X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=saml%2Fbinding%2Fimpl%2FSimpleSigningRule.cpp;h=0fc1a1d045b128ffd810a28139e30553ac816661;hb=71da1c2d917edf7e7a8244a108df784066b60dc4;hp=394802bc47a2f89391b4154a323b3dc0456f8dbc;hpb=3e40c0e62375c069e7860a87ca4f65fb2003f018;p=shibboleth%2Fcpp-opensaml.git diff --git a/saml/binding/impl/SimpleSigningRule.cpp b/saml/binding/impl/SimpleSigningRule.cpp index 394802b..0fc1a1d 100644 --- a/saml/binding/impl/SimpleSigningRule.cpp +++ b/saml/binding/impl/SimpleSigningRule.cpp @@ -1,5 +1,5 @@ /* - * Copyright 2001-2006 Internet2 + * Copyright 2001-2007 Internet2 * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,71 +22,98 @@ #include "internal.h" #include "exceptions.h" -#include "binding/HTTPRequest.h" -#include "binding/SimpleSigningRule.h" +#include "binding/SecurityPolicyRule.h" #include "saml2/core/Assertions.h" #include "saml2/metadata/Metadata.h" +#include "saml2/metadata/MetadataCredentialCriteria.h" #include "saml2/metadata/MetadataProvider.h" -#include +#include +#include +#include +#include using namespace opensaml::saml2md; using namespace opensaml; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; using xmlsignature::KeyInfo; +using xmlsignature::SignatureException; namespace opensaml { + class SAML_DLLLOCAL SimpleSigningRule : public SecurityPolicyRule + { + public: + SimpleSigningRule(const DOMElement* e); + virtual ~SimpleSigningRule() {} + + const char* getType() const { + return SIMPLESIGNING_POLICY_RULE; + } + void evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const; + + private: + // Appends a raw parameter=value pair to the string. + static bool appendParameter(string& s, const char* data, const char* name); + + bool m_errorFatal; + }; + SecurityPolicyRule* SAML_DLLLOCAL SimpleSigningRuleFactory(const DOMElement* const & e) { return new SimpleSigningRule(e); } - // Appends a raw parameter=value pair to the string. - static bool appendParameter(string& s, const char* data, const char* name) - { - const char* start = strstr(data,name); - if (!start) - return false; - if (!s.empty()) - s += '&'; - const char* end = strchr(start,'&'); - if (end) - s.append(start, end-start); - else - s.append(start); - return true; - } + static const XMLCh errorFatal[] = UNICODE_LITERAL_10(e,r,r,o,r,F,a,t,a,l); }; +bool SimpleSigningRule::appendParameter(string& s, const char* data, const char* name) +{ + const char* start = strstr(data,name); + if (!start) + return false; + if (!s.empty()) + s += '&'; + const char* end = strchr(start,'&'); + if (end) + s.append(start, end-start); + else + s.append(start); + return true; +} + +SimpleSigningRule::SimpleSigningRule(const DOMElement* e) : m_errorFatal(false) +{ + if (e) { + const XMLCh* flag = e->getAttributeNS(NULL, errorFatal); + m_errorFatal = (flag && (*flag==chLatin_t || *flag==chDigit_1)); + } +} void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const { Category& log=Category::getInstance(SAML_LOGCAT".SecurityPolicyRule.SimpleSigning"); - log.debug("evaluating simple signing policy"); if (!policy.getIssuerMetadata()) { log.debug("ignoring message, no issuer metadata supplied"); return; } - else if (!policy.getTrustEngine()) { - log.debug("ignoring message, no TrustEngine supplied"); + + const SignatureTrustEngine* sigtrust; + if (!(sigtrust=dynamic_cast(policy.getTrustEngine()))) { + log.debug("ignoring message, no SignatureTrustEngine supplied"); return; } const HTTPRequest* httpRequest = dynamic_cast(request); - if (!request || !httpRequest) { - log.debug("ignoring message, no HTTP protocol request available"); + if (!request || !httpRequest) return; - } const char* signature = request->getParameter("Signature"); - if (!signature) { - log.debug("ignoring unsigned message"); + if (!signature) return; - } const char* sigAlgorithm = request->getParameter("SigAlg"); if (!sigAlgorithm) { @@ -100,6 +127,10 @@ void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* // We have to construct a string containing the signature input by accessing the // request directly. We can't use the decoded parameters because we need the raw // data and URL-encoding isn't canonical. + + // NOTE: SimpleSign for GET means Redirect binding, which means we verify over the + // base64-encoded message directly. + pch = httpRequest->getQueryString(); if (!appendParameter(input, pch, "SAMLRequest=")) appendParameter(input, pch, "SAMLResponse="); @@ -109,13 +140,34 @@ void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* else { // With POST, the input string is concatenated from the decoded form controls. // GET should be this way too, but I messed up the spec, sorry. + + // NOTE: SimpleSign for POST means POST binding, which means we verify over the + // base64-decoded XML. This sucks, because we have to decode the base64 directly. + // Serializing the XMLObject doesn't guarantee the signature will verify (this is + // why XMLSignature exists, and why this isn't really "simpler"). + + unsigned int x; pch = httpRequest->getParameter("SAMLRequest"); - if (pch) - input = string("SAMLRequest=") + pch; + if (pch) { + XMLByte* decoded=Base64::decode(reinterpret_cast(pch),&x); + if (!decoded) { + log.warn("unable to decode base64 in POST binding message"); + return; + } + input = string("SAMLRequest=") + reinterpret_cast(decoded); + XMLString::release(&decoded); + } else { pch = httpRequest->getParameter("SAMLResponse"); - input = string("SAMLResponse=") + pch; + XMLByte* decoded=Base64::decode(reinterpret_cast(pch),&x); + if (!decoded) { + log.warn("unable to decode base64 in POST binding message"); + return; + } + input = string("SAMLResponse=") + reinterpret_cast(decoded); + XMLString::release(&decoded); } + pch = httpRequest->getParameter("RelayState"); if (pch) input = input + "&RelayState=" + pch; @@ -126,30 +178,41 @@ void SimpleSigningRule::evaluate(const XMLObject& message, const GenericRequest* KeyInfo* keyInfo=NULL; pch = request->getParameter("KeyInfo"); if (pch) { - try { - istringstream kstrm(pch); - DOMDocument* doc = XMLToolingConfig::getConfig().getParser().parse(kstrm); - XercesJanitor janitor(doc); - XMLObject* kxml = XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true); - janitor.release(); - if (!(keyInfo=dynamic_cast(kxml))) - delete kxml; + unsigned int x; + XMLByte* decoded=Base64::decode(reinterpret_cast(pch),&x); + if (decoded) { + try { + istringstream kstrm(pch); + DOMDocument* doc = XMLToolingConfig::getConfig().getParser().parse(kstrm); + XercesJanitor janitor(doc); + XMLObject* kxml = XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true); + janitor.release(); + if (!(keyInfo=dynamic_cast(kxml))) + delete kxml; + } + catch (XMLToolingException& ex) { + log.warn("Failed to load KeyInfo from message: %s", ex.what()); + } } - catch (XMLToolingException& ex) { - log.warn("Failed to load KeyInfo from message: %s", ex.what()); + else { + log.warn("Failed to load KeyInfo from message: Unable to decode base64-encoded KeyInfo."); } } auto_ptr kjanitor(keyInfo); auto_ptr_XMLCh alg(sigAlgorithm); - - if (!policy.getTrustEngine()->validate( - alg.get(), signature, keyInfo, input.c_str(), input.length(), - *(policy.getIssuerMetadata()), policy.getMetadataProvider()->getKeyResolver() - )) { + + // Set up criteria object. + MetadataCredentialCriteria cc(*(policy.getIssuerMetadata())); + cc.setXMLAlgorithm(alg.get()); + + if (!sigtrust->validate(alg.get(), signature, keyInfo, input.c_str(), input.length(), *(policy.getMetadataProvider()), &cc)) { log.error("unable to verify message signature with supplied trust engine"); + if (m_errorFatal) + throw SecurityPolicyException("Message was signed, but signature could not be verified."); return; } log.debug("signature verified against message issuer"); + policy.setAuthenticated(true); }