[cpp-opensaml] branch master updated: CPPOST-112 - Implement message correlation in SAML2 encoder/decoder

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=7bd912dda71801487015f31d32abfa4cb0dd042c

The following commit(s) were added to refs/heads/master by this push:
       new  7bd912d   CPPOST-112 - Implement message correlation in SAML2 encoder/decoder
7bd912d is described below

commit 7bd912dda71801487015f31d32abfa4cb0dd042c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 24 21:33:23 2020 -0500

    CPPOST-112 - Implement message correlation in SAML2 encoder/decoder
    
    https://issues.shibboleth.net/jira/browse/CPPOST-112
    
    "Final" disposition of logic in Bearer and MessageFlow rules.
---
 saml/binding/impl/MessageFlowRule.cpp              | 27 +++++++++++++++-------
 saml/saml2/profile/impl/BearerConfirmationRule.cpp |  2 +-
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/saml/binding/impl/MessageFlowRule.cpp b/saml/binding/impl/MessageFlowRule.cpp
index 5f473b3..d4cea01 100644
--- a/saml/binding/impl/MessageFlowRule.cpp
+++ b/saml/binding/impl/MessageFlowRule.cpp
@@ -53,8 +53,8 @@ namespace opensaml {
         bool evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const;
 
     private:
-        bool m_checkReplay;
-        bool m_correlation;
+        logging::Category& m_log;
+        bool m_checkReplay, m_correlation, m_blockUnsolicited;
         time_t m_expires;
     };
 
@@ -62,17 +62,24 @@ namespace opensaml {
     {
         return new MessageFlowRule(e);
     }
-};
 
-static const XMLCh checkReplay[] = UNICODE_LITERAL_11(c,h,e,c,k,R,e,p,l,a,y);
-static const XMLCh checkCorrelation[] = UNICODE_LITERAL_16(c,h,e,c,k,C,o,r,r,e,l,a,t,i,o,n);
-static const XMLCh expires[] = UNICODE_LITERAL_7(e,x,p,i,r,e,s);
+    static const XMLCh blockUnsolicited[] = UNICODE_LITERAL_16(b,l,o,c,k,U,n,s,o,l,i,c,i,t,e,d);
+    static const XMLCh checkReplay[] =      UNICODE_LITERAL_11(c,h,e,c,k,R,e,p,l,a,y);
+    static const XMLCh checkCorrelation[] = UNICODE_LITERAL_16(c,h,e,c,k,C,o,r,r,e,l,a,t,i,o,n);
+    static const XMLCh expires[] =          UNICODE_LITERAL_7(e,x,p,i,r,e,s);
+};
 
 MessageFlowRule::MessageFlowRule(const DOMElement* e) : SecurityPolicyRule(e),
-    m_checkReplay(XMLHelper::getAttrBool(e, true, checkReplay)),
+    m_log(logging::Category::getInstance(SAML_LOGCAT ".SecurityPolicyRule.MessageFlow")),
+        m_checkReplay(XMLHelper::getAttrBool(e, true, checkReplay)),
         m_correlation(XMLHelper::getAttrBool(e, false, checkCorrelation)),
+        m_blockUnsolicited(XMLHelper::getAttrBool(e, false, blockUnsolicited)),
         m_expires(XMLHelper::getAttrInt(e, XMLToolingConfig::getConfig().clock_skew_secs, expires))
 {
+    if (m_blockUnsolicited && !m_correlation) {
+        m_correlation = true;
+        m_log.info("enabling request/response correlation checking to block unsolicited responses");
+    }
 }
 
 bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* request, SecurityPolicy& policy) const
@@ -116,9 +123,13 @@ bool MessageFlowRule::evaluate(const XMLObject& message, const GenericRequest* r
             }
         }
         else if (policy.getInResponseTo() && *(policy.getInResponseTo())) {
-            log.warn("request/response correlation failed due to lack of request ID to compare against");
+            log.warn("request/response correlation failed due to lack of request ID to compare");
             throw SecurityPolicyException("Response correlation failed with lack of correlation ID");
         }
+        else if (blockUnsolicited) {
+            log.warn("unsolicited response rejected by policy");
+            throw SecurityPolicyException("Unsolicited response rejected by policy");
+        }
     }
     else {
         log.debug("ignoring InResponseTo, correlation checking is disabled");
diff --git a/saml/saml2/profile/impl/BearerConfirmationRule.cpp b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
index 6ffa2e3..b038a2a 100644
--- a/saml/saml2/profile/impl/BearerConfirmationRule.cpp
+++ b/saml/saml2/profile/impl/BearerConfirmationRule.cpp
@@ -136,7 +136,7 @@ bool BearerConfirmationRule::evaluate(const XMLObject& message, const GenericReq
                         msg = "bearer confirmation issued in response to request failed on lack of correlation ID";
                         continue;
                     }
-                    else {
+                    else if (blockUnsolicited) {
                         msg = "unsolicited bearer confirmation rejected by policy";
                         continue;
                     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.