[cpp-sp] branch main updated: CPPSP-8 WinHTTPRemotingService Development

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=61623ae794d6edc34050d939e978a806d256b402

The following commit(s) were added to refs/heads/main by this push:
     new 61623ae7  CPPSP-8 WinHTTPRemotingService Development
61623ae7 is described below

commit 61623ae794d6edc34050d939e978a806d256b402
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun May 11 14:47:28 2025 +0100

     CPPSP-8 WinHTTPRemotingService Development
    
    https://shibboleth.atlassian.net/browse/CPPSP-8
    
    Add some extra logging when CAtrust goes wrong.
---
 shibsp/remoting/impl/WinHTTPRemotingService.cpp | 30 +++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/shibsp/remoting/impl/WinHTTPRemotingService.cpp b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
index 0d04b69d..527b0820 100644
--- a/shibsp/remoting/impl/WinHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
@@ -73,6 +73,8 @@ namespace {
 
         void handleCert(HINTERNET Handle) const;
 
+        void logSecureFailure(DWORD status) const;
+
     private:
         Category& m_log;
         Category& m_winHTTPlog;
@@ -188,6 +190,28 @@ void WinHTTPRemotingService::setupCaChecking() {
 
 }
 
+void WinHTTPRemotingService::logSecureFailure(DWORD Status) const
+{
+    string details("");
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REVOKED)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_CERT_REVOKED ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_WRONG_USAGE)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_CERT_WRONG_USAGE ";
+    if (Status & WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR)
+        details += "WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR ";
+    m_log.crit("WinHttp Security Error 0x%x (%s)", Status, details.c_str());
+}
+
 void WinHTTPRemotingService::handleCert(HINTERNET Handle) const
 {
     PCCERT_CONTEXT certCtx = NULL;
@@ -252,6 +276,8 @@ StatusCallback(
 
     if (dwInternetStatus == WINHTTP_CALLBACK_STATUS_SENDING_REQUEST) {
         service->handleCert(hInternet);
+    } else if (dwInternetStatus == WINHTTP_CALLBACK_STATUS_SECURE_FAILURE) {
+        service->logSecureFailure(*((DWORD*)lpvStatusInformation));
     }
 };
 
@@ -346,7 +372,7 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
         }
 
         // And register the callback
-        if (WinHttpSetStatusCallback(m_session, StatusCallback, WINHTTP_CALLBACK_STATUS_SENDING_REQUEST, NULL) == WINHTTP_INVALID_STATUS_CALLBACK) {
+        if (WinHttpSetStatusCallback(m_session, StatusCallback, WINHTTP_CALLBACK_STATUS_SENDING_REQUEST | WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, NULL) == WINHTTP_INVALID_STATUS_CALLBACK) {
             m_log.crit("WinHttpSetStatusCallback failure: %d", GetLastError());
             throw runtime_error("WinHHHTP failed to initialize: Could not register callback");
         }
@@ -543,4 +569,4 @@ void WinHTTPRemotingService::send(const char* path, istream& input, ostream& out
     if (buffer) {
         delete[] buffer;
     }
-}
\ No newline at end of file
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.