[cpp-sp] branch main updated: CPPSP-38 - Remoting needs to expose option to limit use of IPv6
Codeberg
noreply at shibboleth.net
Tue Dec 9 14:18:40 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/e3e5d6fbe393d6278cc410af69800928a2509813
The following commit(s) were added to refs/heads/main by this push:
new e3e5d6fb CPPSP-38 - Remoting needs to expose option to limit use of IPv6
e3e5d6fb is described below
commit e3e5d6fbe393d6278cc410af69800928a2509813
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 9 09:17:21 2025 -0500
CPPSP-38 - Remoting needs to expose option to limit use of IPv6
https://shibboleth.atlassian.net/browse/CPPSP-38
---
.../remoting/impl/AbstractHTTPRemotingService.cpp | 28 ++++++++++++++++++----
shibsp/remoting/impl/AbstractHTTPRemotingService.h | 6 ++++-
shibsp/remoting/impl/CurlHTTPRemotingService.cpp | 18 +++++++++++---
3 files changed, 44 insertions(+), 8 deletions(-)
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
index 1dd65e0c..0ca30760 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
@@ -54,19 +54,24 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
static const char TIMEOUT_PROP_NAME[] = "timeout";
static const char CA_FILE_PROP_NAME[] = "tlsCAFile";
static const char REVOCATION_CHECK_PROP_NAME[] = "revocationCheck";
+ static const char ENABLE_IP4_PROP_NAME[] = "enableIP4";
+ static const char ENABLE_IP6_PROP_NAME[] = "enableIP6";
static const char AGENT_ID_PROP_DEFAULT[] = "localhost";
static const char SECRET_SOURCE_TYPE_PROP_DEFAULT[] = FILE_SECRET_SOURCE;
static const char BASE_URL_PROP_DEFAULT[] = "http://localhost:8080/idp/profile/sp/";
+ static const char USER_AGENT_PROP_DEFAULT[] = "";
static const char AUTH_METHOD_PROP_DEFAULT[] = "none";
static const char AUTH_CACHING_COOKIE_PROP_DEFAULT[] = "__Host-JSESSIONID";
static unsigned int CONNECT_TIMEOUT_PROP_DEFAULT = 3;
static unsigned int TIMEOUT_PROP_DEFAULT = 10;
+ static const char CA_FILE_PROP_DEFAULT[] = "";
static const bool REVOCATION_CHECK_DEFAULT = false;
-
+ static const bool ENABLE_IP4_PROP_DEFAULT = true;
+ static const bool ENABLE_IP6_PROP_DEFAULT = true;
m_agentID = props.getString(AGENT_ID_PROP_NAME, AGENT_ID_PROP_DEFAULT);
- m_userAgent = props.getString(USER_AGENT_PROP_NAME, "");
+ m_userAgent = props.getString(USER_AGENT_PROP_NAME, USER_AGENT_PROP_DEFAULT);
m_baseURL = props.getString(BASE_URL_PROP_NAME, BASE_URL_PROP_DEFAULT);
if (m_baseURL.back() != '/') {
m_baseURL += '/';
@@ -76,6 +81,12 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
m_connectTimeout = props.getUnsignedInt(CONNECT_TIMEOUT_PROP_NAME, CONNECT_TIMEOUT_PROP_DEFAULT);
m_timeout = props.getUnsignedInt(TIMEOUT_PROP_NAME, TIMEOUT_PROP_DEFAULT);
m_revocationCheck = props.getBool(REVOCATION_CHECK_PROP_NAME, REVOCATION_CHECK_DEFAULT);
+ m_enableIP4 = props.getBool(ENABLE_IP4_PROP_NAME, ENABLE_IP4_PROP_DEFAULT);
+ m_enableIP6 = props.getBool(ENABLE_IP6_PROP_NAME, ENABLE_IP6_PROP_DEFAULT);
+
+ if (!m_enableIP4 && !m_enableIP6) {
+ throw ConfigurationException("One of IP4 or IP6 must be enabled.");
+ }
if (m_authMethod != agent_auth_none) {
m_secretSource.reset(AgentConfig::getConfig().SecretSourceManager.newPlugin(
@@ -83,8 +94,7 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
);
}
-
- m_caFile = props.getString(CA_FILE_PROP_NAME, "");
+ m_caFile = props.getString(CA_FILE_PROP_NAME, CA_FILE_PROP_DEFAULT);
if (!m_caFile.empty()) {
