[xmlsectool] 03/03: XSTJ-51 fix schema-invalid ECDSA signatures
Ian Young
ian at iay.org.uk
Tue May 24 13:18:36 EDT 2016
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository xmlsectool.
commit 59cade256c3ffda1de5f19a403f41e17e2fd75c5
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Tue May 24 18:18:23 2016 +0100
XSTJ-51 fix schema-invalid ECDSA signatures
---
.../net/shibboleth/tool/xmlsectool/XmlSecTool.java | 20 +++-
.../net/shibboleth/tool/xmlsectool/XSTJ51Test.java | 65 +++++++++--
.../{ecsign384.crt => XSTJ51Test-cert.crt} | 0
.../shibboleth/tool/xmlsectool/XSTJ51Test-in.xml | 119 +++++++++++++++++++++
.../shibboleth/tool/xmlsectool/XSTJ51Test-key.key | 6 ++
5 files changed, 199 insertions(+), 11 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
index f08d899..6f3f3c6 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
@@ -26,10 +26,13 @@ import java.io.OutputStream;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.KeyException;
+import java.security.PublicKey;
import java.security.cert.CRLException;
import java.security.cert.CertificateException;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
+import java.security.interfaces.DSAPublicKey;
+import java.security.interfaces.RSAPublicKey;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
@@ -379,7 +382,7 @@ public final class XmlSecTool {
signatureAlgorithm = cli.getDigest().getEcdsaAlgorithm();
} else {
/*
- * Not RSA, not EC, so probably some kind of symmetric algorithm.
+ * Not RSA, not EC, so probably some kind of symmetric algorithm or original DSA.
*
* Previously handled this way:
*
@@ -452,7 +455,20 @@ public final class XmlSecTool {
}
}
- keyInfo.add(credential.getPublicKey());
+ /*
+ * XSTJ-51: Santuario doesn't handle adding KeyValue elements correctly
+ * for anything other than the DSA and RSA cases. If you hand it anything else,
+ * it generates an empty and therefore schema-invalid KeyValue.
+ *
+ * Avoid this by only adding the public key to the KeyInfo if we know that
+ * Santuario will do the right thing.
+ */
+ final PublicKey pk = credential.getPublicKey();
+ if (pk instanceof RSAPublicKey || pk instanceof DSAPublicKey) {
+ keyInfo.add(pk);
+ } else {
+ log.debug("not adding KeyValue for unsupported credential of type " + pk.getAlgorithm());
+ }
final X509Data x509Data = new X509Data(doc);
keyInfo.add(x509Data);
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
index e941ba0..0b810d6 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
@@ -2,28 +2,75 @@ package net.shibboleth.tool.xmlsectool;
import java.io.File;
import java.security.PublicKey;
+import java.util.List;
+import javax.xml.transform.dom.DOMSource;
+
+import org.opensaml.core.config.InitializationService;
import org.opensaml.security.x509.BasicX509Credential;
+import org.opensaml.xmlsec.signature.KeyInfo;
+import org.opensaml.xmlsec.signature.KeyValue;
import org.testng.Assert;
import org.testng.annotations.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import net.shibboleth.utilities.java.support.xml.ElementSupport;
+import net.shibboleth.utilities.java.support.xml.SchemaBuilder.SchemaLanguage;
public class XSTJ51Test extends BaseTest {
XSTJ51Test() {
super(XSTJ51Test.class);
}
-
+
@Test
- public void testInstance() throws Exception {
- final File file = packageRelativeFile("ecsign384.crt");
- final BasicX509Credential cred = CredentialHelper.getFileBasedCredentials(null, null, file.getPath());
+ public void testKeyInfo() throws Exception {
+ // acquire an Elliptic Curve credential to sign with
+ final File certFile = classRelativeFile("cert.crt");
+ final File keyFile = classRelativeFile("key.key");
+
+ // build command-line arguments
+ final String[] args = {
+ "--sign",
+ "--inFile", "in.xml",
+ "--outFile", "out.xml",
+ "--certificate", certFile.toString(),
+ "--key", keyFile.toString()
+ };
+ final CommandLineArguments cli = new CommandLineArguments();
+ cli.parseCommandLineArguments(args);
+ XmlSecTool.initLogging(cli);
+ InitializationService.initialize();
+
+ // check that the credential is of the right kind
+ final BasicX509Credential cred = XmlSecTool.getCredential(cli);
final PublicKey pk = cred.getPublicKey();
Assert.assertEquals(pk.getAlgorithm(), "EC");
- if (pk instanceof java.security.interfaces.DSAPublicKey) {
- Assert.fail("should not have been a DSAPublicKey");
- } else if (pk instanceof java.security.interfaces.RSAPublicKey) {
- Assert.fail("should not have been a RSAPublicKey");
- }
Assert.assertTrue(pk instanceof java.security.interfaces.ECPublicKey);
+
+ // acquire a document to sign
+ final Document xml = readXMLDocument("in.xml");
+
+ // perform signature operation
+ XmlSecTool.sign(cli, xml);
+
+ // verify the signature using our own code for consistency
+ XmlSecTool.verifySignature(cli, xml);
+
+ // take a careful look at the signature
+ final Element signatureElement = XmlSecTool.getSignatureElement(xml);
+ final Element keyInfoElement = ElementSupport.getFirstChildElement(signatureElement,
+ KeyInfo.DEFAULT_ELEMENT_NAME);
+ final List<Element> keyInfoChildren = ElementSupport.getChildElements(keyInfoElement);
+ Assert.assertFalse(keyInfoChildren.isEmpty());
+ final List<Element> keyValues = ElementSupport.getChildElements(keyInfoElement, KeyValue.DEFAULT_ELEMENT_NAME);
+ for (final Element keyValue : keyValues) {
+ Assert.assertNotNull(ElementSupport.getFirstChildElement(keyValue), "empty KeyValue element");
+ }
+
+ // validate the resulting XML; this will also show up any error
+ final SchemaValidator validator = new SchemaValidator(SchemaLanguage.XML, getSchemaDirectory());
+ validator.validate(new DOMSource(xml));
}
}
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.crt b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-cert.crt
similarity index 100%
rename from src/test/resources/net/shibboleth/tool/xmlsectool/ecsign384.crt
rename to src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-cert.crt
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-in.xml b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-in.xml
new file mode 100644
index 0000000..cd3c3f0
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-in.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../xml/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport ../xml/sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui ../xml/sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol ../xml/sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init ../xml/sstc-request-initiation.xsd
+ urn:mace:shibboleth:metadata:1.0 ../xml/shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label ../xml/uk-fed-label.xsd
+ http://www.w3.org/2001/04/xmlenc# ../xml/xenc-schema.xsd
+ http://www.w3.org/2000/09/xmldsig# ../xml/xmldsig-core-schema.xsd"
+ ID="uk001480" entityID="https://idp.shibboleth.net/idp/shibboleth">
+ <!--
+ This is a shibboleth.net Shibboleth 2 IdP for the JISC Services Management Company Ltd.
