[xmlsectool] branch master updated: XSTJ-44 - extend elliptic curve support beyond current platforms
Ian Young
ian at iay.org.uk
Tue Jun 7 12:50:58 EDT 2016
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository xmlsectool.
View the commit online:
http://git.shibboleth.net/view/?p=xmlsectool.git;a=commit;h=491eb68eb15fc04ab0b83967f22a82597a57807e
The following commit(s) were added to refs/heads/master by this push:
new 491eb68 XSTJ-44 - extend elliptic curve support beyond current platforms
491eb68 is described below
commit 491eb68eb15fc04ab0b83967f22a82597a57807e
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Tue Jun 7 17:50:51 2016 +0100
XSTJ-44 - extend elliptic curve support beyond current platforms
Add the Bouncy Castle provider if we don't have an ECC provider already.
Skip ECC tests if we might have a *broken* ECC provider (OpenJDK 7
under CentOS 7).
---
pom.xml | 11 +++
.../tool/xmlsectool/InitializationSupport.java | 83 ++++++++++++++++++++++
.../net/shibboleth/tool/xmlsectool/XMLSecTool.java | 3 +-
.../net/shibboleth/tool/xmlsectool/BaseTest.java | 33 ++++++++-
.../net/shibboleth/tool/xmlsectool/XSTJ51Test.java | 9 +++
5 files changed, 135 insertions(+), 4 deletions(-)
diff --git a/pom.xml b/pom.xml
index 7f1c02a..fc840d6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,6 +82,10 @@
<artifactId>xmlsec</artifactId>
</dependency>
<dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcprov-jdk15on</artifactId>
+ </dependency>
+ <dependency>
<groupId>com.beust</groupId>
<artifactId>jcommander</artifactId>
</dependency>
@@ -118,6 +122,13 @@
</dependency>
<!-- Test Dependencies -->
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-security-api</artifactId>
+ <version>${opensaml.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
</dependencies>
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/InitializationSupport.java b/src/main/java/net/shibboleth/tool/xmlsectool/InitializationSupport.java
new file mode 100644
index 0000000..a88e8e7
--- /dev/null
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/InitializationSupport.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.tool.xmlsectool;
+
+import java.security.NoSuchAlgorithmException;
+import java.security.Security;
+import java.security.Signature;
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.opensaml.core.config.InitializationException;
+import org.opensaml.core.config.InitializationService;
+
+/**
+ * Support class to assist in initializing the environment in which the command-line application runs.
+ */
+public final class InitializationSupport {
+
+ /** Remember whether we have already been initialized. */
+ private static boolean initialized;
+
+ /** Constructor. */
+ private InitializationSupport() {
+ }
+
+ /**
+ * Do we have an ECC provider available?
+ *
+ * @return <code>true</code> if and only if we have an ECC provider available
+ */
+ private static boolean haveECCProvider() {
+ try {
+ Signature.getInstance("SHA256withECDSA");
+ return true;
+ } catch (NoSuchAlgorithmException e) {
+ return false;
+ }
+ }
+
+ /**
+ * Add an instance of the Bouncy Castle provider to the end of the provider list.
+ */
+ private static void addBouncyCastleProvider() {
+ Security.addProvider(new BouncyCastleProvider());
+ }
+
+ /**
+ * Initialize the environment.
+ *
+ * @throws InitializationException if the OpenSAML environment cannot be initialized
+ */
+ public static void initialize() throws InitializationException {
+
+ // we only need to do this once, even for multiple tests
+ if (initialized) {
+ return;
+ }
+
+ // make sure that we have an ECC signature provider available
+ if (!haveECCProvider()) {
+ addBouncyCastleProvider();
+ }
+
+ // initialize OpenSAML
+ InitializationService.initialize();
+
+ initialized = true;
+ }
+}
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
index 4e77055..8a917a9 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
@@ -72,7 +72,6 @@ import org.apache.xml.security.transforms.Transform;
import org.apache.xml.security.transforms.TransformationException;
import org.apache.xml.security.transforms.Transforms;
import org.opensaml.core.config.InitializationException;
-import org.opensaml.core.config.InitializationService;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Credential;
@@ -123,7 +122,7 @@ public final class XMLSecTool {
initLogging(cli);
try {
- InitializationService.initialize();
+ InitializationSupport.initialize();
} catch (InitializationException e) {
log.error("Unable to initialize OpenSAML library", e);
throw new Terminator(ReturnCode.RC_INIT);
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
index 8e9895d..1df7d0a 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
@@ -5,7 +5,9 @@ import java.io.InputStream;
import java.net.URISyntaxException;
import java.net.URL;
import java.security.KeyException;
+import java.security.NoSuchAlgorithmException;
import java.security.PublicKey;
+import java.security.Signature;
import java.security.cert.CertificateException;
import java.util.MissingResourceException;
@@ -14,7 +16,7 @@ import javax.annotation.Nonnull;
import org.custommonkey.xmlunit.Diff;
import org.custommonkey.xmlunit.XMLUnit;
import org.opensaml.core.config.InitializationException;
-import org.opensaml.core.config.InitializationService;
+import org.opensaml.security.SecurityProviderTestSupport;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.xmlsec.signature.support.SignatureConstants;
import org.testng.Assert;
@@ -161,7 +163,7 @@ public abstract class BaseTest {
*/
@BeforeClass
public void setUp() throws ComponentInitializationException, InitializationException {
- InitializationService.initialize();
+ InitializationSupport.initialize();
XMLUnit.setIgnoreWhitespace(true);
parserPool = new BasicParserPool();
@@ -252,6 +254,33 @@ public abstract class BaseTest {
zapSignatureValues(doc.getDocumentElement(), "zap");
}
+ /**
+ * Is it worth testing Elliptic Curve signatures?
+ *
+ * @return <code>true</code> if we can test Elliptic Curve signatures
+ */
+ protected boolean canTestECC() {
+ final Signature ecsig;
+ try {
+ // look for an ECC provider
+ ecsig = Signature.getInstance("SHA256withECDSA");
+ } catch (NoSuchAlgorithmException e) {
+ // if we don't have one at all, we can't test ECC
+ return false;
+ }
+
+ // If we're using something claiming to be SunEC on OpenJDK 7, it may actually be broken
+ // so don't bother with the tests.
+ // Note: test version last to avoid problems with OpenJDK 9 previews.
+ final SecurityProviderTestSupport sup = new SecurityProviderTestSupport();
+ if (ecsig.getProvider().getName().equals(SecurityProviderTestSupport.SUNEC_PROVIDER_NAME) &&
+ sup.isOpenJDK() && sup.getJavaVersion() <= 7) {
+ return false;
+ }
+
+ return true;
+ }
+
// *********************************
// *** ***
// *** C R E D E N T I A L S ***
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
index 59fa321..3644328 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
@@ -9,6 +9,8 @@ import org.opensaml.security.x509.X509Credential;
import org.opensaml.xmlsec.signature.KeyInfo;
import org.opensaml.xmlsec.signature.KeyValue;
import org.testng.Assert;
+import org.testng.SkipException;
+import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
@@ -22,6 +24,13 @@ public class XSTJ51Test extends BaseTest {
super(XSTJ51Test.class);
}
+ @BeforeMethod
+ protected void conditionalSkip() {
+ if (!canTestECC()) {
+ throw new SkipException("skipping because we don't have a working ECC provider");
+ }
+ }
+
@Test
public void xstj51_KeyInfo() throws Exception {
// acquire an Elliptic Curve credential to sign with
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list