[cpp-xmltooling] branch master updated: Refactoring of DataSealer code and a static key source.
Scott Cantor
cantor.2 at osu.edu
Tue Feb 27 11:47:33 EST 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=209ae0f72fa1dae87af3891ef85052c334d2dfff
The following commit(s) were added to refs/heads/master by this push:
new 209ae0f Refactoring of DataSealer code and a static key source.
209ae0f is described below
commit 209ae0f72fa1dae87af3891ef85052c334d2dfff
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 27 11:47:22 2018 -0500
Refactoring of DataSealer code and a static key source.
---
Projects/vc15/xmltooling/xmltooling.vcxproj | 5 +-
.../vc15/xmltooling/xmltooling.vcxproj.filters | 11 ++-
xmltooling/Makefile.am | 4 +-
xmltooling/XMLToolingConfig.cpp | 8 +-
xmltooling/XMLToolingConfig.h | 6 ++
xmltooling/{util => security}/DataSealer.h | 51 +++++++++-
xmltooling/{util => security/impl}/DataSealer.cpp | 26 ++++-
.../security/impl/StaticDataSealerKeyStrategy.cpp | 107 +++++++++++++++++++++
xmltoolingtest/DataSealerTest.h | 41 ++++++--
9 files changed, 238 insertions(+), 21 deletions(-)
diff --git a/Projects/vc15/xmltooling/xmltooling.vcxproj b/Projects/vc15/xmltooling/xmltooling.vcxproj
index 612963f..f8acd48 100644
--- a/Projects/vc15/xmltooling/xmltooling.vcxproj
+++ b/Projects/vc15/xmltooling/xmltooling.vcxproj
@@ -208,11 +208,12 @@
<ClCompile Include="..\..\..\XMLTooling\Lockable.cpp" />
<ClCompile Include="..\..\..\XMLTooling\Namespace.cpp" />
<ClCompile Include="..\..\..\XMLTooling\QName.cpp" />
+ <ClCompile Include="..\..\..\xmltooling\security\impl\DataSealer.cpp" />
<ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSecurityHelper.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\PKIXPathValidator.cpp" />
+ <ClCompile Include="..\..\..\xmltooling\security\impl\StaticDataSealerKeyStrategy.cpp" />
<ClCompile Include="..\..\..\XMLTooling\unicode.cpp" />
<ClCompile Include="..\..\..\XMLTooling\util\CloneInputStream.cpp" />
- <ClCompile Include="..\..\..\xmltooling\util\DataSealer.cpp" />
<ClCompile Include="..\..\..\XMLTooling\version.cpp" />
<ClCompile Include="..\..\..\XMLTooling\XMLObjectBuilder.cpp" />
<ClCompile Include="..\..\..\XMLTooling\XMLToolingConfig.cpp" />
@@ -286,12 +287,12 @@
<ClInclude Include="..\..\..\XMLTooling\Namespace.h" />
<ClInclude Include="..\..\..\XMLTooling\PluginManager.h" />
<ClInclude Include="..\..\..\XMLTooling\QName.h" />
+ <ClInclude Include="..\..\..\xmltooling\security\DataSealer.h" />
<ClInclude Include="..\..\..\XMLTooling\security\OpenSSLPathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PKIXPathValidatorParams.h" />
<ClInclude Include="..\..\..\XMLTooling\unicode.h" />
<ClInclude Include="..\..\..\XMLTooling\util\CloneInputStream.h" />
- <ClInclude Include="..\..\..\xmltooling\util\DataSealer.h" />
<ClInclude Include="..\..\..\XMLTooling\version.h" />
<ClInclude Include="..\..\..\XMLTooling\XMLObject.h" />
<ClInclude Include="..\..\..\XMLTooling\XMLObjectBuilder.h" />
diff --git a/Projects/vc15/xmltooling/xmltooling.vcxproj.filters b/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
index 6a8112f..1fecfe9 100644
--- a/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
+++ b/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
