.gitignore

@@ -1 +0,0 @@
-SOURCES/mod_auth_mellon-0.14.0.tar.gz

.mod_auth_mellon.metadata

@@ -1 +0,0 @@
-4a93f8b093e1dea20e8a286931693c614903f2d9 SOURCES/mod_auth_mellon-0.14.0.tar.gz

SOURCES/0001-Modify-am_handler-setup-to-run-before-mod_proxy.patch

@@ -1,80 +0,0 @@
-From e09a28a30e13e5c22b481010f26b4a7743a09280 Mon Sep 17 00:00:00 2001
-From: John Dennis <jdennis@redhat.com>
-Date: Tue, 5 Mar 2019 10:15:48 +0100
-Subject: [PATCH] Modify am_handler setup to run before mod_proxy
-
-The way the ECP flow works is that when a client initiates the flow, the
-SP's response is HTTP 200, but not the requested content, but a signed XML
-document that contains the "samlp:AuthnRequest" element. The idea is that
-the ECP client would then determine the IDP and send the document to the
-IDP, get a samlp:Response and convey that to the SP to get access to the
-protected resource.
-
-Internally, the auth check which is normally done with am_check_uid() set to
-apache's ap_hook_check_user_id() hook, just responds with OK, so it pretends
-to authenticate the user. Then in the usual flow, the request reaches the
-ap_hook_handler which handles the request. There in the pipeline, mellon
-registers functions am_handler() which should run first (APR_HOOK_FIRST),
-determine that this request is an ECP one and return the ECP AuthnRequest
-document. But in case the proxy module is also in the picture, the proxy
-module "races" for who gets to be the first to handle the request in the
-pipeline and wins. Therefore, the request reaches the protected resource
-via mod_proxy and returns it.
-
-This fix modifies the ap_hook_handler() call to explicitly run before
-handlers from mod_proxy.c
-
-To reproduce the bug:
-0) Have a SP with mellon connected to a Keycloak IDP (or any other IDP I
-   guess). In the example below, my SAML SP is saml.federation.test
-1) Set a Location protected by mellon that proxies requests to another
-   URL. For example:
-
-    ProxyPass         /sp-proxy  http://app.federation.test/example_app/
-    <Location /sp-proxy>
-        AuthType Mellon
-        MellonEnable auth
-        Require valid-user
-    </Location>
-
-2) call:
- curl -L -H "Accept: application/vnd.paos+xml" \
-         -H 'PAOS: ver="urn:liberty:paos:2003-08";"urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"' \
-          http://saml.federation.test/sp-proxy
-
-Before the patch, you would see whatever is served from the proxied
-page. With the patch, you should get back a XML document with a
-samlp:AuthnRequest.
----
- mod_auth_mellon.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/mod_auth_mellon.c b/mod_auth_mellon.c
-index 74bd328..5330f48 100644
---- a/mod_auth_mellon.c
-+++ b/mod_auth_mellon.c
-@@ -207,6 +207,12 @@ static int am_create_request(request_rec *r)
- 
- static void register_hooks(apr_pool_t *p)
- {
-+    /* Our handler needs to run before mod_proxy so that it can properly
-+     * return ECP AuthnRequest messages when running as a reverse proxy.
-+     * See: https://github.com/Uninett/mod_auth_mellon/pull/196
-+     */
-+    static const char * const run_handler_before[]={ "mod_proxy.c", NULL };
-+
-     ap_hook_access_checker(am_auth_mellon_user, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_check_user_id(am_check_uid, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_post_config(am_global_init, NULL, NULL, APR_HOOK_MIDDLE);
-@@ -222,7 +228,7 @@ static void register_hooks(apr_pool_t *p)
-      * Therefore this hook must run before any handler that may check
-      * r->handler and decide that it is the only handler for this URL.
-      */
--    ap_hook_handler(am_handler, NULL, NULL, APR_HOOK_FIRST);
-+    ap_hook_handler(am_handler, NULL, run_handler_before, APR_HOOK_FIRST);
- 
- #ifdef ENABLE_DIAGNOSTICS
-     ap_hook_open_logs(am_diag_log_init,NULL,NULL,APR_HOOK_MIDDLE);
--- 
-2.19.2
-

SOURCES/0002-Fix-redirect-URL-validation-bypass.patch

@@ -1,44 +0,0 @@
-From 62041428a32de402e0be6ba45fe12df6a83bedb8 Mon Sep 17 00:00:00 2001
-From: Olav Morken <olav.morken@uninett.no>
-Date: Tue, 19 Mar 2019 13:42:22 +0100
-Subject: [PATCH] Fix redirect URL validation bypass
-
-It turns out that browsers silently convert backslash characters into
-forward slashes, while apr_uri_parse() does not.
-
-This mismatch allows an attacker to bypass the redirect URL validation
-by using an URL like:
-
-  https://sp.example.org/mellon/logout?ReturnTo=https:%5c%5cmalicious.example.org/
-
-mod_auth_mellon will assume that it is a relative URL and allow the
-request to pass through, while the browsers will use it as an absolute
-url and redirect to https://malicious.example.org/ .
-
-This patch fixes this issue by rejecting all redirect URLs with
-backslashes.
----
- auth_mellon_util.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/auth_mellon_util.c b/auth_mellon_util.c
-index 0fab309..fd442f9 100644
---- a/auth_mellon_util.c
-+++ b/auth_mellon_util.c
-@@ -927,6 +927,13 @@ int am_check_url(request_rec *r, const char *url)
-                           "Control character detected in URL.");
-             return HTTP_BAD_REQUEST;
-         }
-+        if (*i == '\\') {
-+            /* Reject backslash character, as it can be used to bypass
-+             * redirect URL validation. */
-+            AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
-+                          "Backslash character detected in URL.");
-+            return HTTP_BAD_REQUEST;
-+        }
-     }
- 
-     return OK;
--- 
-2.19.2
-

