->length))) {
#endif
log.debug("matched full subject DN to a key name (%s)", n->c_str());
checkName=false;
if (check->type==GEN_DNS || check->type==GEN_URI) {
const char* altptr = (char*)ASN1_STRING_data(check->d.ia5);
const int altlen = ASN1_STRING_length(check->d.ia5);
-
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if ((check->type==GEN_DNS && !strncasecmp(altptr,n->c_str(),altlen))
+ if ((check->type==GEN_DNS && n->length()==altlen && !strncasecmp(altptr,n->c_str(),altlen))
#else
- if ((check->type==GEN_DNS && !strnicmp(altptr,n->c_str(),altlen))
+ if ((check->type==GEN_DNS && n->length()==altlen && !strnicmp(altptr,n->c_str(),altlen))
#endif
- || (check->type==GEN_URI && !strncmp(altptr,n->c_str(),altlen))) {
+ || (check->type==GEN_URI && n->length()==altlen && !strncmp(altptr,n->c_str(),altlen))) {
log.debug("matched DNS/URI subjectAltName to a key name (%s)", n->c_str());
checkName=false;
break;
if (checkName) {
log.debug("unable to match subjectAltName, trying TLS CN match");
- memset(buf,0,sizeof(buf));
- if (X509_NAME_get_text_by_NID(subject,NID_commonName,buf,255)>0) {
+
+ // Fetch the last CN RDN.
+ char* peer_CN = NULL;
+ int j,i = -1;
+ while ((j=X509_NAME_get_index_by_NID(subject, NID_commonName, i)) >= 0)
+ i = j;
+ if (i >= 0) {
+ ASN1_STRING* tmp = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject, i));
+ // Copied in from libcurl.
+ /* In OpenSSL 0.9.7d and earlier, ASN1_STRING_to_UTF8 fails if the input
+ is already UTF-8 encoded. We check for this case and copy the raw
+ string manually to avoid the problem. */
+ if(tmp && ASN1_STRING_type(tmp) == V_ASN1_UTF8STRING) {
+ j = ASN1_STRING_length(tmp);
+ if(j >= 0) {
+ peer_CN = (char*)OPENSSL_malloc(j + 1);
+ memcpy(peer_CN, ASN1_STRING_data(tmp), j);
+ peer_CN[j] = '\0';
+ }
+ }
+ else /* not a UTF8 name */ {
+ j = ASN1_STRING_to_UTF8(reinterpret_cast<unsigned char**>(&peer_CN), tmp);
+ }
+
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if (!strcasecmp(buf,n->c_str())) {
+ if (n->length() == j && !strncasecmp(peer_CN, n->c_str(), j)) {
#else
- if (!stricmp(buf,n->c_str())) {
+ if (n->length() == j && !strnicmp(peer_CN, n->c_str(), j)) {
#endif
log.debug("matched subject CN to a key name (%s)", n->c_str());
checkName=false;
break;
}
}
+ if(peer_CN)
+ OPENSSL_free(peer_CN);
}
- else
+ else {
log.warn("no common name in certificate subject");
+ }
}
}
}
- else
+ else {
log.error("certificate has no subject?!");
+ }
}
if (checkName) {
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 6,2,0,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 6,3,0,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Core Library\0"
- VALUE "FileVersion", "6, 2, 0, 0\0"
+ VALUE "FileVersion", "6, 3, 0, 0\0"
#ifdef _DEBUG
VALUE "InternalName", "shib_6D\0"
#else
#endif
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END
%{_libdir}/libshib-target.so
%changelog
+* Tue Aug 4 2009 Scott Cantor <cantor.2@osu.edu> - 1.3.3-1
+- 1.3.3 release
+
* Fri Jun 12 2009 Scott Cantor <cantor.2@osu.edu> - 1.3.2-1
- 1.3.2 release
/*
- * Copyright 2001-2005 Internet2
+ * Copyright 2001-2009 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
auto_ptr<char> kn(toUTF8(role->getEntityDescriptor()->getId()));
keynames.push_back(kn.get());
- char buf[256];
X509* x=(X509*)certEE;
X509_NAME* subject=X509_get_subject_name(x);
if (subject) {
// Seems that the way to do the compare is to write the X509_NAME into a BIO.
BIO* b = BIO_new(BIO_s_mem());
BIO* b2 = BIO_new(BIO_s_mem());
- BIO_set_mem_eof_return(b, 0);
- BIO_set_mem_eof_return(b2, 0);
// The flags give us LDAP order instead of X.500, with a comma separator.
int len=X509_NAME_print_ex(b,subject,0,XN_FLAG_RFC2253);
- string subjectstr,subjectstr2;
BIO_flush(b);
- while ((len = BIO_read(b, buf, 255)) > 0) {
- buf[len] = '\0';
- subjectstr+=buf;
- }
- if (log.isDebugEnabled())
- log.debugStream() << "certificate subject: " << subjectstr << xmlproviders::logging::eol;
// The flags give us LDAP order instead of X.500, with a comma plus space separator.
len=X509_NAME_print_ex(b2,subject,0,XN_FLAG_RFC2253 + XN_FLAG_SEP_CPLUS_SPC - XN_FLAG_SEP_COMMA_PLUS);
BIO_flush(b2);
- while ((len = BIO_read(b2, buf, 255)) > 0) {
- buf[len] = '\0';
- subjectstr2+=buf;
+
+ BUF_MEM* bptr=NULL;
+ BUF_MEM* bptr2=NULL;
+ BIO_get_mem_ptr(b, &bptr);
+ BIO_get_mem_ptr(b2, &bptr2);
+
+ if (bptr && bptr->length > 0 && log.isDebugEnabled()) {
+ string subjectstr(bptr->data, bptr->length);
+ log.debug("certificate subject: %s", subjectstr.c_str());
}
// Check each keyname.