@@ -273,8 +273,11 @@
<ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSecurityHelper.cpp">
<Filter>Source Files\security\impl</Filter>
</ClCompile>
- <ClCompile Include="..\..\..\xmltooling\util\DataSealer.cpp">
- <Filter>Source Files\util</Filter>
+ <ClCompile Include="..\..\..\xmltooling\security\impl\DataSealer.cpp">
+ <Filter>Source Files\security\impl</Filter>
+ </ClCompile>
+ <ClCompile Include="..\..\..\xmltooling\security\impl\StaticDataSealerKeyStrategy.cpp">
+ <Filter>Source Files\security\impl</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
@@ -524,8 +527,8 @@
<ClInclude Include="..\..\..\XMLTooling\util\CloneInputStream.h">
<Filter>Header Files\util</Filter>
</ClInclude>
- <ClInclude Include="..\..\..\xmltooling\util\DataSealer.h">
- <Filter>Header Files\util</Filter>
+ <ClInclude Include="..\..\..\xmltooling\security\DataSealer.h">
+ <Filter>Header Files\security</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
diff --git a/xmltooling/Makefile.am b/xmltooling/Makefile.am
index d0a9fda..fc5facd 100644
--- a/xmltooling/Makefile.am
+++ b/xmltooling/Makefile.am
@@ -77,6 +77,7 @@ secinclude_HEADERS = \
security/CredentialContext.h \
security/CredentialCriteria.h \
security/CredentialResolver.h \
+ security/DataSealer.h \
security/KeyInfoCredentialContext.h \
security/KeyInfoResolver.h \
security/OpenSSLCredential.h \
@@ -108,7 +109,6 @@ soapinclude_HEADERS = \
utilinclude_HEADERS = \
util/CloneInputStream.h \
util/CurlURLInputStream.h \
- util/DataSealer.h \
util/NDC.h \
util/ParserPool.h \
util/PathResolver.h \
@@ -143,6 +143,7 @@ xmlsec_sources = \
security/impl/ChainingTrustEngine.cpp \
security/impl/CredentialCriteria.cpp \
security/impl/CredentialResolver.cpp \
+ security/impl/DataSealer.cpp \
security/impl/DummyCredentialResolver.cpp \
security/impl/ExplicitKeyTrustEngine.cpp \
security/impl/FilesystemCredentialResolver.cpp \
@@ -153,6 +154,7 @@ xmlsec_sources = \
security/impl/OpenSSLSecurityHelper.cpp \
security/impl/PKIXPathValidator.cpp \
security/impl/SecurityHelper.cpp \
+ security/impl/StaticDataSealerKeyStrategy.cpp \
security/impl/StaticPKIXTrustEngine.cpp \
security/impl/TrustEngine.cpp \
security/impl/XSECCryptoX509CRL.cpp \
diff --git a/xmltooling/XMLToolingConfig.cpp b/xmltooling/XMLToolingConfig.cpp
index a224bc4..1c3afb9 100644
--- a/xmltooling/XMLToolingConfig.cpp
+++ b/xmltooling/XMLToolingConfig.cpp
@@ -32,16 +32,16 @@
#include "encryption/Encrypter.h"
#include "impl/UnknownElement.h"
#include "io/HTTPResponse.h"
-#include "security/TrustEngine.h"
-#include "security/OpenSSLCryptoX509CRL.h"
#include "security/CredentialResolver.h"
+#include "security/DataSealer.h"
#include "security/KeyInfoResolver.h"
+#include "security/OpenSSLCryptoX509CRL.h"
#include "security/PathValidator.h"
+#include "security/TrustEngine.h"
#include "signature/KeyInfo.h"
#include "signature/Signature.h"
#include "soap/SOAP.h"
#include "soap/SOAPTransport.h"
-#include "util/DataSealer.h"
#include "util/NDC.h"
#include "util/PathResolver.h"
#include "util/ReplayCache.h"
@@ -439,6 +439,7 @@ bool XMLToolingInternalConfig::init()
REGISTER_XMLTOOLING_EXCEPTION_FACTORY(XMLSecurityException,xmltooling);
