[cpp-sp] 02/02: SSPCPP - 836 - Allow more flexibility in session address check
Scott Cantor
cantor.2 at osu.edu
Fri Oct 4 14:56:49 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=909e90b9664276321f1f234950ecc0ee72e13e96
commit 909e90b9664276321f1f234950ecc0ee72e13e96
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Oct 4 14:55:47 2019 -0400
SSPCPP - 836 - Allow more flexibility in session address check
https://issues.shibboleth.net/jira/browse/SSPCPP-836
---
schemas/shibboleth-3.0-native-sp-config.xsd | 3 ++-
shibsp/impl/StorageServiceSessionCache.cpp | 28 +++++++++++++++++++++++++++-
shibsp/impl/StorageServiceSessionCache.h | 7 ++++++-
shibsp/impl/StoredSession.cpp | 4 ++--
shibsp/impl/StoredSession.h | 2 +-
5 files changed, 38 insertions(+), 6 deletions(-)
diff --git a/schemas/shibboleth-3.0-native-sp-config.xsd b/schemas/shibboleth-3.0-native-sp-config.xsd
index 5bfa3a2..22fd8ee 100644
--- a/schemas/shibboleth-3.0-native-sp-config.xsd
+++ b/schemas/shibboleth-3.0-native-sp-config.xsd
@@ -9,7 +9,7 @@
elementFormDefault="qualified"
attributeFormDefault="unqualified"
blockDefault="substitution"
- version="3.0">
+ version="3.1">
<import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
<import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>
@@ -130,6 +130,7 @@
<attribute name="reverseIndexMaxSize" type="unsignedInt"/>
<attribute name="excludeReverseIndex" type="conf:listOfStrings"/>
<attribute name="persistedAttributes" type="conf:listOfStrings"/>
+ <attribute name="unreliableNetworks" type="conf:listOfStrings"/>
<anyAttribute namespace="##any" processContents="lax"/>
</restriction>
</complexContent>
diff --git a/shibsp/impl/StorageServiceSessionCache.cpp b/shibsp/impl/StorageServiceSessionCache.cpp
index 271395b..0bc8e52 100644
--- a/shibsp/impl/StorageServiceSessionCache.cpp
+++ b/shibsp/impl/StorageServiceSessionCache.cpp
@@ -42,6 +42,7 @@
#include "handler/RemotedHandler.h"
#include "impl/StoredSession.h"
#include "impl/StorageServiceSessionCache.h"
+#include "util/IPRange.h"
#include "util/SPConstants.h"
#include <algorithm>
@@ -53,6 +54,7 @@
#include <xmltooling/util/Threads.h>
#include <xmltooling/util/URLEncoder.h>
#include <xmltooling/util/XMLHelper.h>
+#include <xercesc/util/XMLStringTokenizer.hpp>
#include <xercesc/util/XMLUniDefs.hpp>
#ifndef SHIBSP_LITE
@@ -63,7 +65,6 @@
# include <xmltooling/XMLToolingConfig.h>
# include <xmltooling/util/ParserPool.h>
# include <xmltooling/util/StorageService.h>
-# include <xercesc/util/XMLStringTokenizer.hpp>
using namespace opensaml::saml2md;
#else
# include <xercesc/util/XMLDateTime.hpp>
@@ -117,6 +118,7 @@ SSCache::SSCache(const DOMElement* e, bool deprecationSupport)
static const XMLCh outboundHeader[] = UNICODE_LITERAL_14(o,u,t,b,o,u,n,d,H,e,a,d,e,r);
static const XMLCh _StorageService[] = UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e);
static const XMLCh _StorageServiceLite[] = UNICODE_LITERAL_18(S,t,o,r,a,g,e,S,e,r,v,i,c,e,L,i,t,e);
+ static const XMLCh _unreliableNetworks[] = UNICODE_LITERAL_18(u,n,r,e,l,i,a,b,l,e,N,e,t,w,o,r,k,s);
if (e && e->hasAttributeNS(nullptr, cacheTimeout)) {
m_log.warn("DEPRECATED: cacheTimeout property is replaced by cacheAllowance (see documentation)");
@@ -189,6 +191,15 @@ SSCache::SSCache(const DOMElement* e, bool deprecationSupport)
}
#endif
+ const XMLCh* unreliableNetworks = e ? e->getAttributeNS(nullptr, _unreliableNetworks) : nullptr;
+ if (unreliableNetworks && *unreliableNetworks) {
+ XMLStringTokenizer toks(unreliableNetworks);
+ while (toks.hasMoreTokens()) {
+ auto_ptr_char tok(toks.nextToken());
+ m_unreliableNetworks.push_back(IPRange::parseCIDRBlock(tok.get()));