+ -->
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <ukfedlabel:UKFederationMember/>
+ <ukfedlabel:ExportOptIn date="2011-12-07"/>
+ <ukfedlabel:Software fullVersion="2.3.8" version="2" name="Shibboleth" date="2012-12-07"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+ <mdui:DisplayName xml:lang="en">Shibboleth.net</mdui:DisplayName>
+ <mdui:Description xml:lang="en">An identity provider hosted and used by the
+ developers of Shibboleth.</mdui:Description>
+ <mdui:Logo height="82" width="64">https://shibboleth.net/images/gryphon_64x82.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDNDCCAhygAwIBAgIVAKyBWnv1/h1U11C7kHvV33FIrEsJMA0GCSqGSIb3DQEB
+ BQUAMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5ldDAeFw0xMDEyMjkwMDA5
+ MTlaFw0zMDEyMjkwMDA5MTlaMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5l
+ dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKjWAdpUx/82FUzrRMfA
+ M63PkZZYCm3RnT3eiL+DeJcbGdcEJx/o+32vgHXJgJOBt14YdVam5GErIYgk4SGq
+ 5Z5RYl0PpQn6HQG/9prGnYCu6p5zfb0557o51Eh8TcVehS6Y2ruyCjAF0jgVMwh5
+ /0Oh8EE9wG93pSpm70DAiiaTVCb8WoT1aZYtxbBmmuH10bU+wge/NMmaHuVAe599
+ pyezFIL4FoI2g+1Q6nG4Yl1Z07I81tTApXKVMWRt/4/M3m2D7PUMOQ9qsxthp2L/
+ LovIeNo0bTyeW290T2Y/JRZhKOgeDqkhuu82DPri2Vm5G/unB69KfRB7CF9QWIc3
+ y80CAwEAAaNrMGkwSAYDVR0RBEEwP4ISaWRwLnNoaWJib2xldGgubmV0hilodHRw
+ czovL2lkcC5zaGliYm9sZXRoLm5ldC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU
+ 3uZ32tKXJBzPCTp2dtHSLV0FvGgwDQYJKoZIhvcNAQEFBQADggEBAAYXYuzp0UTj
+ 3yLRvUCbEtaw9b80+weOELkVv3WFY3QAG8pIKEblrMMtzrzLFWZwYwwMZDab/HnH
+ egmgjZBthrOedEmoJ+OHRmIiS8zdZxVGEadJhTUaeIkO6kwK7Ht3nQePoiXV7TI5
+ +A9SpmZGoukC85Za4wGDw4xWGs5t5l6tBuuV+1s0oC6T8ih5n/NyThfpbihSW0d7
+ iBfSUickgpoM2BLM3FCnbO8HOsX1rGV4ypG9ZGDDvr2jrzalXXmc05gSlL2qd9ce
+ Q1M+9vavusPCqlj2zZf2/HfzhyiFcb/OgA0oTFWW2ynXji6UarIV5QaPoi/XmGmx
+ BXD36HfGBXk=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ </KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://shibboleth.net/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">JISC Services Management Company Ltd</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Shibboleth.net</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://www.shibboleth.net/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Shibboleth.Net Technical Support</GivenName>
+ <EmailAddress>mailto:contact at shibboleth.net</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed at iay.org.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ian at iay.org.uk</EmailAddress>
+ </ContactPerson>
+</EntityDescriptor>
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-key.key b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-key.key
new file mode 100644
index 0000000..cc0ae83
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-key.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDVE9MOjWl0v+kvIzdb
+ps4vjBNYekt0erO88OUOKQ8tps7iuk/fgamC8kZ214DK9AahZANiAASTk3Fh3J7m
+msMpmDPaaUq3sco3LRaSybirZ2FueE6/SgF0l/FdnKPZXm/r+YwpbQAseTpGyDiA
+5rmTqeDubfP4Aayzf7L+9z2+LCKfWuThw7qI8tOpphqodw/kSzKo14g=
+-----END PRIVATE KEY-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list