[java-metadata-aggregator] 01/03: MDA-183 - add Jetty demo keys to private key blacklists
Ian Young
ian at iay.org.uk
Mon Jul 17 11:27:22 EDT 2017
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=dd9dcbee024a0336cf4f9759a1c71057918c9904
commit dd9dcbee024a0336cf4f9759a1c71057918c9904
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Mon Jul 17 16:19:57 2017 +0100
MDA-183 - add Jetty demo keys to private key blacklists
---
aggregator-blacklists/pom.xml | 28 ++++
.../metadata/validate/x509/compromised-1024.txt | 5 +
.../metadata/validate/x509/compromised-2048.txt | 4 +
.../metadata/validate/x509/MDA183Test.java | 144 +++++++++++++++++++++
.../x509/X509RSAOpenSSLBlacklistValidatorTest.java | 50 +++++++
.../metadata/validate/x509/MDA183Test-keystore.jks | Bin 0 -> 3697 bytes
aggregator-pipeline/pom.xml | 6 -
.../x509/X509RSAOpenSSLBlacklistValidatorTest.java | 13 --
8 files changed, 231 insertions(+), 19 deletions(-)
diff --git a/aggregator-blacklists/pom.xml b/aggregator-blacklists/pom.xml
index 9afb370..82416a7 100644
--- a/aggregator-blacklists/pom.xml
+++ b/aggregator-blacklists/pom.xml
@@ -23,6 +23,34 @@
<!-- Runtime Dependencies -->
<!-- Test Dependencies -->
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>aggregator-pipeline</artifactId>
+ <version>${project.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>aggregator-pipeline</artifactId>
+ <version>${project.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.utilities</groupId>
+ <artifactId>java-support</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>commons-codec</groupId>
+ <artifactId>commons-codec</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-core</artifactId>
+ <scope>test</scope>
+ </dependency>
<!-- Managed Dependencies -->
</dependencies>
diff --git a/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-1024.txt b/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-1024.txt
index d30f19e..8e9dbc4 100644
--- a/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-1024.txt
+++ b/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-1024.txt
@@ -12,7 +12,12 @@
# In either case, you should then remove the first 20 characters; in other words,
# the blacklist line should be the lower 80 bits of the fingerprint).
#
+
# simpleSAMLphp example key, shipped up to version 1.11
4817f3e0b5df319289ad
+
# Shibboleth SP dummy key, shipped in pre-2.0.0 releases
8a69bcdc8677c7ecb37a
+
+# "mykey" demo key, shipped in jetty-distribution-9.4.6.v20170531
+a45c935fecfe041cf87b
diff --git a/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-2048.txt b/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-2048.txt
index dc152d3..3ab3e09 100644
--- a/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-2048.txt
+++ b/aggregator-blacklists/src/main/resources/net/shibboleth/metadata/validate/x509/compromised-2048.txt
@@ -11,5 +11,9 @@
# openssl x509 -noout -modulus -in /tmp/cert.pem | sha1sum | \
# cut -d ' ' -f 1 | cut -c 21-
#
+
# Shibboleth IdP dummy key, shipped in 3.0.0-alpha1 release
959a1a153444578d010b
+
+# "jetty" demo key, shipped in jetty-distribution-9.4.6.v20170531
+6475773dd6238880de70
diff --git a/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/MDA183Test.java b/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/MDA183Test.java
new file mode 100644
index 0000000..23c6a1d
--- /dev/null
+++ b/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/MDA183Test.java
@@ -0,0 +1,144 @@
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.apache.commons.codec.binary.Hex;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.metadata.BaseTest;
+import net.shibboleth.metadata.ErrorStatus;
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.MockItem;
+import net.shibboleth.metadata.pipeline.StageProcessingException;
+import net.shibboleth.metadata.validate.Validator;
+
+public class MDA183Test extends BaseTest {
+
+ /** Sequence of bytes put on the front of the string to be hashed. */
+ private final byte[] openSSLprefix = {
+ 'M', 'o', 'd', 'u', 'l', 'u', 's', '=',
+ };
+
+ /**
+ * Computes the OpenSSL digest value for the given modulus.
