[java-shib-idp2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/shibboleth/i...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Dec 11 23:00:25 2012
New Revision: 3127

URL: http://svn.shibboleth.net/view/java-shib-idp2?rev=3127&view=rev
Log:
SIDP-564: Dual address support in IdP session cookie

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=3127&r1=3126&r2=3127&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Tue Dec 11 23:00:25 2012
@@ -5,6 +5,7 @@
 [SIDP-557] - aacli.sh Exception (again)
 [SIDP-559] - Attribute queries are ignoring input designators
 [SIDP-563] - IdP-only SAML logout profile handler
+[SIDP-564] - Happy Eyeballs support for IdP session cookie address checking
 
 Changes in Release 2.3.8
 =============================================

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java?rev=3127&r1=3126&r2=3127&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java Tue Dec 11 23:00:25 2012
@@ -789,14 +789,23 @@
             Session userSession) {
         httpRequest.setAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE, userSession);
 
-        byte[] remoteAddress = httpRequest.getRemoteAddr().getBytes();
+        String remoteAddressStr = httpRequest.getRemoteAddr();
+        boolean isV4 = remoteAddressStr.contains(".");
+        byte[] remoteAddress = remoteAddressStr.getBytes();
         byte[] sessionId = userSession.getSessionID().getBytes();
-
+        byte[] placeholder = "-".getBytes();       
+ 
         String signature = null;
         try {
             MessageDigest digester = MessageDigest.getInstance("SHA");
             digester.update(userSession.getSessionSecret());
-            digester.update(remoteAddress);
+            if (isV4) {
+                digester.update(remoteAddress);
+                digester.update(placeholder);    // placeholder for V6 address
+            } else {
+                digester.update(placeholder);    // placeholder for V4 address
+                digester.update(remoteAddress);
+            }
             digester.update(sessionId);
             signature = Base64.encodeBytes(digester.digest());
         } catch (GeneralSecurityException e) {
@@ -805,7 +814,13 @@
 
         LOG.debug("Adding IdP session cookie to HTTP response");
         StringBuilder cookieValue = new StringBuilder();
-        cookieValue.append(Base64.encodeBytes(remoteAddress, Base64.DONT_BREAK_LINES)).append("|");
+        if (isV4) {
+            cookieValue.append(Base64.encodeBytes(remoteAddress, Base64.DONT_BREAK_LINES)).append("|");
+            cookieValue.append(Base64.encodeBytes(placeholder, Base64.DONT_BREAK_LINES)).append("|");    // placeholder for V6 address
+        } else {
+            cookieValue.append(Base64.encodeBytes(placeholder, Base64.DONT_BREAK_LINES)).append("|");    // placeholder for V4 address
+            cookieValue.append(Base64.encodeBytes(remoteAddress, Base64.DONT_BREAK_LINES)).append("|");
+        }
         cookieValue.append(Base64.encodeBytes(sessionId, Base64.DONT_BREAK_LINES)).append("|");
         cookieValue.append(signature);
 
@@ -820,4 +835,4 @@
         sessionCookie.setSecure(httpRequest.isSecure());
         httpResponse.addCookie(sessionCookie);
     }
-}
+}

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java?rev=3127&r1=3126&r2=3127&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java Tue Dec 11 23:00:25 2012
@@ -25,11 +25,13 @@
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
 import org.joda.time.DateTime;

[... 199 lines stripped ...]