Use init_cache_size instead of cache_size when clearing session store.

Just make it clear that we should always be using init_cache_size. In
practice this commit doesn't actually affect the program, it just
clarifies the code.
Fix access of uninitialized data when logging out.

Since the session data for an unused session isn't initialized,
we may end up reading uninitialized data, leading to a segmentation
fault.
Add support for AssertionConsumerServiceURL

Apperently some IdPs like PicketLink insist they reaaaally want to see
AssertionConsumerServiceURL as part of the Authentication Request.

Provide it if allowed by the SP metadata.

Signed-off-by: Simo Sorce <simo@redhat.com>
Move session table initialization into session file.

This moves all the code working on the session table to that file.
Fix offset calculation for session entries.

The session entry size isn't known on compile time, so we must
actually calculate the offset at runtime.

This fixes a nasty bug where we would randomly overwrite session
entries.
Fix am_cache_env_fetch_first.

This function is supposed to return the value of the entry we are
looking for, but instead it returned the name. Fix it to return the
value.

Also, fix exit condition on for-loop.

This fixes NameID-based logout.
Add NEWS-file for 0.9.0.
Version 0.9.0.
Make Apache run our handler hook earlier.

The mod_auth_mellon hook is designed to handle requests to
MellonEndpointPath rather than looking at r->handler.

If we are unlucky, a different handler hook may look at r->handler,
and decide that the request is meant for it instead of mod_auth_mellon.

This patch makes the mod_auth_mellon hook run before most other hooks.

A workaround is to add something like this to the Apache configuration:

<Location /mellon>
  SetHandler mod_auth_mellon
</Location
Fix session offset bug with creating new session.

When fixing the session offset calculation in 22990058be, I forgot
to update the logic for creating the new session. The result is that
the code for creating new sessions use a different logic for
calculating the session offset than the code for looking up sessions.

This in turn means that we can only have a single session.
NEWS-file for 0.9.1.
Version 0.9.1.
Ensure that all generated session IDs are cryptographically strong.

We used to call RAND_pseudo_bytes, which will generate cryptographically
strong random bytes in most cases. Under memory pressure or other error
conditions, it can return weak random bytes.

It is unlikely that there is a way for an attacker to set up a condition
where the user is sucessfully logged in but receives a weak session
identifier, but to be safe, we switch to RAND_bytes.
Merge branch 'master' of https://github.com/UNINETT/mod_auth_mellon
Commented out my assertionconsumerurl lines, but left the protocolbinding ones.