+ *
+ * @param modulus RSA public modulus to be digested
+ * @return value to be compared against the blacklist
+ * @throws StageProcessingException if SHA1 digester can not be acquired, or for internal
+ * errors related to {@link ByteArrayOutputStream}
+ */
+ @Nonnull
+ private String openSSLDigest(@Nonnull final BigInteger modulus) throws StageProcessingException {
+ try {
+ // Acquire a representation of the modulus
+ byte[] modulusBytes = modulus.toByteArray();
+ if (modulusBytes[0] == 0) {
+ // drop first 00 byte of modulus representation
+ modulusBytes = Arrays.copyOfRange(modulusBytes, 1, modulusBytes.length);
+ }
+
+ // Encode the modulus into upper-case hex characters
+ final char[] encodedModulus = Hex.encodeHex(modulusBytes, false);
+
+ // Now construct the thing we want to hash
+ final ByteArrayOutputStream bb = new ByteArrayOutputStream();
+ try {
+ bb.write(openSSLprefix);
+ for (final char c : encodedModulus) {
+ bb.write((byte) c);
+ }
+ bb.write('\n');
+ } catch (final IOException e) {
+ throw new StageProcessingException("internal error writing to ByteArrayStream", e);
+ }
+ //System.out.println("To be digested: " + bb.toString());
+
+ // Make the digest
+ final MessageDigest digest = MessageDigest.getInstance("SHA1");
+ digest.update(bb.toByteArray());
+ final byte[] bytes = digest.digest();
+
+ // Convert the digest to a lower-case hex string
+ final char [] encodedDigest = Hex.encodeHex(bytes, true);
+ final String strValue = String.valueOf(encodedDigest);
+ final String trimmed = strValue.substring(20);
+ //System.out.println("Digest: " + strValue + " trimmed " + trimmed);
+ return trimmed;
+ } catch (final NoSuchAlgorithmException e) {
+ throw new StageProcessingException("could not create message digester", e);
+ }
+ }
+
+ protected MDA183Test() {
+ super(MDA183Test.class);
+ }
+
+ private Validator<X509Certificate> getValidator(final int keySize) throws Exception {
+ // pick up the blacklist resource
+ final Resource blacklistResource =
+ new ClassPathResource("net/shibboleth/metadata/validate/x509/compromised-" + keySize + ".txt");
+
+ // create a validator
+ final X509RSAOpenSSLBlacklistValidator val = new X509RSAOpenSSLBlacklistValidator();
+ val.setId("validator-" + keySize);
+ val.setBlacklistResource(blacklistResource);
+ val.setKeySize(keySize);
+ val.initialize();
+
+ return val;
+ }
+
+ private void verifyKey(final KeyStore ks, final String alias,
+ final String password,
+ final Validator<X509Certificate> val,
+ int expectedKeySize) throws Exception {
+ final Key key = ks.getKey(alias, password.toCharArray());
+ Assert.assertTrue(key instanceof RSAPrivateKey);
+ final RSAPrivateKey rKey = (RSAPrivateKey)key;
+ Assert.assertEquals(rKey.getModulus().bitLength(), expectedKeySize);
+ // The following two lines can be used to extract an appropriate digest value
+ // for new keys, along with the size of the modulus.
