Skip to content

release 2.4.0

Latest
Latest

Choose a tag to compare

View all tags
@zandbelt zandbelt released this 10 Sep 17:48
· 1 commit to master since this release
v2.4.0
85da434

Features

  • cfg: encode claim values passed to the target application via a new encoding option on the target pass config (latin1 default, base64url, none); thanks @maltesmann; closes OpenIDC/mod_oauth2#77
  • jose: allow the expected iss and aud values to be configured for token verification, using the claim names themselves as options.
  • doc: document the entire public API with Doxygen, published to GitHub Pages by a Docs workflow and described in the README; see #11

Security

  • oauth2: apply the DPoP/mTLS proof-of-possession settings of the verifier that actually verified the token, not those of the first verifier in the chain.
  • oauth2: require an iss claim in JWTs verified against the issuer discovered from the AS metadata document.
  • dpop: compare the htu claim to the request URL per RFC 9449 (scheme and host case-insensitive, path as-is) instead of case-insensitively throughout.

Bugfixes

  • oauth2: always return an HTTP error status code from oauth2_token_verify when a token is rejected; thanks @smanolache; closes OpenIDC/mod_oauth2#94
  • oauth2: release the token payload, and check the introspection context before use, when a proof-of-possession check fails after a verifier accepted the token.
  • session: slide the inactivity timeout forward on activity, which had stopped moving so sessions expired at first-save time plus the timeout.
  • session: start a new session instead of failing the request when a stored one exceeds its maximum duration.
  • session: release replaced claims and cookie settings, register a configuration only once, and guard NULL in the record free and cache getter.
  • cache: honour the configured shm max_key_size when checking the key length.
  • cache: do not register a cache whose backend failed to initialize, which leaked it and shadowed the name.
  • cache: in the memcache backend delete the entry on a NULL value, return oauth2-allocated memory, and free libmemcached's own buffer.
  • openidc: default the client scope to "openid", HTTP timeout to 20 seconds and TLS verification to on when unset, and release a replaced provider resolver.
  • http: release replaced basic-auth credentials, accept port 0, guard NULL in oauth2_http_request_is_secure, format Content-Length with %zu, and do not retry a response that exceeded the 1 MB buffer.
  • cfg: release the previous value when a string option or an endpoint's auth is reconfigured, and fix two misreported error strings.
  • jose: check the JWE rather than the JWS after cjose_jwe_encrypt, and reject NULL arguments in oauth2_jose_hash2s.
  • jose/util: release the output of json_dumps through the oauth2 allocator instead of free().
  • log: advance the tail of the sink list so that adding a third sink no longer drops the second one.
  • ipc: return false from the semaphore wait and trywait, and thereby the mutex lock, on failure instead of reporting success.
  • proto: do not dereference a missing Content-Type header when reading the source token from a form POST.
  • nginx: fix OAUTH2_NGINX_CFG_FUNC_ARGS4 reading its fourth argument from the third one's data.
  • apache: pass the log callback, not the server_rec, when merging server configurations.
  • apache: drop the duplicate ssl_var_lookup typedef that MSVC rejects.
  • jq: free the intermediate outputs of a multi-output filter instead of leaking all but the last.
  • util: do not dereference a NULL number pointer in oauth2_json_number_get.
  • dpop: fix a stray backslash, and log the computed thumbprint, in the thumbprint mismatch message.
  • session: remove the declaration of the unimplemented oauth2_cfg_session_release.

Other

  • portability: compile the library and its test suite with MSVC
  • build: bump the libtool version-info to 2:0:1; the soname stays liboauth2.so.1.
  • test: replace the suite-wide forked HTTP server on port 8888 with a per-test loopback fixture.
  • test: add a session suite and unit tests raising coverage of cfg.c, proto_cfg.c, dpop.c, ipc.c and the cache backends.
  • test: split the cache suite into per-backend suites and add a make check-parallel target that runs them concurrently.

The RPM packages are signed with the following RSA PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGh53lgBCADCyoOkfnE5h5rBLlf02oFpI/z2vUXK5W4T56xnNPu0/iIOxbBk
YX9rSypZFhfjv28lhGgelWEg28Ab/Yxs6l0obCgDEuFUDQ5Dv+N+YSMy67vtLwYW
9LM5p9fMN9bXOa62PwvtzRzh+xRyRBcIfMacGJC+SqUK6QhzC0lNwCsr1OaWjzon
mkaodwrloNMxEZVvFn63PvuQDZ3wwQty+0XpYiiChMssGBn6nmPDQJ7pDtQDkhfD
Z5FKY6K7AQJ4fneiVCLGngPBwTXBGcfWa+Y0HCS2ghQwDO6jYXd5GjowVDTjfMK3
QJ3e26Ox9X3V0Fl04R1i5EthEkAWGfy1lksvABEBAAG0HU9wZW5JREMgPHN1cHBv
cnRAb3BlbmlkYy5jb20+iQFRBBMBCgA7FiEEFdjWJA1IGDkAITSxnyZY1L0OSOMF
Amh53lgCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQnyZY1L0OSONG
Jgf+II0wG96R0g28Kp+R4AYzSdX0CEqr6OhwHHw4cFpLsHxZNhojo7I4OnLKEdfc
lFl37rE+hG3QpzD/b4S/fpPjd4hcLkguBQxtdxqZZVAIT8HWbveHRkI8MNnjOPwv
Hy6jBncMs1IT/URV2si/Q34+PLo8tvo/lXNa16svVl2DoYXO8MCszgCE1bx055EF
XPh4Teu5Y4OLHECSicMxrmN746dAD121zy4bLLx9mZ0erhLjvkj1vkFmlHFKyvwY
/pbSqXs9hW/wweW1oQ/xEIJWWS71PeoutUBjr0WC4sILnR5PBPZplgNh297Qex6g
qaW3io0tCH9KxU1tXYn/iL/hbQ==
=mlOy
-----END PGP PUBLIC KEY BLOCK-----

Contributors

smanolache and maltesmann
Assets 39
Loading