REGISTER_XMLTOOLING_EXCEPTION_FACTORY(SignatureException,xmlsignature);
REGISTER_XMLTOOLING_EXCEPTION_FACTORY(EncryptionException,xmlencryption);
+ registerDataSealerKeyStrategies();
registerKeyInfoClasses();
registerEncryptionClasses();
registerCredentialResolvers();
@@ -521,6 +522,7 @@ void XMLToolingInternalConfig::term()
TrustEngineManager.deregisterFactories();
CredentialResolverManager.deregisterFactories();
KeyInfoResolverManager.deregisterFactories();
+ DataSealerKeyStrategyManager.deregisterFactories();
m_algorithmMap.clear();
m_keyInfoResolver.reset();
diff --git a/xmltooling/XMLToolingConfig.h b/xmltooling/XMLToolingConfig.h
index b5b52e9..21fa4ef 100644
--- a/xmltooling/XMLToolingConfig.h
+++ b/xmltooling/XMLToolingConfig.h
@@ -54,6 +54,7 @@ namespace xmltooling {
#ifndef XMLTOOLING_NO_XMLSEC
class XMLTOOL_API CredentialResolver;
class XMLTOOL_API DataSealer;
+ class XMLTOOL_API DataSealerKeyStrategy;
class XMLTOOL_API KeyInfoResolver;
class XMLTOOL_API PathValidator;
class XMLTOOL_API TrustEngine;
@@ -321,6 +322,11 @@ namespace xmltooling {
PluginManager<TrustEngine,std::string,const xercesc::DOMElement*> TrustEngineManager;
/**
+ * Manages factories for DataSealerKeyStrategy plugins.
+ */
+ PluginManager<DataSealerKeyStrategy, std::string, const xercesc::DOMElement*> DataSealerKeyStrategyManager;
+
+ /**
* Maps an XML Signature/Encryption algorithm identifier to a library-specific
* key algorithm and size for use in resolving credentials.
*
diff --git a/xmltooling/util/DataSealer.h b/xmltooling/security/DataSealer.h
similarity index 60%
rename from xmltooling/util/DataSealer.h
rename to xmltooling/security/DataSealer.h
index 14be846..47eccf7 100644
--- a/xmltooling/util/DataSealer.h
+++ b/xmltooling/security/DataSealer.h
@@ -32,15 +32,62 @@
#include <ctime>
#include <string>
+#include <xsec/enc/XSECCryptoSymmetricKey.hpp>
+
namespace xmltooling {
+ class XMLTOOL_API DataSealerKeyStrategy {
+ MAKE_NONCOPYABLE(DataSealerKeyStrategy);
+ public:
+ virtual ~DataSealerKeyStrategy();
+
+ /**
+ * Get the default/current key to use for new operations, returned along with an identifier for it.
+ *
+ * @return the key and its label
+ */
+ virtual std::pair<std::string, const XSECCryptoSymmetricKey*> getDefaultKey() const=0;
+
+ /**
+ * Get a specifically named key.
+ *
+ * @param name name of the key to retrieve
+ *
+ * @return the key
+ */
+ virtual const XSECCryptoSymmetricKey* getKey(const char* name) const=0;
+
+ protected:
+ DataSealerKeyStrategy();
+ };
+
+ /**
+ * Registers DataSealerKeyStrategy classes into the runtime.
+ */
+ void XMLTOOL_API registerDataSealerKeyStrategies();
+
+ /** DataSealerKeyStrategy based on a single statically-defined key. */
+ #define STATIC_DATA_SEALER_KEY_STRATEGY "Static"
+
+ /** DataSealerKeyStrategy based on versioned keys in an XML file. */
+ #define VERSIONED_DATA_SEALER_KEY_STRATEGY "Versioned"
+
/**
* Interface to a data integrity and confidentiality tool, and a default implementation.
*/
class XMLTOOL_API DataSealer {
MAKE_NONCOPYABLE(DataSealer);
public:
- DataSealer();
+
+ /**
+ * Creates a data sealer on top of a particular key strategy.
+ *
+ * The lifetime of the DataSealerKeyStrategy <strong>MUST</strong> be longer than
+ * the lifetime of the DataSealer.
