-/*
- * Copyright 2001-2007 Internet2
+/**
+ * Licensed to the University Corporation for Advanced Internet
+ * Development, Inc. (UCAID) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for
+ * additional information regarding copyright ownership.
*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * UCAID licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the
+ * License at
*
- * http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
*
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
*/
/**
*/
#include "internal.h"
+#include "exceptions.h"
#include "Application.h"
#include "ServiceProvider.h"
#include "attribute/Attribute.h"
#include "attribute/filtering/AttributeFilter.h"
+#include "attribute/filtering/FilteringContext.h"
#include "attribute/filtering/FilterPolicyContext.h"
+#include "attribute/filtering/MatchFunctor.h"
#include "util/SPConstants.h"
+#include <boost/iterator/indirect_iterator.hpp>
+#include <boost/tuple/tuple.hpp>
#include <xmltooling/util/NDC.h>
#include <xmltooling/util/ReloadableXMLFile.h>
+#include <xmltooling/util/Threads.h>
#include <xmltooling/util/XMLHelper.h>
#include <xercesc/util/XMLUniDefs.hpp>
using namespace opensaml::saml2md;
using namespace opensaml;
using namespace xmltooling;
+using namespace boost;
using namespace std;
namespace shibsp {
#endif
// Each Policy has a functor for determining applicability and a map of
- // attribute IDs to Accept/Deny functor pairs (which can include NULLs).
+ // attribute IDs to Accept/Deny functor pairs (which can include nullptrs).
struct SHIBSP_DLLLOCAL Policy
{
- Policy() : m_applies(NULL) {}
+ Policy() : m_applies(nullptr) {}
const MatchFunctor* m_applies;
typedef multimap< string,pair<const MatchFunctor*,const MatchFunctor*> > rules_t;
rules_t m_rules;
MatchFunctor* buildFunctor(
const DOMElement* e, const FilterPolicyContext& functorMap, const char* logname, bool standalone
);
- pair< string,pair<const MatchFunctor*,const MatchFunctor*> > buildAttributeRule(
+ boost::tuple<string,const MatchFunctor*,const MatchFunctor*> buildAttributeRule(
const DOMElement* e, const FilterPolicyContext& permMap, const FilterPolicyContext& denyMap, bool standalone
);
Category& m_log;
DOMDocument* m_document;
vector<Policy> m_policies;
- map< string,pair<string,pair<const MatchFunctor*,const MatchFunctor*> > > m_attrRules;
+ map< string,boost::tuple<string,const MatchFunctor*,const MatchFunctor*> > m_attrRules;
multimap<string,MatchFunctor*> m_policyReqRules;
multimap<string,MatchFunctor*> m_permitValRules;
multimap<string,MatchFunctor*> m_denyValRules;
class SHIBSP_DLLLOCAL XMLFilter : public AttributeFilter, public ReloadableXMLFile
{
public:
- XMLFilter(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".AttributeFilter")), m_impl(NULL) {
- load();
+ XMLFilter(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter")) {
+ background_load();
}
~XMLFilter() {
- delete m_impl;
+ shutdown();
}
void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const {
}
protected:
- pair<bool,DOMElement*> load();
+ pair<bool,DOMElement*> background_load();
private:
- XMLFilterImpl* m_impl;
+ scoped_ptr<XMLFilterImpl> m_impl;
};
#if defined (_MSC_VER)
static const XMLCh _ref[] = UNICODE_LITERAL_3(r,e,f);
};
-XMLFilterImpl::XMLFilterImpl(const DOMElement* e, Category& log) : m_log(log), m_document(NULL)
+XMLFilterImpl::XMLFilterImpl(const DOMElement* e, Category& log) : m_log(log), m_document(nullptr)
{
#ifdef _DEBUG
xmltooling::NDC ndc("XMLFilterImpl");
}
else if (XMLHelper::isNodeNamed(child, SHIB2ATTRIBUTEFILTER_NS, AttributeFilterPolicy)) {
e = XMLHelper::getFirstChildElement(child);
- MatchFunctor* func = NULL;
+ MatchFunctor* func = nullptr;
if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PolicyRequirementRule)) {
func = buildFunctor(e, reqFunctors, "PolicyRequirementRule", false);
}
else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PolicyRequirementRuleReference)) {
- auto_ptr_char ref(e->getAttributeNS(NULL, _ref));
- if (ref.get() && *ref.get()) {
- multimap<string,MatchFunctor*>::const_iterator prr = m_policyReqRules.find(ref.get());