SOURCES/0003-backport-Make-the-environment-variable-prefix-configurable.patch

@@ -1,172 +0,0 @@
-diff -up mod_auth_mellon-0.14.0/auth_mellon_cache.c.env_prefix mod_auth_mellon-0.14.0/auth_mellon_cache.c
---- mod_auth_mellon-0.14.0/auth_mellon_cache.c.env_prefix	2017-10-02 11:44:08.000000000 +0200
-+++ mod_auth_mellon-0.14.0/auth_mellon_cache.c	2019-06-10 09:46:36.806014513 +0200
-@@ -589,7 +589,7 @@ void am_cache_env_populate(request_rec *
-      */
-     for(i = 0; i < t->size; ++i) {
-         varname = am_cache_entry_get_string(t, &t->env[i].varname);
--        varname_prefix = "MELLON_";
-+        varname_prefix = d->env_prefix;
- 
-         /* Check if we should map this name into another name. */
-         env_varname_conf = (am_envattr_conf_t *)apr_hash_get(
-diff -up mod_auth_mellon-0.14.0/auth_mellon_config.c.env_prefix mod_auth_mellon-0.14.0/auth_mellon_config.c
---- mod_auth_mellon-0.14.0/auth_mellon_config.c.env_prefix	2018-03-16 08:14:54.000000000 +0100
-+++ mod_auth_mellon-0.14.0/auth_mellon_config.c	2019-06-10 09:46:36.807014516 +0200
-@@ -36,6 +36,11 @@ static const char *default_endpoint_path
-  */
- static const char *default_user_attribute = "NAME_ID";
- 
-+/* This is the default prefix to use for attributes received from the
-+ * server. Customizable using the MellonEnvPrefix option
-+ */
-+static const char *default_env_prefix = "MELLON_";
-+
- /* This is the default name of the cookie which mod_auth_mellon will set.
-  * If you change this, then you should also update the description of the
-  * MellonVar configuration directive.
-@@ -1372,8 +1377,10 @@ const command_rec auth_mellon_commands[]
-         am_set_setenv_slot,
-         NULL,
-         OR_AUTHCFG,
--        "Renames attributes received from the server while retaining prefix MELLON_. The format is"
--        " MellonSetEnv <old name> <new name>."
-+        "Renames attributes received from the server while retaining the"
-+        " prefix. The prefix defaults to MELLON_ but can be changed with"
-+        " MellonEnvPrefix."
-+        " The format is MellonSetEnv <old name> <new name>."
-         ),
-      AP_INIT_TAKE2(
-         "MellonSetEnvNoPrefix",
-@@ -1383,6 +1390,13 @@ const command_rec auth_mellon_commands[]
-         "Renames attributes received from the server without adding prefix. The format is"
-         " MellonSetEnvNoPrefix <old name> <new name>."
-         ),
-+    AP_INIT_TAKE1(
-+        "MellonEnvPrefix",
-+        ap_set_string_slot,
-+        (void *)APR_OFFSETOF(am_dir_cfg_rec, env_prefix),
-+        OR_AUTHCFG,
-+        "The prefix to use for attributes received from the server."
-+        ),
-     AP_INIT_FLAG(
-         "MellonSessionDump",
-         ap_set_flag_slot,
-@@ -1714,6 +1728,7 @@ void *auth_mellon_dir_config(apr_pool_t
-     dir->cookie_path = NULL;
-     dir->cookie_samesite = am_samesite_default;
-     dir->envattr   = apr_hash_make(p);
-+    dir->env_prefix = default_env_prefix;
-     dir->userattr  = default_user_attribute;
-     dir->idpattr  = NULL;
-     dir->signature_method = inherit_signature_method;
-@@ -1868,6 +1883,10 @@ void *auth_mellon_dir_merge(apr_pool_t *
-                                      add_cfg->envattr :
-                                      base_cfg->envattr);
- 
-+    new_cfg->env_prefix = (add_cfg->env_prefix != default_env_prefix ?
-+                           add_cfg->env_prefix :
-+                           base_cfg->env_prefix);
-+
-     new_cfg->userattr = (add_cfg->userattr != default_user_attribute ?
-                          add_cfg->userattr :
-                          base_cfg->userattr);
-diff -up mod_auth_mellon-0.14.0/auth_mellon_diagnostics.c.env_prefix mod_auth_mellon-0.14.0/auth_mellon_diagnostics.c
---- mod_auth_mellon-0.14.0/auth_mellon_diagnostics.c.env_prefix	2018-03-16 08:14:54.000000000 +0100
-+++ mod_auth_mellon-0.14.0/auth_mellon_diagnostics.c	2019-06-10 09:46:36.808014518 +0200
-@@ -442,6 +442,9 @@ am_diag_log_dir_cfg(request_rec *r, int
-                     "%sMellonCookieSameSite (cookie_samesite): %s\n",
-                     indent(level+1),
-                     am_diag_samesite_str(r, cfg->cookie_samesite));
-+    apr_file_printf(diag_cfg->fd,
-+                    "%sMellonEnvPrefix (env_prefix): %s\n",
-+                    indent(level+1), cfg->env_prefix);
- 
-     apr_file_printf(diag_cfg->fd,
-                     "%sMellonCond (cond): %d items\n",
-@@ -466,7 +469,7 @@ am_diag_log_dir_cfg(request_rec *r, int
-         apr_hash_this(hash_item, (void *)&key, NULL, (void *)&envattr_conf);
- 
-         if (envattr_conf->prefixed) {
--            name = apr_pstrcat(r->pool, "MELLON_",
-+            name = apr_pstrcat(r->pool, cfg->env_prefix,
-                                envattr_conf->name, NULL);
-         } else {
-             name = envattr_conf->name;
-diff -up mod_auth_mellon-0.14.0/auth_mellon.h.env_prefix mod_auth_mellon-0.14.0/auth_mellon.h
---- mod_auth_mellon-0.14.0/auth_mellon.h.env_prefix	2018-03-16 08:14:54.000000000 +0100
-+++ mod_auth_mellon-0.14.0/auth_mellon.h	2019-06-10 09:46:36.805014510 +0200
-@@ -237,6 +237,7 @@ typedef struct am_dir_cfg_rec {
-     am_samesite_t cookie_samesite;
-     apr_array_header_t *cond;
-     apr_hash_t *envattr;
-+    const char *env_prefix;
-     const char *userattr;
-     const char *idpattr;
-     LassoSignatureMethod signature_method;
-diff -up mod_auth_mellon-0.14.0/doc/user_guide/mellon_user_guide.adoc.env_prefix mod_auth_mellon-0.14.0/doc/user_guide/mellon_user_guide.adoc
---- mod_auth_mellon-0.14.0/doc/user_guide/mellon_user_guide.adoc.env_prefix	2018-03-16 08:14:54.000000000 +0100
-+++ mod_auth_mellon-0.14.0/doc/user_guide/mellon_user_guide.adoc	2019-06-10 09:48:08.422237471 +0200
-@@ -2007,11 +2007,13 @@ attributes.
-   assertion to a name of your choosing when it is placed in the Apache
-   environment. This is controlled by `MellonSetEnv` and
-   `MellonSetEnvNoPrefix` directives.  The distinction
--  is `MellonSetEnv` always prepends the `MELLON_` prefix to the
-+  is `MellonSetEnv` always prepends a prefix to the
-   environment variable name to help to prevent name collisions. The
-+  prefix defaults to `MELLON_` and can be configured using the
-+  `MellonEnvPrefix` configuration option. The
-   `MellonSetEnvNoPrefix` directive also remaps the assertion name to a
-   name of your choosing but it omits prepending the environment
--  variable name with `MELLON_`. See <<map_assertion_attr_name>>
-+  variable name with the prefix. See <<map_assertion_attr_name>>
- 
- Using the <<assertion_response,assertion example>> Mellon places these
- environment variables in the Apache environment. See
-@@ -2096,10 +2098,12 @@ and `MellonSetEnvNoPrefix` directives. T
- assertion attribute to a name of your choosing. The `MellonSetEnv`
- directive follows the same convention as all other assertion
- attributes added by Mellon in that it always prefixes the environment
--variable name with `MELLON_` to help avoid name collisions in the
-+variable name with a configurable prefix, which defaults to `MELLON_` to help avoid name collisions in the
- Apache environment. However sometimes you do not want the `MELLON_`
--prefix added and instead you want to use exactly the environment
--variable name as specified., `MellonSetEnvNoPrefix` serves this role.
-+prefix added. In case you simply want the variables prefixed with
-+a different string, use the `MellonEnvPrefix` configuration option. If,
-+instead you want to use exactly the environment variable name as specified.,
-+`MellonSetEnvNoPrefix` serves this role.
- 
- To illustrate let's look at an example. Suppose your web app is
- expecting an attribute which is the user's last name, specifically it
-@@ -2117,6 +2121,15 @@ MellonSetEnvNoPrefix REMOTE_USER_LASTNAM
- Also see <<set_remote_user>> for an example of setting the `REMOTE_USER`
- environment variable using `MellonSetEnvNoPrefix`.
- 
-+The `MellonEnvPrefix` variable might be useful e.g. if you
-+are migrating from a different SP which used its own prefix
-+for the variables passed by the IdP. For example, to prefix
-+all variables with `NOLLEM_` you would use:
-+
-+----
-+MellonEnvPrefix NOLLEM_
-+----
-+
- === Using Mellon to apply constraints [[assertion_constraints]]
- 
- SAML attributes can be used for more than exporting those values to a
-diff -up mod_auth_mellon-0.14.0/README.md.env_prefix mod_auth_mellon-0.14.0/README.md
---- mod_auth_mellon-0.14.0/README.md.env_prefix	2018-03-16 08:14:54.000000000 +0100
-+++ mod_auth_mellon-0.14.0/README.md	2019-06-10 09:46:36.805014510 +0200
-@@ -253,6 +253,11 @@ MellonDiagnosticsEnable Off
-         # Default. None set.
-         MellonSetEnvNoPrefix "DISPLAY_NAME" "displayName"
- 
-+        # MellonEnvPrefix changes the string the variables passed from the
-+        # IdP are prefixed with.
-+        # Default: MELLON_
-+        MellonEnvPrefix "NOLLEM_"
-+
-         # MellonMergeEnvVars merges multiple values of environment variables
-         # set using MellonSetEnv into single variable:
-         # ie: MYENV_VAR => val1;val2;val3 instead of default behaviour of:

