[cpp-xmltooling] branch master updated: SSPCPP-775 - Client-side session storage
Scott Cantor
cantor.2 at osu.edu
Fri Mar 16 19:58:19 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=683766aa179f29aef759e1ef194b22f0ded87d09
The following commit(s) were added to refs/heads/master by this push:
new 683766a SSPCPP-775 - Client-side session storage
683766a is described below
commit 683766aa179f29aef759e1ef194b22f0ded87d09
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 16 19:57:02 2018 -0400
SSPCPP-775 - Client-side session storage
https://issues.shibboleth.net/jira/browse/SSPCPP-775
Object ownership changes, "real" key strategy plugin.
---
Projects/vc15/xmltooling/xmltooling.vcxproj | 5 +-
.../vc15/xmltooling/xmltooling.vcxproj.filters | 15 +++-
xmltooling/security/DataSealer.h | 16 ++--
xmltooling/security/impl/DataSealer.cpp | 37 ++++++--
.../security/impl/FilesystemCredentialResolver.cpp | 99 +++-------------------
.../security/impl/StaticDataSealerKeyStrategy.cpp | 6 +-
xmltoolingtest/DataSealerTest.h | 51 +++++++++++
7 files changed, 120 insertions(+), 109 deletions(-)
diff --git a/Projects/vc15/xmltooling/xmltooling.vcxproj b/Projects/vc15/xmltooling/xmltooling.vcxproj
index f8acd48..e18801c 100644
--- a/Projects/vc15/xmltooling/xmltooling.vcxproj
+++ b/Projects/vc15/xmltooling/xmltooling.vcxproj
@@ -210,8 +210,10 @@
<ClCompile Include="..\..\..\XMLTooling\QName.cpp" />
<ClCompile Include="..\..\..\xmltooling\security\impl\DataSealer.cpp" />
<ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSecurityHelper.cpp" />
+ <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\PKIXPathValidator.cpp" />
<ClCompile Include="..\..\..\xmltooling\security\impl\StaticDataSealerKeyStrategy.cpp" />
+ <ClCompile Include="..\..\..\xmltooling\security\impl\VersionedDataSealerKeyStrategy.cpp" />
<ClCompile Include="..\..\..\XMLTooling\unicode.cpp" />
<ClCompile Include="..\..\..\XMLTooling\util\CloneInputStream.cpp" />
<ClCompile Include="..\..\..\XMLTooling\version.cpp" />
@@ -257,7 +259,6 @@
<ClCompile Include="..\..\..\XMLTooling\security\impl\FilesystemCredentialResolver.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\InlineKeyResolver.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\KeyInfoResolver.cpp" />
- <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\OpenSSLCryptoX509CRL.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\SecurityHelper.cpp" />
<ClCompile Include="..\..\..\XMLTooling\security\impl\StaticPKIXTrustEngine.cpp" />
@@ -288,6 +289,8 @@
<ClInclude Include="..\..\..\XMLTooling\PluginManager.h" />
<ClInclude Include="..\..\..\XMLTooling\QName.h" />
<ClInclude Include="..\..\..\xmltooling\security\DataSealer.h" />
+ <ClInclude Include="..\..\..\xmltooling\security\impl\ManagedResource.h" />
+ <ClInclude Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.h" />
<ClInclude Include="..\..\..\XMLTooling\security\OpenSSLPathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PathValidator.h" />
<ClInclude Include="..\..\..\XMLTooling\security\PKIXPathValidatorParams.h" />
