[cpp-sp] branch main updated: SSPCPP-915 - Deprecate and replace sensitive terms in APIs
Scott Cantor
cantor.2 at osu.edu
Thu Dec 3 00:58:13 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=5d2bd297c74a5012fb7a1114adbccf7f6b35c300
The following commit(s) were added to refs/heads/main by this push:
new 5d2bd297 SSPCPP-915 - Deprecate and replace sensitive terms in APIs
5d2bd297 is described below
commit 5d2bd297c74a5012fb7a1114adbccf7f6b35c300
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 2 19:57:09 2020 -0500
SSPCPP-915 - Deprecate and replace sensitive terms in APIs
https://issues.shibboleth.net/jira/browse/SSPCPP-915
---
configs/security-policy.xml | 2 +-
doc/RELEASE.txt | 15 ++--
schemas/shibboleth-3.0-native-sp-config.xsd | 14 ++++
shibsp/Application.h | 2 +-
shibsp/impl/XMLApplication.cpp | 63 +++++++++------
shibsp/impl/XMLApplication.h | 8 +-
shibsp/impl/XMLSecurityPolicyProvider.cpp | 117 +++++++++++++++++++++-------
shibsp/impl/XMLServiceProvider.cpp | 34 ++++----
shibsp/security/SecurityPolicyProvider.h | 57 ++++++++++----
9 files changed, 214 insertions(+), 98 deletions(-)
diff --git a/configs/security-policy.xml b/configs/security-policy.xml
index 24899894..f8eaacda 100644
--- a/configs/security-policy.xml
+++ b/configs/security-policy.xml
@@ -39,6 +39,6 @@
</Policy>
<!-- Disables known weak algorithms. -->
- <AlgorithmBlacklist includeDefaultBlacklist="true"/>
+ <ExcludedAlgorithms excludeDefaults="true"/>
</SecurityPolicies>
diff --git a/doc/RELEASE.txt b/doc/RELEASE.txt
index cac7a190..2901a9c3 100644
--- a/doc/RELEASE.txt
+++ b/doc/RELEASE.txt
@@ -1,13 +1,8 @@
-Shibboleth Native SP Release Notes
+Shibboleth SP Release Notes
-Fix/Enhancement Lists:
-https://wiki.shibboleth.net/confluence/display/DEV/SPRoadmap
+Release Notes:
+https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes
-Important Changes:
-https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationChanges
-
-Feature Highlights:
-https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPInterestingFeatures
NOTE: The shibboleth2.xml configuration format in this release
is fully compatible with the 2.x releases, but there are significant
@@ -44,7 +39,7 @@ Fully Supported
- Metadata Providers
- Bulk resolution via local file, or URL with local file backup
- Dynamic resolution and caching based on entityID or MDX
- - Filtering based on whitelist, blacklist, or signature verification
+ - Filtering and signature verification
- Support for enhanced PKI processing in transport and signature verification
- Metadata Generation Handler
@@ -78,7 +73,7 @@ Fully Supported
- Optional outgoing encryption of NameID in requests and responses
- General Security
- - Black/whitelisting of XML security algorithms (with xml-security 1.6+)
+ - Limiting XML security algorithms (with xml-security 1.6+)
- RSA and ECDSA signatures (EC requires xml-security 1.6+ and support from openssl)
- AES-GCM encryption (requires xml-security 1.7+ and support from openssl)
- Metadata-based algorithm selection
diff --git a/schemas/shibboleth-3.0-native-sp-config.xsd b/schemas/shibboleth-3.0-native-sp-config.xsd
index 564c389a..ab03c606 100644
--- a/schemas/shibboleth-3.0-native-sp-config.xsd
+++ b/schemas/shibboleth-3.0-native-sp-config.xsd
@@ -61,6 +61,9 @@
<enumeration value="whitelist"/>
