From 5961626ff116a2a5cc43b0a34cd6b954b1905cbd Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 12 Nov 2013 16:50:41 +0000
Subject: [PATCH] Bugzilla 1057: enforce SAML no-empty-reference rule in
 digital signatures where possible.

---
 mdx/au_aaf/beans.xml       | 1 +
 mdx/be_belnet/beans.xml    | 1 +
 mdx/br_cafe/beans.xml      | 1 +
 mdx/ca_caf/beans.xml       | 3 ++-
 mdx/ch_switchaai/beans.xml | 2 ++
 mdx/common-beans.xml       | 6 ++++++
 mdx/cz_eduid/beans.xml     | 1 +
 mdx/es_sir/beans.xml       | 1 +
 mdx/fi_haka/beans.xml      | 2 ++
 mdx/fr_renater/beans.xml   | 2 ++
 mdx/gr_grnet/beans.xml     | 1 +
 mdx/ie_edugate/beans.xml   | 1 +
 mdx/it_idem/beans.xml      | 1 +
 mdx/jp_gakunin/beans.xml   | 1 +
 mdx/lv_laife/beans.xml     | 1 +
 mdx/se_swamid/beans.xml    | 1 +
 mdx/si_arnes/beans.xml     | 1 +
 17 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/mdx/au_aaf/beans.xml b/mdx/au_aaf/beans.xml
index 1aa764fb..dbd6c012 100644
--- a/mdx/au_aaf/beans.xml
+++ b/mdx/au_aaf/beans.xml
@@ -42,6 +42,7 @@
     <bean id="au_aaf_checkSignature" parent="XMLSignatureValidationStage"
         p:id="au_aaf_checkSignature">
         <property name="verificationCertificate" ref="au_aaf_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/be_belnet/beans.xml b/mdx/be_belnet/beans.xml
index f1c54586..c7005b65 100644
--- a/mdx/be_belnet/beans.xml
+++ b/mdx/be_belnet/beans.xml
@@ -65,6 +65,7 @@
     <bean id="be_belnet_checkSignature" parent="XMLSignatureValidationStage"
         p:id="be_belnet_checkSignature">
         <property name="verificationCertificate" ref="be_belnet_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
 
     <!--
diff --git a/mdx/br_cafe/beans.xml b/mdx/br_cafe/beans.xml
index 901166d3..97267880 100644
--- a/mdx/br_cafe/beans.xml
+++ b/mdx/br_cafe/beans.xml
@@ -65,6 +65,7 @@
     <bean id="br_cafe_checkSignature" parent="XMLSignatureValidationStage"
         p:id="br_cafe_checkSignature">
         <property name="verificationCertificate" ref="br_cafe_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
 
     <!--
diff --git a/mdx/ca_caf/beans.xml b/mdx/ca_caf/beans.xml
index e89610c9..53df6c7c 100644
--- a/mdx/ca_caf/beans.xml
+++ b/mdx/ca_caf/beans.xml
@@ -86,8 +86,9 @@
         Check "cafshib" signing signature.
     -->
     <bean id="ca_caf_cafShibCheckSignature" parent="XMLSignatureValidationStage"
-        p:id="ca_caf_checkSignature">
+        p:id="ca_caf_cafShibCheckSignature">
         <property name="verificationCertificate" ref="ca_caf_cafShibSigningCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/ch_switchaai/beans.xml b/mdx/ch_switchaai/beans.xml
index 7fd66298..42e0fc6d 100644
--- a/mdx/ch_switchaai/beans.xml
+++ b/mdx/ch_switchaai/beans.xml
@@ -76,6 +76,7 @@
     <bean id="ch_switchaai_checkSignature" parent="XMLSignatureValidationStage"
         p:id="ch_switchaai_checkSignature">
         <property name="verificationCertificate" ref="ch_switchaai_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
@@ -84,6 +85,7 @@
     <bean id="ch_switchaai_checkInterfedSignature" parent="XMLSignatureValidationStage"
         p:id="ch_switchaai_checkInterfedSignature">
         <property name="verificationCertificate" ref="ch_switchaai_interfedSigningCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index a1371098..4f36ca1b 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -80,6 +80,11 @@
         
         Applies global algorithm blacklists. For values, see:
             http://www.w3.org/TR/xmlsec-algorithms/
+            
+        Establishes a default of *not* permitting empty references
+        in signatures, per the SAML specification. This will be
+        overridden in specific beans where a signature is known to
+        require it.
     -->
     <bean id="XMLSignatureValidationStage" abstract="true" parent="stage_parent"
         class="net.shibboleth.metadata.dom.XMLSignatureValidationStage">
@@ -93,6 +98,7 @@
                 <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
             </list>
         </property>
+        <property name="permittingEmptyReferences" value="false"/>
     </bean>
 
