[cpp-sp COMMIT] /branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Sat Sep 29 13:54:11 2012
New Revision: 3773

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3773&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-447

Modified:
    branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp

Modified: branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp?rev=3773&r1=3772&r2=3773&view=diff
==============================================================================
--- branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp (original)
+++ branches/REL_2/shibsp/impl/StorageServiceSessionCache.cpp Sat Sep 29 13:54:11 2012
@@ -231,6 +231,18 @@
     {
     public:
         StoredSession(SSCache* cache, DDF& obj) : m_obj(obj), m_cache(cache), m_expires(0), m_lastAccess(time(nullptr)) {
+            // Check for old address format.
+            if (m_obj["client_addr"].isstring()) {
+                const char* saddr = m_obj["client_addr"].string();
+                DDF addrobj = m_obj["client_addr"].structure();
+                if (saddr && *saddr) {
+                    if (strchr(saddr, ':'))
+                        addrobj.addmember("6").string(saddr);
+                    else
+                        addrobj.addmember("4").string(saddr);
+                }
+            }
+
             auto_ptr_XMLCh exp(m_obj["expires"].string());
             if (exp.get()) {
                 DateTime iso(exp.get());
@@ -278,8 +290,25 @@
             return m_obj["application_id"].string();
         }
         const char* getClientAddress() const {
-            return m_obj["client_addr"].string();
-        }
+            return m_obj["client_addr"].first().string();
+        }
+
+        const char* getClientAddressV4() const {
+            return m_obj["client_addr"]["4"].string();
+        }
+        const char* getClientAddressV6() const {
+            return m_obj["client_addr"]["6"].string();
+        }
+        void setClientAddress(const char* client_addr) {
+            DDF obj = m_obj["client_addr"];
+            if (!obj.isstruct())
+                obj = m_obj.addmember("client_addr").structure();
+            if (strchr(client_addr, ':'))
+                obj.addmember("6").string(client_addr);
+            else
+                obj.addmember("4").string(client_addr);
+        }
+
         const char* getEntityID() const {
             return m_obj["entity_id"].string();
         }
@@ -419,16 +448,27 @@
 
     // Address check?
     if (client_addr) {
-        if (!XMLString::equals(getClientAddress(),client_addr)) {
-            m_cache->m_log.warn("client address mismatch, client (%s), session (%s)", client_addr, getClientAddress());
-            throw RetryableProfileException(
-                "Your IP address ($1) does not match the address recorded at the time the session was established.",
-                params(1,client_addr)
-                );
-        }
-    }
-
-    if (!timeout)
+        const char* saddr = nullptr;
+        if (strchr(client_addr, ':'))
+            saddr = getClientAddressV6();
+        else
+            saddr = getClientAddressV4();
+        if (saddr && *saddr) {
+            if (!XMLString::equals(saddr, client_addr)) {
+                m_cache->m_log.warn("client address mismatch, client (%s), session (%s)", client_addr, saddr);
+                throw RetryableProfileException(
+                    "Your IP address ($1) does not match the address recorded at the time the session was established.",
+                    params(1, client_addr)
+                    );
+            }
+            client_addr = nullptr;  // clear out parameter as signal that session need not be updated below
+        }
+        else {
+            m_cache->m_log.info("session (%s) not yet bound to client address type, binding it to (%s)", getID(), client_addr);
+        }
+    }
+
+    if (!timeout && !client_addr)
         return;
 
     if (!SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
@@ -438,13 +478,15 @@
         in.addmember("key").string(getID());
         in.addmember("version").integer(m_obj["version"].integer());
         in.addmember("application_id").string(app.getId());
-        if (*timeout) {
+        if (client_addr)    // signals we need to bind an additional address to the session
+            in.addmember("client_addr").string(client_addr);
+        if (timeout && *timeout) {
             // On 64-bit Windows, time_t doesn't fit in a long, so I'm using ISO timestamps.
 #ifndef HAVE_GMTIME_R
-            struct tm* ptime=gmtime(timeout);
+            struct tm* ptime = gmtime(timeout);
 #else
             struct tm res;
-            struct tm* ptime=gmtime_r(timeout,&res);
+            struct tm* ptime = gmtime_r(timeout,&res);
 #endif
             char timebuf[32];
             strftime(timebuf,32,"%Y-%m-%dT%H:%M:%SZ",ptime);
@@ -461,6 +503,7 @@
 
         if (out.isstruct()) {
             // We got an updated record back.
+            m_cache->m_log.debug("session updated, reconstituting it");

[... 255 lines stripped ...]