- func = (prr!=m_policyReqRules.end()) ? prr->second : NULL;
+ string ref(XMLHelper::getAttrString(e, nullptr, _ref));
+ if (!ref.empty()) {
+ multimap<string,MatchFunctor*>::const_iterator prr = m_policyReqRules.find(ref);
+ func = (prr!=m_policyReqRules.end()) ? prr->second : nullptr;
}
}
if (func) {
e = XMLHelper::getNextSiblingElement(e);
while (e) {
if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, AttributeRule)) {
- pair< string,pair<const MatchFunctor*,const MatchFunctor*> > rule = buildAttributeRule(e, permFunctors, denyFunctors, false);
- if (rule.second.first || rule.second.second)
- m_policies.back().m_rules.insert(Policy::rules_t::value_type(rule.first, rule.second));
+ boost::tuple<string,const MatchFunctor*,const MatchFunctor*> rule = buildAttributeRule(e, permFunctors, denyFunctors, false);
+ if (rule.get<1>() || rule.get<2>())
+ m_policies.back().m_rules.insert(Policy::rules_t::value_type(rule.get<0>(), make_pair(rule.get<1>(), rule.get<2>())));
}
else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, AttributeRuleReference)) {
- auto_ptr_char ref(e->getAttributeNS(NULL, _ref));
- if (ref.get() && *ref.get()) {
- map< string,pair< string,pair< const MatchFunctor*,const MatchFunctor*> > >::const_iterator ar = m_attrRules.find(ref.get());
- if (ar != m_attrRules.end())
- m_policies.back().m_rules.insert(Policy::rules_t::value_type(ar->second.first, ar->second.second));
- else
- m_log.warn("skipping invalid AttributeRuleReference (%s)", ref.get());
+ string ref(XMLHelper::getAttrString(e, nullptr, _ref));
+ if (!ref.empty()) {
+ map< string,boost::tuple<string,const MatchFunctor*,const MatchFunctor*> >::const_iterator ar = m_attrRules.find(ref);
+ if (ar != m_attrRules.end()) {
+ m_policies.back().m_rules.insert(
+ Policy::rules_t::value_type(ar->second.get<0>(), make_pair(ar->second.get<1>(), ar->second.get<2>()))
+ );
+ }
+ else {
+ m_log.warn("skipping invalid AttributeRuleReference (%s)", ref.c_str());
+ }
}
}
e = XMLHelper::getNextSiblingElement(e);
const DOMElement* e, const FilterPolicyContext& functorMap, const char* logname, bool standalone
)
{
- auto_ptr_char temp(e->getAttributeNS(NULL,_id));
- const char* id = (temp.get() && *temp.get()) ? temp.get() : "";
+ string id(XMLHelper::getAttrString(e, nullptr, _id));
- if (standalone && !*id) {
+ if (standalone && id.empty()) {
m_log.warn("skipping stand-alone %s with no id", logname);
- return NULL;
+ return nullptr;
}
- else if (*id && functorMap.getMatchFunctors().count(id)) {
+ else if (!id.empty() && functorMap.getMatchFunctors().count(id)) {
if (standalone) {
- m_log.warn("skipping duplicate stand-alone %s with id (%s)", logname, id);
- return NULL;
+ m_log.warn("skipping duplicate stand-alone %s with id (%s)", logname, id.c_str());
+ return nullptr;
}
else
- id = "";
+ id.clear();
}
- auto_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
- if (type.get()) {
+ scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
+ if (type) {
try {
- MatchFunctor* func = SPConfig::getConfig().MatchFunctorManager.newPlugin(*type.get(), make_pair(&functorMap,e));
- functorMap.getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func));
- return func;
+ auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(&functorMap,e)));
+ functorMap.getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
+ return func.release();
}
catch (exception& ex) {
m_log.error("error building %s with type (%s): %s", logname, type->toString().c_str(), ex.what());
else
m_log.error("%s with no xsi:type", logname);
- return NULL;
+ return nullptr;
}
-pair< string,pair<const MatchFunctor*,const MatchFunctor*> > XMLFilterImpl::buildAttributeRule(
+boost::tuple<string,const MatchFunctor*,const MatchFunctor*> XMLFilterImpl::buildAttributeRule(
const DOMElement* e, const FilterPolicyContext& permMap, const FilterPolicyContext& denyMap, bool standalone
)
{
- auto_ptr_char temp(e->getAttributeNS(NULL,_id));
- const char* id = (temp.get() && *temp.get()) ? temp.get() : "";
+ string id(XMLHelper::getAttrString(e, nullptr, _id));
