X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=shibsp%2Fimpl%2FXMLServiceProvider.cpp;h=231039fbb12b40c86cc025e6ad723594b3bd38e4;hb=73514022d6a44deb8da9be57c8ed9d7e823d3b6b;hp=b0d9b707a18aa39777b7ddbf628236d9c1646401;hpb=fa95bb7c06a1641ab1aabc5f168bd0336f502ff7;p=shibboleth%2Fsp.git diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp index b0d9b70..231039f 100644 --- a/shibsp/impl/XMLServiceProvider.cpp +++ b/shibsp/impl/XMLServiceProvider.cpp @@ -1,6 +1,6 @@ /* - * Copyright 2001-2007 Internet2 - * + * Copyright 2001-2010 Internet2 + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -17,17 +17,19 @@ /** * XMLServiceProvider.cpp * - * XML-based SP configuration and mgmt + * XML-based SP configuration and mgmt. */ #include "internal.h" #include "exceptions.h" +#include "version.h" #include "AccessControl.h" #include "Application.h" #include "RequestMapper.h" #include "ServiceProvider.h" #include "SessionCache.h" #include "SPConfig.h" +#include "SPRequest.h" #include "handler/SessionInitiator.h" #include "remoting/ListenerService.h" #include "util/DOMPropertySet.h" @@ -40,10 +42,14 @@ #else # error "Supported logging library not available." #endif +#include #include #include +#include #include #include +#include +#include #include #ifndef SHIBSP_LITE @@ -52,24 +58,39 @@ # include "attribute/resolver/AttributeExtractor.h" # include "attribute/resolver/AttributeResolver.h" # include "security/PKIXTrustEngine.h" +# include "security/SecurityPolicyProvider.h" # include +# include # include # include # include +# include # include -# include -# include +# include +# include +# include +# include +# include +# include # include +# include +# include using namespace opensaml::saml2; using namespace opensaml::saml2p; using namespace opensaml::saml2md; using namespace opensaml; +#else +# include "lite/SAMLConstants.h" #endif using namespace shibsp; using namespace xmltooling; using namespace std; +#ifndef min +# define min(a,b) (((a) < (b)) ? (a) : (b)) +#endif + namespace { #if defined (_MSC_VER) @@ -83,9 +104,9 @@ namespace { class SHIBSP_DLLLOCAL XMLApplication : public Application, public Remoted, public DOMPropertySet, public DOMNodeFilter { public: - XMLApplication(const ServiceProvider*, const DOMElement* e, const XMLApplication* base=NULL); + XMLApplication(const ServiceProvider*, const DOMElement* e, const XMLApplication* base=nullptr); ~XMLApplication() { cleanup(); } - + const char* getHash() const {return m_hash.c_str();} #ifndef SHIBSP_LITE @@ -98,7 +119,11 @@ namespace { index = props->getInt("artifactEndpointIndex"); if (!index.first) index = getArtifactEndpointIndex(); - return new SAML2ArtifactType0004(SAMLConfig::getConfig().hashSHA1(props->getString("entityID").second),index.first ? index.second : 1); + pair entityID = props->getString("entityID"); + return new SAML2ArtifactType0004( + SecurityHelper::doHash("SHA1", entityID.second, strlen(entityID.second), false), + index.first ? index.second : 1 + ); } MetadataProvider* getMetadataProvider(bool required=true) const { @@ -124,6 +149,7 @@ namespace { return (!m_credResolver && m_base) ? m_base->getCredentialResolver() : m_credResolver; } const PropertySet* getRelyingParty(const EntityDescriptor* provider) const; + const PropertySet* getRelyingParty(const XMLCh* entityID) const; const vector* getAudiences() const { return (m_audiences.empty() && m_base) ? m_base->getAudiences() : &m_audiences; } @@ -134,6 +160,10 @@ namespace { return (m_remoteUsers.empty() && m_base) ? m_base->getRemoteUserAttributeIds() : m_remoteUsers; } + void clearHeader(SPRequest& request, const char* rawname, const char* cginame) const; + void setHeader(SPRequest& request, const char* name, const char* value) const; + string getSecureHeader(const SPRequest& request, const char* name) const; + const SessionInitiator* getDefaultSessionInitiator() const; const SessionInitiator* getSessionInitiatorById(const char* id) const; const Handler* getDefaultAssertionConsumerService() const; @@ -145,7 +175,7 @@ namespace { void receive(DDF& in, ostream& out) { // Only current function is to return the headers to clear. DDF header; - DDF ret=DDF(NULL).list(); + DDF ret=DDF(nullptr).list(); DDFJanitor jret(ret); for (vector< pair >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) { header = DDF(i->first.c_str()).string(i->second.c_str()); @@ -155,12 +185,18 @@ namespace { } // Provides filter to exclude special config elements. - short acceptNode(const DOMNode* node) const; - +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE + short +#else + FilterAction +#endif + acceptNode(const DOMNode* node) const; + private: void cleanup(); const XMLApplication* m_base; string m_hash; + std::pair m_attributePrefix; #ifndef SHIBSP_LITE MetadataProvider* m_metadata; TrustEngine* m_trust; @@ -171,11 +207,7 @@ namespace { vector m_audiences; // RelyingParty properties -#ifdef HAVE_GOOD_STL map m_partyMap; -#else - map m_partyMap; -#endif #endif vector m_remoteUsers,m_frontLogout,m_backLogout; @@ -187,16 +219,12 @@ namespace { // maps unique indexes to consumer services map m_acsIndexMap; - + // pointer to default consumer service const Handler* m_acsDefault; // maps binding strings to supporting consumer service(s) -#ifdef HAVE_GOOD_STL typedef map > ACSBindingMap; -#else - typedef map > ACSBindingMap; -#endif ACSBindingMap m_acsBindingMap; // pointer to default session initiator @@ -221,16 +249,21 @@ namespace { public: XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer, Category& log); ~XMLConfigImpl(); - + RequestMapper* m_requestMapper; map m_appmap; #ifndef SHIBSP_LITE - map< string,pair< PropertySet*,vector > > m_policyMap; + SecurityPolicyProvider* m_policy; vector< pair< string, pair > > m_transportOptions; #endif - + // Provides filter to exclude special config elements. - short acceptNode(const DOMNode* node) const; +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE + short +#else + FilterAction +#endif + acceptNode(const DOMNode* node) const; void setDocument(DOMDocument* doc) { m_document = doc; @@ -251,37 +284,53 @@ namespace { { public: XMLConfig(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".Config")), - m_impl(NULL), m_listener(NULL), m_sessionCache(NULL) + m_impl(nullptr), m_listener(nullptr), m_sessionCache(nullptr) #ifndef SHIBSP_LITE - , m_tranLog(NULL) + , m_tranLog(nullptr) #endif { } - + void init() { - load(); + background_load(); } ~XMLConfig() { + shutdown(); delete m_impl; delete m_sessionCache; delete m_listener; #ifndef SHIBSP_LITE delete m_tranLog; - SAMLConfig::getConfig().setArtifactMap(NULL); - XMLToolingConfig::getConfig().setReplayCache(NULL); + SAMLConfig::getConfig().setArtifactMap(nullptr); + XMLToolingConfig::getConfig().setReplayCache(nullptr); for_each(m_storage.begin(), m_storage.end(), cleanup_pair()); #endif } +#ifndef SHIBSP_LITE + // Lockable + Lockable* lock() { + ReloadableXMLFile::lock(); + if (m_impl->m_policy) + m_impl->m_policy->lock(); + return this; + } + void unlock() { + if (m_impl->m_policy) + m_impl->m_policy->unlock(); + ReloadableXMLFile::unlock(); + } +#endif + // PropertySet const PropertySet* getParent() const { return m_impl->getParent(); } void setParent(const PropertySet* parent) {return m_impl->setParent(parent);} - pair getBool(const char* name, const char* ns=NULL) const {return m_impl->getBool(name,ns);} - pair getString(const char* name, const char* ns=NULL) const {return m_impl->getString(name,ns);} - pair getXMLString(const char* name, const char* ns=NULL) const {return m_impl->getXMLString(name,ns);} - pair getUnsignedInt(const char* name, const char* ns=NULL) const {return m_impl->getUnsignedInt(name,ns);} - pair getInt(const char* name, const char* ns=NULL) const {return m_impl->getInt(name,ns);} + pair getBool(const char* name, const char* ns=nullptr) const {return m_impl->getBool(name,ns);} + pair getString(const char* name, const char* ns=nullptr) const {return m_impl->getString(name,ns);} + pair getXMLString(const char* name, const char* ns=nullptr) const {return m_impl->getXMLString(name,ns);} + pair getUnsignedInt(const char* name, const char* ns=nullptr) const {return m_impl->getUnsignedInt(name,ns);} + pair getInt(const char* name, const char* ns=nullptr) const {return m_impl->getInt(name,ns);} void getAll(map& properties) const {return m_impl->getAll(properties);} const PropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:2.0:native:sp:config") const {return m_impl->getPropertySet(name,ns);} const DOMElement* getElement() const {return m_impl->getElement();} @@ -303,7 +352,7 @@ namespace { if (i!=m_storage.end()) return i->second; } - return NULL; + return nullptr; } #endif @@ -327,22 +376,22 @@ namespace { const Application* getApplication(const char* applicationId) const { map::const_iterator i=m_impl->m_appmap.find(applicationId); - return (i!=m_impl->m_appmap.end()) ? i->second : NULL; + return (i!=m_impl->m_appmap.end()) ? i->second : nullptr; } #ifndef SHIBSP_LITE + SecurityPolicyProvider* getSecurityPolicyProvider(bool required=true) const { + if (required && !m_impl->m_policy) + throw ConfigurationException("No SecurityPolicyProvider available."); + return m_impl->m_policy; + } + const PropertySet* getPolicySettings(const char* id) const { - map > >::const_iterator i = m_impl->m_policyMap.find(id); - if (i!=m_impl->m_policyMap.end()) - return i->second.first; - throw ConfigurationException("Security Policy ($1) not found, check element.", params(1,id)); + return getSecurityPolicyProvider()->getPolicySettings(id); } const vector& getPolicyRules(const char* id) const { - map > >::const_iterator i = m_impl->m_policyMap.find(id); - if (i!=m_impl->m_policyMap.end()) - return i->second.second; - throw ConfigurationException("Security Policy ($1) not found, check element.", params(1,id)); + return getSecurityPolicyProvider()->getPolicyRules(id); } bool setTransportOptions(SOAPTransport& transport) const { @@ -359,7 +408,7 @@ namespace { #endif protected: - pair load(); + pair background_load(); private: friend class XMLConfigImpl; @@ -404,13 +453,12 @@ namespace { static const XMLCh _option[] = UNICODE_LITERAL_6(o,p,t,i,o,n); static const XMLCh OutOfProcess[] = UNICODE_LITERAL_12(O,u,t,O,f,P,r,o,c,e,s,s); static const XMLCh _path[] = UNICODE_LITERAL_4(p,a,t,h); - static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y); static const XMLCh _provider[] = UNICODE_LITERAL_8(p,r,o,v,i,d,e,r); static const XMLCh RelyingParty[] = UNICODE_LITERAL_12(R,e,l,y,i,n,g,P,a,r,t,y); static const XMLCh _ReplayCache[] = UNICODE_LITERAL_11(R,e,p,l,a,y,C,a,c,h,e); static const XMLCh _RequestMapper[] = UNICODE_LITERAL_13(R,e,q,u,e,s,t,M,a,p,p,e,r); - static const XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e); static const XMLCh SecurityPolicies[] = UNICODE_LITERAL_16(S,e,c,u,r,i,t,y,P,o,l,i,c,i,e,s); + static const XMLCh SecurityPolicyProvider[] = UNICODE_LITERAL_22(S,e,c,u,r,i,t,y,P,o,l,i,c,y,P,r,o,v,i,d,e,r); static const XMLCh _SessionCache[] = UNICODE_LITERAL_12(S,e,s,s,i,o,n,C,a,c,h,e); static const XMLCh _SessionInitiator[] = UNICODE_LITERAL_16(S,e,s,s,i,o,n,I,n,i,t,i,a,t,o,r); static const XMLCh _SingleLogoutService[] = UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e); @@ -421,16 +469,6 @@ namespace { static const XMLCh _TrustEngine[] = UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e); static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e); static const XMLCh UnixListener[] = UNICODE_LITERAL_12(U,n,i,x,L,i,s,t,e,n,e,r); - -#ifndef SHIBSP_LITE - class SHIBSP_DLLLOCAL PolicyNodeFilter : public DOMNodeFilter - { - public: - short acceptNode(const DOMNode* node) const { - return FILTER_REJECT; - } - }; -#endif }; namespace shibsp { @@ -446,11 +484,11 @@ XMLApplication::XMLApplication( const XMLApplication* base ) : Application(sp), m_base(base), #ifndef SHIBSP_LITE - m_metadata(NULL), m_trust(NULL), - m_attrExtractor(NULL), m_attrFilter(NULL), m_attrResolver(NULL), - m_credResolver(NULL), + m_metadata(nullptr), m_trust(nullptr), + m_attrExtractor(nullptr), m_attrFilter(nullptr), m_attrResolver(nullptr), + m_credResolver(nullptr), #endif - m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL) + m_acsDefault(nullptr), m_sessionInitDefault(nullptr), m_artifactResolutionDefault(nullptr) { #ifdef _DEBUG xmltooling::NDC ndc("XMLApplication"); @@ -459,7 +497,7 @@ XMLApplication::XMLApplication( try { // First load any property sets. - load(e,NULL,this); + load(e,nullptr,this); if (base) setParent(base); @@ -478,6 +516,18 @@ XMLApplication::XMLApplication( m_hash += (DIGITS[0x0F & *ch]); } + // Populate prefix pair. + m_attributePrefix.second = "HTTP_"; + pair prefix = getString("attributePrefix"); + if (prefix.first) { + m_attributePrefix.first = prefix.second; + const char* pch = prefix.second; + while (*pch) { + m_attributePrefix.second += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + } + // Load attribute ID lists for REMOTE_USER and header clearing. if (conf.isEnabled(SPConfig::InProcess)) { pair attributes = getString("REMOTE_USER"); @@ -494,16 +544,16 @@ XMLApplication::XMLApplication( if (pos) *pos=0; m_remoteUsers.push_back(start); - start = pos ? pos+1 : NULL; + start = pos ? pos+1 : nullptr; } free(dup); } attributes = getString("unsetHeaders"); if (attributes.first) { - string transformedprefix("HTTP_"); + string transformedprefix(m_attributePrefix.second); const char* pch; - pair prefix = getString("metadataAttributePrefix"); + prefix = getString("metadataAttributePrefix"); if (prefix.first) { pch = prefix.second; while (*pch) { @@ -529,29 +579,30 @@ XMLApplication::XMLApplication( transformed += (isalnum(*pch) ? toupper(*pch) : '_'); pch++; } - m_unsetHeaders.push_back(pair(start,string("HTTP_") + transformed)); + + m_unsetHeaders.push_back(pair(m_attributePrefix.first + start, m_attributePrefix.second + transformed)); if (prefix.first) - m_unsetHeaders.push_back(pair(string(prefix.second) + start, transformedprefix + transformed)); - start = pos ? pos+1 : NULL; + m_unsetHeaders.push_back(pair(m_attributePrefix.first + prefix.second + start, transformedprefix + transformed)); + start = pos ? pos+1 : nullptr; } free(dup); - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + m_unsetHeaders.push_back(pair(m_attributePrefix.first + "Shib-Application-ID", m_attributePrefix.second + "SHIB_APPLICATION_ID")); } } - Handler* handler=NULL; + Handler* handler=nullptr; const PropertySet* sessions = getPropertySet("Sessions"); // Process assertion export handler. - pair location = sessions ? sessions->getString("exportLocation") : pair(false,NULL); + pair location = sessions ? sessions->getString("exportLocation") : pair(false,nullptr); if (location.first) { try { DOMElement* exportElement = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS,_Handler); - exportElement->setAttributeNS(NULL,Location,sessions->getXMLString("exportLocation").second); + exportElement->setAttributeNS(nullptr,Location,sessions->getXMLString("exportLocation").second); pair exportACL = sessions->getXMLString("exportACL"); if (exportACL.first) { static const XMLCh _acl[] = UNICODE_LITERAL_9(e,x,p,o,r,t,A,C,L); - exportElement->setAttributeNS(NULL,_acl,exportACL.second); + exportElement->setAttributeNS(nullptr,_acl,exportACL.second); } handler = conf.HandlerManager.newPlugin( samlconstants::SAML20_BINDING_URI, pair(exportElement, getId()) @@ -574,13 +625,17 @@ XMLApplication::XMLApplication( // Process other handlers. bool hardACS=false, hardSessionInit=false, hardArt=false; - const DOMElement* child = sessions ? XMLHelper::getFirstChildElement(sessions->getElement()) : NULL; + const DOMElement* child = sessions ? XMLHelper::getFirstChildElement(sessions->getElement()) : nullptr; while (child) { + if (!child->hasAttributeNS(nullptr, Location)) { + auto_ptr_char hclass(child->getLocalName()); + log.error("%s handler with no Location property cannot be processed", hclass.get()); + child = XMLHelper::getNextSiblingElement(child); + continue; + } try { - // A handler is based on the Binding property in conjunction with the element name. - // If it's an ACS or SI, also handle index/id mappings and defaulting. if (XMLString::equals(child->getLocalName(),_AssertionConsumerService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); + auto_ptr_char bindprop(child->getAttributeNS(nullptr,Binding)); if (!bindprop.get() || !*(bindprop.get())) { log.warn("md:AssertionConsumerService element has no Binding attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -588,13 +643,9 @@ XMLApplication::XMLApplication( } handler=conf.AssertionConsumerServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); // Map by binding (may be > 1 per binding, e.g. SAML 1.0 vs 1.1) -#ifdef HAVE_GOOD_STL m_acsBindingMap[handler->getXMLString("Binding").second].push_back(handler); -#else - m_acsBindingMap[handler->getString("Binding").second].push_back(handler); -#endif m_acsIndexMap[handler->getUnsignedInt("index").second]=handler; - + if (!hardACS) { pair defprop=handler->getBool("isDefault"); if (defprop.first) { @@ -608,7 +659,7 @@ XMLApplication::XMLApplication( } } else if (XMLString::equals(child->getLocalName(),_SessionInitiator)) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); if (!type.get() || !*(type.get())) { log.warn("SessionInitiator element has no type attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -632,7 +683,7 @@ XMLApplication::XMLApplication( } } else if (XMLString::equals(child->getLocalName(),_LogoutInitiator)) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); if (!type.get() || !*(type.get())) { log.warn("LogoutInitiator element has no type attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -641,14 +692,14 @@ XMLApplication::XMLApplication( handler=conf.LogoutInitiatorManager.newPlugin(type.get(),make_pair(child, getId())); } else if (XMLString::equals(child->getLocalName(),_ArtifactResolutionService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); + auto_ptr_char bindprop(child->getAttributeNS(nullptr,Binding)); if (!bindprop.get() || !