[java-sp-server] branch main updated: Strip AccessControl out, try out some strategies for security.
Scott Cantor
cantor.2 at osu.edu
Thu May 19 18:47:53 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-sp-server.
View the commit online:
http://git.shibboleth.net/view/?p=java-sp-server.git;a=commit;h=d8ca2812ea642c71acd802505f546785a153623c
The following commit(s) were added to refs/heads/main by this push:
new d8ca281 Strip AccessControl out, try out some strategies for security.
d8ca281 is described below
commit d8ca2812ea642c71acd802505f546785a153623c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 19 14:47:50 2022 -0400
Strip AccessControl out, try out some strategies for security.
---
.../shibboleth/sp/conf/access-control-system.xml | 32 -------
.../net/shibboleth/sp/conf/integration.xml | 27 +++++-
.../net/shibboleth/sp/conf/services-system.xml | 23 -----
.../src/main/resources/conf/services.properties | 5 +
sp-conf/src/main/resources/conf/sp.properties | 7 ++
.../src/main/java/net/shibboleth/sp/impl/Main.java | 4 +
.../tcp/impl/TCPConnectionInterceptorFactory.java | 104 +++++++++++++++++++++
.../sp/remoting/tcp/impl/package-info.java | 19 ++++
8 files changed, 165 insertions(+), 56 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/access-control-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/access-control-system.xml
deleted file mode 100644
index 4c33842..0000000
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/access-control-system.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <bean class="net.shibboleth.idp.security.ReloadingAccessControlService">
- <constructor-arg>
- <bean class="net.shibboleth.utilities.java.support.security.impl.BasicAccessControlService"
- p:id="shibboleth.AccessControlService"
- p:policyMap-ref="shibboleth.AccessControlPolicies" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.IPRangeAccessControl" abstract="true"
- class="net.shibboleth.utilities.java.support.security.impl.IPRangeAccessControl" />
-
- <bean id="shibboleth.PredicateAccessControl" abstract="true"
- class="org.opensaml.profile.logic.PredicateAccessControl" />
-
- <!-- Wildcard import hook for plugins. -->
- <import resource="classpath*:/META-INF/net/shibboleth/sp/service/access-control/postconfig.xml" />
-
-</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/integration.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/integration.xml
index 4987520..ea633ad 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/integration.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/integration.xml
@@ -24,9 +24,34 @@
</property>
</bean>
+ <bean id="ByteArrayLengthHeaderSerializer"
+ class="org.springframework.integration.ip.tcp.serializer.ByteArrayLengthHeaderSerializer" />
+
+ <bean id="ByteArrayCrLfSerializer"
+ class="org.springframework.integration.ip.tcp.serializer.ByteArrayCrLfSerializer" />
+
+ <bean id="shibboleth.TCPInterceptorFactory"
+ class="org.springframework.integration.ip.tcp.connection.TcpConnectionInterceptorFactoryChain">
+ <property name="interceptors">
+ <array>
+ <bean class="net.shibboleth.sp.remoting.tcp.impl.TCPConnectionInterceptorFactory">
+ <constructor-arg>
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{sp.service.allowedRanges:127.0.0.1/32,::0/128}'.trim()}" />
+ </constructor-arg>
+ </bean>
+ </array>
+ </property>
+ </bean>
+
<int-ip:tcp-connection-factory id="shibboleth.IntegrationConnectionFactory"
type="server"
- port="%{sp.service.integration.port:1600}" />
+ lookup-host="false"
+ local-address="%{sp.service.address:127.0.0.1}"
+ port="%{sp.service.port:1600}"
+ serializer="#{%{sp.service.prefixLength:false} ? 'ByteArrayLengthHeaderSerializer' : 'ByteArrayCrLfSerializer'}"
+ deserializer="#{%{sp.service.prefixLength:false} ? 'ByteArrayLengthHeaderSerializer' : 'ByteArrayCrLfSerializer'}"
+ interceptor-factory-chain="shibboleth.TCPInterceptorFactory" />
<int-ip:tcp-inbound-gateway id="shibboleth.IntegrationGateway"
connection-factory="shibboleth.IntegrationConnectionFactory"
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/services-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/services-system.xml
index c7eb8e9..fea9fa7 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/services-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/services-system.xml
@@ -42,31 +42,8 @@
</property>
</bean>
- <bean id="shibboleth.AccessControlService" class="net.shibboleth.ext.spring.service.ReloadableSpringService"
- c:claz="net.shibboleth.utilities.java.support.security.AccessControlService"
- p:serviceConfigurations-ref="ExtendedAccessControlResources"
- p:failFast="%{sp.service.access.failFast:%{idp.service.failFast:true}}"
- p:reloadCheckDelay="%{sp.service.access.checkInterval:PT0S}"
- p:beanPostProcessors-ref="shibboleth.IdentifiableBeanPostProcessor"
- p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer" />
- <!-- Auto-append system config file to resource set. -->
- <bean id ="ExtendedAccessControlResources" class="net.shibboleth.ext.spring.factory.CombiningListFactoryBean"
- p:firstList="#{getObject('%{sp.service.access.resources:shibboleth.AccessControlResources}'.trim())}" >
- <property name="secondList">
- <util:list >
- <value>classpath:/net/shibboleth/sp/conf/access-control-system.xml</value>
- </util:list>
- </property>
- </bean>
-
<!-- TODO: add attribute and metadata services (at least) -->
- <!-- Service facades. -->
-
- <bean id="shibboleth.WrappedAccessControlService"
- class="net.shibboleth.utilities.java.support.security.impl.DelegatingAccessControlService"
- c:acService-ref="shibboleth.AccessControlService" />
-
<import resource="conditional:%{sp.home}/conf/services.xml" />
</beans>
diff --git a/sp-conf/src/main/resources/conf/services.properties b/sp-conf/src/main/resources/conf/services.properties