SOURCES/0004-Fix-incorrect-header-used-for-detecting-AJAX-request.patch

@@ -1,49 +0,0 @@
-From 6358a5169762ef7b89d8b6d0f1a99b006f0fdd2f Mon Sep 17 00:00:00 2001
-From: Olav Morken <olav.morken@uninett.no>
-Date: Wed, 25 Jul 2018 12:19:39 +0200
-Subject: [PATCH] Fix incorrect header used for detecting AJAX requests
-
-The code was looking for "X-Request-With", but the header is actually
-"X-Requested-With". As far as I can tell, it has always been the
-latter, at least in the jQuery source code.
-
-Fixes issue #174.
----
- README.md             | 2 +-
- auth_mellon_handler.c | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/README.md b/README.md
-index 0a91dc5..8d85b43 100644
---- a/README.md
-+++ b/README.md
-@@ -180,7 +180,7 @@ MellonDiagnosticsEnable Off
-         #           then we will redirect him to the login page of the IdP.
-         #
-         #           There is a special handling of AJAX requests, that are
--        #           identified by the "X-Request-With: XMLHttpRequest" HTTP
-+        #           identified by the "X-Requested-With: XMLHttpRequest" HTTP
-         #           header. Since no user interaction can happen there,
-         #           we always fail unauthenticated (not logged in) requests
-         #           with a 403 Forbidden error without redirecting to the IdP.
-diff --git a/auth_mellon_handler.c b/auth_mellon_handler.c
-index b16dc45..e33e6e9 100644
---- a/auth_mellon_handler.c
-+++ b/auth_mellon_handler.c
-@@ -3658,11 +3658,11 @@ int am_auth_mellon_user(request_rec *r)
-              * If this is an AJAX request, we cannot proceed to the IdP,
-              * Just fail early to save our resources
-              */
--            ajax_header = apr_table_get(r->headers_in, "X-Request-With");
-+            ajax_header = apr_table_get(r->headers_in, "X-Requested-With");
-             if (ajax_header != NULL &&
-                 strcmp(ajax_header, "XMLHttpRequest") == 0) {
-                     AM_LOG_RERROR(APLOG_MARK, APLOG_INFO, 0, r,
--                      "Deny unauthenticated X-Request-With XMLHttpRequest "
-+                      "Deny unauthenticated X-Requested-With XMLHttpRequest "
-                       "(AJAX) request");
-                     return HTTP_FORBIDDEN;
-             }
--- 
-2.20.1
-

SOURCES/0005-CVE_2019_13038.patch

@@ -1,28 +0,0 @@
-From 297093e6a48a4c0fd307c2206c59a8c8eb84fb53 Mon Sep 17 00:00:00 2001
-From: Valentin <awakenine@users.noreply.github.com>
-Date: Fri, 6 Sep 2019 13:30:36 +0300
-Subject: [PATCH] Update auth_mellon_mode.c
-
-Fix open redirect CVE-2019-13038
----
- auth_mellon_util.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/auth_mellon_util.c b/auth_mellon_util.c
-index fd442f9..7dff61e 100644
---- a/auth_mellon_util.c
-+++ b/auth_mellon_util.c
-@@ -116,6 +116,10 @@ int am_validate_redirect_url(request_rec *r, const char *url)
- 
-     /* Sanity check of the scheme of the domain. We only allow http and https. */
-     if (uri.scheme) {
-+	/* http and https schemes without hostname are invalid. */
-+        if (!uri.hostname) {
-+            return HTTP_BAD_REQUEST;
-+	}
-         if (strcasecmp(uri.scheme, "http")
-             && strcasecmp(uri.scheme, "https")) {
-             AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, 0, r,
--- 
-2.21.0
-

