From 284537dfc0585e08cfc0702c89b241d8986c7236 Mon Sep 17 00:00:00 2001

From: Hans Zandbelt <hans.zandbelt@zmartzone.eu>

Date: Fri, 3 Aug 2018 12:22:45 +0200

Subject: [PATCH 07/11] set boundaries on min and max values on number of

 parallel state cookies

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>

(cherry picked from commit b8c53d7e0439f190afe0c6eeb2e2e12e881c65ac)

---

 src/config.c | 17 ++++++++++++++++-

 src/parse.c  | 31 +++++++++++++++++++++++++++++++

 src/parse.h  |  2 ++

 3 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/src/config.c b/src/config.c

index 2fd63ea..c793818 100644

--- a/src/config.c

+++ b/src/config.c

@@ -997,6 +997,21 @@ static const char *oidc_set_client_auth_bearer_token(cmd_parms *cmd,

 	return NULL;

 }

+/*

+ * set the maximun number of parallel state cookies

+ */

+static const char *oidc_set_max_number_of_state_cookies(cmd_parms *cmd,

+		void *struct_ptr, const char *arg) {

+	oidc_cfg *cfg = (oidc_cfg *) ap_get_module_config(

+			cmd->server->module_config, &auth_openidc_module);

+	const char *rv = oidc_parse_max_number_of_state_cookies(cmd->pool, arg,

+			&cfg->max_number_of_state_cookies);

+	return OIDC_CONFIG_DIR_RV(cmd, rv);

+}

+

+/*

+ * return the maximun number of parallel state cookies

+ */

 int oidc_cfg_max_number_of_state_cookies(oidc_cfg *cfg) {

 	if (cfg->max_number_of_state_cookies == OIDC_CONFIG_POS_INT_UNSET)

 		return OIDC_DEFAULT_MAX_NUMBER_OF_STATE_COOKIES;

@@ -2642,7 +2657,7 @@ const command_rec oidc_config_cmds[] = {

 				RSRC_CONF,

 				"Time to live in seconds for state parameter (cq. interval in which the authorization request and the corresponding response need to be completed)."),

 		AP_INIT_TAKE1(OIDCStateMaxNumberOfCookies,

-				oidc_set_int_slot,

+				oidc_set_max_number_of_state_cookies,

 				(void*)APR_OFFSETOF(oidc_cfg, max_number_of_state_cookies),

 				RSRC_CONF,

 				"Maximun number of parallel state cookies i.e. outstanding authorization requests."),

diff --git a/src/parse.c b/src/parse.c

index 9d3763c..0f986fd 100644

--- a/src/parse.c

+++ b/src/parse.c

@@ -530,6 +530,28 @@ const char *oidc_valid_session_max_duration(apr_pool_t *pool, int v) {

 	return NULL;

 }

+#define OIDC_MAX_NUMBER_OF_STATE_COOKIES_MIN  0

+#define OIDC_MAX_NUMBER_OF_STATE_COOKIES_MAX  255

+

+/*

+ * check the maximum number of parallel state cookies

+ */

+const char *oidc_valid_max_number_of_state_cookies(apr_pool_t *pool, int v) {

+	if (v == 0) {

+		return NULL;

+	}

+	if (v < OIDC_MAX_NUMBER_OF_STATE_COOKIES_MIN) {

+		return apr_psprintf(pool, "maximum must not be less than %d",

+				OIDC_MAX_NUMBER_OF_STATE_COOKIES_MIN);

+	}

+	if (v > OIDC_MAX_NUMBER_OF_STATE_COOKIES_MAX) {

+		return apr_psprintf(pool, "maximum must not be greater than %d",

+				OIDC_MAX_NUMBER_OF_STATE_COOKIES_MAX);

+	}

+	return NULL;

+}

+

+

 /*

  * parse a session max duration value from the provided string

  */

@@ -1218,3 +1240,12 @@ const char *oidc_parse_auth_request_method(apr_pool_t *pool, const char *arg,

 	return NULL;

 }

+

+/*

+ * parse the maximum number of parallel state cookies

+ */

+const char *oidc_parse_max_number_of_state_cookies(apr_pool_t *pool,

+		const char *arg, int *int_value) {

+	return oidc_parse_int_valid(pool, arg, int_value,

+			oidc_valid_max_number_of_state_cookies);

+}

diff --git a/src/parse.h b/src/parse.h

index 853e98f..6355db4 100644

--- a/src/parse.h

+++ b/src/parse.h

@@ -90,6 +90,7 @@ const char *oidc_valid_userinfo_refresh_interval(apr_pool_t *pool, int v);

 const char *oidc_valid_userinfo_token_method(apr_pool_t *pool, const char *arg);

 const char *oidc_valid_token_binding_policy(apr_pool_t *pool, const char *arg);

 const char *oidc_valid_auth_request_method(apr_pool_t *pool, const char *arg);

+const char *oidc_valid_max_number_of_state_cookies(apr_pool_t *pool, int v);

 const char *oidc_parse_int(apr_pool_t *pool, const char *arg, int *int_value);

 const char *oidc_parse_boolean(apr_pool_t *pool, const char *arg, int *bool_value);

@@ -116,6 +117,7 @@ const char *oidc_parse_info_hook_data(apr_pool_t *pool, const char *arg, apr_has

 const char *oidc_parse_token_binding_policy(apr_pool_t *pool, const char *arg, int *int_value);

 const char *oidc_token_binding_policy2str(apr_pool_t *pool, int v);

 const char *oidc_parse_auth_request_method(apr_pool_t *pool, const char *arg, int *method);

+const char *oidc_parse_max_number_of_state_cookies(apr_pool_t *pool, const char *arg, int *int_value);

 typedef const char *(*oidc_valid_int_function_t)(apr_pool_t *, int);

 typedef const char *(*oidc_valid_function_t)(apr_pool_t *, const char *);

-- 

2.26.2