https://bugs.internet2.edu/jira/browse/SSPCPP-273

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/branches/REL_2@3229 cb58f699-b61c-0410-a6fe-9272a202ed29

diff --git a/config_win32.h b/config_win32.h
index 95838b6..471adc0 100644 (file)
--- a/config_win32.h
+++ b/config_win32.h
@@ -56,8 +56,12 @@
 /* Define if you have POSIX threads libraries and header files. */
 /* #undef HAVE_PTHREAD */
 
-/* Define if saml library was found */
-#define HAVE_SAML 1
+#ifndef SHIBSP_LITE
+# include <xsec/framework/XSECDefs.hpp>
+# if (_XSEC_VERSION_FULL >= 10600)
+#  define SHIBSP_XMLSEC_WHITELISTING 1
+# endif
+#endif
 
 /* Define to 1 if you have the <stdint.h> header file. */
 /* #undef HAVE_STDINT_H */

diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index 8ed5938..71b45e3 100644 (file)
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -257,6 +257,12 @@
             <PolicyRule type="XMLSigning" errorFatal="true"/>
             <PolicyRule type="SimpleSigning" errorFatal="true"/>
         </Policy>
+        
+        <!-- Disables known weak algorithms. -->
+        <AlgorithmBlacklist>
+        http://www.w3.org/2001/04/xmldsig-more#md5
+        http://www.w3.org/2001/04/xmldsig-more#rsa-md5
+        </AlgorithmBlacklist>
     </SecurityPolicies>
 
 </SPConfig>

diff --git a/configure.ac b/configure.ac
index a37af1c..62df0f9 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -306,8 +306,8 @@ XMLSEC_LIBS="-lxml-security-c $XMLSEC_LIBS"
 save_LIBS="$LIBS"
 LIBS="$XMLSEC_LIBS $LIBS"
 
-AC_CHECK_HEADER([xsec/utils/XSECPlatformUtils.hpp],,AC_MSG_ERROR([unable to find XML-Security header files]))
-AC_MSG_CHECKING([XML-Security version])
+AC_CHECK_HEADER([xsec/utils/XSECPlatformUtils.hpp],,AC_MSG_ERROR([unable to find XML-Security-C header files]))
+AC_MSG_CHECKING([XML-Security-C version])
 AC_PREPROC_IFELSE(
     [AC_LANG_PROGRAM([#include <xsec/utils/XSECPlatformUtils.hpp>],
     [#if XSEC_VERSION_MAJOR > 1 || (XSEC_VERSION_MAJOR == 1 && XSEC_VERSION_MEDIUM > 3)
@@ -316,12 +316,21 @@ int i = 0;
 #error need version 1.4.0 or later
 #endif])],
     [AC_MSG_RESULT(OK)],
-    [AC_MSG_FAILURE([XML-Security version 1.4.0 or greater is required.])])
+    [AC_MSG_FAILURE([XML-Security-C version 1.4.0 or greater is required.])])
 AC_TRY_LINK(
         [#include <xsec/utils/XSECPlatformUtils.hpp>],
         [XSECPlatformUtils::Initialise()],,
         [AC_MSG_ERROR([unable to link with XML-Security])])
 
+
+AC_MSG_CHECKING([whether XML-Security-C supports white/blacklisting of algorithms])
+AC_TRY_COMPILE([#include <xsec/framework/XSECAlgorithmMapper.hpp>],
+      [XSECAlgorithmMapper* mapper; mapper->whitelistAlgorithm(NULL);],
+      [AC_MSG_RESULT([yes])]
+      [AC_DEFINE([SHIBSP_XMLSEC_WHITELISTING], [1], [Define to 1 if XML-Security-C supports white/blacklisting algorithms.])],
+      [AC_MSG_RESULT([no])])
+
+
 # restore master libs
 LIBS="$save_LIBS"
 

diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 4b48bef..315b6ba 100644 (file)
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -708,6 +708,10 @@
                                                <anyAttribute namespace="##any" processContents="skip"/>
                                        </complexType>
                                </element>
+                <choice minOccurs="0">
+                    <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
+                    <element name="AlgorithmBlacklist" type="conf:listOfURIs"/>
+                </choice>
                        </sequence>
                </complexType>
        </element>

diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp
index ab4dce6..9f86df3 100644 (file)
--- a/shibsp/impl/XMLServiceProvider.cpp
+++ b/shibsp/impl/XMLServiceProvider.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2009 Internet2
+ *  Copyright 2001-2010 Internet2
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -73,6 +73,8 @@
 # include <xmltooling/security/TrustEngine.h>
 # include <xmltooling/util/ReplayCache.h>
 # include <xmltooling/util/StorageService.h>
+# include <xercesc/util/XMLStringTokenizer.hpp>
+# include <xsec/utils/XSECPlatformUtils.hpp>
 using namespace opensaml::saml2;
 using namespace opensaml::saml2p;
 using namespace opensaml::saml2md;
@@ -407,6 +409,8 @@ namespace {
     #pragma warning( pop )
 #endif
 
+    static const XMLCh AlgorithmBlacklist[] =   UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,B,l,a,c,k,l,i,s,t);
+    static const XMLCh AlgorithmWhitelist[] =   UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,W,h,i,t,e,l,i,s,t);
     static const XMLCh ApplicationOverride[] =  UNICODE_LITERAL_19(A,p,p,l,i,c,a,t,i,o,n,O,v,e,r,r,i,d,e);
     static const XMLCh ApplicationDefaults[] =  UNICODE_LITERAL_19(A,p,p,l,i,c,a,t,i,o,n,D,e,f,a,u,l,t,s);
     static const XMLCh _ArtifactMap[] =         UNICODE_LITERAL_11(A,r,t,i,f,a,c,t,M,a,p);
@@ -1446,6 +1450,38 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
                     throw ConfigurationException("Can't build SessionCache, missing conf:SessionCache element?");
                 }
             }
+
+#ifndef SHIBSP_LITE
+            child = XMLHelper::getLastChildElement(e, SecurityPolicies);
+            if (child) {
+                const XMLCh* algs = NULL;
+                const DOMElement* alglist = XMLHelper::getLastChildElement(child, AlgorithmBlacklist);
+                if (alglist && alglist->hasChildNodes()) {
+                    algs = alglist->getFirstChild()->getNodeValue();
+                }
+                else if ((alglist = XMLHelper::getLastChildElement(child, AlgorithmWhitelist)) && alglist->hasChildNodes()) {
+                    algs = alglist->getFirstChild()->getNodeValue();
+                }
+                if (algs) {
+#ifdef SHIBSP_XMLSEC_WHITELISTING
+                    const XMLCh* token;
+                    XMLStringTokenizer tokenizer(algs);
+                    while (tokenizer.hasMoreTokens()) {
+                        token = tokenizer.nextToken();
+                        if (token) {
+                            if (XMLString::equals(alglist->getLocalName(), AlgorithmBlacklist))
+                                XSECPlatformUtils::blacklistAlgorithm(token);
+                            else
+                                XSECPlatformUtils::whitelistAlgorithm(token);
+                        }
+                    }
+#else
+                    log.fatal("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists");
+                    throw ConfigurationException("XML-Security-C library prior to 1.6.0 does not support algorithm white/blacklists.");
+#endif
+                }
+            }
+#endif
         } // end of first-time-only stuff
 
         // Back to the fully dynamic stuff...next up is the RequestMapper.