SOURCES/0006-Add-none-option-for-samesite.patch

@@ -1,95 +0,0 @@
-From fb5ad7bf997946df4472cb94d7875ee70281d59c Mon Sep 17 00:00:00 2001
-From: Anthony Critelli <acritelli@datto.com>
-Date: Tue, 7 Jan 2020 11:14:24 -0500
-Subject: [PATCH] Add none option for samesite
-
----
- README.md                 | 7 +++++--
- auth_mellon.h             | 3 ++-
- auth_mellon_config.c      | 2 ++
- auth_mellon_cookie.c      | 4 +++-
- auth_mellon_diagnostics.c | 1 +
- 5 files changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/README.md b/README.md
-index be374bc..82a88fc 100644
---- a/README.md
-+++ b/README.md
-@@ -218,8 +218,11 @@ MellonDiagnosticsEnable Off
- 
-         # MellonCookieSameSite allows control over the SameSite value used
-         # for the authentication cookie.
--        # The setting accepts values of "Strict" or "Lax"
--        # If not set, the SameSite attribute is not set on the cookie.
-+        # The setting accepts values of "Strict", "Lax", or "None".
-+        # When using none, you should set "MellonSecureCookie On" to prevent
-+        # compatibility issues with newer browsers.
-+        # If not set, the SameSite attribute is not set on the cookie. In newer
-+        # browsers, this may cause SameSite to default to "Lax"
-         # Default: not set
-         # MellonCookieSameSite lax
- 
-diff --git a/auth_mellon.h b/auth_mellon.h
-index 9ef2d8a..5f5a20b 100644
---- a/auth_mellon.h
-+++ b/auth_mellon.h
-@@ -164,7 +164,8 @@ typedef enum {
- typedef enum {
-   am_samesite_default,
-   am_samesite_lax,
--  am_samesite_strict
-+  am_samesite_strict,
-+  am_samesite_none,
- } am_samesite_t;
- 
- typedef enum {
-diff --git a/auth_mellon_config.c b/auth_mellon_config.c
-index 7932e2d..f1a9d12 100644
---- a/auth_mellon_config.c
-+++ b/auth_mellon_config.c
-@@ -583,6 +583,8 @@ static const char *am_set_samesite_slot(cmd_parms *cmd,
-         d->cookie_samesite = am_samesite_lax;
-     } else if(!strcasecmp(arg, "strict")) {
-         d->cookie_samesite = am_samesite_strict;
-+    } else if(!strcasecmp(arg, "none")) {
-+        d->cookie_samesite = am_samesite_none;
-     } else {
-         return "The MellonCookieSameSite parameter must be 'lax' or 'strict'";
-     }
-diff --git a/auth_mellon_cookie.c b/auth_mellon_cookie.c
-index 8394c18..b2c8535 100644
---- a/auth_mellon_cookie.c
-+++ b/auth_mellon_cookie.c
-@@ -1,7 +1,7 @@
- /*
-  *
-  *   auth_mellon_cookie.c: an authentication apache module
-- *   Copyright © 2003-2007 UNINETT (http://www.uninett.no/)
-+ *   Copyright © 2003-2007 UNINETT (http://www.uninett.no/)
-  *
-  *   This program is free software; you can redistribute it and/or modify
-  *   it under the terms of the GNU General Public License as published by
-@@ -73,6 +73,8 @@ static const char *am_cookie_params(request_rec *r)
-         cookie_samesite = "; SameSite=Lax";
-     } else if (cfg->cookie_samesite == am_samesite_strict) {
-         cookie_samesite = "; SameSite=Strict";
-+    } else if (cfg->cookie_samesite == am_samesite_none) {
-+        cookie_samesite = "; SameSite=None";
-     }
- 
-     secure_cookie = cfg->secure;
-diff --git a/auth_mellon_diagnostics.c b/auth_mellon_diagnostics.c
-index 792e894..912814b 100644
---- a/auth_mellon_diagnostics.c
-+++ b/auth_mellon_diagnostics.c
-@@ -214,6 +214,7 @@ am_diag_samesite_str(request_rec *r, am_samesite_t samesite)
-     case am_samesite_default: return "default";
-     case am_samesite_lax:     return "lax";
-     case am_samesite_strict:  return "strict";
-+    case am_samesite_none:    return "none";
-     default:
-         return apr_psprintf(r->pool, "unknown (%d)", samesite);
-     }
--- 
-2.21.0
-

SOURCES/0007-avoid-always-set-SameSite-cookie.patch

@@ -1,69 +0,0 @@
-From b9d87e0deb528817689f1648999a95645b1b19ad Mon Sep 17 00:00:00 2001
-From: Keita SUZUKI <keita@osstech.co.jp>
-Date: Mon, 20 Jan 2020 11:03:14 +0900
-Subject: [PATCH] avoid always set SameSite cookie
-
----
- auth_mellon.h        |  5 +++++
- auth_mellon_cookie.c | 22 ++++++++++++++++------
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/auth_mellon.h b/auth_mellon.h
-index 5f5a20b..8bb8023 100644
---- a/auth_mellon.h
-+++ b/auth_mellon.h
-@@ -96,6 +96,11 @@ typedef enum {
- } am_diag_flags_t;
- #endif
- 
-+
-+/* Disable SameSite Environment Value */
-+#define AM_DISABLE_SAMESITE_ENV_VAR "MELLON_DISABLE_SAMESITE"
-+
-+
- /* This is the length of the id we use (for session IDs and
-  * replaying POST data).
-  */
-diff --git a/auth_mellon_cookie.c b/auth_mellon_cookie.c
-index b2c8535..55f77a5 100644
---- a/auth_mellon_cookie.c
-+++ b/auth_mellon_cookie.c
-@@ -59,6 +59,7 @@ static const char *am_cookie_params(request_rec *r)
-     const char *cookie_domain = ap_get_server_name(r);
-     const char *cookie_path = "/";
-     const char *cookie_samesite = "";
-+    const char *env_var_value = NULL;
-     am_dir_cfg_rec *cfg = am_get_dir_cfg(r);
- 
-     if (cfg->cookie_domain) {
-@@ -69,12 +70,21 @@ static const char *am_cookie_params(request_rec *r)
-         cookie_path = cfg->cookie_path;
-     }
- 
--    if (cfg->cookie_samesite == am_samesite_lax) {
--        cookie_samesite = "; SameSite=Lax";
--    } else if (cfg->cookie_samesite == am_samesite_strict) {
--        cookie_samesite = "; SameSite=Strict";
--    } else if (cfg->cookie_samesite == am_samesite_none) {
--        cookie_samesite = "; SameSite=None";
-+    if (r->subprocess_env != NULL){
-+        env_var_value = apr_table_get(r->subprocess_env,
-+                        AM_DISABLE_SAMESITE_ENV_VAR);
-+        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,
-+                     "%s : %s", AM_DISABLE_SAMESITE_ENV_VAR, env_var_value);
-+    }
-+
-+    if (env_var_value == NULL){
-+        if (cfg->cookie_samesite == am_samesite_lax) {
-+            cookie_samesite = "; SameSite=Lax";
-+        } else if (cfg->cookie_samesite == am_samesite_strict) {
-+            cookie_samesite = "; SameSite=Strict";
-+        } else if (cfg->cookie_samesite == am_samesite_none) {
-+            cookie_samesite = "; SameSite=None";
-+        }
-     }
- 
-     secure_cookie = cfg->secure;
--- 
-2.21.0
-