- if (standalone && !*id) {
+ if (standalone && id.empty()) {
m_log.warn("skipping stand-alone AttributeRule with no id");
- return make_pair(string(),pair<const MatchFunctor*,const MatchFunctor*>(NULL,NULL));
+ return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
}
- else if (*id && m_attrRules.count(id)) {
+ else if (!id.empty() && m_attrRules.count(id)) {
if (standalone) {
- m_log.warn("skipping duplicate stand-alone AttributeRule with id (%s)", id);
- return make_pair(string(),pair<const MatchFunctor*,const MatchFunctor*>(NULL,NULL));
+ m_log.warn("skipping duplicate stand-alone AttributeRule with id (%s)", id.c_str());
+ return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
}
else
- id = "";
+ id.clear();
}
- auto_ptr_char attrID(e->getAttributeNS(NULL,attributeID));
- if (!attrID.get() || !*attrID.get())
+ string attrID(XMLHelper::getAttrString(e, nullptr, attributeID));
+ if (attrID.empty())
m_log.warn("skipping AttributeRule with no attributeID");
- MatchFunctor* perm=NULL;
- MatchFunctor* deny=NULL;
+ MatchFunctor* perm = nullptr;
+ MatchFunctor* deny = nullptr;
e = XMLHelper::getFirstChildElement(e);
if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PermitValueRule)) {
e = XMLHelper::getNextSiblingElement(e);
}
else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, PermitValueRuleReference)) {
- auto_ptr_char ref(e->getAttributeNS(NULL, _ref));
- if (ref.get() && *ref.get()) {
- multimap<string,MatchFunctor*>::const_iterator pvr = m_permitValRules.find(ref.get());
- perm = (pvr!=m_permitValRules.end()) ? pvr->second : NULL;
+ string ref(XMLHelper::getAttrString(e, nullptr, _ref));
+ if (!ref.empty()) {
+ multimap<string,MatchFunctor*>::const_iterator pvr = m_permitValRules.find(ref);
+ perm = (pvr!=m_permitValRules.end()) ? pvr->second : nullptr;
}
e = XMLHelper::getNextSiblingElement(e);
}
deny = buildFunctor(e, denyMap, "DenyValueRule", false);
}
else if (e && XMLHelper::isNodeNamed(e, SHIB2ATTRIBUTEFILTER_NS, DenyValueRuleReference)) {
- auto_ptr_char ref(e->getAttributeNS(NULL, _ref));
- if (ref.get() && *ref.get()) {
- multimap<string,MatchFunctor*>::const_iterator pvr = m_denyValRules.find(ref.get());
- deny = (pvr!=m_denyValRules.end()) ? pvr->second : NULL;
+ string ref(XMLHelper::getAttrString(e, nullptr, _ref));
+ if (!ref.empty()) {
+ multimap<string,MatchFunctor*>::const_iterator pvr = m_denyValRules.find(ref);
+ deny = (pvr!=m_denyValRules.end()) ? pvr->second : nullptr;
}
}
if (perm || deny) {
- if (*id) {
- m_attrRules[id] = pair< string,pair<const MatchFunctor*,const MatchFunctor*> >(attrID.get(), pair<const MatchFunctor*,const MatchFunctor*>(perm,deny));
+ if (!id.empty()) {
+ m_attrRules[id] = boost::make_tuple(attrID, perm, deny);
return m_attrRules[id];
}
else {
- return pair< string,pair<const MatchFunctor*,const MatchFunctor*> >(attrID.get(), pair<const MatchFunctor*,const MatchFunctor*>(perm,deny));
+ return boost::make_tuple(attrID, perm, deny);
}
}
- m_log.warn("skipping AttributeRule (%s), permit and denial rule(s) invalid or missing", id);
- return pair< string,pair<const MatchFunctor*,const MatchFunctor*> >(string(),pair<const MatchFunctor*,const MatchFunctor*>(NULL,NULL));
+ if (!id.empty())
+ m_log.warn("skipping AttributeRule (%s), permit and denial rule(s) invalid or missing", id.c_str());
+ else
+ m_log.warn("skipping AttributeRule, permit and denial rule(s) invalid or missing");
+ return boost::tuple<string,const MatchFunctor*,const MatchFunctor*>(string(),nullptr,nullptr);
}
void XMLFilterImpl::filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const
// For efficiency, we build an array of the policies that apply in advance.
vector<const Policy*> applicablePolicies;
- for (vector<Policy>::const_iterator p=m_policies.begin(); p!=m_policies.end(); ++p) {
+ for (vector<Policy>::const_iterator p = m_policies.begin(); p != m_policies.end(); ++p) {
if (p->m_applies->evaluatePolicyRequirement(context))
applicablePolicies.push_back(&(*p));
}
vector< pair<const MatchFunctor*,const MatchFunctor*> > wildcardRules;
// Store off the wildcards ahead of time.
