Resolves: bug #1414020 Incorrect PAOS Content-Type header

am_check_uid() should be no-op if mellon not enabled

.gitignore

@@ -3,3 +3,4 @@
 /mod_auth_mellon-0.9.1.tar.gz
 /mod_auth_mellon-0.10.0.tar.gz
 /mod_auth_mellon-0.11.0.tar.gz
+/mod_auth_mellon-0.12.0.tar.gz

content-type.patch

@@ -0,0 +1,36 @@
+commit 040a1ae5cb2aab38b2bc716cc3d0d6fa7b998a7a
+Author: John Dennis <jdennis@redhat.com>
+Date:   Mon Jan 16 09:02:06 2017 -0500
+
+    Use ap_set_content_type() to set "Content-Type" header
+    
+    Formerly we were setting the response header "Content-Type" in
+    r->headers_out directly via the apr_table_setn() call. Although using
+    apr_table_setn() is appropriate for many HTTP headers Apache actively
+    manages a small set of headers in
+    http_filters.c:ap_http_header_filter(). These managed headers are
+    derived from values maintained in the request_rec. "Content-Type" is
+    one of the managed headers.
+    
+    Because we didn't set r->content_type field via the
+    ap_set_content_type() call and instead directly updated the
+    r->headers_out table our value for "Content-Type" was overwriten when
+    the ap_http_header_filter() was run just prior to emitting the
+    response with the result the "Content-Type" header returned to the
+    client was incorrect.
+    
+    Signed-off-by: John Dennis <jdennis@redhat.com>
+
+diff --git a/auth_mellon_handler.c b/auth_mellon_handler.c
+index a55828a..25365de 100644
+--- a/auth_mellon_handler.c
++++ b/auth_mellon_handler.c
+@@ -2655,7 +2655,7 @@ static int am_set_authn_request_post_content(request_rec *r, LassoLogin *login)
+  */
+ static int am_set_authn_request_paos_content(request_rec *r, LassoLogin *login)
+ {
+-    apr_table_setn(r->headers_out, "Content-Type", MEDIA_TYPE_PAOS);
++    ap_set_content_type(r, MEDIA_TYPE_PAOS);
+     ap_rputs(LASSO_PROFILE(login)->msg_body, r);
+ 
+     return OK;

enabled_in_check_uid.patch

@@ -0,0 +1,34 @@
+commit 912aa852ebd78577f59cf7958c709acea98ace4c
+Author: John Dennis <jdennis@redhat.com>
+Date:   Fri Apr 8 09:01:22 2016 -0400
+
+    am_check_uid() should be no-op if mellon not enabled
+    
+    mod_auth_mellon was interferring with other Apache authentication
+    modules (e.g. mod_auth_kerb) because when the Apache check_user_id
+    hook ran the logic in am_check_uid would execute even if mellon was
+    not enabled for the location. This short circuited the hook execution
+    and never allowed the authentication enabled for the location to
+    execute. It resulted in HTTP_UNAUTHORIZED being returned with the
+    client then expecting a WWW-Authenticate header field causing the
+    client to attempt to authenticate again.
+    
+    Signed-off-by: John Dennis <jdennis@redhat.com>
+
+diff --git a/auth_mellon_handler.c b/auth_mellon_handler.c
+index a72e1ca..864396f 100644
+--- a/auth_mellon_handler.c
++++ b/auth_mellon_handler.c
+@@ -3625,6 +3625,12 @@ int am_check_uid(request_rec *r)
+         return OK;
+     }
+ 
++    /* Check that the user has enabled authentication for this directory. */
++    if(dir->enable_mellon == am_enable_off
++       || dir->enable_mellon == am_enable_default) {
++	return DECLINED;
++    }
++
+ #ifdef HAVE_ECP
+     am_req_cfg_rec *req_cfg = am_get_req_cfg(r);
+     if (req_cfg->ecp_authn_req) {

mod_auth_mellon.spec

@@ -1,7 +1,7 @@
 Summary: A SAML 2.0 authentication module for the Apache Httpd Server
 Name: mod_auth_mellon
-Version: 0.11.0
-Release: 4%{?dist}
+Version: 0.12.0
+Release: 3%{?dist}
 Group: System Environment/Daemons
 Source0: https://github.com/UNINETT/mod_auth_mellon/releases/download/v%{version}/%{name}-%{version}.tar.gz
 Source1: auth_mellon.conf
@@ -19,7 +19,9 @@ Requires: httpd-mmn = %{_httpd_mmn}
 Requires: lasso >= 2.5.0
 Url: https://github.com/UNINETT/mod_auth_mellon
 
-Patch1: acs-warning.patch
+Patch1: enabled_in_check_uid.patch
+Patch2: content-type.patch
+
 
 %description
 The mod_auth_mellon module is an authentication service that implements the
@@ -28,7 +30,8 @@ received in assertions generated by a IdP server.
 
 %prep
 %setup -q -n %{name}-%{version}
-%patch1 -p1 -b .acs-warning
+%patch1 -p1
+%patch2 -p1
 
 %build
 export APXS=%{_httpd_apxs}
@@ -56,7 +59,12 @@ install -m 755 %{SOURCE4} %{buildroot}/%{_libexecdir}/%{name}
 
 %files
 %defattr(-,root,root)
-%doc README COPYING NEWS
+%if 0%{?rhel} && 0%{?rhel} < 7
+%doc COPYING
+%else
+%license COPYING
+%endif
+%doc README NEWS ECP.rst
 %config(noreplace) %{_httpd_modconfdir}/10-auth_mellon.conf
 %config(noreplace) %{_httpd_confdir}/auth_mellon.conf
 %{_httpd_moddir}/mod_auth_mellon.so
@@ -65,6 +73,31 @@ install -m 755 %{SOURCE4} %{buildroot}/%{_libexecdir}/%{name}
 %dir /run/%{name}/
 
 %changelog
+* Tue Jan 17 2017 John Dennis <jdennis@redhat.com> - 0.12.0-3
+- Resolves: bug #1414020 Incorrect PAOS Content-Type header
+
+* Tue May  3 2016 John Dennis <jdennis@redhat.com> - 0.12.0-2
+- Resolves: bug #1332729, mellon conflicts with mod_auth_openidc
+- am_check_uid() should be no-op if mellon not enabled
+
+* Wed Mar  9 2016 John Dennis <jdennis@redhat.com> - 0.12.0-1
+- Update to new upstream 0.12.0
+- [CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to
+  incorrect error handling when reading POST data from client.
+
+- [CVE-2016-2146] Fix DOS attack (Apache worker process crash /
+  resource exhaustion) due to missing size checks when reading
+  POST data.
+
+In addition this release contains the following new features and fixes:
+
+- Add MellonRedirectDomains option to limit the sites that
+  mod_auth_mellon can redirect to. This option is enabled by default.
+
+- Add support for ECP service options in PAOS requests.
+
+- Fix AssertionConsumerService lookup for PAOS requests.
+
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.11.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 

sources

@@ -1 +1 @@
-d24347881f1c60f26cf686d22cf419de  mod_auth_mellon-0.11.0.tar.gz
+6c1057847c06d433d4d4a4f55cca1740  mod_auth_mellon-0.12.0.tar.gz