SOURCES/0008-Set-SameSite-to-None-on-test-cookie.patch

@@ -1,78 +0,0 @@
-From 7ef4ae72a8578475064eb66e3ed5703ccf6ee078 Mon Sep 17 00:00:00 2001
-From: Ruediger Pluem <r.pluem@gmx.de>
-Date: Thu, 30 Apr 2020 07:56:01 +0200
-Subject: [PATCH] Set SameSite to None on test cookie
-
-If the SameSite cookie attribute is to be set because
-MellonCookieSameSite is configured and MELLON_DISABLE_SAMESITE not set
-for this particular request set it to None for the test cookie.
-This ensures that the test cookie with the static test content does not
-get lost in the HTTP-POST binding request issued by the autosubmit form
-returned by the IDP.
-Addresses #20
-
-* auth_mellon.h: Add AM_FORCE_SAMESITE_NONE_NOTE
-
-* auth_mellon_handler.c (am_send_login_authn_request): Set request note
-  to set SameSite to None if appropriate.
-
-* auth_mellon_cookie.c (am_cookie_params): Set SameSite to None if
-  requested via request note.
----
- auth_mellon.h         | 3 +++
- auth_mellon_cookie.c  | 6 +++++-
- auth_mellon_handler.c | 5 +++++
- 3 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/auth_mellon.h b/auth_mellon.h
-index fd39b28..401ed9c 100644
---- a/auth_mellon.h
-+++ b/auth_mellon.h
-@@ -100,6 +100,9 @@ typedef enum {
- /* Disable SameSite Environment Value */
- #define AM_DISABLE_SAMESITE_ENV_VAR "MELLON_DISABLE_SAMESITE"
- 
-+/* Force setting SameSite to None */
-+#define AM_FORCE_SAMESITE_NONE_NOTE "MELLON_FORCE_SAMESITE_NONE"
-+
- 
- /* This is the length of the id we use (for session IDs and
-  * replaying POST data).
-diff --git a/auth_mellon_cookie.c b/auth_mellon_cookie.c
-index 55f77a5..6bff81e 100644
---- a/auth_mellon_cookie.c
-+++ b/auth_mellon_cookie.c
-@@ -78,7 +78,11 @@ static const char *am_cookie_params(request_rec *r)
-     }
- 
-     if (env_var_value == NULL){
--        if (cfg->cookie_samesite == am_samesite_lax) {
-+        if ((cfg->cookie_samesite != am_samesite_default) &&
-+            (apr_table_get(r->notes, AM_FORCE_SAMESITE_NONE_NOTE) != NULL)) {
-+            cookie_samesite = "; SameSite=None";
-+        }
-+        else if (cfg->cookie_samesite == am_samesite_lax) {
-             cookie_samesite = "; SameSite=Lax";
-         } else if (cfg->cookie_samesite == am_samesite_strict) {
-             cookie_samesite = "; SameSite=Strict";
-diff --git a/auth_mellon_handler.c b/auth_mellon_handler.c
-index 395ee1d..40c9bcd 100644
---- a/auth_mellon_handler.c
-+++ b/auth_mellon_handler.c
-@@ -3261,8 +3261,13 @@ static int am_send_login_authn_request(request_rec *r, const char *idp,
-     /* Add cookie for cookie test. We know that we should have
-      * a valid cookie when we return from the IdP after SP-initiated
-      * login.
-+     * Ensure that SameSite is set to None for this cookie if SameSite
-+     * is allowed to be set as the cookie otherwise gets lost on
-+     * HTTP-POST binding messages.
-      */
-+    apr_table_setn(r->notes, AM_FORCE_SAMESITE_NONE_NOTE, "1");
-     am_cookie_set(r, "cookietest");
-+    apr_table_unset(r->notes, AM_FORCE_SAMESITE_NONE_NOTE);
- 
-     server = am_get_lasso_server(r);
-     if(server == NULL) {
--- 
-2.26.2
-

SOURCES/0009-Prevent-redirect-to-URLs-that-begin-with.patch

@@ -1,47 +0,0 @@
-From 42a11261b9dad2e48d70bdff7c53dd57a12db6f5 Mon Sep 17 00:00:00 2001
-From: AIMOTO Norihito <aimoto@osstech.co.jp>
-Date: Tue, 6 Jul 2021 22:57:24 +0200
-Subject: [PATCH] Prevent redirect to URLs that begin with '///'
-
-Visiting a logout URL like this:
-    https://rp.example.co.jp/mellon/logout?ReturnTo=///fishing-site.example.com/logout.html
-would have redirected the user to fishing-site.example.com
-
-With the patch, this URL would be rejected.
-
-Fixes: CVE-2021-3639
----
- auth_mellon_util.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/auth_mellon_util.c b/auth_mellon_util.c
-index 2f8c9c3..6a686db 100644
---- a/auth_mellon_util.c
-+++ b/auth_mellon_util.c
-@@ -927,6 +927,10 @@ int am_check_url(request_rec *r, const char *url)
- {
-     const char *i;
- 
-+    if (url == NULL) {
-+        return HTTP_BAD_REQUEST;
-+    }
-+
-     for (i = url; *i; i++) {
-         if (*i >= 0 && *i < ' ') {
-             /* Deny all control-characters. */
-@@ -943,6 +947,12 @@ int am_check_url(request_rec *r, const char *url)
-         }
-     }
- 
-+    if (strstr(url, "///") == url) {
-+        AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
-+                          "URL starts with '///'");
-+        return HTTP_BAD_REQUEST;
-+    }
-+
-     return OK;
- }
- 
--- 
-2.26.3
-