*(bindprop.get())) { log.warn("md:ArtifactResolutionService element has no Binding attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); continue; } handler=conf.ArtifactResolutionServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); - + if (!hardArt) { pair defprop=handler->getBool("isDefault"); if (defprop.first) { @@ -662,7 +713,7 @@ XMLApplication::XMLApplication( } } else if (XMLString::equals(child->getLocalName(),_SingleLogoutService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); + auto_ptr_char bindprop(child->getAttributeNS(nullptr,Binding)); if (!bindprop.get() || !*(bindprop.get())) { log.warn("md:SingleLogoutService element has no Binding attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -671,7 +722,7 @@ XMLApplication::XMLApplication( handler=conf.SingleLogoutServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); } else if (XMLString::equals(child->getLocalName(),_ManageNameIDService)) { - auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); + auto_ptr_char bindprop(child->getAttributeNS(nullptr,Binding)); if (!bindprop.get() || !*(bindprop.get())) { log.warn("md:ManageNameIDService element has no Binding attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -680,7 +731,7 @@ XMLApplication::XMLApplication( handler=conf.ManageNameIDServiceManager.newPlugin(bindprop.get(),make_pair(child, getId())); } else { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); if (!type.get() || !*(type.get())) { log.warn("Handler element has no type attribute, skipping it..."); child = XMLHelper::getNextSiblingElement(child); @@ -702,7 +753,7 @@ XMLApplication::XMLApplication( catch (exception& ex) { log.error("caught exception processing handler element: %s", ex.what()); } - + child = XMLHelper::getNextSiblingElement(child); } @@ -710,8 +761,8 @@ XMLApplication::XMLApplication( DOMNodeList* nlist=e->getElementsByTagNameNS(shibspconstants::SHIB2SPCONFIG_NS,Notify); for (XMLSize_t i=0; nlist && igetLength(); i++) { if (nlist->item(i)->getParentNode()->isSameNode(e)) { - const XMLCh* channel = static_cast(nlist->item(i))->getAttributeNS(NULL,Channel); - auto_ptr_char loc(static_cast(nlist->item(i))->getAttributeNS(NULL,Location)); + const XMLCh* channel = static_cast(nlist->item(i))->getAttributeNS(nullptr,Channel); + auto_ptr_char loc(static_cast(nlist->item(i))->getAttributeNS(nullptr,Location)); if (loc.get() && *loc.get()) { if (channel && *channel == chLatin_f) m_frontLogout.push_back(loc.get()); @@ -723,14 +774,17 @@ XMLApplication::XMLApplication( #ifndef SHIBSP_LITE nlist=e->getElementsByTagNameNS(samlconstants::SAML20_NS,Audience::LOCAL_NAME); - for (XMLSize_t i=0; nlist && igetLength(); i++) - if (nlist->item(i)->getParentNode()->isSameNode(e) && nlist->item(i)->hasChildNodes()) - m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue()); + if (nlist && nlist->getLength()) { + log.warn("use of elements outside of a Security Policy Rule is deprecated"); + for (XMLSize_t i=0; igetLength(); i++) + if (nlist->item(i)->getParentNode()->isSameNode(e) && nlist->item(i)->hasChildNodes()) + m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue()); + } if (conf.isEnabled(SPConfig::Metadata)) { child = XMLHelper::getFirstChildElement(e,_MetadataProvider); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building MetadataProvider of type %s...",type.get()); try { auto_ptr mp(samlConf.MetadataProviderManager.newPlugin(type.get(),child)); @@ -746,7 +800,7 @@ XMLApplication::XMLApplication( if (conf.isEnabled(SPConfig::Trust)) { child = XMLHelper::getFirstChildElement(e,_TrustEngine); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building TrustEngine of type %s...",type.get()); try { m_trust = xmlConf.TrustEngineManager.newPlugin(type.get(),child); @@ -760,7 +814,7 @@ XMLApplication::XMLApplication( if (conf.isEnabled(SPConfig::AttributeResolution)) { child = XMLHelper::getFirstChildElement(e,_AttributeExtractor); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building AttributeExtractor of type %s...",type.get()); try { m_attrExtractor = conf.AttributeExtractorManager.newPlugin(type.get(),child); @@ -772,7 +826,7 @@ XMLApplication::XMLApplication( child = XMLHelper::getFirstChildElement(e,_AttributeFilter); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building AttributeFilter of type %s...",type.get()); try { m_attrFilter = conf.AttributeFilterManager.newPlugin(type.get(),child); @@ -784,7 +838,7 @@ XMLApplication::XMLApplication( child = XMLHelper::getFirstChildElement(e,_AttributeResolver); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building AttributeResolver of type %s...",type.get()); try { m_attrResolver = conf.AttributeResolverManager.newPlugin(type.get(),child); @@ -800,18 +854,20 @@ XMLApplication::XMLApplication( Locker extlock(m_attrExtractor); m_attrExtractor->getAttributeIds(unsetHeaders); } + else if (m_base && m_base->m_attrExtractor) { + Locker extlock(m_base->m_attrExtractor); + m_base->m_attrExtractor->getAttributeIds(unsetHeaders); + } if (m_attrResolver) { Locker reslock(m_attrResolver); m_attrResolver->getAttributeIds(unsetHeaders); } - if (unsetHeaders.empty()) { - if (m_base) - m_unsetHeaders.insert(m_unsetHeaders.end(), m_base->m_unsetHeaders.begin(), m_base->m_unsetHeaders.end()); - else - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + else if (m_base && m_base->m_attrResolver) { + Locker extlock(m_base->m_attrResolver); + m_base->m_attrResolver->getAttributeIds(unsetHeaders); } - else { - string transformedprefix("HTTP_"); + if (!unsetHeaders.empty()) { + string transformedprefix(m_attributePrefix.second); const char* pch; pair prefix = getString("metadataAttributePrefix"); if (prefix.first) { @@ -828,19 +884,19 @@ XMLApplication::XMLApplication( transformed += (isalnum(*pch) ? toupper(*pch) : '_'); pch++; } - m_unsetHeaders.push_back(pair(*hdr, string("HTTP_") + transformed)); + m_unsetHeaders.push_back(pair(m_attributePrefix.first + *hdr, m_attributePrefix.second + transformed)); if (prefix.first) - m_unsetHeaders.push_back(pair(string(prefix.second) + *hdr, transformedprefix + transformed)); + m_unsetHeaders.push_back(pair(m_attributePrefix.first + prefix.second + *hdr, transformedprefix + transformed)); } - m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); } + m_unsetHeaders.push_back(pair(m_attributePrefix.first + "Shib-Application-ID", m_attributePrefix.second + "SHIB_APPLICATION_ID")); } } if (conf.isEnabled(SPConfig::Credentials)) { child = XMLHelper::getFirstChildElement(e,_CredentialResolver); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building CredentialResolver of type %s...",type.get()); try { m_credResolver = xmlConf.CredentialResolverManager.newPlugin(type.get(),child); @@ -855,9 +911,9 @@ XMLApplication::XMLApplication( child = XMLHelper::getFirstChildElement(e,RelyingParty); while (child) { auto_ptr rp(new DOMPropertySet()); - rp->load(child,NULL,this); + rp->load(child,nullptr,this); rp->setParent(this); - m_partyMap[child->getAttributeNS(NULL,saml2::Attribute::NAME_ATTRIB_NAME)]=rp.release(); + m_partyMap[child->getAttributeNS(nullptr,saml2::Attribute::NAME_ATTRIB_NAME)]=rp.release(); child = XMLHelper::getNextSiblingElement(child,RelyingParty); } #endif @@ -895,28 +951,29 @@ void XMLApplication::cleanup() for_each(m_handlers.begin(),m_handlers.end(),xmltooling::cleanup()); m_handlers.clear(); #ifndef SHIBSP_LITE -#ifdef HAVE_GOOD_STL for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); -#else - for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); -#endif m_partyMap.clear(); delete m_credResolver; - m_credResolver = NULL; + m_credResolver = nullptr; delete m_attrResolver; - m_attrResolver = NULL; + m_attrResolver = nullptr; delete m_attrFilter; - m_attrFilter = NULL; + m_attrFilter = nullptr; delete m_attrExtractor; - m_attrExtractor = NULL; + m_attrExtractor = nullptr; delete m_trust; - m_trust = NULL; + m_trust = nullptr; delete m_metadata; - m_metadata = NULL; + m_metadata = nullptr; #endif } -short XMLApplication::acceptNode(const DOMNode* node) const +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE +short +#else +DOMNodeFilter::FilterAction +#endif +XMLApplication::acceptNode(const DOMNode* node) const { const XMLCh* name=node->getLocalName(); if (XMLString::equals(name,ApplicationOverride) || @@ -947,8 +1004,7 @@ const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provi { if (!provider) return this; - -#ifdef HAVE_GOOD_STL + map::const_iterator i=m_partyMap.find(provider->getEntityID()); if (i!=m_partyMap.end()) return i->second; @@ -961,19 +1017,17 @@ const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provi } group=dynamic_cast(group->getParent()); } -#else - map::const_iterator i=m_partyMap.begin(); - for (; i!=m_partyMap.end(); i++) { - if (XMLString::equals(i->first,provider->getEntityID())) - return i->second; - const EntitiesDescriptor* group=dynamic_cast(provider->getParent()); - while (group) { - if (XMLString::equals(i->first,group->getName())) - return i->second; - group=dynamic_cast(group->getParent()); - } - } -#endif + return this; +} + +const PropertySet* XMLApplication::getRelyingParty(const XMLCh* entityID) const +{ + if (!entityID) + return this; + + map::const_iterator i=m_partyMap.find(entityID); + if (i!=m_partyMap.end()) + return i->second; return this; } @@ -995,7 +1049,7 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi throw ConfigurationException("Request URL was not absolute."); const char* handler=locs[index].c_str(); - + // Should never happen... if (!handler || (*handler!='/' && strncmp(handler,"http:",5) && strncmp(handler,"https:",6))) throw ConfigurationException( @@ -1014,7 +1068,7 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi // 2 handler resource handler // 3 resource resource handler - const char* path = NULL; + const char* path = nullptr; // Decide whether to use the handler or the resource for the "protocol" const char* prot; @@ -1051,40 +1105,78 @@ string XMLApplication::getNotificationURL(const char* resource, bool front, unsi return notifyURL; } +void XMLApplication::clearHeader(SPRequest& request, const char* rawname, const char* cginame) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + rawname; + string temp2 = m_attributePrefix.second + (cginame + 5); + request.clearHeader(temp.c_str(), temp2.c_str()); + } + else if (m_base) { + m_base->clearHeader(request, rawname, cginame); + } + else { + request.clearHeader(rawname, cginame); + } +} + +void XMLApplication::setHeader(SPRequest& request, const char* name, const char* value) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + name; + request.setHeader(temp.c_str(), value); + } + else if (m_base) { + m_base->setHeader(request, name, value); + } + else { + request.setHeader(name, value); + } +} + +string XMLApplication::getSecureHeader(const SPRequest& request, const char* name) const +{ + if (!m_attributePrefix.first.empty()) { + string temp = m_attributePrefix.first + name; + return request.getSecureHeader(temp.c_str()); + } + else if (m_base) { + return m_base->getSecureHeader(request,name); + } + else { + return request.getSecureHeader(name); + } +} + const SessionInitiator* XMLApplication::getDefaultSessionInitiator() const { if (m_sessionInitDefault) return m_sessionInitDefault; - return m_base ? m_base->getDefaultSessionInitiator() : NULL; + return m_base ? m_base->getDefaultSessionInitiator() : nullptr; } const SessionInitiator* XMLApplication::getSessionInitiatorById(const char* id) const { map::const_iterator i=m_sessionInitMap.find(id); if (i!=m_sessionInitMap.end()) return i->second; - return m_base ? m_base->getSessionInitiatorById(id) : NULL; + return m_base ? m_base->getSessionInitiatorById(id) : nullptr; } const Handler* XMLApplication::getDefaultAssertionConsumerService() const { if (m_acsDefault) return m_acsDefault; - return m_base ? m_base->getDefaultAssertionConsumerService() : NULL; + return m_base ? m_base->getDefaultAssertionConsumerService() : nullptr; } const Handler* XMLApplication::getAssertionConsumerServiceByIndex(unsigned short index) const { map::const_iterator i=m_acsIndexMap.find(index); if (i!