[java-identity-provider] branch main updated: IDP-1694 - IPv6 fails when servlet container uses square brackets
Scott Cantor
cantor.2 at osu.edu
Tue Oct 20 14:09:30 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bf6c2bce770e5a84b9f622fa2b6f9da24a669d97
The following commit(s) were added to refs/heads/main by this push:
new bf6c2bce7 IDP-1694 - IPv6 fails when servlet container uses square brackets
bf6c2bce7 is described below
commit bf6c2bce770e5a84b9f622fa2b6f9da24a669d97
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 20 10:08:54 2020 -0400
IDP-1694 - IPv6 fails when servlet container uses square brackets
https://issues.shibboleth.net/jira/browse/IDP-1694
Apply sanitizing helper method.
---
.../authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java | 3 ++-
.../shibboleth/idp/authn/impl/ExtractUserAgentAddress.java | 6 +++---
.../idp/authn/impl/StorageBackedAccountLockoutManager.java | 3 ++-
.../java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java | 3 ++-
.../net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java | 3 ++-
.../impl/BaseAddAuthenticationStatementToAssertion.java | 3 ++-
.../shibboleth/idp/session/impl/PopulateSessionContext.java | 12 ++++++------
.../java/net/shibboleth/idp/session/impl/ProcessLogout.java | 8 +++++---
.../idp/session/impl/StorageBackedSessionManager.java | 3 ++-
9 files changed, 26 insertions(+), 18 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
index 810561992..486c6c51d 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.ui.context.RelyingPartyUIContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
@@ -250,7 +251,7 @@ public class ExtractDuoAuthenticationFromHeaders extends AbstractAuthenticationA
}
if (clientAddressTrusted) {
- context.setClientAddress(httpRequest.getRemoteAddr());
+ context.setClientAddress(HttpServletSupport.getRemoteAddr(httpRequest));
}
final String factor = httpRequest.getHeader(factorHeaderName);
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
index 95aa47bb1..f6a998881 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
@@ -24,6 +24,7 @@ import net.shibboleth.idp.authn.AbstractExtractionAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.UserAgentContext;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -48,7 +49,6 @@ public class ExtractUserAgentAddress extends AbstractExtractionAction {
@Nonnull private final Logger log = LoggerFactory.getLogger(ExtractUserAgentAddress.class);
/** {@inheritDoc} */
- // CheckStyle: ReturnCount OFF
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
@@ -60,7 +60,7 @@ public class ExtractUserAgentAddress extends AbstractExtractionAction {
return;
}
- final String addressString = applyTransforms(request.getRemoteAddr());
+ final String addressString = applyTransforms(HttpServletSupport.getRemoteAddr(request));
if (addressString == null || !InetAddresses.isInetAddress(addressString)) {
log.debug("{} User agent's address, {}, is not a valid IP address", getLogPrefix(), addressString);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
@@ -70,5 +70,5 @@ public class ExtractUserAgentAddress extends AbstractExtractionAction {
authenticationContext.getSubcontext(UserAgentContext.class, true).setAddress(
InetAddresses.forString(addressString));
}
- // CheckStyle: ReturnCount ON
+
}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
index 3b7fd79e8..1d93429dc 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
@@ -46,6 +46,7 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
/**
* Implementation of {@link AccountLockoutManager} interface that relies on a {@link StorageService}
@@ -428,7 +429,7 @@ public class StorageBackedAccountLockoutManager extends AbstractIdentifiableInit
}
final String username = upContext.getUsername();
- final String ipAddr = httpRequest.getRemoteAddr();
+ final String ipAddr = HttpServletSupport.getRemoteAddr(httpRequest);
if (username == null || username.isEmpty() || ipAddr == null || ipAddr.isEmpty()) {
return null;
}
diff --git a/idp-core/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java b/idp-core/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
index a6cc396fd..1ce6fbb3e 100644
--- a/idp-core/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
+++ b/idp-core/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
@@ -31,6 +31,7 @@ import javax.servlet.http.HttpSession;
import net.shibboleth.idp.Version;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import org.slf4j.MDC;
@@ -59,7 +60,7 @@ public class SLF4JMDCServletFilter implements Filter {
throws IOException, ServletException {
try {
MDC.put(Version.MDC_ATTRIBUTE, Version.getVersion());
- MDC.put(CLIENT_ADDRESS_MDC_ATTRIBUTE, request.getRemoteAddr());
+ MDC.put(CLIENT_ADDRESS_MDC_ATTRIBUTE, HttpServletSupport.getRemoteAddr(request));
MDC.put(SERVER_ADDRESS_MDC_ATTRIBUTE, request.getServerName());