<enumeration value="exact+whitelist"/>
<enumeration value="host+whitelist"/>
+ <enumeration value="allow"
+ <enumeration value="exact+allow"/>
+ <enumeration value="host+allow"/>
</restriction>
</simpleType>
@@ -611,6 +614,7 @@
<attribute name="relayStateWhitelist" type="conf:listOfURIs"/>
<attribute name="redirectLimit" type="conf:redirectLimitType"/>
<attribute name="redirectWhitelist" type="conf:listOfURIs"/>
+ <attribute name="redirectAllow" type="conf:listOfURIs"/>
<anyAttribute namespace="##other" processContents="lax"/>
</complexType>
@@ -815,6 +819,16 @@
</simpleContent>
</complexType>
</element>
+ <element name="IncludedAlgorithms" type="conf:listOfURIs"/>
+ <element name="ExcludedAlgorithms">
+ <complexType>
+ <simpleContent>
+ <extension base="conf:listOfURIs">
+ <attribute name="excludeDefaults" type="boolean"/>
+ </extension>
+ </simpleContent>
+ </complexType>
+ </element>
</choice>
</sequence>
</complexType>
diff --git a/shibsp/Application.h b/shibsp/Application.h
index 7ba3d73d..7b6a510e 100644
--- a/shibsp/Application.h
+++ b/shibsp/Application.h
@@ -327,7 +327,7 @@ namespace shibsp {
/**
* Checks a proposed redirect URL against application-specific settings for legal redirects,
- * such as same-host restrictions or whitelisted domains, and raises a SecurityPolicyException
+ * such as same-host restrictions or allowed domains, and raises a SecurityPolicyException
* in the event of a violation.
*
* @param request the request leading to the redirect
diff --git a/shibsp/impl/XMLApplication.cpp b/shibsp/impl/XMLApplication.cpp
index 2d16f7bb..707bd5f2 100644
--- a/shibsp/impl/XMLApplication.cpp
+++ b/shibsp/impl/XMLApplication.cpp
@@ -125,7 +125,8 @@ XMLApplication::XMLApplication(
map<string,string> remapperMap;
remapperMap[shibspconstants::ASCII_SHIB2SPCONFIG_NS] = shibspconstants::ASCII_SHIB3SPCONFIG_NS;
remapperMap["relayStateLimit"] = "redirectLimit";
- remapperMap["relayStateWhitelist"] = "redirectWhitelist";
+ remapperMap["relayStateWhitelist"] = "redirectAllow";
+ remapperMap["redirectWhitelist"] = "redirectAllow";
DOMPropertySet::STLRemapper remapper(remapperMap);
load(e, nullptr, this, &remapper);
@@ -142,19 +143,35 @@ XMLApplication::XMLApplication(
else if (!strcmp(prop.second, "host"))
m_redirectLimit = REDIRECT_LIMIT_HOST;
else {
- if (!strcmp(prop.second, "exact+whitelist"))
- m_redirectLimit = REDIRECT_LIMIT_EXACT_WHITELIST;
- else if (!strcmp(prop.second, "host+whitelist"))
- m_redirectLimit = REDIRECT_LIMIT_HOST_WHITELIST;
- else if (!strcmp(prop.second, "whitelist"))
- m_redirectLimit = REDIRECT_LIMIT_WHITELIST;
- else
+ if (!strcmp(prop.second, "exact+allow")) {
+ m_redirectLimit = REDIRECT_LIMIT_EXACT_ALLOW;
+ }
+ else if (!strcmp(prop.second, "host+allow")) {
+ m_redirectLimit = REDIRECT_LIMIT_HOST_ALLOW;
+ }
+ else if (!strcmp(prop.second, "allow")) {
+ m_redirectLimit = REDIRECT_LIMIT_ALLOW;
+ }
+ else if (!strcmp(prop.second, "exact+whitelist")) {
+ log.warn("DEPRECATED: redirectLimit of \"exact+whitelist\" replaced by \"exact+allow\"");
+ m_redirectLimit = REDIRECT_LIMIT_EXACT_ALLOW;
+ }
+ else if (!strcmp(prop.second, "host+whitelist")) {
+ log.warn("DEPRECATED: redirectLimit of \"host+whitelist\" replaced by \"host+allow\"");
+ m_redirectLimit = REDIRECT_LIMIT_HOST_ALLOW;
+ }
+ else if (!strcmp(prop.second, "whitelist")) {