=m_acsIndexMap.end()) return i->second; - return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : NULL; + return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : nullptr; } const vector& XMLApplication::getAssertionConsumerServicesByBinding(const XMLCh* binding) const { -#ifdef HAVE_GOOD_STL ACSBindingMap::const_iterator i=m_acsBindingMap.find(binding); -#else - auto_ptr_char temp(binding); - ACSBindingMap::const_iterator i=m_acsBindingMap.find(temp.get()); -#endif if (i!=m_acsBindingMap.end()) return i->second; return m_base ? m_base->getAssertionConsumerServicesByBinding(binding) : g_noHandlers; @@ -1093,10 +1185,11 @@ const vector& XMLApplication::getAssertionConsumerServicesByBind const Handler* XMLApplication::getHandler(const char* path) const { string wrap(path); + wrap = wrap.substr(0,wrap.find(';')); map::const_iterator i=m_handlerMap.find(wrap.substr(0,wrap.find('?'))); if (i!=m_handlerMap.end()) return i->second; - return m_base ? m_base->getHandler(path) : NULL; + return m_base ? m_base->getHandler(path) : nullptr; } void XMLApplication::getHandlers(vector& handlers) const @@ -1110,7 +1203,12 @@ void XMLApplication::getHandlers(vector& handlers) const } } -short XMLConfigImpl::acceptNode(const DOMNode* node) const +#ifdef SHIBSP_XERCESC_SHORT_ACCEPTNODE +short +#else +DOMNodeFilter::FilterAction +#endif +XMLConfigImpl::acceptNode(const DOMNode* node) const { if (!XMLString::equals(node->getNamespaceURI(),shibspconstants::SHIB2SPCONFIG_NS)) return FILTER_ACCEPT; @@ -1122,6 +1220,7 @@ short XMLConfigImpl::acceptNode(const DOMNode* node) const XMLString::equals(name,_RequestMapper) || XMLString::equals(name,_ReplayCache) || XMLString::equals(name,SecurityPolicies) || + XMLString::equals(name,SecurityPolicyProvider) || XMLString::equals(name,_SessionCache) || XMLString::equals(name,Site) || XMLString::equals(name,_StorageService) || @@ -1139,15 +1238,16 @@ void XMLConfigImpl::doExtensions(const DOMElement* e, const char* label, Categor if (exts) { exts=XMLHelper::getFirstChildElement(exts,Library); while (exts) { - auto_ptr_char path(exts->getAttributeNS(NULL,_path)); + auto_ptr_char path(exts->getAttributeNS(nullptr,_path)); try { if (path.get()) { - XMLToolingConfig::getConfig().load_library(path.get(),(void*)exts); + if (!XMLToolingConfig::getConfig().load_library(path.get(),(void*)exts)) + throw ConfigurationException("XMLToolingConfig::load_library failed."); log.debug("loaded %s extension library (%s)", label, path.get()); } } catch (exception& e) { - const XMLCh* fatal=exts->getAttributeNS(NULL,_fatal); + const XMLCh* fatal=exts->getAttributeNS(nullptr,_fatal); if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) { log.fatal("unable to load mandatory %s extension library %s: %s", label, path.get(), e.what()); throw; @@ -1162,7 +1262,11 @@ void XMLConfigImpl::doExtensions(const DOMElement* e, const char* label, Categor } XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer, Category& log) - : m_requestMapper(NULL), m_outer(outer), m_document(NULL) + : m_requestMapper(nullptr), +#ifndef SHIBSP_LITE + m_policy(nullptr), +#endif + m_outer(outer), m_document(nullptr) { #ifdef _DEBUG xmltooling::NDC ndc("XMLConfigImpl"); @@ -1179,29 +1283,44 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o // Initialize log4cpp manually in order to redirect log messages as soon as possible. if (conf.isEnabled(SPConfig::Logging)) { - const XMLCh* logconf=NULL; + const XMLCh* logconf=nullptr; if (conf.isEnabled(SPConfig::OutOfProcess)) - logconf=SHAR->getAttributeNS(NULL,logger); + logconf=SHAR->getAttributeNS(nullptr,logger); else if (conf.isEnabled(SPConfig::InProcess)) - logconf=SHIRE->getAttributeNS(NULL,logger); + logconf=SHIRE->getAttributeNS(nullptr,logger); if (!logconf || !*logconf) - logconf=e->getAttributeNS(NULL,logger); + logconf=e->getAttributeNS(nullptr,logger); if (logconf && *logconf) { auto_ptr_char logpath(logconf); log.debug("loading new logging configuration from (%s), check log destination for status of configuration",logpath.get()); - XMLToolingConfig::getConfig().log_config(logpath.get()); + if (!XMLToolingConfig::getConfig().log_config(logpath.get())) + log.crit("failed to load new logging configuration from (%s)", logpath.get()); } - + #ifndef SHIBSP_LITE if (first) m_outer->m_tranLog = new TransactionLog(); #endif } - + + // Re-log library versions now that logging is set up. + log.info("Shibboleth SP Version %s", PACKAGE_VERSION); +#ifndef SHIBSP_LITE + log.info( + "Library versions: Xerces-C %s, XML-Security-C %s, XMLTooling-C %s, OpenSAML-C %s, Shibboleth %s", + XERCES_FULLVERSIONDOT, XSEC_FULLVERSIONDOT, XMLTOOLING_FULLVERSIONDOT, OPENSAML_FULLVERSIONDOT, SHIBSP_FULLVERSIONDOT + ); +#else + log.info( + "Library versions: Xerces-C %s, XMLTooling-C %s, Shibboleth %s", + XERCES_FULLVERSIONDOT, XMLTOOLING_FULLVERSIONDOT, SHIBSP_FULLVERSIONDOT + ); +#endif + // First load any property sets. - load(e,NULL,this); + load(e,nullptr,this); - const DOMElement* child; + DOMElement* child; string plugtype; // Much of the processing can only occur on the first instantiation. @@ -1209,7 +1328,25 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o // Set clock skew. pair skew=getUnsignedInt("clockSkew"); if (skew.first) - xmlConf.clock_skew_secs=skew.second; + xmlConf.clock_skew_secs=min(skew.second,(60*60*24*7*28)); + + pair unsafe = getString("unsafeChars"); + if (unsafe.first) + TemplateEngine::unsafe_chars = unsafe.second; + + unsafe = getString("allowedSchemes"); + if (unsafe.first) { + HTTPResponse::getAllowedSchemes().clear(); + string schemes=unsafe.second; + unsigned int j_sch=0; + for (unsigned int i_sch=0; i_sch < schemes.length(); i_sch++) { + if (schemes.at(i_sch)==' ') { + HTTPResponse::getAllowedSchemes().push_back(schemes.substr(j_sch, i_sch-j_sch)); + j_sch = i_sch + 1; + } + } + HTTPResponse::getAllowedSchemes().push_back(schemes.substr(j_sch, schemes.length()-j_sch)); + } // Extensions doExtensions(e, "global", log); @@ -1218,7 +1355,7 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o if (conf.isEnabled(SPConfig::InProcess)) doExtensions(SHIRE, "in