index 505e0ba..8409c82 100644
--- a/sp-conf/src/main/resources/conf/services.properties
+++ b/sp-conf/src/main/resources/conf/services.properties
@@ -12,6 +12,11 @@
#sp.service.logging.failFast = true
sp.service.logging.checkInterval = PT5M
+#idp.service.provider.resources = shibboleth.ServiceProviderResources
+#idp.service.provider.failFast = true
+idp.service.provider.checkInterval = PT5M
+
+
# These settings impact the behavior of the internal HTTP Client used by default
# with some internal components, but notably *not* for metadata acquisition.
#sp.httpclient.useSecurityEnhancedTLSSocketFactory = false
diff --git a/sp-conf/src/main/resources/conf/sp.properties b/sp-conf/src/main/resources/conf/sp.properties
index a371f27..99605de 100644
--- a/sp-conf/src/main/resources/conf/sp.properties
+++ b/sp-conf/src/main/resources/conf/sp.properties
@@ -5,6 +5,13 @@ sp.searchForProperties = true
# Load any "outside-tree" property sources from a comma-delimited list
sp.additionalProperties = /credentials/secrets.properties
+# Networking settings for service.
+#sp.service.address = 127.0.0.1
+#sp.service.port = 1600
+sp.service.allowedRanges = 1.2.3.4/32
+# Set to true for better performance.
+#sp.service.prefixLength = false
+
# In most cases (and unless noted in the surrounding comments) the
# commented settings in the distributed files document default behavior.
# Uncomment them and change the value to change functionality.
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/Main.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/Main.java
index 7f11b59..7d898f8 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/Main.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/Main.java
@@ -56,7 +56,11 @@ public final class Main {
Thread.currentThread().interrupt();
}
}
+ } catch (final Exception e) {
+ e.printStackTrace(System.err);
}
+
+ System.out.println("Exiting...");
}
}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/TCPConnectionInterceptorFactory.java b/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/TCPConnectionInterceptorFactory.java
new file mode 100644
index 0000000..65e737c
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/TCPConnectionInterceptorFactory.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.sp.remoting.tcp.impl;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.context.ApplicationEventPublisherAware;
+import org.springframework.integration.ip.tcp.connection.TcpConnectionInterceptorFactory;
+import org.springframework.integration.ip.tcp.connection.TcpConnectionInterceptorSupport;
+import org.springframework.messaging.Message;
+import org.springframework.messaging.MessagingException;
+
+import net.shibboleth.sp.remoting.RemoteProcessingException;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.net.IPRange;
+
+/**
+ * Interceptor that adds security to connections.
+ */
+public class TCPConnectionInterceptorFactory implements TcpConnectionInterceptorFactory, ApplicationEventPublisherAware {
+
+ /** List of CIDR blocks allowed to access connections. */
+ @Nonnull @NonnullElements private Collection<IPRange> allowedRanges;
+
+ /** Object passed through to interceptor. */
+ @Nullable private ApplicationEventPublisher applicationEventPublisher;
+
+ /**
+ * Constructor.
+ *
+ * @param ranges allowed ranges for client connection enforcement
+ */
+ public TCPConnectionInterceptorFactory(@Nullable @NonnullElements final Collection<IPRange> ranges) {
+ if (ranges != null) {
+ allowedRanges = List.copyOf(ranges);
+ } else {
+ allowedRanges = Collections.emptyList();
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void setApplicationEventPublisher(ApplicationEventPublisher publisher) {
+ applicationEventPublisher = publisher;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public TcpConnectionInterceptorSupport getInterceptor() {
+ return new TCPConnectionInterceptor(applicationEventPublisher);
+ }
+
+ /**
+ * Actual interceptor built by the factory.
+ */
+ public class TCPConnectionInterceptor extends TcpConnectionInterceptorSupport {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(TCPConnectionInterceptor.class);
+
+ /**
+ * Constructor.
+ *
+ * @param publisher event publisher
+ */
+ public TCPConnectionInterceptor(final ApplicationEventPublisher publisher) {
+ super(publisher);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean onMessage(Message<?> message) {
+
+ if (allowedRanges.stream().anyMatch(range -> range.contains(getSocketInfo().getInetAddress()))) {
+ return super.onMessage(message);
+ }
+
+ log.warn("Blocked message from client address: {}", getSocketInfo().getInetAddress().getHostAddress());
+ throw new MessagingException("Access Denied", new RemoteProcessingException("Blocked message from unauthorized client address"));
+ }
+
+ }
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/package-info.java b/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/package-info.java
new file mode 100644
index 0000000..4ced633
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/remoting/tcp/impl/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Classes supporting TCP as a remoting protocol.
+ */
+
+package net.shibboleth.sp.remoting.tcp.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list