+ log.warn("DEPRECATED: redirectLimit of \"whitelist\" replaced by \"allow\"");
+ m_redirectLimit = REDIRECT_LIMIT_ALLOW;
+ }
+ else {
throw ConfigurationException("Unrecognized redirectLimit setting ($1)", params(1, prop.second));
- prop = sessionProps->getString("redirectWhitelist");
+ }
+ prop = sessionProps->getString("redirectAllow");
if (prop.first) {
string dup(prop.second);
trim(dup);
- split(m_redirectWhitelist, dup, is_space(), algorithm::token_compress_on);
+ split(m_redirectAllow, dup, is_space(), algorithm::token_compress_on);
}
}
}
@@ -1549,32 +1566,32 @@ void XMLApplication::limitRedirect(const GenericRequest& request, const char* ur
urlcopy += '/';
}
- vector<string> whitelist;
- if (m_redirectLimit == REDIRECT_LIMIT_EXACT || m_redirectLimit == REDIRECT_LIMIT_EXACT_WHITELIST) {
+ vector<string> allowlist;
+ if (m_redirectLimit == REDIRECT_LIMIT_EXACT || m_redirectLimit == REDIRECT_LIMIT_EXACT_ALLOW) {
// Scheme and hostname have to match.
if (request.isDefaultPort()) {
- whitelist.push_back(string(request.getScheme()) + "://" + request.getHostname() + '/');
+ allowlist.push_back(string(request.getScheme()) + "://" + request.getHostname() + '/');
}
- whitelist.push_back(string(request.getScheme()) + "://" + request.getHostname() + ':' + lexical_cast<string>(request.getPort()) + '/');
+ allowlist.push_back(string(request.getScheme()) + "://" + request.getHostname() + ':' + lexical_cast<string>(request.getPort()) + '/');
}
- else if (m_redirectLimit == REDIRECT_LIMIT_HOST || m_redirectLimit == REDIRECT_LIMIT_HOST_WHITELIST) {
+ else if (m_redirectLimit == REDIRECT_LIMIT_HOST || m_redirectLimit == REDIRECT_LIMIT_HOST_ALLOW) {
// Allow any scheme or port.
- whitelist.push_back(string("https://") + request.getHostname() + '/');
- whitelist.push_back(string("http://") + request.getHostname() + '/');
- whitelist.push_back(string("https://") + request.getHostname() + ':');
- whitelist.push_back(string("http://") + request.getHostname() + ':');
+ allowlist.push_back(string("https://") + request.getHostname() + '/');
+ allowlist.push_back(string("http://") + request.getHostname() + '/');
+ allowlist.push_back(string("https://") + request.getHostname() + ':');
+ allowlist.push_back(string("http://") + request.getHostname() + ':');
}
- if (!whitelist.empty()) {
- for (vector<string>::const_iterator i = whitelist.begin(); i != whitelist.end(); ++i) {
+ if (!allowlist.empty()) {
+ for (vector<string>::const_iterator i = allowlist.begin(); i != allowlist.end(); ++i) {
if (istarts_with(urlcopy, *i)) {
return;
}
}
}
- if (!m_redirectWhitelist.empty()) {
- for (vector<string>::const_iterator i = m_redirectWhitelist.begin(); i != m_redirectWhitelist.end(); ++i) {
+ if (!m_redirectAllow.empty()) {
+ for (vector<string>::const_iterator i = m_redirectAllow.begin(); i != m_redirectAllow.end(); ++i) {
if (istarts_with(urlcopy, *i)) {
return;
}
diff --git a/shibsp/impl/XMLApplication.h b/shibsp/impl/XMLApplication.h
index 28d0c047..2a455b33 100644
--- a/shibsp/impl/XMLApplication.h
+++ b/shibsp/impl/XMLApplication.h
@@ -221,12 +221,12 @@ namespace shibsp {
REDIRECT_LIMIT_NONE,
REDIRECT_LIMIT_EXACT,
REDIRECT_LIMIT_HOST,
- REDIRECT_LIMIT_WHITELIST,
- REDIRECT_LIMIT_EXACT_WHITELIST,
- REDIRECT_LIMIT_HOST_WHITELIST
+ REDIRECT_LIMIT_ALLOW,
