X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fbinding%2Fimpl%2FSecurityPolicy.cpp;h=d78e1df24d2a5a42edc9f10b60b77f85f0689ca1;hp=437241a890d9296e946605c7871efddbb43149f9;hb=c3cd4ec3fa87d0ad3c6f65c1a5e15f548b1b6cc2;hpb=9e5f5fd6b4d0dfd3cb062e98dcb087640bf82414 diff --git a/saml/binding/impl/SecurityPolicy.cpp b/saml/binding/impl/SecurityPolicy.cpp index 437241a..d78e1df 100644 --- a/saml/binding/impl/SecurityPolicy.cpp +++ b/saml/binding/impl/SecurityPolicy.cpp @@ -1,6 +1,6 @@ /* - * Copyright 2001-2006 Internet2 - * + * Copyright 2001-2009 Internet2 + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -16,13 +16,13 @@ /** * SecurityPolicy.cpp - * - * Overall policy used to verify the security of an incoming message. + * + * Overall policy used to verify the security of an incoming message. */ #include "internal.h" #include "exceptions.h" -#include "binding/SecurityPolicy.h" +#include "binding/SecurityPolicyRule.h" #include "saml2/core/Assertions.h" using namespace opensaml::saml2md; @@ -32,68 +32,131 @@ using namespace xmltooling; using namespace std; namespace opensaml { - SAML_DLLLOCAL PluginManager::Factory MessageFlowRuleFactory; - SAML_DLLLOCAL PluginManager::Factory SimpleSigningRuleFactory; - SAML_DLLLOCAL PluginManager::Factory XMLSigningRuleFactory; + SAML_DLLLOCAL PluginManager::Factory AudienceRestrictionRuleFactory; + SAML_DLLLOCAL PluginManager::Factory ClientCertAuthRuleFactory; + SAML_DLLLOCAL PluginManager::Factory ConditionsRuleFactory; + SAML_DLLLOCAL PluginManager::Factory IgnoreRuleFactory; + SAML_DLLLOCAL PluginManager::Factory MessageFlowRuleFactory; + SAML_DLLLOCAL PluginManager::Factory NullSecurityRuleFactory; + SAML_DLLLOCAL PluginManager::Factory SimpleSigningRuleFactory; + SAML_DLLLOCAL PluginManager::Factory XMLSigningRuleFactory; }; void SAML_API opensaml::registerSecurityPolicyRules() { SAMLConfig& conf=SAMLConfig::getConfig(); + conf.SecurityPolicyRuleManager.registerFactory(AUDIENCE_POLICY_RULE, AudienceRestrictionRuleFactory); + conf.SecurityPolicyRuleManager.registerFactory(CLIENTCERTAUTH_POLICY_RULE, ClientCertAuthRuleFactory); + conf.SecurityPolicyRuleManager.registerFactory(CONDITIONS_POLICY_RULE, ConditionsRuleFactory); + conf.SecurityPolicyRuleManager.registerFactory(IGNORE_POLICY_RULE, IgnoreRuleFactory); conf.SecurityPolicyRuleManager.registerFactory(MESSAGEFLOW_POLICY_RULE, MessageFlowRuleFactory); + conf.SecurityPolicyRuleManager.registerFactory(NULLSECURITY_POLICY_RULE, NullSecurityRuleFactory); conf.SecurityPolicyRuleManager.registerFactory(SIMPLESIGNING_POLICY_RULE, SimpleSigningRuleFactory); conf.SecurityPolicyRuleManager.registerFactory(XMLSIGNING_POLICY_RULE, XMLSigningRuleFactory); } SecurityPolicy::IssuerMatchingPolicy SecurityPolicy::m_defaultMatching; +SecurityPolicy::SecurityPolicy( + const saml2md::MetadataProvider* metadataProvider, + const xmltooling::QName* role, + const xmltooling::TrustEngine* trustEngine, + bool validate + ) : m_metadataCriteria(NULL), + m_messageID(NULL), + m_issueInstant(0), + m_issuer(NULL), + m_issuerRole(NULL), + m_authenticated(false), + m_matchingPolicy(NULL), + m_metadata(metadataProvider), + m_role(NULL), + m_trust(trustEngine), + m_validate(validate), + m_entityOnly(true), + m_recipient(NULL), + m_ts(0) +{ + if (role) + m_role = new xmltooling::QName(*role); +} + SecurityPolicy::~SecurityPolicy() { - delete m_matchingPolicy; + XMLString::release(&m_messageID); + delete m_metadataCriteria; delete m_issuer; } -void SecurityPolicy::evaluate(const GenericRequest& request, const XMLObject& message) +void SecurityPolicy::reset(bool messageOnly) +{ + _reset(); +} + +void SecurityPolicy::_reset(bool messageOnly) +{ + XMLString::release(&m_messageID); + m_messageID=NULL; + m_issueInstant=0; + if (!messageOnly) { + delete m_issuer; + m_issuer=NULL; + m_issuerRole=NULL; + m_authenticated=false; + } +} + +MetadataProvider::Criteria& SecurityPolicy::getMetadataProviderCriteria() const { - for (vector::const_iterator i=m_rules.begin(); i!=m_rules.end(); ++i) { - - // Run the rule... - pair ident = (*i)->evaluate(request,message,m_metadata,&m_role,m_trust); - - // Make sure returned issuer doesn't conflict. - - if (ident.first) { - if (!