saml/profile/impl/ConditionsRule.cpp

   1 /*
   2  *  Copyright 2009 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * ConditionsRule.cpp
  19  *
  20  * SAML Conditions SecurityPolicyRule
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "binding/SecurityPolicy.h"
  26 #include "binding/SecurityPolicyRule.h"
  27 #include "saml1/core/Assertions.h"
  28 #include "saml2/core/Assertions.h"
  29
  30 #include <xmltooling/logging.h>
  31 #include <xmltooling/XMLToolingConfig.h>
  32
  33 using namespace opensaml;
  34 using namespace xmltooling::logging;
  35 using namespace xmltooling;
  36 using namespace std;
  37
  38 namespace opensaml {
  39     class SAML_DLLLOCAL ConditionsRule : public SecurityPolicyRule
  40     {
  41     public:
  42         ConditionsRule(const DOMElement* e);
  43
  44         virtual ~ConditionsRule() {
  45             for_each(m_rules.begin(), m_rules.end(), xmltooling::cleanup<SecurityPolicyRule>());
  46             if (m_doc)
  47                 m_doc->release();
  48         }
  49         const char* getType() const {
  50             return CONDITIONS_POLICY_RULE;
  51         }
  52         bool evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const;
  53
  54     private:
  55         DOMDocument* m_doc;
  56         vector<SecurityPolicyRule*> m_rules;
  57     };
  58
  59     SecurityPolicyRule* SAML_DLLLOCAL ConditionsRuleFactory(const DOMElement* const & e)
  60     {
  61         return new ConditionsRule(e);
  62     }
  63
  64     static const XMLCh Rule[] =     UNICODE_LITERAL_10(P,o,l,i,c,y,R,u,l,e);
  65     static const XMLCh type[] =     UNICODE_LITERAL_4(t,y,p,e);
  66
  67     const char config[] =
  68         "<PolicyRule type=\"Conditions\" xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:saml=\"urn:oasis:names:tc:SAML:1.0:assertion\">"
  69             "<PolicyRule type=\"Audience\"/>"
  70             "<PolicyRule type=\"Ignore\">saml:DoNotCacheCondition</PolicyRule>"
  71             "<PolicyRule type=\"Ignore\">saml2:OneTimeUse</PolicyRule>"
  72             "<PolicyRule type=\"Ignore\">saml2:ProxyRestriction</PolicyRule>"
  73         "</PolicyRule>";
  74 };
  75
  76 ConditionsRule::ConditionsRule(const DOMElement* e) : m_doc(NULL)
  77 {
  78     Category& log=Category::getInstance(SAML_LOGCAT".SecurityPolicyRule.Conditions");
  79
  80     if (!e || !e->hasChildNodes()) {
  81         // Default the configuration.
  82         istringstream in(config);
  83         m_doc = XMLToolingConfig::getConfig().getParser().parse(in);
  84         e = m_doc->getDocumentElement();
  85     }
  86
  87     e = XMLHelper::getFirstChildElement(e, Rule);
  88     while (e) {
  89         auto_ptr_char temp(e->getAttributeNS(NULL, type));
  90         if (temp.get() && *temp.get()) {
  91             try {
  92                 log.info("building SecurityPolicyRule of type %s", temp.get());
  93                 m_rules.push_back(SAMLConfig::getConfig().SecurityPolicyRuleManager.newPlugin(temp.get(),e));
  94             }
  95             catch (exception& ex) {
  96                 log.crit("error building SecurityPolicyRule: %s", ex.what());
  97             }
  98         }
  99         e = XMLHelper::getNextSiblingElement(e, Rule);
 100     }
 101 }
 102
 103 bool ConditionsRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
 104 {
 105     const saml2::Assertion* a2=dynamic_cast<const saml2::Assertion*>(&message);
 106     if (a2) {
 107         const saml2::Conditions* conds = a2->getConditions();
 108         if (!conds)
 109             return true;
 110
 111         // First verify the time conditions, using the specified timestamp.
 112         time_t now = policy.getTime();
 113         unsigned int skew = XMLToolingConfig::getConfig().clock_skew_secs;
 114         time_t t = conds->getNotBeforeEpoch();
 115         if (now + skew < t)
 116             throw SecurityPolicyException("Assertion is not yet valid.");
 117         t = conds->getNotOnOrAfterEpoch();
 118         if (t <= now - skew)
 119             throw SecurityPolicyException("Assertion is no longer valid.");
 120
 121         // Now we process conditions, starting with the known types and then extensions.