diff --git a/Projects/vc15/xmltooling/xmltooling.vcxproj.filters b/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
index 1fecfe9..f1e1702 100644
--- a/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
+++ b/Projects/vc15/xmltooling/xmltooling.vcxproj.filters
@@ -267,9 +267,6 @@
<ClCompile Include="..\..\..\XMLTooling\util\CloneInputStream.cpp">
<Filter>Source Files\util</Filter>
</ClCompile>
- <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp">
- <Filter>Source Files</Filter>
- </ClCompile>
<ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSecurityHelper.cpp">
<Filter>Source Files\security\impl</Filter>
</ClCompile>
@@ -279,6 +276,12 @@
<ClCompile Include="..\..\..\xmltooling\security\impl\StaticDataSealerKeyStrategy.cpp">
<Filter>Source Files\security\impl</Filter>
</ClCompile>
+ <ClCompile Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.cpp">
+ <Filter>Source Files\security\impl</Filter>
+ </ClCompile>
+ <ClCompile Include="..\..\..\xmltooling\security\impl\VersionedDataSealerKeyStrategy.cpp">
+ <Filter>Source Files\security\impl</Filter>
+ </ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\..\..\XMLTooling\AbstractAttributeExtensibleXMLObject.h">
@@ -530,6 +533,12 @@
<ClInclude Include="..\..\..\xmltooling\security\DataSealer.h">
<Filter>Header Files\security</Filter>
</ClInclude>
+ <ClInclude Include="..\..\..\xmltooling\security\impl\OpenSSLSupport.h">
+ <Filter>Source Files\security\impl</Filter>
+ </ClInclude>
+ <ClInclude Include="..\..\..\xmltooling\security\impl\ManagedResource.h">
+ <Filter>Source Files\security\impl</Filter>
+ </ClInclude>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="..\..\..\XMLTooling\xmltooling.rc">
diff --git a/xmltooling/security/DataSealer.h b/xmltooling/security/DataSealer.h
index 775b566..0d074ec 100644
--- a/xmltooling/security/DataSealer.h
+++ b/xmltooling/security/DataSealer.h
@@ -27,7 +27,8 @@
#if !defined(__xmltooling_sealer_h__) && !defined(XMLTOOLING_NO_XMLSEC)
#define __xmltooling_sealer_h__
-#include <xmltooling/base.h>
+#include <xmltooling/logging.h>
+#include <xmltooling/Lockable.h>
#include <ctime>
#include <string>
@@ -36,7 +37,7 @@ class XSECCryptoSymmetricKey;
namespace xmltooling {
- class XMLTOOL_API DataSealerKeyStrategy {
+ class XMLTOOL_API DataSealerKeyStrategy : public virtual Lockable {
MAKE_NONCOPYABLE(DataSealerKeyStrategy);
public:
virtual ~DataSealerKeyStrategy();
@@ -69,7 +70,7 @@ namespace xmltooling {
/** DataSealerKeyStrategy based on a single statically-defined key. */
#define STATIC_DATA_SEALER_KEY_STRATEGY "Static"
- /** DataSealerKeyStrategy based on versioned keys in an XML file. */
+ /** DataSealerKeyStrategy based on versioned keys in a file. */
#define VERSIONED_DATA_SEALER_KEY_STRATEGY "Versioned"
/**
@@ -82,12 +83,12 @@ namespace xmltooling {
/**
* Creates a data sealer on top of a particular key strategy.
*
- * The lifetime of the DataSealerKeyStrategy <strong>MUST</strong> be longer than
- * the lifetime of the DataSealer.