(m_matchingPolicy ? m_matchingPolicy : &m_defaultMatching)->issuerMatches(ident.first, m_issuer)) { - delete ident.first; - throw BindingException("Policy rules returned differing Issuers."); - } - delete m_issuer; - m_issuer=ident.first; - } - - if (ident.second) { - if (m_issuerRole && ident.second!=m_issuerRole) - throw BindingException("Policy rules returned differing issuer RoleDescriptors."); - m_issuerRole=ident.second; - } + if (!m_metadataCriteria) + m_metadataCriteria=new MetadataProvider::Criteria(); + else + m_metadataCriteria->reset(); + return *m_metadataCriteria; +} + +void SecurityPolicy::setMetadataProviderCriteria(saml2md::MetadataProvider::Criteria* criteria) +{ + if (m_metadataCriteria) + delete m_metadataCriteria; + m_metadataCriteria=criteria; +} + +void SecurityPolicy::evaluate(const XMLObject& message, const GenericRequest* request) +{ + for (vector::const_iterator i=m_rules.begin(); i!=m_rules.end(); ++i) + (*i)->evaluate(message,request,*this); +} + +void SecurityPolicy::setIssuer(const Issuer* issuer) +{ + if (!getIssuerMatchingPolicy().issuerMatches(m_issuer, issuer)) + throw SecurityPolicyException("An Issuer was supplied that conflicts with previous results."); + + if (!m_issuer) { + if (m_entityOnly && issuer->getFormat() && !XMLString::equals(issuer->getFormat(), NameIDType::ENTITY)) + throw SecurityPolicyException("A non-entity Issuer was supplied, violating policy."); + m_issuerRole = NULL; + m_issuer=issuer->cloneIssuer(); } } -void SecurityPolicy::setIssuer(saml2::Issuer* issuer) +void SecurityPolicy::setIssuer(const XMLCh* issuer) { - if (!((m_matchingPolicy ? m_matchingPolicy : &m_defaultMatching))->issuerMatches(issuer, m_issuer)) { - delete issuer; - throw BindingException("Externally provided Issuer conflicts with policy results."); + if (!getIssuerMatchingPolicy().issuerMatches(m_issuer, issuer)) + throw SecurityPolicyException("An Issuer was supplied that conflicts with previous results."); + + if (!m_issuer && issuer && *issuer) { + m_issuerRole = NULL; + m_issuer = IssuerBuilder::buildIssuer(); + m_issuer->setName(issuer); } - - delete m_issuer; - m_issuer=issuer; } void SecurityPolicy::setIssuerMetadata(const RoleDescriptor* issuerRole) { if (issuerRole && m_issuerRole && issuerRole!=m_issuerRole) - throw BindingException("Externally provided RoleDescriptor conflicts with policy results."); + throw SecurityPolicyException("A rule supplied a RoleDescriptor that conflicts with previous results."); m_issuerRole=issuerRole; } @@ -102,17 +165,17 @@ bool SecurityPolicy::IssuerMatchingPolicy::issuerMatches(const Issuer* issuer1, // NULL matches anything for the purposes of this interface. if (!issuer1 || !issuer2) return true; - + const XMLCh* op1=issuer1->getName(); const XMLCh* op2=issuer2->getName(); if (!op1 || !op2 || !XMLString::equals(op1,op2)) return false; - + op1=issuer1->getFormat(); op2=issuer2->getFormat(); if (!XMLString::equals(op1 ? op1 : NameIDType::ENTITY, op2 ? op2 : NameIDType::ENTITY)) return false; - + op1=issuer1->getNameQualifier(); op2=issuer2->getNameQualifier(); if (!XMLString::equals(op1 ? op1 : &chNull, op2 ? op2 : &chNull)) @@ -122,6 +185,31 @@ bool SecurityPolicy::IssuerMatchingPolicy::issuerMatches(const Issuer* issuer1, op2=issuer2->getSPNameQualifier(); if (!XMLString::equals(op1 ? op1 : &chNull, op2 ? op2 : &chNull)) return false; - + + return true; +} + +bool SecurityPolicy::IssuerMatchingPolicy::issuerMatches(const Issuer* issuer1, const XMLCh* issuer2) const +{ + // NULL matches anything for the purposes of this interface. + if (!issuer1 || !issuer2 || !*issuer2) + return true; + + const XMLCh* op1=issuer1->getName(); + if (!op1 || !XMLString::equals(op1,issuer2)) + return false; + + op1=issuer1->getFormat(); + if (op1 && *op1 && !XMLString::equals(op1, NameIDType::ENTITY)) + return false; + + op1=issuer1->getNameQualifier(); + if (op1 && *op1) + return false; + + op1=issuer1->getSPNameQualifier(); + if (op1 && *op1) + return false; + return true; }