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if (!strcasecmp(n->c_str(),subjectstr.c_str()) || !strcasecmp(n->c_str(),subjectstr2.c_str())) {
+ if ((n->length() == bptr->length && !strncasecmp(n->c_str(), bptr->data, bptr->length)) ||
+ (n->length() == bptr2->length && !strncasecmp(n->c_str(), bptr2->data, bptr2->length))) {
#else
- if (!stricmp(n->c_str(),subjectstr.c_str()) || !stricmp(n->c_str(),subjectstr2.c_str())) {
+ if ((n->length() == bptr->length && !strnicmp(n->c_str(), bptr->data, bptr->length)) ||
+ (n->length() == bptr2->length && !strnicmp(n->c_str(), bptr2->data, bptr2->length))) {
#endif
log.debug("matched full subject DN to a key name (%s)", n->c_str());
checkName=false;
STACK_OF(GENERAL_NAME)* altnames=(STACK_OF(GENERAL_NAME)*)X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
if (altnames) {
int numalts = sk_GENERAL_NAME_num(altnames);
- for (int an=0; !checkName && an<numalts; an++) {
+ for (int an=0; checkName && an<numalts; an++) {
const GENERAL_NAME* check = sk_GENERAL_NAME_value(altnames, an);
if (check->type==GEN_DNS || check->type==GEN_URI) {
const char* altptr = (char*)ASN1_STRING_data(check->d.ia5);
const int altlen = ASN1_STRING_length(check->d.ia5);
-
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if (!strncasecmp(altptr,n->c_str(),altlen)) {
+ if ((check->type==GEN_DNS && n->length()==altlen && !strncasecmp(altptr,n->c_str(),altlen))
#else
- if (!strnicmp(altptr,n->c_str(),altlen)) {
+ if ((check->type==GEN_DNS && n->length()==altlen && !strnicmp(altptr,n->c_str(),altlen))
#endif
+ || (check->type==GEN_URI && n->length()==altlen && !strncmp(altptr,n->c_str(),altlen))) {
log.debug("matched DNS/URI subjectAltName to a key name (%s)", n->c_str());
checkName=false;
break;
if (checkName) {
log.debug("unable to match subjectAltName, trying TLS CN match");
- memset(buf,0,sizeof(buf));
- if (X509_NAME_get_text_by_NID(subject,NID_commonName,buf,255)>0) {
+
+ // Fetch the last CN RDN.
+ char* peer_CN = NULL;
+ int j,i = -1;
+ while ((j=X509_NAME_get_index_by_NID(subject, NID_commonName, i)) >= 0)
+ i = j;
+ if (i >= 0) {
+ ASN1_STRING* tmp = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject, i));
+ // Copied in from libcurl.
+ /* In OpenSSL 0.9.7d and earlier, ASN1_STRING_to_UTF8 fails if the input
+ is already UTF-8 encoded. We check for this case and copy the raw
+ string manually to avoid the problem. */
+ if(tmp && ASN1_STRING_type(tmp) == V_ASN1_UTF8STRING) {
+ j = ASN1_STRING_length(tmp);
+ if(j >= 0) {
+ peer_CN = (char*)OPENSSL_malloc(j + 1);
+ memcpy(peer_CN, ASN1_STRING_data(tmp), j);
+ peer_CN[j] = '\0';
+ }
+ }
+ else /* not a UTF8 name */ {
+ j = ASN1_STRING_to_UTF8(reinterpret_cast<unsigned char**>(&peer_CN), tmp);
+ }
+
for (vector<string>::const_iterator n=keynames.begin(); n!=keynames.end(); n++) {
#ifdef HAVE_STRCASECMP
- if (!strcasecmp(buf,n->c_str())) {
+ if (n->length() == j && !strncasecmp(peer_CN, n->c_str(), j)) {
#else
- if (!stricmp(buf,n->c_str())) {
+ if (n->length() == j && !strnicmp(peer_CN, n->c_str(), j)) {
#endif
log.debug("matched subject CN to a key name (%s)", n->c_str());
checkName=false;
break;
}
}
+ if(peer_CN)
+ OPENSSL_free(peer_CN);
}
- else
+ else {
log.warn("no common name in certificate subject");
+ }
}
}
}
- else
+ else {
log.error("certificate has no subject?!");
+ }
}
if (checkName) {
//
VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,3,2,0
- PRODUCTVERSION 1,3,2,0
+ FILEVERSION 1,3,3,0
+ PRODUCTVERSION 1,3,3,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
VALUE "Comments", "\0"
VALUE "CompanyName", "Internet2\0"
VALUE "FileDescription", "Shibboleth Core Plugins\0"
- VALUE "FileVersion", "1, 3, 2, 0\0"
+ VALUE "FileVersion", "1, 3, 3, 0\0"
VALUE "InternalName", "xmlproviders\0"
VALUE "LegalCopyright", "Copyright © 2009 Internet2\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "xmlproviders.so\0"
VALUE "PrivateBuild", "\0"
VALUE "ProductName", "Shibboleth\0"
- VALUE "ProductVersion", "1, 3, 2, 0\0"
+ VALUE "ProductVersion", "1, 3, 3, 0\0"
VALUE "SpecialBuild", "\0"
END
END