[xmlsectool] branch master updated: XSTJ41 - refactor for testability
Ian Young
ian at iay.org.uk
Wed May 25 03:01:26 EDT 2016
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository xmlsectool.
The following commit(s) were added to refs/heads/master by this push:
new 3df2427 XSTJ41 - refactor for testability
3df2427 is described below
commit 3df24273663dc6f12dfe1d302644122a10f1ab37
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed May 25 08:00:41 2016 +0100
XSTJ41 - refactor for testability
---
.../net/shibboleth/tool/xmlsectool/XmlSecTool.java | 7 ++-
.../net/shibboleth/tool/xmlsectool/BaseTest.java | 51 +++++++++++++++++++++-
.../xmlsectool/{XSTJ51Test.java => XSTJ51.java} | 28 ++++--------
.../{XSTJ51Test-in.xml => XSTJ51-in.xml} | 0
.../{XSTJ51Test-cert.crt => XSTJ51-sign.crt} | 0
.../{XSTJ51Test-key.key => XSTJ51-sign.key} | 0
6 files changed, 64 insertions(+), 22 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
index af3f9da..019b94f 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
@@ -151,7 +151,8 @@ public final class XmlSecTool {
}
if (cli.doSignatureVerify()) {
- verifySignature(cli, xml);
+ final X509Credential cred = getCredential(cli);
+ verifySignature(cli, cred, xml);
}
if (cli.getOutputFile() != null) {
@@ -630,9 +631,11 @@ public final class XmlSecTool {
* Verifies that the signature on a document is valid.
*
* @param cli command line argument
+ * @param credential credential to use for validation
* @param xmlDocument document whose signature will be validated
*/
protected static void verifySignature(final CommandLineArguments cli,
+ @Nonnull final X509Credential credential,
final Document xmlDocument) {
final Element signatureElement = getSignatureElement(xmlDocument);
if (signatureElement == null) {
@@ -679,7 +682,7 @@ public final class XmlSecTool {
throw new Terminator(ReturnCode.RC_SIG);
}
- final Key verificationKey = CredentialSupport.extractVerificationKey(getCredential(cli));
+ final Key verificationKey = CredentialSupport.extractVerificationKey(credential);
log.debug("Verifying XML signature with key\n{}", Base64.encodeBase64String(verificationKey.getEncoded()));
try {
if (signature.checkSignatureValue(verificationKey)) {
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
index d5b073d..d0d0662 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
@@ -4,10 +4,16 @@ import java.io.File;
import java.io.InputStream;
import java.net.URISyntaxException;
import java.net.URL;
+import java.security.KeyException;
+import java.security.PublicKey;
+import java.security.cert.CertificateException;
import java.util.MissingResourceException;
import org.custommonkey.xmlunit.Diff;
import org.custommonkey.xmlunit.XMLUnit;
+import org.opensaml.core.config.InitializationException;
+import org.opensaml.core.config.InitializationService;
+import org.opensaml.security.x509.X509Credential;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
import org.w3c.dom.Document;
@@ -144,9 +150,11 @@ public abstract class BaseTest {
* Setup test class. Creates and initializes the parser pool.
*
* @throws ComponentInitializationException if there is a problem initializing the parser pool
+ * @throws InitializationException if OpenSAML initialization fails
*/
@BeforeClass
- public void setUp() throws ComponentInitializationException {
+ public void setUp() throws ComponentInitializationException, InitializationException {
+ InitializationService.initialize();
XMLUnit.setIgnoreWhitespace(true);
parserPool = new BasicParserPool();
@@ -203,4 +211,45 @@ public abstract class BaseTest {
org.testng.Assert.fail(diff.toString());
}
}
+
+ // *********************************
+ // *** ***
+ // *** C R E D E N T I A L S ***
+ // *** ***
+ // *********************************
+
+ /**
+ * Acquire a class-local signing credential consisting of a certificate and key.