+ }
+ }
+
ListenerService* listener=conf.getServiceProvider()->getListenerService(false);
if (inproc) {
if (!conf.isEnabled(SPConfig::OutOfProcess) && !listener)
@@ -277,6 +288,21 @@ string SSCache::active(const Application& app, const HTTPRequest& request)
return (session_id ? session_id : "");
}
+bool SSCache::compareAddresses(const char* client_addr, const char* session_addr) const
+{
+ if (XMLString::equals(client_addr, session_addr)) {
+ return true;
+ }
+
+ for (vector<IPRange>::const_iterator i = m_unreliableNetworks.begin(); i != m_unreliableNetworks.end(); ++i) {
+ if (i->contains(client_addr) && i->contains(session_addr)) {
+ return true;
+ }
+ }
+
+ return false;
+}
+
#ifndef SHIBSP_LITE
void SSCache::test()
diff --git a/shibsp/impl/StorageServiceSessionCache.h b/shibsp/impl/StorageServiceSessionCache.h
index df5bfaa..ae0f12d 100644
--- a/shibsp/impl/StorageServiceSessionCache.h
+++ b/shibsp/impl/StorageServiceSessionCache.h
@@ -55,8 +55,9 @@ namespace opensaml {
namespace shibsp {
+ class IPRange;
class StoredSession;
- class SSCache : public SessionCache
+ class SHIBSP_DLLLOCAL SSCache : public SessionCache
#ifndef SHIBSP_LITE
,public virtual Remoted
#endif
@@ -154,11 +155,15 @@ namespace shibsp {
const xercesc::DOMElement* m_root; // Only valid during initialization
unsigned long m_inprocTimeout,m_cacheTimeout,m_cacheAllowance;
std::string m_inboundHeader,m_outboundHeader;
+ std::vector<IPRange> m_unreliableNetworks;
// inproc means we buffer sessions in memory
boost::scoped_ptr<xmltooling::RWLock> m_lock;
std::map<std::string,StoredSession*> m_hashtable;
+ // handle potentially inexact address comparisons
+ bool compareAddresses(const char* client_addr, const char* session_addr) const;
+
// management of buffered sessions
void dormant(const char* key);
static void* cleanup_fn(void*);
diff --git a/shibsp/impl/StoredSession.cpp b/shibsp/impl/StoredSession.cpp
index 4b7873d..8c1f3f2 100644
--- a/shibsp/impl/StoredSession.cpp
+++ b/shibsp/impl/StoredSession.cpp
@@ -186,7 +186,7 @@ void StoredSession::validate(const Application& app, const char* client_addr, ti
if (client_addr) {
const char* saddr = getClientAddress(getAddressFamily(client_addr));
if (saddr && *saddr) {
- if (!XMLString::equals(saddr, client_addr)) {
+ if (!m_cache->compareAddresses(client_addr, saddr)) {
m_cache->m_log.warn("client address mismatch, client (%s), session (%s)", client_addr, saddr);
throw RetryableProfileException(
"Your IP address ($1) does not match the address recorded at the time the session was established.",
@@ -297,7 +297,7 @@ void StoredSession::validate(const Application& app, const char* client_addr, ti
const char* saddr = getClientAddress(getAddressFamily(client_addr));
if (saddr) {
// Something snuck in and bound the session to this address type, so it better match what we have.
- if (!XMLString::equals(saddr, client_addr)) {
+ if (!m_cache->compareAddresses(client_addr, saddr)) {
m_cache->m_log.warn("client address mismatch, client (%s), session (%s)", client_addr, saddr);
throw RetryableProfileException(
"Your IP address ($1) does not match the address recorded at the time the session was established.",
diff --git a/shibsp/impl/StoredSession.h b/shibsp/impl/StoredSession.h
index a7f0a7e..b664a36 100644
--- a/shibsp/impl/StoredSession.h
+++ b/shibsp/impl/StoredSession.h
@@ -52,7 +52,7 @@ namespace shibsp {
class SSCache;
- class StoredSession : public virtual Session
+ class SHIBSP_DLLLOCAL StoredSession : public virtual Session
{
public:
StoredSession(SSCache* cache, DDF& obj);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list