- for (vector<const Policy*>::const_iterator pol=applicablePolicies.begin(); pol!=applicablePolicies.end(); ++pol) {
- pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = (*pol)->m_rules.equal_range("*");
+ for (indirect_iterator<vector<const Policy*>::const_iterator> pol = make_indirect_iterator(applicablePolicies.begin());
+ pol != make_indirect_iterator(applicablePolicies.end()); ++pol) {
+ pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = pol->m_rules.equal_range("*");
for (; rules.first!=rules.second; ++rules.first)
wildcardRules.push_back(rules.first->second);
}
map< Attribute*, vector<bool> > deletedPositions;
// Loop over each attribute to filter them.
- for (vector<Attribute*>::size_type a=0; a<attributes.size(); ++a) {
+ for (vector<Attribute*>::size_type a = 0; a < attributes.size(); ++a) {
Attribute* attr = attributes[a];
// Clear the rule store.
applicableRules.clear();
// Look for rules to run in each policy.
- for (vector<const Policy*>::const_iterator pol=applicablePolicies.begin(); pol!=applicablePolicies.end(); ++pol) {
- pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = (*pol)->m_rules.equal_range(attr->getId());
+ for (indirect_iterator<vector<const Policy*>::const_iterator> pol = make_indirect_iterator(applicablePolicies.begin());
+ pol != make_indirect_iterator(applicablePolicies.end()); ++pol) {
+ pair<Policy::rules_t::const_iterator,Policy::rules_t::const_iterator> rules = pol->m_rules.equal_range(attr->getId());
for (; rules.first!=rules.second; ++rules.first)
applicableRules.push_back(rules.first->second);
}
// If no rules found, apply wildcards.
- const vector< pair<const MatchFunctor*,const MatchFunctor*> >& rulesToRun = applicableRules.empty() ? wildcardRules : applicableRules;
+ const vector< pair<const MatchFunctor*,const MatchFunctor*> >& rulesToRun =
+ applicableRules.empty() ? wildcardRules : applicableRules;
// If no rules apply, remove the attribute entirely.
if (rulesToRun.empty()) {
m_log.warn(
- "no rule found, removing attribute (%s) from (%s)",
+ "no rule found, will remove attribute (%s) from (%s)",
attr->getId(), issuer.get() ? issuer.get() : "unknown source"
);
deletedAttributes[a] = true;
// Assume we're kicking it out.
kickit=true;
- for (vector< pair<const MatchFunctor*,const MatchFunctor*> >::const_iterator r=rulesToRun.begin(); r!=rulesToRun.end(); ++r) {
+ for (vector< pair<const MatchFunctor*,const MatchFunctor*> >::const_iterator r = rulesToRun.begin(); r != rulesToRun.end(); ++r) {
// If there's a permit rule that passes, don't kick it.
if (r->first && r->first->evaluatePermitValue(context, *attr, index))
kickit = false;
// Final step: go over the deletedPositions matrix and apply the actual changes. In order to delete
// any attributes that end up with no values, we have to do it by looping over the originals.
- for (vector<Attribute*>::size_type a=0; a<attributes.size();) {
+ for (vector<Attribute*>::size_type a = 0; a < attributes.size();) {
Attribute* attr = attributes[a];
if (deletedAttributes[a]) {
+ m_log.warn(
+ "removing filtered attribute (%s) from (%s)",
+ attr->getId(), issuer.get() ? issuer.get() : "unknown source"
+ );
delete attr;
deletedAttributes.erase(deletedAttributes.begin() + a);
attributes.erase(attributes.begin() + a);
attr->getId(), issuer.get() ? issuer.get() : "unknown source"
);
delete attr;
+ deletedAttributes.erase(deletedAttributes.begin() + a);
attributes.erase(attributes.begin() + a);
continue;
}
}
}
-pair<bool,DOMElement*> XMLFilter::load()
+pair<bool,DOMElement*> XMLFilter::background_load()
{
// Load from source using base class.
pair<bool,DOMElement*> raw = ReloadableXMLFile::load();
// If we own it, wrap it.
- XercesJanitor<DOMDocument> docjanitor(raw.first ? raw.second->getOwnerDocument() : NULL);
+ XercesJanitor<DOMDocument> docjanitor(raw.first ? raw.second->getOwnerDocument() : nullptr);
- XMLFilterImpl* impl = new XMLFilterImpl(raw.second, m_log);
+ scoped_ptr<XMLFilterImpl> impl(new XMLFilterImpl(raw.second, m_log));
// If we held the document, transfer it to the impl. If we didn't, it's a no-op.
impl->setDocument(docjanitor.release());
- delete m_impl;
- m_impl = impl;
+ // Perform the swap inside a lock.
+ if (m_lock)
+ m_lock->wrlock();
+ SharedLock locker(m_lock, false);
+ m_impl.swap(impl);
- return make_pair(false,(DOMElement*)NULL);
+ return make_pair(false,(DOMElement*)nullptr);
}
projects / shibboleth / cpp-sp.git / blobdiff