+ REDIRECT_LIMIT_EXACT_ALLOW,
+ REDIRECT_LIMIT_HOST_ALLOW
} m_redirectLimit;
- std::vector<std::string> m_redirectWhitelist;
+ std::vector<std::string> m_redirectAllow;
bool m_deprecationSupport;
xercesc::DOMDocument* m_doc;
};
diff --git a/shibsp/impl/XMLSecurityPolicyProvider.cpp b/shibsp/impl/XMLSecurityPolicyProvider.cpp
index 077912c3..f3ac2ca4 100644
--- a/shibsp/impl/XMLSecurityPolicyProvider.cpp
+++ b/shibsp/impl/XMLSecurityPolicyProvider.cpp
@@ -59,6 +59,21 @@ namespace shibsp {
#pragma warning( disable : 4250 )
#endif
+ static const XMLCh _id[] = UNICODE_LITERAL_2(i,d);
+ static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e);
+ static const XMLCh excludeDefaults[] = UNICODE_LITERAL_15(e,x,c,l,u,d,e,D,e,f,a,u,l,t,s);
+ static const XMLCh includeDefaultBlacklist[] = UNICODE_LITERAL_23(i,n,c,l,u,d,e,D,e,f,a,u,l,t,B,l,a,c,k,l,i,s,t);
+ static const XMLCh AlgorithmBlacklist[] = UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,B,l,a,c,k,l,i,s,t);
+ static const XMLCh AlgorithmWhitelist[] = UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,W,h,i,t,e,l,i,s,t);
+ static const XMLCh ExcludedAlgorithms[] = UNICODE_LITERAL_18(E,x,c,l,u,d,e,d,A,l,g,o,r,i,t,h,m,s);
+ static const XMLCh IncludedAlgorithms[] = UNICODE_LITERAL_18(I,n,c,l,u,d,e,d,A,l,g,o,r,i,t,h,m,s);
+ static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y);
+ static const XMLCh PolicyRule[] = UNICODE_LITERAL_10(P,o,l,i,c,y,R,u,l,e);
+ static const XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e);
+ static const XMLCh SecurityPolicies[] = UNICODE_LITERAL_16(S,e,c,u,r,i,t,y,P,o,l,i,c,i,e,s);
+
+ static vector<xstring> EMPTY_VECTOR;
+
class SHIBSP_DLLLOCAL XMLSecurityPolicyProviderImpl
{
public:
@@ -74,8 +89,8 @@ namespace shibsp {
private:
DOMDocument* m_document;
- bool m_includeDefaultBlacklist;
- vector<xstring> m_whitelist,m_blacklist;
+ bool m_excludeDefaults;
+ vector<xstring> m_includes,m_excludes;
vector< boost::shared_ptr<SecurityPolicyRule> > m_ruleJanitor; // need this to maintain vector type in API
typedef map< string,pair< boost::shared_ptr<PropertySet>,vector<const SecurityPolicyRule*> > > policymap_t;
policymap_t m_policyMap;
@@ -113,22 +128,30 @@ namespace shibsp {
return i->second.second;
throw ConfigurationException("Security Policy ($1) not found, check <SecurityPolicies> element.", params(1,id));
}
+ const vector<xstring>& getDefaultExcludedAlgorithms() const {
+ return m_impl->m_excludeDefaults ? m_defaultBlacklist : EMPTY_VECTOR;
+ }
+ const vector<xstring>& getExcludedAlgorithms() const {
+ return m_impl->m_excludes;
+ }
+ const vector<xstring>& getIncludedAlgorithms() const {
+ return m_impl->m_includes;
+ }
const vector<xstring>& getDefaultAlgorithmBlacklist() const {
- return m_impl->m_includeDefaultBlacklist ? m_defaultBlacklist : m_empty;
+ return getDefaultExcludedAlgorithms();
}
const vector<xstring>& getAlgorithmBlacklist() const {
- return m_impl->m_blacklist;
+ return getExcludedAlgorithms();
}
const vector<xstring>& getAlgorithmWhitelist() const {
- return m_impl->m_whitelist;
+ return getIncludedAlgorithms();
}
-
+
protected:
pair<bool,DOMElement*> background_load();
private:
scoped_ptr<XMLSecurityPolicyProviderImpl> m_impl;
- static vector<xstring> m_empty;
};
#if defined (_MSC_VER)
@@ -147,16 +170,6 @@ namespace shibsp {