process", log); - + // Instantiate the ListenerService and SessionCache objects. if (conf.isEnabled(SPConfig::Listener)) { child=XMLHelper::getFirstChildElement(e,UnixListener); @@ -1231,7 +1368,7 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o else { child=XMLHelper::getFirstChildElement(e,Listener); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); if (type.get()) plugtype=type.get(); } @@ -1249,8 +1386,10 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o #ifndef SHIBSP_LITE if (m_outer->m_listener && conf.isEnabled(SPConfig::OutOfProcess) && !conf.isEnabled(SPConfig::InProcess)) { - m_outer->m_listener->regListener("set::RelayState", m_outer->m_listener); - m_outer->m_listener->regListener("get::RelayState", m_outer->m_listener); + m_outer->m_listener->regListener("set::RelayState", const_cast(m_outer)); + m_outer->m_listener->regListener("get::RelayState", const_cast(m_outer)); + m_outer->m_listener->regListener("set::PostData", const_cast(m_outer)); + m_outer->m_listener->regListener("get::PostData", const_cast(m_outer)); } #endif @@ -1260,8 +1399,8 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o // First build any StorageServices. child=XMLHelper::getFirstChildElement(e,_StorageService); while (child) { - auto_ptr_char id(child->getAttributeNS(NULL,_id)); - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char id(child->getAttributeNS(nullptr,_id)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); try { log.info("building StorageService (%s) of type %s...", id.get(), type.get()); m_outer->m_storage[id.get()] = xmlConf.StorageServiceManager.newPlugin(type.get(),child); @@ -1273,10 +1412,10 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } // Replay cache. - StorageService* replaySS=NULL; + StorageService* replaySS=nullptr; child=XMLHelper::getFirstChildElement(e,_ReplayCache); if (child) { - auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); + auto_ptr_char ssid(child->getAttributeNS(nullptr,_StorageService)); if (ssid.get() && *ssid.get()) { if (m_outer->m_storage.count(ssid.get())) replaySS = m_outer->m_storage[ssid.get()]; @@ -1290,17 +1429,17 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o else { log.warn("no ReplayCache built, missing conf:ReplayCache element?"); } - + // ArtifactMap child=XMLHelper::getFirstChildElement(e,_ArtifactMap); if (child) { - auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); + auto_ptr_char ssid(child->getAttributeNS(nullptr,_StorageService)); if (ssid.get() && *ssid.get() && m_outer->m_storage.count(ssid.get())) { log.info("building ArtifactMap on top of StorageService (%s)...", ssid.get()); samlConf.setArtifactMap(new ArtifactMap(child, m_outer->m_storage[ssid.get()])); } } - if (samlConf.getArtifactMap()==NULL) { + if (samlConf.getArtifactMap()==nullptr) { log.info("building in-memory ArtifactMap..."); samlConf.setArtifactMap(new ArtifactMap(child)); } @@ -1308,7 +1447,7 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } child=XMLHelper::getFirstChildElement(e,_SessionCache); if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building SessionCache of type %s...",type.get()); m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(), child); } @@ -1318,12 +1457,11 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } } } // end of first-time-only stuff - + // Back to the fully dynamic stuff...next up is the RequestMapper. if (conf.isEnabled(SPConfig::RequestMapping)) { - child=XMLHelper::getFirstChildElement(e,_RequestMapper); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); + if (child = XMLHelper::getFirstChildElement(e,_RequestMapper)) { + auto_ptr_char type(child->getAttributeNS(nullptr,_type)); log.info("building RequestMapper of type %s...",type.get()); m_requestMapper=conf.RequestMapperManager.newPlugin(type.get(),child); } @@ -1332,44 +1470,49 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o throw ConfigurationException("Can't build RequestMapper, missing conf:RequestMapper element?"); } } - + #ifndef SHIBSP_LITE // Load security policies. - child = XMLHelper::getLastChildElement(e,SecurityPolicies); - if (child) { - PolicyNodeFilter filter; - child = XMLHelper::getFirstChildElement(child,Policy); - while (child) { - auto_ptr_char id(child->getAttributeNS(NULL,_id)); - pair< PropertySet*,vector >& rules = m_policyMap[id.get()]; - rules.first = NULL; - auto_ptr settings(new DOMPropertySet()); - settings->load(child, NULL, &filter); - rules.first = settings.release(); - - // Process Rule elements. - const DOMElement* rule = XMLHelper::getFirstChildElement(child,Rule); - while (rule) { - auto_ptr_char type(rule->getAttributeNS(NULL,_type)); - try { - rules.second.push_back(samlConf.SecurityPolicyRuleManager.newPlugin(type.get(),rule)); - } - catch (exception& ex) { - log.crit("error instantiating policy rule (%s) in policy (%s): %s", type.get(), id.get(), ex.what()); - } - rule = XMLHelper::getNextSiblingElement(rule,Rule); - } - - child = XMLHelper::getNextSiblingElement(child,Policy); + if (child = XMLHelper::getLastChildElement(e, SecurityPolicyProvider)) { + auto_ptr_char type(child->getAttributeNS(nullptr, _type)); + log.info("building SecurityPolicyProvider of type %s...", type.get()); + m_policy = conf.SecurityPolicyProviderManager.newPlugin(type.get(), child); + } + else if (child = XMLHelper::getLastChildElement(e, SecurityPolicies)) { + // For backward compatibility, wrap in a plugin element. + DOMElement* polwrapper = e->getOwnerDocument()->createElementNS(nullptr, SecurityPolicyProvider); + polwrapper->appendChild(child); + log.info("building SecurityPolicyProvider of type %s...", XML_SECURITYPOLICY_PROVIDER); + m_policy = conf.SecurityPolicyProviderManager.newPlugin(XML_SECURITYPOLICY_PROVIDER, polwrapper); + } + else { + log.fatal("can't build SecurityPolicyProvider, missing conf:SecurityPolicyProvider element?"); + throw ConfigurationException("Can't build SecurityPolicyProvider, missing conf:SecurityPolicyProvider element?"); + } + + if (first) { +#ifdef SHIBSP_XMLSEC_WHITELISTING + vector::const_iterator