SOURCES/10-auth_mellon.conf

@@ -1 +0,0 @@
-LoadModule auth_mellon_module modules/mod_auth_mellon.so

SOURCES/README.redhat.rst

@@ -1,83 +0,0 @@
-Red Hat Specific mod_auth_mellon Information
-============================================
-
-This README contains information specific to Red Hat's distribution of
-``mod_auth_mellon``.
-
-Diagnostic Logging
-------------------
-
-Diagnostic logging can be used to collect run time information to help
-diagnose problems with your ``mod_auth_mellon`` deployment. Please see
-the "Mellon Diagnostics" section in the Mellon User Guide for more
-details.
-
-How to enable diagnostic logging on Red Hat systems
-```````````````````````````````````````````````````
-
-Diagnostic logging adds overhead to the execution of
-``mod_auth_mellon``. The code to emit diagnostic logging must be
-compiled into ``mod_auth_mellon`` at build time. In addition the
-diagnostic log file may contain security sensitive information which
-should not normally be written to a log file. If you have a
-version of ``mod_auth_mellon`` which was built with diagnostics you
-can disable diagnostic logging via the ``MellonDiagnosticsEnable``
-configuration directive. However given human nature the potential to
-enable diagnostic logging while resolving a problem and then forget to
-disable it is not a situation that should exist by default. Therefore
-given the overhead consideration and the desire to avoid enabling
-diagnostic logging by mistake the Red Hat ``mod_auth_mellon`` RPM's
-ship with two versions of the ``mod_auth_mellon`` Apache module.
-
-1. The ``mod_auth_mellon`` RPM contains the normal Apache module
-   ``/usr/lib*/httpd/modules/mod_auth_mellon.so`` 
-
-2. The ``mod_auth_mellon-diagnostics`` RPM contains the diagnostic
-   version of the Apache module
-   ``/usr/lib*/httpd/modules/mod_auth_mellon-diagnostics.so``
-
-Because each version of the module has a different name both the
-normal and diagnostic modules can be installed simultaneously without
-conflict. But Apache will only load one of the two modules. Which
-module is loaded is controlled by the
-``/etc/httpd/conf.modules.d/10-auth_mellon.conf`` config file which
-has a line in it which looks like this::
-
-    LoadModule auth_mellon_module modules/mod_auth_mellon.so
-
-To load the diagnostics version of the module you need to change the
-module name so it looks like this::
-
-    LoadModule auth_mellon_module modules/mod_auth_mellon-diagnostics.so
-
-**Don't forget to change it back again when you're done debugging.**
-
-You'll also need to enable the collection of diagnostic information,
-do this by adding this directive at the top of your Mellon conf.d
-config file or inside your virtual host config (diagnostics are per
-server instance)::
-
-    MellonDiagnosticsEnable On
-
-.. NOTE::
-   Some versions of the Mellon User Guide have a typo in the name of
-   this directive, it incorrectly uses ``MellonDiagnosticEnable``
-   instead of ``MellonDiagnosticsEnable``. The difference is
-   Diagnostics is plural.
-
-The Apache ``error_log`` will contain a message indicating how it
-processed the ``MellonDiagnosticsEnable`` directive. If you loaded the
-standard module without diagnostics you'll see a message like this::
-
-    MellonDiagnosticsEnable has no effect because Mellon was not
-    compiled with diagnostics enabled, use
-    ./configure --enable-diagnostics at build time to turn this
-    feature on.
-
-If you've loaded the diagnostics version of the module you'll see a
-message in the ``error_log`` like this::
-
-    mellon diagnostics enabled for virtual server *:443
-    (/etc/httpd/conf.d/my_server.conf:7)
-    ServerName=https://my_server.example.com:443, diagnostics
-    filename=logs/mellon_diagnostics

SOURCES/auth_mellon.conf

@@ -1,2 +0,0 @@
-MellonCacheSize 100
-MellonLockFile "/run/mod_auth_mellon/lock"

SOURCES/mellon_create_metadata.sh

@@ -1,126 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-PROG="$(basename "$0")"
-
-printUsage() {
-    echo "Usage: $PROG ENTITY-ID ENDPOINT-URL"
-    echo ""
-    echo "Example:"
-    echo "  $PROG urn:someservice https://sp.example.org/mellon"
-    echo ""
-}
-
-if [ "$#" -lt 2 ]; then
-    printUsage
-    exit 1
-fi
-
-ENTITYID="$1"
-if [ -z "$ENTITYID" ]; then
-    echo "$PROG: An entity ID is required." >&2
-    exit 1
-fi
-
-BASEURL="$2"
-if [ -z "$BASEURL" ]; then
-    echo "$PROG: The URL to the MellonEndpointPath is required." >&2
-    exit 1
-fi
-
-if ! echo "$BASEURL" | grep -q '^https\?://'; then
-    echo "$PROG: The URL must start with \"http://\" or \"https://\"." >&2
-    exit 1
-fi
-
-HOST="$(echo "$BASEURL" | sed 's#^[a-z]*://\([^/]*\).*#\1#')"
-BASEURL="$(echo "$BASEURL" | sed 's#/$##')"
-
-OUTFILE="$(echo "$ENTITYID" | sed 's/[^0-9A-Za-z.]/_/g' | sed 's/__*/_/g')"
-echo "Output files:"
-echo "Private key:                              $OUTFILE.key"
-echo "Certificate:                              $OUTFILE.cert"
-echo "Metadata:                                 $OUTFILE.xml"
-echo "Host:                                     $HOST"
-echo
-echo "Endpoints:"
-echo "SingleLogoutService (SOAP):               $BASEURL/logout"
-echo "SingleLogoutService (HTTP-Redirect):      $BASEURL/logout"
-echo "AssertionConsumerService (HTTP-POST):     $BASEURL/postResponse"
-echo "AssertionConsumerService (HTTP-Artifact): $BASEURL/artifactResponse"
-echo "AssertionConsumerService (PAOS):          $BASEURL/paosResponse"
-echo
-
-# No files should not be readable by the rest of the world.
-umask 0077
-
-TEMPLATEFILE="$(mktemp -t mellon_create_sp.XXXXXXXXXX)"
-
-cat >"$TEMPLATEFILE" <<EOF
-RANDFILE           = /dev/urandom
-[req]
-default_bits       = 2048
-default_keyfile    = privkey.pem
-distinguished_name = req_distinguished_name
-prompt             = no
-policy             = policy_anything
-[req_distinguished_name]
-commonName         = $HOST
-EOF
-
-openssl req -utf8 -batch -config "$TEMPLATEFILE" -new -x509 -days 3652 -nodes -out "$OUTFILE.cert" -keyout "$OUTFILE.key" 2>/dev/null
-
-rm -f "$TEMPLATEFILE"
-
-CERT="$(grep -v '^-----' "$OUTFILE.cert")"
-
-cat >"$OUTFILE.xml" <<EOF
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<EntityDescriptor
- entityID="$ENTITYID"
- xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
- <SPSSODescriptor
-   AuthnRequestsSigned="true"
-   WantAssertionsSigned="true"
-   protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-   <KeyDescriptor use="signing">
-     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-       <ds:X509Data>
-         <ds:X509Certificate>$CERT</ds:X509Certificate>
-       </ds:X509Data>
-     </ds:KeyInfo>
-   </KeyDescriptor>
-   <KeyDescriptor use="encryption">
-     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-       <ds:X509Data>
-         <ds:X509Certificate>$CERT</ds:X509Certificate>
-       </ds:X509Data>
-     </ds:KeyInfo>
-   </KeyDescriptor>
-   <SingleLogoutService
-     Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
-     Location="$BASEURL/logout" />
-   <SingleLogoutService
-     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-     Location="$BASEURL/logout" />
-   <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
-   <AssertionConsumerService
-     index="0"
-     isDefault="true"
-     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-     Location="$BASEURL/postResponse" />
-   <AssertionConsumerService
-     index="1"
-     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
-     Location="$BASEURL/artifactResponse" />
-   <AssertionConsumerService
-     index="2"
-     Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
-     Location="$BASEURL/paosResponse" />
- </SPSSODescriptor>
-</EntityDescriptor>
-EOF
-
-umask 0777
-chmod go+r "$OUTFILE.xml"
-chmod go+r "$OUTFILE.cert"

