[cpp-sp] branch master updated: Move correlation cookie cleanup into decoder.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=12ecd4e85b74e83edac27985f26648f63b51df00

The following commit(s) were added to refs/heads/master by this push:
       new  12ecd4e   Move correlation cookie cleanup into decoder.
12ecd4e is described below

commit 12ecd4e85b74e83edac27985f26648f63b51df00
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 14 10:17:14 2020 -0500

    Move correlation cookie cleanup into decoder.
---
 configs/security-policy.xml             | 13 +++++++++-
 shibsp/handler/impl/AbstractHandler.cpp | 43 ++++++++++++---------------------
 2 files changed, 27 insertions(+), 29 deletions(-)

diff --git a/configs/security-policy.xml b/configs/security-policy.xml
index dc3a04c..0ff8558 100644
--- a/configs/security-policy.xml
+++ b/configs/security-policy.xml
@@ -18,7 +18,18 @@
         <PolicyRule type="SimpleSigning" errorFatal="true"/>
     </Policy>
 
-    <!--
+    <Policy id="blockUnsolicited" validate="false">
+        <PolicyRule type="MessageFlow" checkCorrelation="true" checkReplay="true" expires="60"/>
+        <PolicyRule type="Conditions">
+            <PolicyRule type="Audience"/>
+        </PolicyRule>
+        <PolicyRule type="ClientCertAuth" errorFatal="true"/>
+        <PolicyRule type="XMLSigning" errorFatal="true"/>
+        <PolicyRule type="SimpleSigning" errorFatal="true"/>
+        <PolicyRule type="Bearer"/>
+    </Policy>
+
+  <!--
     This policy is a place-holder for use of assertions in metadata
     as a way of attaching signed information about particular IdPs.
     -->
diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index e3800e2..c76b007 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -195,16 +195,16 @@ void Handler::cleanRelayState(
         }
     }
 
-    int maxRSCookies = 20,purgedRSCookies = 0;
-    int maxOSCookies = 20,purgedOSCookies = 0;
-
-    if (mech.first && !strncmp(mech.second, "cookie", 6)) {
-        mech.second += 6;
-        if (*mech.second == ':' && isdigit(*(++mech.second))) {
-            maxRSCookies = maxOSCookies = atoi(mech.second);
-            if (maxRSCookies == 0) {
-                maxRSCookies = maxOSCookies = 20;
-            }
+    if (!mech.first || !mech.second || strncmp(mech.second, "cookie", 6))
+        return;
+
+    int maxCookies = 20,purgedCookies = 0;
+
+    mech.second += 6;
+    if (*mech.second == ':' && isdigit(*(++mech.second))) {
+        maxCookies = atoi(mech.second);
+        if (maxCookies == 0) {
+            maxCookies = 20;
         }
     }
 
@@ -213,33 +213,20 @@ void Handler::cleanRelayState(
     for (map<string,string>::const_reverse_iterator i = cookies.rbegin(); i != cookies.rend(); ++i) {
         // Process relay state cookies only.
         if (starts_with(i->first, "_shibstate_")) {
-            if (maxRSCookies > 0) {
-                // Keep it, but count it against the limit.
-                --maxRSCookies;
-            }
-            else {
-                // We're over the limit, so everything here and older gets cleaned up.
-                response.setCookie(i->first.c_str(), nullptr, 0, HTTPResponse::SAMESITE_NONE);
-                ++purgedRSCookies;
-            }
-        }
-        else if (starts_with(i->first, "_opensaml_req_")) {
-            if (maxOSCookies > 0) {
+            if (maxCookies > 0) {
                 // Keep it, but count it against the limit.
-                --maxOSCookies;
+                --maxCookies;
             }
             else {
                 // We're over the limit, so everything here and older gets cleaned up.
                 response.setCookie(i->first.c_str(), nullptr, 0, HTTPResponse::SAMESITE_NONE);
-                ++purgedOSCookies;
+                ++purgedCookies;
             }
         }
     }
 
-    if (purgedRSCookies > 0)
-        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedRSCookies) + " stale relay state cookie(s) from client");
-    if (purgedOSCookies > 0)
-        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedOSCookies) + " stale request correlation cookie(s) from client");
+    if (purgedCookies > 0)
+        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedCookies) + " stale relay state cookie(s) from client");
 }
 
 void Handler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.