AgentConfig::getConfig().getPathResolver().resolve(m_caFile, PathResolver::SHIBSP_CFG_FILE);
#ifdef WIN32
@@ -205,6 +215,16 @@ unsigned int AbstractHTTPRemotingService::getTimeout() const
return m_timeout;
}
+bool AbstractHTTPRemotingService::isEnableIP4() const
+{
+ return m_enableIP4;
+}
+
+bool AbstractHTTPRemotingService::isEnableIP6() const
+{
+ return m_enableIP6;
+}
+
bool AbstractHTTPRemotingService::isRevocationCheck() const
{
return m_revocationCheck;
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.h b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
index abd822de..690ec492 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.h
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
@@ -79,8 +79,10 @@ namespace shibsp {
std::string getAuthCachingCookieValue() const;
unsigned int getConnectTimeout() const;
unsigned int getTimeout() const;
- bool isRevocationCheck() const;
const char* getCAFile() const;
+ bool isRevocationCheck() const;
+ bool isEnableIP4() const;
+ bool isEnableIP6() const;
protected:
AbstractHTTPRemotingService(boost::property_tree::ptree& pt);
@@ -99,6 +101,8 @@ namespace shibsp {
unsigned int m_connectTimeout;
unsigned int m_timeout;
bool m_revocationCheck;
+ bool m_enableIP4;
+ bool m_enableIP6;
/** Shared lock for guarding auth cache value. */
#if defined(HAVE_CXX17)
std::unique_ptr<std::shared_mutex> m_authcachelock;
diff --git a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
index 0e3144b3..15c6438b 100644
--- a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
@@ -187,11 +187,15 @@ CurlHTTPRemotingService::CurlHTTPRemotingService(ptree& pt)
static const char CHUNKED_PROP_NAME[] = "chunkedEncoding";
static const char TRACE_FILE_PROP_NAME[] = "traceFileBase";
+ static const char CIPHER_LIST_PROP_DEFAULT[] = "";
+ static bool CHUNKED_PROP_DEFAULT = true;
+ static const char TRACE_FILE_PROP_DEFAULT[] = "";
+
BoostPropertySet props;
props.load(pt);
- m_chunked = props.getBool(CHUNKED_PROP_NAME, true);
- m_ciphers = props.getString(CIPHER_LIST_PROP_NAME, "");
+ m_chunked = props.getBool(CHUNKED_PROP_NAME, CHUNKED_PROP_DEFAULT);
+ m_ciphers = props.getString(CIPHER_LIST_PROP_NAME, CIPHER_LIST_PROP_DEFAULT);
if (getUserAgent() == nullptr) {
string useragent = string(PACKAGE_NAME) + '/' + PACKAGE_VERSION;
@@ -204,7 +208,7 @@ CurlHTTPRemotingService::CurlHTTPRemotingService(ptree& pt)
m_log.info("CurlHTTP RemotingService installed for agent ID (%s), baseURL (%s)", getAgentID(), getBaseURL());
- m_traceFileBase = props.getString(TRACE_FILE_PROP_NAME, "");
+ m_traceFileBase = props.getString(TRACE_FILE_PROP_NAME, TRACE_FILE_PROP_DEFAULT);
if (!m_traceFileBase.empty()) {
AgentConfig::getConfig().getPathResolver().resolve(m_traceFileBase, PathResolver::SHIBSP_LOG_FILE);
m_log.warn("tracing enabled (%s), sensitive information *will* be logged; do not share and protect appropriately",
@@ -285,6 +289,14 @@ CURL* CurlHTTPRemotingService::checkout() const
SHIB_CURL_SET(CURLOPT_CONNECTTIMEOUT, getConnectTimeout());
SHIB_CURL_SET(CURLOPT_TIMEOUT, getTimeout());
+ // One of these has to be enabled. Default is for both.
+ if (!isEnableIP6()) {
+ SHIB_CURL_SET(CURLOPT_RESOLVE, CURL_IPRESOLVE_V4);
+ }
+ else if (!isEnableIP4()) {
+ SHIB_CURL_SET(CURLOPT_RESOLVE, CURL_IPRESOLVE_V6);
+ }
+
long flag=0;
switch (getAuthMethod()) {
case agent_auth_none:
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list