     <!--
diff --git a/mdx/cz_eduid/beans.xml b/mdx/cz_eduid/beans.xml
index bac3ec9b..5264cb1b 100644
--- a/mdx/cz_eduid/beans.xml
+++ b/mdx/cz_eduid/beans.xml
@@ -75,6 +75,7 @@
     <bean id="cz_eduid_checkSignature" parent="XMLSignatureValidationStage"
         p:id="cz_eduid_checkSignature">
         <property name="verificationCertificate" ref="cz_eduid_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/es_sir/beans.xml b/mdx/es_sir/beans.xml
index faa98359..21a6a5e9 100644
--- a/mdx/es_sir/beans.xml
+++ b/mdx/es_sir/beans.xml
@@ -65,6 +65,7 @@
     <bean id="es_sir_checkSignature" parent="XMLSignatureValidationStage"
         p:id="es_sir_checkSignature">
         <property name="verificationCertificate" ref="es_sir_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/fi_haka/beans.xml b/mdx/fi_haka/beans.xml
index 113d0442..f636602e 100644
--- a/mdx/fi_haka/beans.xml
+++ b/mdx/fi_haka/beans.xml
@@ -65,6 +65,7 @@
     <bean id="fi_haka_checkSignature" parent="XMLSignatureValidationStage"
         p:id="fi_haka_checkSignature">
         <property name="verificationCertificate" ref="fi_haka_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
@@ -84,6 +85,7 @@
     <bean id="fi_haka_checkEdugainSignature" parent="XMLSignatureValidationStage"
         p:id="fi_haka_checkEdugainSignature">
         <property name="verificationCertificate" ref="fi_haka_edugainSigningCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/fr_renater/beans.xml b/mdx/fr_renater/beans.xml
index 3305ec49..8a223f2f 100644
--- a/mdx/fr_renater/beans.xml
+++ b/mdx/fr_renater/beans.xml
@@ -81,6 +81,7 @@
     <bean id="fr_renater_checkSignature" parent="XMLSignatureValidationStage"
         p:id="fr_renater_checkSignature">
         <property name="verificationCertificate" ref="fr_renater_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
@@ -100,6 +101,7 @@
     <bean id="fr_renater_edugainCheckSignature" parent="XMLSignatureValidationStage"
         p:id="fr_renater_edugainCheckSignature">
         <property name="verificationCertificate" ref="fr_renater_edugainSigningCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/gr_grnet/beans.xml b/mdx/gr_grnet/beans.xml
index c9947bd5..0373f872 100644
--- a/mdx/gr_grnet/beans.xml
+++ b/mdx/gr_grnet/beans.xml
@@ -65,6 +65,7 @@
     <bean id="gr_grnet_checkSignature" parent="XMLSignatureValidationStage"
         p:id="gr_grnet_checkSignature">
         <property name="verificationCertificate" ref="gr_grnet_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/ie_edugate/beans.xml b/mdx/ie_edugate/beans.xml
index d4179a8c..356eed59 100644
--- a/mdx/ie_edugate/beans.xml
+++ b/mdx/ie_edugate/beans.xml
@@ -55,6 +55,7 @@
     <bean id="ie_edugate_checkSignature" parent="XMLSignatureValidationStage"
         p:id="ie_edugate_checkSignature">
         <property name="verificationCertificate" ref="ie_edugate_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/it_idem/beans.xml b/mdx/it_idem/beans.xml
index 0375956a..4cb658ad 100644
--- a/mdx/it_idem/beans.xml
+++ b/mdx/it_idem/beans.xml
@@ -65,6 +65,7 @@
     <bean id="it_idem_checkSignature" parent="XMLSignatureValidationStage"
         p:id="it_idem_checkSignature">
         <property name="verificationCertificate" ref="it_idem_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/jp_gakunin/beans.xml b/mdx/jp_gakunin/beans.xml
index 3078111d..70964e5e 100644
--- a/mdx/jp_gakunin/beans.xml
+++ b/mdx/jp_gakunin/beans.xml
@@ -42,6 +42,7 @@
     <bean id="jp_gakunin_checkSignature" parent="XMLSignatureValidationStage"
         p:id="jp_gakunin_checkSignature">
         <property name="verificationCertificate" ref="jp_gakunin_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/lv_laife/beans.xml b/mdx/lv_laife/beans.xml
index 5da33bd3..2f053a05 100644
--- a/mdx/lv_laife/beans.xml
+++ b/mdx/lv_laife/beans.xml
@@ -68,6 +68,7 @@
     <bean id="lv_laife_checkSignature" parent="XMLSignatureValidationStage"
         p:id="lv_laife_checkSignature">
         <property name="verificationCertificate" ref="lv_laife_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/se_swamid/beans.xml b/mdx/se_swamid/beans.xml
index 76d56133..fc2f64a8 100644
--- a/mdx/se_swamid/beans.xml
+++ b/mdx/se_swamid/beans.xml
@@ -71,6 +71,7 @@
     <bean id="se_swamid_checkSignature" parent="XMLSignatureValidationStage"
         p:id="se_swamid_checkSignature">
         <property name="verificationCertificate" ref="se_swamid_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--
diff --git a/mdx/si_arnes/beans.xml b/mdx/si_arnes/beans.xml
index e168ef39..2a523fae 100644
--- a/mdx/si_arnes/beans.xml
+++ b/mdx/si_arnes/beans.xml
@@ -42,6 +42,7 @@
     <bean id="si_arnes_checkSignature" parent="XMLSignatureValidationStage"
         p:id="si_arnes_checkSignature">
         <property name="verificationCertificate" ref="si_arnes_signingCertificate"/>
+        <property name="permittingEmptyReferences" value="true"/>
     </bean>
     
     <!--