[utilities COMMIT] in /xmlsectool/trunk/src: main/java/edu/internet2/middleware/security/XmlSecTool.java main/java/ed...

[noreply at shibboleth.net]

Author: iay
Date: Mon Mar 18 05:41:09 2013
New Revision: 357

URL: http://svn.shibboleth.net/view/utilities?rev=357&view=rev
Log:
XSTJ-38 blacklist MD5 algorithm during signature verification

Added:
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/original.xml   (with props)
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/readme.md
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/sha256-md5d.xml   (with props)
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/sha256-md5s.xml   (with props)
    xmlsectool/trunk/src/test/resources/manual/XSTJ-38/sha256.xml   (with props)
Modified:
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java?rev=357&r1=356&r2=357&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java Mon Mar 18 05:41:09 2013
@@ -139,6 +139,31 @@
             cli.printHelp(System.out);
             System.exit(RC_OK);
         }
+        
+        if (cli.doClearBlacklist()) {
+            cli.getBlacklist().clear();
+        }
+        if (cli.doListBlacklist()) {
+            System.out.println("Digest algorithm blacklist:");
+            if (cli.getBlacklist().getDigestBlacklist().isEmpty()) {
+                System.out.println("   blacklist is empty");
+            } else {
+                for (String uri: cli.getBlacklist().getDigestBlacklist()) {
+                    System.out.println("   " + uri);
+                }
+            }
+            System.out.println();
+            System.out.println("Signature algorithm blacklist:");
+            if (cli.getBlacklist().getSignatureBlacklist().isEmpty()) {
+                System.out.println("   blacklist is empty");
+            } else {
+                for (String uri: cli.getBlacklist().getSignatureBlacklist()) {
+                    System.out.println("   " + uri);
+                }
+            }
+            System.out.println();
+            System.exit(RC_OK);
+        }
 
         initLogging(cli);
 
@@ -661,6 +686,27 @@
 
         final Reference ref = extractReference(signature);
         markIdAttribute(xmlDocument.getDocumentElement(), ref);
+        
+        // check reference digest algorithm against blacklist
+        try {
+            String alg = ref.getMessageDigestAlgorithm().getAlgorithmURI();
+            log.debug("blacklist checking digest {}", alg);
+            if (cli.getBlacklist().isBlacklistedDigest(alg)) {
+                log.error("Digest algorithm {} is blacklisted", alg);
+                System.exit(RC_SIG);
+            }
+        } catch (XMLSignatureException e) {
+            log.error("unable to retrieve signature digest algorithm", e);
+            System.exit(RC_SIG);
+        }
+        
+        // check signature algorithm against blacklist
+        String alg = signature.getSignedInfo().getSignatureMethodURI();
+        log.debug("blacklist checking signature method {}", alg);
+        if (cli.getBlacklist().isBlacklistedSignature(alg)) {
+            log.error("Signature algorithm {} is blacklisted", alg);
+            System.exit(RC_SIG);
+        }        
 
         Key verificationKey = SecurityHelper.extractVerificationKey(getCredential(cli));
         log.debug("Verifying XML signature with key\n{}", Base64.encodeBytes(verificationKey.getEncoded()));

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java?rev=357&r1=356&r2=357&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java Mon Mar 18 05:41:09 2013
@@ -21,7 +21,11 @@
 import jargs.gnu.CmdLineParser.OptionException;
 
 import java.io.PrintStream;
+import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
 
 import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.signature.SignatureConstants;
@@ -29,6 +33,82 @@
 /** Command line arguments for the {@link XmlSecTool} command line tool. */
 public class XmlSecToolCommandLineArguments {
 
+    /**
+     * A blacklist of digest and signature algorithms we should not accept during
+     * signature verification.

[... 192 lines stripped ...]