+ *
+ * @param which name of the credential to acquire
+ * @return the credential
+ * @throws KeyException if the key cannot be acquired
+ * @throws CertificateException if the certificate cannot be acquired
+ */
+ protected X509Credential getSigningCredential(final String which) throws KeyException, CertificateException {
+ final File certFile = classRelativeFile(which + ".crt");
+ final File keyFile = classRelativeFile(which + ".key");
+ return CredentialHelper.getFileBasedCredentials(keyFile.toString(), null, certFile.toString());
+ }
+
+ /**
+ * Acquire a class-local signing credential consisting of a certificate and key.
+ *
+ * Checks that the returned credential has an appropriate public key algorithm and class.
+ *
+ * @param which name of the credential to acquire
+ * @param algorithm required public key algorithm
+ * @param clazz required public key class or interface
+ * @return the credential
+ * @throws KeyException if the key cannot be acquired
+ * @throws CertificateException if the certificate cannot be acquired
+ */
+ protected X509Credential getSigningCredential(final String which, final String algorithm, final Class<?> clazz)
+ throws KeyException, CertificateException {
+ final X509Credential cred = getSigningCredential(which);
+ final PublicKey pk = cred.getPublicKey();
+ Assert.assertEquals(pk.getAlgorithm(), algorithm);
+ Assert.assertTrue(clazz.isInstance(pk));
+ return cred;
+ }
}
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
similarity index 70%
rename from src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
rename to src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
index 623cb40..1526c54 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
@@ -1,13 +1,10 @@
package net.shibboleth.tool.xmlsectool;
-import java.io.File;
-import java.security.PublicKey;
+import java.security.interfaces.ECPublicKey;
import java.util.List;
import javax.xml.transform.dom.DOMSource;
-import org.opensaml.core.config.InitializationService;
-import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.xmlsec.signature.KeyInfo;
import org.opensaml.xmlsec.signature.KeyValue;
@@ -19,35 +16,28 @@ import org.w3c.dom.Element;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
import net.shibboleth.utilities.java.support.xml.SchemaBuilder.SchemaLanguage;
-public class XSTJ51Test extends BaseTest {
+public class XSTJ51 extends BaseTest {
- XSTJ51Test() {
- super(XSTJ51Test.class);
+ XSTJ51() {
+ super(XSTJ51.class);
}
@Test
- public void testKeyInfo() throws Exception {
+ public void xstj51_KeyInfo() throws Exception {
// acquire an Elliptic Curve credential to sign with
- final File certFile = classRelativeFile("cert.crt");
- final File keyFile = classRelativeFile("key.key");
- final X509Credential cred =
- CredentialHelper.getFileBasedCredentials(keyFile.toString(), null, certFile.toString());
- final PublicKey pk = cred.getPublicKey();
- Assert.assertEquals(pk.getAlgorithm(), "EC");
- Assert.assertTrue(pk instanceof java.security.interfaces.ECPublicKey);
+ final X509Credential cred = getSigningCredential("sign", "EC", ECPublicKey.class);
// build command-line arguments
final String[] args = {
"--sign",
"--inFile", "in.xml",
"--outFile", "out.xml",
- "--certificate", certFile.toString(),
- "--key", keyFile.toString()
+ "--certificate", "sign.crt",
+ "--key", "sign.key"
};
final CommandLineArguments cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
XmlSecTool.initLogging(cli);
- InitializationService.initialize();
// check that the credential is of the right kind
@@ -58,7 +48,7 @@ public class XSTJ51Test extends BaseTest {
XmlSecTool.sign(cli, cred, xml);
// verify the signature using our own code for consistency
- XmlSecTool.verifySignature(cli, xml);
+ XmlSecTool.verifySignature(cli, cred, xml);
// take a careful look at the signature
final Element signatureElement = XmlSecTool.getSignatureElement(xml);
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-in.xml b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-in.xml
similarity index 100%
rename from src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-in.xml
rename to src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-in.xml
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-cert.crt b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-sign.crt
similarity index 100%
rename from src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-cert.crt
rename to src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-sign.crt
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-key.key b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-sign.key
similarity index 100%
rename from src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51Test-key.key
rename to src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ51-sign.key
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list