+ //System.out.println("alias " + alias + " key size " + rKey.getModulus().bitLength());
+ //System.out.println("hash " + openSSLDigest(rKey.getModulus()));
+ final Certificate cert = ks.getCertificate(alias);
+ final Item<String> item = new MockItem("mock");
+ val.validate((X509Certificate)cert, item, alias);
+ final List<ErrorStatus> errors = item.getItemMetadata().get(ErrorStatus.class);
+ if (errors.size() == 0) {
+ Assert.fail("certificate " + alias + " was not matched");
+ }
+ }
+
+ @Test
+ public void testMDA183jetty() throws Exception {
+ final Validator<X509Certificate> validator1024 = getValidator(1024);
+ final Validator<X509Certificate> validator2048 = getValidator(2048);
+
+ // grab the keystore
+ final Resource keystoreResource = getClasspathResource("keystore.jks");
+ final KeyStore ks = KeyStore.getInstance("JKS");
+ ks.load(keystoreResource.getInputStream(), "storepwd".toCharArray());
+
+ // verify the keys
+ verifyKey(ks, "jetty", "keypwd", validator2048, 2048);
+ verifyKey(ks, "mykey", "keypwd", validator1024, 1024);
+ }
+
+}
diff --git a/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java b/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java
new file mode 100644
index 0000000..a3f840f
--- /dev/null
+++ b/aggregator-blacklists/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.cert.X509Certificate;
+
+import org.springframework.core.io.ClassPathResource;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.MockItem;
+import net.shibboleth.metadata.validate.Validator;
+
+public class X509RSAOpenSSLBlacklistValidatorTest extends BaseX509ValidatorTest {
+
+ public X509RSAOpenSSLBlacklistValidatorTest() throws Exception {
+ super(X509RSAOpenSSLBlacklistValidator.class);
+ }
+
+ @Test
+ public void classPathResource() throws Exception {
+ final X509RSAOpenSSLBlacklistValidator val = new X509RSAOpenSSLBlacklistValidator();
+ val.setBlacklistResource(new ClassPathResource("net/shibboleth/metadata/validate/x509/debian-2048.txt"));
+ val.setKeySize(2048);
+ val.initialize();
+
+ final Item<String> item = new MockItem("foo");
+ final X509Certificate cert = getCertificate("2048.pem");
+ Assert.assertEquals(val.validate(cert, item, "stage"), Validator.Action.CONTINUE);
+ errorsAndWarnings(item, 1, 0);
+ }
+
+}
diff --git a/aggregator-blacklists/src/test/resources/net/shibboleth/metadata/validate/x509/MDA183Test-keystore.jks b/aggregator-blacklists/src/test/resources/net/shibboleth/metadata/validate/x509/MDA183Test-keystore.jks
new file mode 100644
index 0000000..d6592f9
Binary files /dev/null and b/aggregator-blacklists/src/test/resources/net/shibboleth/metadata/validate/x509/MDA183Test-keystore.jks differ
diff --git a/aggregator-pipeline/pom.xml b/aggregator-pipeline/pom.xml
index fc90331..028265b 100644
--- a/aggregator-pipeline/pom.xml
+++ b/aggregator-pipeline/pom.xml
@@ -53,12 +53,6 @@
<!-- Test Dependencies -->
<dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>aggregator-blacklists</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
- <dependency>
<groupId>net.shibboleth.ext</groupId>
<artifactId>spring-extensions</artifactId>
<scope>test</scope>
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java
index e4f1059..9c71250 100644
--- a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidatorTest.java
@@ -146,17 +146,4 @@ public class X509RSAOpenSSLBlacklistValidatorTest extends BaseX509ValidatorTest
val.initialize();
}
- @Test
- public void classPathResource() throws Exception {
- final X509RSAOpenSSLBlacklistValidator val = new X509RSAOpenSSLBlacklistValidator();
- val.setBlacklistResource(new ClassPathResource("net/shibboleth/metadata/validate/x509/debian-2048.txt"));
- val.setKeySize(2048);
- val.initialize();
-
- final Item<String> item = new MockItem("foo");
- final X509Certificate cert = getCertificate("2048.pem");
- Assert.assertEquals(val.validate(cert, item, "stage"), Validator.Action.CONTINUE);
- errorsAndWarnings(item, 1, 0);
- }
-
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list