return FILTER_REJECT;
}
};
-
- static const XMLCh _id[] = UNICODE_LITERAL_2(i,d);
- static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e);
- static const XMLCh includeDefaultBlacklist[] = UNICODE_LITERAL_23(i,n,c,l,u,d,e,D,e,f,a,u,l,t,B,l,a,c,k,l,i,s,t);
- static const XMLCh AlgorithmBlacklist[] = UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,B,l,a,c,k,l,i,s,t);
- static const XMLCh AlgorithmWhitelist[] = UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,W,h,i,t,e,l,i,s,t);
- static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y);
- static const XMLCh PolicyRule[] = UNICODE_LITERAL_10(P,o,l,i,c,y,R,u,l,e);
- static const XMLCh Rule[] = UNICODE_LITERAL_4(R,u,l,e);
- static const XMLCh SecurityPolicies[] = UNICODE_LITERAL_16(S,e,c,u,r,i,t,y,P,o,l,i,c,i,e,s);
}
void SHIBSP_API shibsp::registerSecurityPolicyProviders()
@@ -175,11 +188,32 @@ SecurityPolicyProvider::~SecurityPolicyProvider()
{
}
-const vector<xstring>& SecurityPolicyProvider::getDefaultAlgorithmBlacklist() const
+const vector<xstring>& SecurityPolicyProvider::getDefaultExcludedAlgorithms() const
{
return m_defaultBlacklist;
}
+const vector<xstring>& SecurityPolicyProvider::getExcludedAlgorithms() const {
+ return getAlgorithmBlacklist();
+}
+
+const vector<xstring>& SecurityPolicyProvider::getIncludedAlgorithms() const {
+ return getAlgorithmWhitelist();
+}
+
+const vector<xstring>& SecurityPolicyProvider::getDefaultAlgorithmBlacklist() const
+{
+ return getDefaultExcludedAlgorithms();
+}
+
+const vector<xstring>& SecurityPolicyProvider::getAlgorithmBlacklist() const {
+ return EMPTY_VECTOR;
+}
+
+const vector<xstring>& SecurityPolicyProvider::getAlgorithmWhitelist() const {
+ return EMPTY_VECTOR;
+}
+
SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
const Application& application, const xmltooling::QName* role, const char* policyId
) const
@@ -198,7 +232,7 @@ SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
}
XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log)
- : m_document(nullptr), m_includeDefaultBlacklist(true), m_defaultPolicy(m_policyMap.end())
+ : m_document(nullptr), m_excludeDefaults(true), m_defaultPolicy(m_policyMap.end())
{
#ifdef _DEBUG
xmltooling::NDC ndc("XMLSecurityPolicyProviderImpl");
@@ -218,25 +252,52 @@ XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e
const XMLCh* algs = nullptr;
const DOMElement* alglist = XMLHelper::getLastChildElement(e, AlgorithmBlacklist);
if (alglist) {
- m_includeDefaultBlacklist = XMLHelper::getAttrBool(alglist, true, includeDefaultBlacklist);
+ log.warn("DEPRECATED: <AlgorithmBlacklist> and includeDefaultBlacklist replaced by <ExcludedAlgorithms> and excludeDefaults");
+ m_excludeDefaults = XMLHelper::getAttrBool(alglist, true, includeDefaultBlacklist);
if (alglist->hasChildNodes()) {
algs = alglist->getFirstChild()->getNodeValue();
}
}
- else if ((alglist = XMLHelper::getLastChildElement(e, AlgorithmWhitelist)) && alglist->hasChildNodes()) {
- algs = alglist->getFirstChild()->getNodeValue();
- m_includeDefaultBlacklist = false;
+ else {
+ alglist = XMLHelper::getLastChildElement(e, AlgorithmWhitelist);
+ if (alglist) {
+ log.warn("DEPRECATED: <AlgorithmWhitelist> replaced by <IncludedAlgorithms>");
+ if (alglist->hasChildNodes()) {
+ algs = alglist->getFirstChild()->getNodeValue();
+ }