SOURCES/mod_auth_mellon.conf

@@ -1,2 +0,0 @@
-# mod_auth_mellon lock file is created in this directory
-d /run/mod_auth_mellon 0755 apache apache

SPECS/mod_auth_mellon.spec

@@ -1,275 +0,0 @@
-Summary: A SAML 2.0 authentication module for the Apache Httpd Server
-Name: mod_auth_mellon
-Version: 0.14.0
-Release: 12%{?dist}.1
-Group: System Environment/Daemons
-Source0: https://github.com/UNINETT/mod_auth_mellon/releases/download/v%{version}/%{name}-%{version}.tar.gz
-Source1: auth_mellon.conf
-Source2: 10-auth_mellon.conf
-Source3: mod_auth_mellon.conf
-Source4: mellon_create_metadata.sh
-Source5: README.redhat.rst
-Source6: mellon_user_guide.html
-License: GPLv2+
-BuildRequires:  gcc
-BuildRequires: curl-devel
-BuildRequires: glib2-devel
-BuildRequires: httpd-devel
-BuildRequires: lasso-devel >= 2.5.1
-BuildRequires: openssl-devel
-BuildRequires: xmlsec1-devel
-Requires: httpd-mmn = %{_httpd_mmn}
-Requires: lasso >= 2.5.1
-Url: https://github.com/UNINETT/mod_auth_mellon
-
-Patch0001: 0001-Modify-am_handler-setup-to-run-before-mod_proxy.patch
-Patch0002: 0002-Fix-redirect-URL-validation-bypass.patch
-Patch0003: 0003-backport-Make-the-environment-variable-prefix-configurable.patch
-Patch0004: 0004-Fix-incorrect-header-used-for-detecting-AJAX-request.patch
-Patch0005: 0005-CVE_2019_13038.patch
-Patch0006: 0006-Add-none-option-for-samesite.patch
-Patch0007: 0007-avoid-always-set-SameSite-cookie.patch
-Patch0008: 0008-Set-SameSite-to-None-on-test-cookie.patch
-Patch0009: 0009-Prevent-redirect-to-URLs-that-begin-with.patch
-
-# FIXME: RHEL-7 does not have rubygem-asciidoctor, only asciidoc. However,
-# I could not get asciidoc to render properly so instead I generated
-# mellon_user_guide.html on Fedora using asciidoctor and included
-# mellon_user_guide.html as a SOURCE. If the user guide source is updated
-# the mellon_user_guide.html will need to be regenerated. 
-
-%description
-The mod_auth_mellon module is an authentication service that implements the
-SAML 2.0 federation protocol. It grants access based on the attributes
-received in assertions generated by a IdP server.
-
-%prep
-%setup -q -n %{name}-%{version}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-
-%build
-export APXS=%{_httpd_apxs}
-%configure --enable-diagnostics
-make clean
-make %{?_smp_mflags}
-cp .libs/%{name}.so %{name}-diagnostics.so
-
-%configure
-make clean
-make %{?_smp_mflags}
-
-%install
-# install module
-mkdir -p %{buildroot}%{_httpd_moddir}
-install -m 755 .libs/%{name}.so %{buildroot}%{_httpd_moddir}
-install -m 755 %{name}-diagnostics.so %{buildroot}%{_httpd_moddir}
-
-# install module configuration
-mkdir -p %{buildroot}%{_httpd_confdir}
-install -m 644 %{SOURCE1} %{buildroot}%{_httpd_confdir}
-mkdir -p %{buildroot}%{_httpd_modconfdir}
-install -m 644 %{SOURCE2} %{buildroot}%{_httpd_modconfdir}
-
-mkdir -p %{buildroot}%{_tmpfilesdir}
-install -m 644 %{SOURCE3} %{buildroot}%{_tmpfilesdir}
-mkdir -p %{buildroot}/run/%{name}
-
-# install script to generate metadata
-mkdir -p %{buildroot}/%{_libexecdir}/%{name}
-install -m 755 %{SOURCE4} %{buildroot}/%{_libexecdir}/%{name}
-
-#install documentation
-mkdir -p %{buildroot}/%{_pkgdocdir}
-
-# install Red Hat README
-install -m 644 %{SOURCE5} %{buildroot}/%{_pkgdocdir}
-
-# install user guide
-cp -r doc/user_guide %{buildroot}/%{_pkgdocdir}
-install -m 644 %{SOURCE6} %{buildroot}/%{_pkgdocdir}/user_guide
-
-%package diagnostics
-Summary: Build of mod_auth_mellon with diagnostic logging
-Requires: %{name} = %{version}-%{release}
-
-%description diagnostics
-Build of mod_auth_mellon with diagnostic logging. See README.redhat.rst
-in the doc directory for instructions on using the diagnostics build.
-
-%files diagnostics
-%{_httpd_moddir}/%{name}-diagnostics.so
-
-%files
-%if 0%{?rhel} && 0%{?rhel} < 7
-%doc COPYING
-%else
-%license COPYING
-%endif
-%doc README.md NEWS ECP.rst
-%doc %{_pkgdocdir}/README.redhat.rst
-%doc %{_pkgdocdir}/user_guide
-%config(noreplace) %{_httpd_modconfdir}/10-auth_mellon.conf
-%config(noreplace) %{_httpd_confdir}/auth_mellon.conf
-%{_httpd_moddir}/mod_auth_mellon.so
-%{_tmpfilesdir}/mod_auth_mellon.conf
-%{_libexecdir}/%{name}
-%attr(0755,apache,apache) %dir /run/%{name}/
-
-%changelog
-* Wed Dec 15 2021 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12.1
-- Resolves: rhbz#1986805 - CVE-2021-3639 mod_auth_mellon: Open Redirect
-                           vulnerability in logout URLs [rhel-8]
-
-* Mon Jan 25 2021 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12
-- Resolves: rhbz#1791262 - Backport SameSite=None cookie from upstream to
-                           support latest browsers
-
-* Fri Oct 18 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-11
-- Resolves: rhbz#1731053 - CVE-2019-13038 mod_auth_mellon: an Open Redirect
-                           via the login?ReturnTo= substring which could
-                           facilitate information theft [rhel-8]
-
-* Fri Oct 18 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-10
-- Resolves: rhbz#1761774 - mod_auth_mellon fix for AJAX header name
-                           X-Requested-With
-
-* Thu Jun 13 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
