[xmlsectool] 04/04: XSTJ-39 - allow digest whitelisting as well as blacklisting
Ian Young
ian at iay.org.uk
Thu Apr 28 11:37:06 EDT 2016
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository xmlsectool.
commit 42a5862fc45317febce50569d857d5fd5d35085b
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Apr 28 16:33:58 2016 +0100
XSTJ-39 - allow digest whitelisting as well as blacklisting
---
.../net/shibboleth/tool/xmlsectool/Blacklist.java | 30 ++++++++++
.../net/shibboleth/tool/xmlsectool/XmlSecTool.java | 6 --
.../xmlsectool/XmlSecToolCommandLineArguments.java | 69 ++++++++++++----------
3 files changed, 67 insertions(+), 38 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java b/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java
index f3cd4ab..c60f6f3 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java
@@ -65,6 +65,15 @@ public class Blacklist {
}
/**
+ * Whitelist an individual digest algorithm.
+ *
+ * @param uri algorithm URI to whitelist
+ */
+ private void removeDigestAlgorithm(String uri) {
+ digestBlacklist.remove(uri);
+ }
+
+ /**
* Blacklist an individual signature algorithm.
*
* @param uri algorithm URI to blacklist
@@ -74,6 +83,15 @@ public class Blacklist {
}
/**
+ * Whitelist an individual signature algorithm.
+ *
+ * @param uri algorithm URI to whitelist
+ */
+ private void removeSignatureAlgorithm(String uri) {
+ signatureBlacklist.remove(uri);
+ }
+
+ /**
* Blacklist the digest and signature algorithms associated with
* a {@link DigestChoice}.
*
@@ -86,6 +104,18 @@ public class Blacklist {
}
/**
+ * Whitelist the digest and signature algorithms associated with
+ * a {@link DigestChoice}.
+ *
+ * @param digestChoice {@link DigestChoice} to remove from blacklist
+ */
+ public void removeDigest(DigestChoice digestChoice) {
+ removeDigestAlgorithm(digestChoice.getDigestAlgorithm());
+ removeSignatureAlgorithm(digestChoice.getRsaAlgorithm());
+ removeSignatureAlgorithm(digestChoice.getEcdsaAlgorithm());
+ }
+
+ /**
* Returns <code>true</code> if the indicated algorithm URI is blacklisted for
* use as a digest algorithm.
*
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
index f4ad755..5931f2d 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
@@ -140,12 +140,6 @@ public final class XmlSecTool {
System.exit(RC_OK);
}
- if (cli.doClearBlacklist()) {
- cli.getBlacklist().clear();
- }
- for (DigestChoice dig: cli.getBlacklistDigests()) {
- cli.getBlacklist().addDigest(dig);
- }
if (cli.doListBlacklist()) {
System.out.println("Digest algorithm blacklist:");
if (cli.getBlacklist().getDigestBlacklist().isEmpty()) {
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
index 4eb0e2a..8ffc579 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
@@ -73,6 +73,7 @@ public class XmlSecToolCommandLineArguments {
private static final String PKCS11_CONFIG_ARG = "pkcs11Config";
private static final String CLEAR_BLACKLIST_ARG = "clearBlacklist";
private static final String BLACKLIST_DIGEST_ARG = "blacklistDigest";
+ private static final String WHITELIST_DIGEST_ARG = "whitelistDigest";
private static final String LIST_BLACKLIST_ARG = "listBlacklist";
private static final String OUT_FILE_ARG = "outFile";
private static final String DEFLATE_OUT_ARG = "deflateOutput";
@@ -230,10 +231,8 @@ public class XmlSecToolCommandLineArguments {
@Parameter(names = OPT + BLACKLIST_DIGEST_ARG)
private List<String> blacklistDigestNames;
- /**
- * Collection of digest choices to be blacklisted.
- */
- private final Collection<DigestChoice> blacklistDigests = new ArrayList<DigestChoice>();
+ @Parameter(names = OPT + WHITELIST_DIGEST_ARG)
+ private List<String> whitelistDigestNames;
// Logging
@Parameter(names = OPT + VERBOSE_ARG)
@@ -258,21 +257,43 @@ public class XmlSecToolCommandLineArguments {
xsdSchema = true;
}
- if (blacklistDigestNames != null) {
- for (final String name : blacklistDigestNames) {
- final DigestChoice dig = DigestChoice.find(name);
- if (dig == null) {
- errorAndExit("digest choice \"" + name + "\" was not recognised");
- }
- blacklistDigests.add(dig);
- }
- }
-
validateCommandLineArguments();
+ processBlacklistOptions();
} catch (ParameterException e) {
errorAndExit(e.getMessage());
}
}
+
+ /**
+ * Handle options related to setting up the blacklist.
+ *
+ * These are --clearBlacklist, --blacklistDigest and --whitelistDigest.
+ */
+ private void processBlacklistOptions() {
+ if (clearBlacklist) {
+ blacklist.clear();
+ }
+
+ if (blacklistDigestNames != null) {
+ for (final String name : blacklistDigestNames) {
+ final DigestChoice dig = DigestChoice.find(name);
+ if (dig == null) {
+ errorAndExit("digest choice \"" + name + "\" was not recognised");
+ }
+ blacklist.addDigest(dig);
+ }
+ }
+
+ if (whitelistDigestNames != null) {
+ for (final String name : whitelistDigestNames) {
+ final DigestChoice dig = DigestChoice.find(name);
+ if (dig == null) {
+ errorAndExit("digest choice \"" + name + "\" was not recognised");
+ }
+ blacklist.removeDigest(dig);
+ }
+ }
+ }
public String getHttpProxy() {
return httpProxy;
@@ -439,15 +460,6 @@ public class XmlSecToolCommandLineArguments {
}
/**
- * Indicates whether the option to clear the blacklist has been selected.
- *
- * @return <code>true</code> if option selected
- */
- public boolean doClearBlacklist() {
- return clearBlacklist;
- }
-
- /**
* Indicates whether the option to list the blacklist has been selected.
*
* @return <code>true</code> if option selected
@@ -456,15 +468,6 @@ public class XmlSecToolCommandLineArguments {
return listBlacklist;
}
- /**
- * Returns the digests designated to be blacklisted on the command line.
- *
- * @return collection of {@link DigestChoice}s to be blacklisted
- */
- public Collection<DigestChoice> getBlacklistDigests() {
- return blacklistDigests;
- }
-
public boolean doVerboseOutput() {
return verbose;
}
@@ -708,6 +711,8 @@ public class XmlSecToolCommandLineArguments {
"Clear the algorithm blacklist."));
out.println(String.format(" --%-20s %s", BLACKLIST_DIGEST_ARG,
"Blacklist a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
+ out.println(String.format(" --%-20s %s", WHITELIST_DIGEST_ARG,
+ "Whitelist a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
out.println(String.format(" --%-20s %s", LIST_BLACKLIST_ARG,
"List the contents of the algorithm blacklist."));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list