+ m_excludeDefaults = false;
+ }
+ else {
+ const DOMElement* alglist = XMLHelper::getLastChildElement(e, ExcludedAlgorithms);
+ if (alglist) {
+ m_excludeDefaults = XMLHelper::getAttrBool(alglist, true, excludeDefaults);
+ if (alglist->hasChildNodes()) {
+ algs = alglist->getFirstChild()->getNodeValue();
+ }
+ }
+ else {
+ alglist = XMLHelper::getLastChildElement(e, IncludedAlgorithms);
+ if (alglist && alglist->hasChildNodes()) {
+ algs = alglist->getFirstChild()->getNodeValue();
+ }
+ m_excludeDefaults = false;
+ }
+ }
}
+
if (algs) {
const XMLCh* token;
XMLStringTokenizer tokenizer(algs);
while (tokenizer.hasMoreTokens()) {
token = tokenizer.nextToken();
if (token) {
- if (XMLString::equals(alglist->getLocalName(), AlgorithmBlacklist))
- m_blacklist.push_back(token);
- else
- m_whitelist.push_back(token);
+ if (XMLString::equals(alglist->getLocalName(), AlgorithmBlacklist) ||
+ XMLString::equals(alglist->getLocalName(), ExcludedAlgorithms)) {
+ m_excludes.push_back(token);
+ }
+ else {
+ m_includes.push_back(token);
+ }
}
}
}
@@ -305,8 +366,6 @@ XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e
throw ConfigurationException("XML SecurityPolicyProvider requires at least one Policy.");
}
-vector<xstring> XMLSecurityPolicyProvider::m_empty;
-
pair<bool,DOMElement*> XMLSecurityPolicyProvider::background_load()
{
// Load from source using base class.
diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp
index 718dbe41..c20492b4 100644
--- a/shibsp/impl/XMLServiceProvider.cpp
+++ b/shibsp/impl/XMLServiceProvider.cpp
@@ -503,26 +503,26 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, XMLConfig* outer,
}
if (first) {
- if (!m_policy->getAlgorithmWhitelist().empty()) {
- for (vector<xstring>::const_iterator white = m_policy->getAlgorithmWhitelist().begin();
- white != m_policy->getAlgorithmWhitelist().end(); ++white) {
- XSECPlatformUtils::whitelistAlgorithm(white->c_str());
- auto_ptr_char whitelog(white->c_str());
- log.info("explicitly whitelisting security algorithm (%s)", whitelog.get());
+ if (!m_policy->getIncludedAlgorithms().empty()) {
+ for (vector<xstring>::const_iterator alg = m_policy->getIncludedAlgorithms().begin();
+ alg != m_policy->getIncludedAlgorithms().end(); ++alg) {
+ XSECPlatformUtils::whitelistAlgorithm(alg->c_str());
+ auto_ptr_char includelog(alg->c_str());
+ log.info("explicitly including security algorithm (%s)", includelog.get());
}
}
- else if (!m_policy->getDefaultAlgorithmBlacklist().empty() || !m_policy->getAlgorithmBlacklist().empty()) {
- for (vector<xstring>::const_iterator black = m_policy->getDefaultAlgorithmBlacklist().begin();
- black != m_policy->getDefaultAlgorithmBlacklist().end(); ++black) {
- XSECPlatformUtils::blacklistAlgorithm(black->c_str());
- auto_ptr_char blacklog(black->c_str());
- log.info("automatically blacklisting security algorithm (%s)", blacklog.get());
+ else if (!m_policy->getDefaultExcludedAlgorithms().empty() || !m_policy->getExcludedAlgorithms().empty()) {
+ for (vector<xstring>::const_iterator alg = m_policy->getDefaultExcludedAlgorithms().begin();
+ alg != m_policy->getDefaultExcludedAlgorithms().end(); ++alg) {
+ XSECPlatformUtils::blacklistAlgorithm(alg->c_str());
+ auto_ptr_char excludelog(alg->c_str());
+ log.info("automatically excluding security algorithm (%s)", excludelog.get());