-- Just bump the release number
-- Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product
-                          listings
-
-* Fri Jun  7 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
-- Resolves: rhbz#1691894 - [RFE] Config option to change mod_auth_mellon prefix
-
-* Fri Jun  7 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
-- Apply the patch from the previous commit
-- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
-                           redirect in logout url when using URLs with
-                           backslashes [rhel-8]
-
-* Fri Jun  7 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
-- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
-                           redirect in logout url when using URLs with
-                           backslashes [rhel-8]
-
-* Fri Jun  7 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
-- Resolves: rhbz#1692457 - CVE-2019-3878 mod_auth_mellon: authentication
-                           bypass in ECP flow [rhel-8.1.0]
-
-* Wed Apr 24 2019 Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-4
-- Resolves: rhbz#1702695 - fresh install of mod_auth_mellon shows rpm
-                           verification warnings
-
-* Mon Jul 30 2018 Florian Weimer <fweimer@redhat.com> - 0.14.0-3
-- Rebuild with fixed binutils
-
-* Fri Jun  1 2018  <jdennis@redhat.com> - 0.14.0-2
-- Resolves: rhbz#1553885
-- fix file permissions on doc files
-
-* Fri Jun  1 2018  <jdennis@redhat.com> - 0.14.0-1
-- Resolves: rhbz#1553885
-- Rebase to current upstream release
-
-* Thu Mar 29 2018 John Dennis <jdennis@redhat.com> - 0.13.1-2
-- Resolves: rhbz#1481330 Add diagnostic logging
-- Resolves: rhbz#1295472 Add MellonSignatureMethod config option to set
-  signature method used to sign SAML messages sent by Mellon.
-  Defaults to original sha1.
-
-* Sun Oct  1 2017 John Dennis <jdennis@redhat.com> - 0.13.1-1
-- upgrade to new upstream release
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.0-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.0-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Tue Jan 17 2017 John Dennis <jdennis@redhat.com> - 0.12.0-4
-- Resolves: bug #1414019 Incorrect PAOS Content-Type header
-
-* Mon Jan  9 2017 John Dennis <jdennis@redhat.com> - 0.12.0-3
-- bump release for rebuild
-
-* Tue May  3 2016 John Dennis <jdennis@redhat.com> - 0.12.0-2
-- Resolves: bug #1332729, mellon conflicts with mod_auth_openidc
-- am_check_uid() should be no-op if mellon not enabled
-
-* Wed Mar  9 2016 John Dennis <jdennis@redhat.com> - 0.12.0-1
-- Update to new upstream 0.12.0
-- [CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to
-  incorrect error handling when reading POST data from client.
-
-- [CVE-2016-2146] Fix DOS attack (Apache worker process crash /
-  resource exhaustion) due to missing size checks when reading
-  POST data.
-
-In addition this release contains the following new features and fixes:
-
-- Add MellonRedirectDomains option to limit the sites that
-  mod_auth_mellon can redirect to. This option is enabled by default.
-
-- Add support for ECP service options in PAOS requests.
-
-- Fix AssertionConsumerService lookup for PAOS requests.
-
-* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.11.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Wed Dec 23 2015 John Dennis <jdennis@redhat.com> - 0.11.0-3
-- Fix the following warning that appears in the Apache log
-  lasso-CRITICAL **: lasso_provider_get_metadata_list_for_role: assertion '_lasso_provider_get_role_index(role)' failed
-
-* Fri Sep 18 2015 John Dennis <jdennis@redhat.com> - 0.11.0-2
-- Add lasso 2.5.0 version dependency
-
-* Fri Sep 18 2015 John Dennis <jdennis@redhat.com> - 0.11.0-1
-- Upgrade to upstream 0.11.0 release.
-- Includes ECP support, see NEWS for all changes.
-- Update mellon_create_metadata.sh to match internally generated metadata,
-  includes AssertionConsumerService for postResponse, artifactResponse &
-  paosResponse.
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.10.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Wed Jan  7 2015 Simo Sorce <simo@redhat.com> 0.10.0-1
-- New upstream release
-
-* Tue Sep  2 2014 Simo Sorce <simo@redhat.com> 0.9.1-1
-- New upstream release
-
-* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.8.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Tue Jun 24 2014 Simo Sorce <simo@redhat.com> 0.8.0-1
-- New upstream realease version 0.8.0
-- Upstream moved to github
-- Drops patches as they have been all included upstream
-
-* Fri Jun 20 2014 Simo Sorce <simo@redhat.com> 0.7.0-3
-- Backport of useful patches from upstream
-  - Better handling of IDP reported errors
-  - Better handling of session data storage size
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Tue Dec 10 2013 Simo Sorce <simo@redhat.com> 0.7.0-1
-- Fix ownership of /run files
-
-* Wed Nov 27 2013 Simo Sorce <simo@redhat.com> 0.7.0-0
-- Initial Fedora release based on version 0.7.0
-- Based on an old spec file by Jean-Marc Liger <jmliger@siris.sorbonne.fr>

dead.package

@@ -0,0 +1 @@
+mod_auth_mellon was removed due to minimization efforts prior to public launch