+ * <p>Ownership of the DataSealerKeyStrategy is assumed by this object upon
+ * successful construction.</p>
*
* @param strategy pointer to a DataSealerKeyStrategy
*/
- DataSealer(const DataSealerKeyStrategy* strategy);
+ DataSealer(DataSealerKeyStrategy* strategy);
virtual ~DataSealer();
@@ -120,7 +121,8 @@ namespace xmltooling {
virtual std::string unwrap(const char* s) const;
private:
- const DataSealerKeyStrategy* m_strategy;
+ logging::Category& m_log;
+ std::auto_ptr<DataSealerKeyStrategy> m_strategy;
};
};
diff --git a/xmltooling/security/impl/DataSealer.cpp b/xmltooling/security/impl/DataSealer.cpp
index 74008d7..f81c496 100644
--- a/xmltooling/security/impl/DataSealer.cpp
+++ b/xmltooling/security/impl/DataSealer.cpp
@@ -26,7 +26,6 @@
*/
#include "internal.h"
-#include "logging.h"
#include "security/DataSealer.h"
#include "util/XMLHelper.h"
@@ -42,6 +41,7 @@
#include <xsec/transformers/TXFMChar.hpp>
#include <xsec/xenc/XENCEncryptionMethod.hpp>
+using namespace xmltooling::logging;
using namespace xmltooling;
using xercesc::Base64;
using xercesc::DOMDocument;
@@ -51,14 +51,14 @@ using namespace std;
namespace xmltooling {
XMLTOOL_DLLLOCAL PluginManager<DataSealerKeyStrategy, string, const xercesc::DOMElement*>::Factory StaticDataSealerKeyStrategyFactory;
- //XMLTOOL_DLLLOCAL PluginManager<DataSealerKeyStrategy, string, const xercesc::DOMElement*>::Factory XMLDataSealerKeyStrategyFactory;
+ XMLTOOL_DLLLOCAL PluginManager<DataSealerKeyStrategy, string, const xercesc::DOMElement*>::Factory VersionedDataSealerKeyStrategyFactory;
};
void XMLTOOL_API xmltooling::registerDataSealerKeyStrategies()
{
XMLToolingConfig& conf = XMLToolingConfig::getConfig();
conf.DataSealerKeyStrategyManager.registerFactory(STATIC_DATA_SEALER_KEY_STRATEGY, StaticDataSealerKeyStrategyFactory);
- //conf.DataSealerKeyStrategyManager.registerFactory(XML_DATA_SEALER_KEY_STRATEGY, XMLDataSealerKeyStrategyFactory);
+ conf.DataSealerKeyStrategyManager.registerFactory(VERSIONED_DATA_SEALER_KEY_STRATEGY, VersionedDataSealerKeyStrategyFactory);
}
DataSealerKeyStrategy::DataSealerKeyStrategy()
@@ -69,9 +69,9 @@ DataSealerKeyStrategy::~DataSealerKeyStrategy()
{
}
-DataSealer::DataSealer(const DataSealerKeyStrategy* strategy) : m_strategy(strategy)
+DataSealer::DataSealer(DataSealerKeyStrategy* strategy) : m_log(Category::getInstance(XMLTOOLING_LOGCAT".DataSealer")), m_strategy(strategy)
{
- if (!m_strategy)
+ if (!strategy)
throw XMLSecurityException("DataSealer requires DataSealerKeyStrategy");
}
@@ -81,6 +81,10 @@ DataSealer::~DataSealer()
string DataSealer::wrap(const char* s, time_t exp) const
{
+ Locker locker(m_strategy.get());
+
+ m_log.debug("wrapping data with default key");
+
// Get default key to use.
pair<string,const XSECCryptoSymmetricKey*> defaultKey = m_strategy->getDefaultKey();
@@ -116,6 +120,8 @@ string DataSealer::wrap(const char* s, time_t exp) const
char timebuf[32];
strftime(timebuf, 32, "%Y-%m-%dT%H:%M:%SZ", ptime);
+ m_log.debug("using key (%s), data will expire on %s", defaultKey.first.c_str(), timebuf);
+
// The data format of the plaintext packet is:
// PLAINTEXT := KEYLABEL + ':' + ISOEXPTIME + DATA
// The plaintext is zipped, encrypted, base64'd, and prefixed with the
@@ -125,6 +131,8 @@ string DataSealer::wrap(const char* s, time_t exp) const
string sb(defaultKey.first);
sb = sb + ':' + timebuf + s;
+ m_log.debug("deflating data");
+
// zip the plaintext packet
unsigned int len;
char* deflated = XMLHelper::deflate(const_cast<char*>(sb.c_str()), sb.length(), &len);
@@ -134,6 +142,8 @@ string DataSealer::wrap(const char* s, time_t exp) const
// Finally we encrypt the data. We have to hack this a bit to reuse the xmlsec routines.