}
- for (vector<xstring>::const_iterator black = m_policy->getAlgorithmBlacklist().begin();
- black != m_policy->getAlgorithmBlacklist().end(); ++black) {
- XSECPlatformUtils::blacklistAlgorithm(black->c_str());
- auto_ptr_char blacklog(black->c_str());
- log.info("explicitly blacklisting security algorithm (%s)", blacklog.get());
+ for (vector<xstring>::const_iterator alg = m_policy->getExcludedAlgorithms().begin();
+ alg != m_policy->getExcludedAlgorithms().end(); ++alg) {
+ XSECPlatformUtils::blacklistAlgorithm(alg->c_str());
+ auto_ptr_char excludelog(alg->c_str());
+ log.info("explicitly excluding security algorithm (%s)", excludelog.get());
}
}
}
diff --git a/shibsp/security/SecurityPolicyProvider.h b/shibsp/security/SecurityPolicyProvider.h
index 0b7c6359..f99f60af 100644
--- a/shibsp/security/SecurityPolicyProvider.h
+++ b/shibsp/security/SecurityPolicyProvider.h
@@ -58,7 +58,11 @@ namespace shibsp {
protected:
SecurityPolicyProvider();
- /** Default algorithms to block in the current release. */
+ /**
+ * @Deprecated
+ *
+ * Default algorithms to block in the current release.
+ */
std::vector<xmltooling::xstring> m_defaultBlacklist;
public:
@@ -80,26 +84,53 @@ namespace shibsp {
*/
virtual const std::vector<const opensaml::SecurityPolicyRule*>& getPolicyRules(const char* id=nullptr) const=0;
- /**
- * Returns a default/implicit set of XML Signature/Encryption algorithm identifiers to block.
- *
- * @return an array of algorithm URIs to block
- */
+ /**
+ * Returns a default/implicit set of XML Signature/Encryption algorithm identifiers to block.
+ *
+ * @return an array of algorithm URIs to block
+ */
+ virtual const std::vector<xmltooling::xstring>& getDefaultExcludedAlgorithms() const;
+
+ /**
+ * Returns a set of XML Signature/Encryption algorithm identifiers to block.
+ *
+ * @return an array of algorithm URIs to block
+ */
+ virtual const std::vector<xmltooling::xstring>& getExcludedAlgorithms() const;
+
+ /**
+ * Returns a set of XML Signature/Encryption algorithm identifiers to permit.
+ *
+ * @return an array of algorithm URIs to permit
+ */
+ virtual const std::vector<xmltooling::xstring>& getIncludedAlgorithms() const;
+
+ /**
+ * @Deprecated
+ *
+ * Returns a default/implicit set of XML Signature/Encryption algorithm identifiers to block.
+ *
+ * @return an array of algorithm URIs to block
+ */
virtual const std::vector<xmltooling::xstring>& getDefaultAlgorithmBlacklist() const;
- /**
- * Returns a set of XML Signature/Encryption algorithm identifiers to block.
- *
- * @return an array of algorithm URIs to block
- */
- virtual const std::vector<xmltooling::xstring>& getAlgorithmBlacklist() const=0;
+ /**
+ * @Deprecated
+ *
+ * Returns a set of XML Signature/Encryption algorithm identifiers to block.
+ *
+ * @return an array of algorithm URIs to block
+ */
+ virtual const std::vector<xmltooling::xstring>& getAlgorithmBlacklist() const;
/**
+ * @Deprecated
+ *
* Returns a set of XML Signature/Encryption algorithm identifiers to permit.
*
* @return an array of algorithm URIs to permit
*/
- virtual const std::vector<xmltooling::xstring>& getAlgorithmWhitelist() const=0;
+ virtual const std::vector<xmltooling::xstring>& getAlgorithmWhitelist() const;
/**
* @Deprecated
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list