alg; + if (!m_policy->getAlgorithmBlacklist().empty()) { + for (alg = m_policy->getAlgorithmBlacklist().begin(); alg != m_policy->getAlgorithmBlacklist().end(); ++alg) + XSECPlatformUtils::blacklistAlgorithm(alg->c_str()); } + else if (!m_policy->getAlgorithmWhitelist().empty()) { + for (alg = m_policy->getAlgorithmWhitelist().begin(); alg != m_policy->getAlgorithmWhitelist().end(); ++alg) + XSECPlatformUtils::whitelistAlgorithm(alg->c_str()); + } +#else + log.fatal("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists"); + throw ConfigurationException("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists."); +#endif } // Process TransportOption elements. child = XMLHelper::getLastChildElement(e,TransportOption); while (child) { if (child->hasChildNodes()) { - auto_ptr_char provider(child->getAttributeNS(NULL,_provider)); - auto_ptr_char option(child->getAttributeNS(NULL,_option)); + auto_ptr_char provider(child->getAttributeNS(nullptr,_provider)); + auto_ptr_char option(child->getAttributeNS(nullptr,_option)); auto_ptr_char value(child->getFirstChild()->getNodeValue()); if (provider.get() && *provider.get() && option.get() && *option.get() && value.get() && *value.get()) { m_transportOptions.push_back(make_pair(string(provider.get()), make_pair(string(option.get()), string(value.get())))); @@ -1387,7 +1530,7 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } XMLApplication* defapp=new XMLApplication(m_outer,child); m_appmap[defapp->getId()]=defapp; - + // Load any overrides. child = XMLHelper::getFirstChildElement(child,ApplicationOverride); while (child) { @@ -1395,8 +1538,8 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o if (m_appmap.count(iapp->getId())) log.crit("found conf:ApplicationOverride element with duplicate id attribute (%s), skipping it", iapp->getId()); else { - const char* iappid=iapp->getId(); - m_appmap[iappid]=iapp.release(); + const char* iappid=iapp->getId(); + m_appmap[iappid]=iapp.release(); } child = XMLHelper::getNextSiblingElement(child,ApplicationOverride); @@ -1418,17 +1561,14 @@ void XMLConfigImpl::cleanup() for_each(m_appmap.begin(),m_appmap.end(),cleanup_pair()); m_appmap.clear(); #ifndef SHIBSP_LITE - for (map< string,pair > >::iterator i=m_policyMap.begin(); i!=m_policyMap.end(); ++i) { - delete i->second.first; - for_each(i->second.second.begin(), i->second.second.end(), xmltooling::cleanup()); - } - m_policyMap.clear(); + delete m_policy; + m_policy = nullptr; #endif delete m_requestMapper; - m_requestMapper = NULL; + m_requestMapper = nullptr; if (m_document) m_document->release(); - m_document = NULL; + m_document = nullptr; } #ifndef SHIBSP_LITE @@ -1455,7 +1595,7 @@ void XMLConfig::receive(DDF& in, ostream& out) } // Repack for return to caller. - DDF ret=DDF(NULL).string(relayState.c_str()); + DDF ret=DDF(nullptr).unsafe_string(relayState.c_str()); DDFJanitor jret(ret); out << ret; } @@ -1470,7 +1610,7 @@ void XMLConfig::receive(DDF& in, ostream& out) if (storage) { SAMLConfig::getConfig().generateRandomBytes(rsKey,20); rsKey = SAMLArtifact::toHex(rsKey); - storage->createString("RelayState", rsKey.c_str(), value, time(NULL) + 600); + storage->createString("RelayState", rsKey.c_str(), value, time(nullptr) + 600); } else { Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").error( @@ -1479,28 +1619,86 @@ void XMLConfig::receive(DDF& in, ostream& out) } // Repack for return to caller. - DDF ret=DDF(NULL).string(rsKey.c_str()); + DDF ret=DDF(nullptr).string(rsKey.c_str()); + DDFJanitor jret(ret); + out << ret; + } + else if (!strcmp(in.name(), "get::PostData")) { + const char* id = in["id"].string(); + const char* key = in["key"].string(); + if (!id || !key) + throw ListenerException("Required parameters missing for PostData recovery."); + + string postData; + StorageService* storage = getStorageService(id); + if (storage) { + if (storage->readString("PostData",key,&postData) > 0) { + storage->deleteString("PostData",key); + } + } + else { + Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").error( + "Storage-backed PostData with invalid StorageService ID (%s)", id + ); + } + // If the data's empty, we'll send nothing back. + // If not, we don't need to round trip it, just send back the serialized DDF list. + if (postData.empty()) { + DDF ret(nullptr); + DDFJanitor jret(ret); + out << ret; + } + else { + out << postData; + } + } + else if (!strcmp(in.name(), "set::PostData")) { + const char* id = in["id"].string(); + if (!id || !in["parameters"].islist()) + throw ListenerException("Required parameters missing for PostData creation."); + + string rsKey; + StorageService* storage = getStorageService(id); + if (storage) { + SAMLConfig::getConfig().generateRandomBytes(rsKey,20); + rsKey = SAMLArtifact::toHex(rsKey); + ostringstream params; + params << in["parameters"]; + storage->createString("PostData", rsKey.c_str(), params.str().c_str(), time(nullptr) + 600); + } + else { + Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").error( + "Storage-backed PostData with invalid StorageService ID (%s)", id + ); + } + + // Repack for return to caller. + DDF ret=DDF(nullptr).string(rsKey.c_str()); DDFJanitor jret(ret); out << ret; } } #endif -pair XMLConfig::load() +pair XMLConfig::background_load() { // Load from source using base class. pair raw = ReloadableXMLFile::load(); - + // If we own it, wrap it. - XercesJanitor docjanitor(raw.first ? raw.second->getOwnerDocument() : NULL); + XercesJanitor docjanitor(raw.first ? raw.second->getOwnerDocument() : nullptr); + + XMLConfigImpl* impl = new XMLConfigImpl(raw.second, (m_impl==nullptr), this, m_log); - XMLConfigImpl* impl = new XMLConfigImpl(raw.second,(m_impl==NULL),this,m_log); - // If we held the document, transfer it to the impl. If we didn't, it's a no-op. impl->setDocument(docjanitor.release()); + // Perform the swap inside a lock. + if (m_lock) + m_lock->wrlock(); + SharedLock locker(m_lock, false); delete m_impl; m_impl = impl; - return make_pair(false,(DOMElement*)NULL); + return make_pair(false,(DOMElement*)nullptr); }