 122
 123         bool valid;
 124
 125         const vector<saml2::AudienceRestriction*>& acvec = conds->getAudienceRestrictions();
 126         for (vector<saml2::AudienceRestriction*>::const_iterator ac = acvec.begin(); ac != acvec.end(); ++ac) {
 127             valid = false;
 128             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 129                 valid = (*r)->evaluate(*(*ac), request, policy);
 130             if (!valid)
 131                 throw SecurityPolicyException("AudienceRestriction condition not successfully validated by policy.");
 132         }
 133
 134         const vector<saml2::OneTimeUse*>& otvec = conds->getOneTimeUses();
 135         for (vector<saml2::OneTimeUse*>::const_iterator ot = otvec.begin(); ot!=otvec.end(); ++ot) {
 136             valid = false;
 137             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 138                 valid = (*r)->evaluate(*(*ot), request, policy);
 139             if (!valid)
 140                 throw SecurityPolicyException("OneTimeUse condition not successfully validated by policy.");
 141         }
 142
 143         const vector<saml2::ProxyRestriction*> pvec = conds->getProxyRestrictions();
 144         for (vector<saml2::ProxyRestriction*>::const_iterator p = pvec.begin(); p != pvec.end(); ++p) {
 145             valid = false;
 146             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 147                 valid = (*r)->evaluate(*(*p), request, policy);
 148             if (!valid)
 149                 throw SecurityPolicyException("ProxyRestriction condition not successfully validated by policy.");
 150         }
 151
 152         const vector<saml2::Condition*>& convec = conds->getConditions();
 153         for (vector<saml2::Condition*>::const_iterator c = convec.begin(); c != convec.end(); ++c) {
 154             valid = false;
 155             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 156                 valid = (*r)->evaluate(*(*c), request, policy);
 157             if (!valid) {
 158                 throw SecurityPolicyException(
 159                     "Extension condition ($1) not successfully validated by policy.",
 160                     params(1,((*c)->getSchemaType() ? (*c)->getSchemaType()->toString().c_str() : "Unknown Type"))
 161                     );
 162             }
 163         }
 164
 165         return true;
 166     }
 167
 168     const saml1::Assertion* a1=dynamic_cast<const saml1::Assertion*>(&message);
 169     if (a1) {
 170         const saml1::Conditions* conds = a1->getConditions();
 171         if (!conds)
 172             return true;
 173
 174         // First verify the time conditions, using the specified timestamp.
 175         time_t now = policy.getTime();
 176         unsigned int skew = XMLToolingConfig::getConfig().clock_skew_secs;
 177         time_t t = conds->getNotBeforeEpoch();
 178         if (now + skew < t)
 179             throw SecurityPolicyException("Assertion is not yet valid.");
 180         t = conds->getNotOnOrAfterEpoch();
 181         if (t <= now - skew)
 182             throw SecurityPolicyException("Assertion is no longer valid.");
 183
 184         // Now we process conditions, starting with the known types and then extensions.
 185
 186         bool valid;
 187
 188         const vector<saml1::AudienceRestrictionCondition*>& acvec = conds->getAudienceRestrictionConditions();
 189         for (vector<saml1::AudienceRestrictionCondition*>::const_iterator ac = acvec.begin(); ac != acvec.end(); ++ac) {
 190             valid = false;
 191             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 192                 valid = (*r)->evaluate(*(*ac), request, policy);
 193             if (!valid)
 194                 throw SecurityPolicyException("AudienceRestrictionCondition not successfully validated by policy.");
 195         }
 196
 197         const vector<saml1::DoNotCacheCondition*>& dncvec = conds->getDoNotCacheConditions();
 198         for (vector<saml1::DoNotCacheCondition*>::const_iterator dnc = dncvec.begin(); dnc != dncvec.end(); ++dnc) {
 199             valid = false;
 200             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 201                 valid = (*r)->evaluate(*(*dnc), request, policy);
 202             if (!valid)
 203                 throw SecurityPolicyException("DoNotCacheCondition not successfully validated by policy.");
 204         }
 205
 206         const vector<saml1::Condition*>& convec = conds->getConditions();
 207         for (vector<saml1::Condition*>::const_iterator c = convec.begin(); c != convec.end(); ++c) {
 208             valid = false;
 209             for (vector<SecurityPolicyRule*>::const_iterator r = m_rules.begin(); !valid && r != m_rules.end(); ++r)
 210                 valid = (*r)->evaluate(*(*c), request, policy);
 211             if (!valid) {
 212                 throw SecurityPolicyException(
 213                     "Extension condition ($1) not successfully validated by policy.",
 214                     params(1,((*c)->getSchemaType() ? (*c)->getSchemaType()->toString().c_str() : (*c)->getElementQName().toString().c_str()))
 215                     );
 216             }
 217         }
 218
 219         return true;
 220     }
 221
 222     return false;
 223 }