+ *
+ * @param strategy pointer to a DataSealerKeyStrategy
+ */
+ DataSealer(const DataSealerKeyStrategy* strategy);
virtual ~DataSealer();
@@ -72,6 +119,8 @@ namespace xmltooling {
*/
virtual std::string unwrap(const char* s) const;
+ private:
+ const DataSealerKeyStrategy* m_strategy;
};
};
diff --git a/xmltooling/util/DataSealer.cpp b/xmltooling/security/impl/DataSealer.cpp
similarity index 75%
rename from xmltooling/util/DataSealer.cpp
rename to xmltooling/security/impl/DataSealer.cpp
index 9e11751..16ed0c1 100644
--- a/xmltooling/util/DataSealer.cpp
+++ b/xmltooling/security/impl/DataSealer.cpp
@@ -27,7 +27,7 @@
#include "internal.h"
#include "logging.h"
-#include "util/DataSealer.h"
+#include "security/DataSealer.h"
#include "util/XMLHelper.h"
#include <sstream>
@@ -39,8 +39,30 @@ using xercesc::Base64;
using xercesc::XMLDateTime;
using namespace std;
-DataSealer::DataSealer()
+namespace xmltooling {
+ XMLTOOL_DLLLOCAL PluginManager<DataSealerKeyStrategy, string, const xercesc::DOMElement*>::Factory StaticDataSealerKeyStrategyFactory;
+ //XMLTOOL_DLLLOCAL PluginManager<DataSealerKeyStrategy, string, const xercesc::DOMElement*>::Factory XMLDataSealerKeyStrategyFactory;
+};
+
+void XMLTOOL_API xmltooling::registerDataSealerKeyStrategies()
+{
+ XMLToolingConfig& conf = XMLToolingConfig::getConfig();
+ conf.DataSealerKeyStrategyManager.registerFactory(STATIC_DATA_SEALER_KEY_STRATEGY, StaticDataSealerKeyStrategyFactory);
+ //conf.DataSealerKeyStrategyManager.registerFactory(XML_DATA_SEALER_KEY_STRATEGY, XMLDataSealerKeyStrategyFactory);
+}
+
+DataSealerKeyStrategy::DataSealerKeyStrategy()
+{
+}
+
+DataSealerKeyStrategy::~DataSealerKeyStrategy()
+{
+}
+
+DataSealer::DataSealer(const DataSealerKeyStrategy* strategy) : m_strategy(strategy)
{
+ if (!m_strategy)
+ throw XMLSecurityException("DataSealer requires DataSealerKeyStrategy");
}
DataSealer::~DataSealer()
diff --git a/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp b/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp
new file mode 100644
index 0000000..fc64a96
--- /dev/null
+++ b/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp
@@ -0,0 +1,107 @@
+/**
+ * Licensed to the University Corporation for Advanced Internet
+ * Development, Inc. (UCAID) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for
+ * additional information regarding copyright ownership.
+ *
+ * UCAID licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the
+ * License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+/**
+ * URLEncoder.cpp
+ *
+ * Interface to a URL-encoding mechanism along with a
+ * default implementation.
+ */
+
+#include "internal.h"
+#include "logging.h"
+#include "security/DataSealer.h"
+#include "util/XMLHelper.h"
+
+#include <xercesc/util/Base64.hpp>
+
+using namespace xmltooling;
+using xercesc::Base64;
+using xercesc::DOMElement;
+using namespace std;
+
+namespace xmltooling {
+
+ class StaticDataSealerKeyStrategy : public DataSealerKeyStrategy {
+ public:
+ StaticDataSealerKeyStrategy(const DOMElement* e);
+ virtual ~StaticDataSealerKeyStrategy();
+
+ pair<string,const XSECCryptoSymmetricKey*> getDefaultKey() const;
+ const XSECCryptoSymmetricKey* getKey(const char* name) const;
+
+ private:
+ string m_name;
+ auto_ptr<XSECCryptoSymmetricKey> m_key;
+ };
+
+ DataSealerKeyStrategy* XMLTOOL_DLLLOCAL StaticDataSealerKeyStrategyFactory(const DOMElement* const & e)
+ {
+ return new StaticDataSealerKeyStrategy(e);