MDC.put(SERVER_PORT_MDC_ATTRIBUTE, Integer.toString(request.getServerPort()));
if (request instanceof HttpServletRequest) {
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
index 94c323460..f6d28ec92 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
@@ -43,6 +43,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
@@ -254,7 +255,7 @@ public class WriteAuditLog extends AbstractProfileAction {
} else if (IdPAuditFields.PROFILE.equals(field)) {
record.append(profileRequestContext.getProfileId());
} else if (IdPAuditFields.REMOTE_ADDR.equals(field) && httpRequest != null) {
- record.append(httpRequest.getRemoteAddr());
+ record.append(HttpServletSupport.getRemoteAddr(httpRequest));
} else if (IdPAuditFields.URI.equals(field) && httpRequest != null) {
record.append(httpRequest.getRequestURI());
} else if (IdPAuditFields.URL.equals(field) && httpRequest != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
index e11aa481c..71442815a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
@@ -37,6 +37,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterI
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
import org.slf4j.Logger;
@@ -242,7 +243,7 @@ public abstract class BaseAddAuthenticationStatementToAssertion extends Abstract
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext t) {
if (getHttpServletRequest() != null) {
- return getHttpServletRequest().getRemoteAddr();
+ return HttpServletSupport.getRemoteAddr(getHttpServletRequest());
}
return null;
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
index 0d38b44ff..6a046864c 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
@@ -32,6 +32,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterI
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -119,7 +120,6 @@ public class PopulateSessionContext extends AbstractProfileAction {
}
}
- // Checkstyle: ReturnCount OFF
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -135,13 +135,14 @@ public class PopulateSessionContext extends AbstractProfileAction {
}
final HttpServletRequest request = getHttpServletRequest();
- if (request != null && request.getRemoteAddr() != null) {
- if (!session.checkAddress(request.getRemoteAddr())) {
+ final String addr = request != null ? HttpServletSupport.getRemoteAddr(request) : null;
+ if (addr != null) {
+ if (!session.checkAddress(addr)) {
return;
}
} else {
- log.info("{} No servlet request or client address available, skipping address check for session {}",
- getLogPrefix(), session.getId());
+ log.info("{} No client address available, skipping address check for session {}", getLogPrefix(),
+ session.getId());
}
final SessionContext sessionCtx = sessionContextCreationStrategy.apply(profileRequestContext);
@@ -159,6 +160,5 @@ public class PopulateSessionContext extends AbstractProfileAction {
log.error("{} Error during timeout or address checking for session {}",getLogPrefix(), session.getId(), e);
}
}
- // Checkstyle: ReturnCount ON
}
\ No newline at end of file
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
index 279c5b95d..92af3e949 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
@@ -35,6 +35,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterI
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -176,9 +177,10 @@ public class ProcessLogout extends AbstractProfileAction {
}
final HttpServletRequest request = getHttpServletRequest();
- if (request != null && request.getRemoteAddr() != null) {
+ final String addr = request != null ? HttpServletSupport.getRemoteAddr(request) : null;
+ if (addr != null) {
try {
- if (!session.checkAddress(request.getRemoteAddr())) {
+ if (!session.checkAddress(addr)) {
return;
}
} catch (final SessionException e) {
@@ -187,7 +189,7 @@ public class ProcessLogout extends AbstractProfileAction {
return;
}
} else {
- log.info("{} No servlet request or client address available, skipping address check for sessions",
+ log.info("{} No client address available, skipping address check for sessions",
getLogPrefix());
}
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
index 3bfa3c0ef..365920dd0 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
@@ -51,6 +51,7 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.net.CookieManager;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -521,7 +522,7 @@ public class StorageBackedSessionManager extends AbstractIdentifiableInitializab
throw new SessionException("No HttpServletRequest available, can't bind to client address");
}
- final String remoteAddr = StringSupport.trimOrNull(httpRequest.getRemoteAddr());
+ final String remoteAddr = StringSupport.trimOrNull(HttpServletSupport.getRemoteAddr(httpRequest));
if (remoteAddr == null) {
throw new SessionException("No client address to bind");
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list