+ }
+};
+
+static const XMLCh key[] = UNICODE_LITERAL_3(k, e, y);
+static const XMLCh name[] = UNICODE_LITERAL_4(n, a, m, e);
+
+StaticDataSealerKeyStrategy::StaticDataSealerKeyStrategy(const DOMElement* e)
+ : m_name(XMLHelper::getAttrString(e, "static", name))
+{
+ const XMLCh* encoded = e ? e->getAttributeNS(nullptr, key) : nullptr;
+ if (encoded && *encoded) {
+ XMLSize_t x;
+ XMLByte* decoded = Base64::decodeToXMLByte(encoded, &x);
+ if (!decoded)
+ throw XMLSecurityException("Unable to decode base64-encoded key.");
+ if (x >= 32) {
+ m_key.reset(XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_256));
+ }
+ else if (x >= 24) {
+ m_key.reset(XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_192));
+ }
+ else if (x >= 16) {
+ m_key.reset(XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_128));
+ }
+ else {
+ XMLString::release((char**)&decoded);
+ throw XMLSecurityException("Insufficient data to create 128-bit AES key.");
+ }
+ m_key->setKey(decoded, x);
+ XMLString::release((char**)&decoded);
+ }
+
+ if (!m_key.get()) {
+ throw XMLSecurityException("No key attribute specified.");
+ }
+}
+
+StaticDataSealerKeyStrategy::~StaticDataSealerKeyStrategy()
+{
+}
+
+pair<string,const XSECCryptoSymmetricKey*> StaticDataSealerKeyStrategy::getDefaultKey() const
+{
+ return pair<string,const XSECCryptoSymmetricKey*>(m_name, m_key.get());
+}
+
+const XSECCryptoSymmetricKey * StaticDataSealerKeyStrategy::getKey(const char* name) const
+{
+ return name && m_name == name ? m_key.get() : nullptr;
+}
diff --git a/xmltoolingtest/DataSealerTest.h b/xmltoolingtest/DataSealerTest.h
index 47082e9..1672698 100644
--- a/xmltoolingtest/DataSealerTest.h
+++ b/xmltoolingtest/DataSealerTest.h
@@ -21,18 +21,43 @@
#include "XMLObjectBaseTestCase.h"
#include <xmltooling/exceptions.h>
-#include <xmltooling/util/DataSealer.h>
+#include <xmltooling/security/DataSealer.h>
+
+#include <xercesc/util/Base64.hpp>
+#include <xsec/utils/XSECPlatformUtils.hpp>
class DataSealerTest : public CxxTest::TestSuite {
public:
- void setUp() {
- }
-
- void tearDown() {
- }
+ void testStaticDataSealer() {
+
+ unsigned char keybuf[32];
+ TS_ASSERT_EQUALS(sizeof(keybuf), XSECPlatformUtils::g_cryptoProvider->getRandom(keybuf, sizeof(keybuf)));
+
+ XMLSize_t x;
+ XMLByte* encoded = Base64::encode(keybuf, sizeof(keybuf), &x);
+ TS_ASSERT_LESS_THAN(0, x);
+ auto_ptr_XMLCh widekey((char*)encoded);
+ XMLString::release((char**)&encoded);
+
+ DOMDocument* doc = XMLToolingConfig::getConfig().getParser().newDocument();
+ Janitor<DOMDocument> jdoc(doc);
+
+ static const XMLCh _key[] = UNICODE_LITERAL_3(k,e,y);
+ DOMElement* root = doc->createElementNS(nullptr, _key);
+ root->setAttributeNS(nullptr, _key, widekey.get());
+ doc->appendChild(root);
+
+ auto_ptr<DataSealerKeyStrategy> keyStrategy(
+ XMLToolingConfig::getConfig().DataSealerKeyStrategyManager.newPlugin(
+ STATIC_DATA_SEALER_KEY_STRATEGY, doc->getDocumentElement()
+ )
+ );
+
+ pair<string,const XSECCryptoSymmetricKey*> key = keyStrategy->getDefaultKey();
+ TS_ASSERT_EQUALS("static", key.first);
+ TSM_ASSERT_EQUALS("Wrong key type", key.second->getSymmetricKeyType(), XSECCryptoSymmetricKey::KEY_AES_256);
- void testDataSealer() {
- auto_ptr<DataSealer> sealer(new DataSealer());
+ auto_ptr<DataSealer> sealer(new DataSealer(keyStrategy.get()));
string data = "this is a test";
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list