+ m_log.debug("encrypting data");
+
DOMDocument* dummydoc = XMLToolingConfig::getConfig().getParser().newDocument();
Janitor<DOMDocument> docjan(dummydoc);
auto_ptr<XSECEnv> env(new XSECEnv(dummydoc));
@@ -156,11 +166,16 @@ string DataSealer::wrap(const char* s, time_t exp) const
defaultKey.first.append(":");
defaultKey.first.append(ciphertext.rawCharBuffer(), ciphertext.sbRawBufferSize());
+
+ m_log.debug("final data size: %lu", defaultKey.first.length());
+
return defaultKey.first;
}
string DataSealer::unwrap(const char* s) const
{
+ Locker locker(m_strategy.get());
+
// The data format of the plaintext packet is:
// PLAINTEXT := KEYLABEL + ':' + ISOEXPTIME + DATA
// The plaintext is zipped, encrypted, base64'd, and prefixed with the
@@ -176,6 +191,8 @@ string DataSealer::unwrap(const char* s) const
if (!requiredKey.second)
throw IOException("Required decryption key not available.");
+ m_log.debug("decrypting data with key (%s)", requiredKey.first.c_str());
+
const XMLCh* algorithm = nullptr;
switch (requiredKey.second->getSymmetricKeyType()) {
case XSECCryptoSymmetricKey::SymmetricKeyType::KEY_AES_128:
@@ -224,7 +241,10 @@ string DataSealer::unwrap(const char* s) const
throw XMLSecurityException("No decrypted data available.");
// Now we have to inflate it.
- stringstream out;
+
+ m_log.debug("inflating data");
+
+ stringstream out;
if (XMLHelper::inflate(const_cast<char*>(plaintext.rawCharBuffer()), len, out) == 0) {
throw IOException("Unable to inflate wrapped data.");
}
@@ -236,14 +256,17 @@ string DataSealer::unwrap(const char* s) const
if (i == string::npos)
throw IOException("Unable to verify key used to decrypt data.");
string keyLabel = decrypted.substr(0, i);
- if (keyLabel != requiredKey.first)
+ if (keyLabel != requiredKey.first) {
+ m_log.warn("key mismatch, outside (%s), inside (%s)", requiredKey.first, keyLabel);
throw IOException("Embedded key label does not match key used to decrypt data.");
+ }
string dstr = decrypted.substr(++i, 20);
auto_ptr_XMLCh expstr(dstr.c_str());
XMLDateTime exp(expstr.get());
exp.parseDateTime();
if (exp.getEpoch() < time(nullptr) - XMLToolingConfig::getConfig().clock_skew_secs) {
+ m_log.debug("decrypted data expired at %s", dstr.c_str());
throw IOException("Decrypted data has expired.");
}
diff --git a/xmltooling/security/impl/FilesystemCredentialResolver.cpp b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
index f9a337d..38c451c 100644
--- a/xmltooling/security/impl/FilesystemCredentialResolver.cpp
+++ b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
@@ -25,7 +25,6 @@
*/
#include "internal.h"
-#include "logging.h"
#include "io/HTTPResponse.h"
#include "security/BasicX509Credential.h"
#include "security/CredentialCriteria.h"
@@ -34,10 +33,10 @@
#include "security/OpenSSLCredential.h"
#include "security/SecurityHelper.h"
#include "security/XSECCryptoX509CRL.h"
+#include "security/impl/ManagedResource.h"
#include "security/impl/OpenSSLSupport.h"
#include "util/NDC.h"
#include "util/PathResolver.h"
-#include "util/Threads.h"
#include "util/XMLHelper.h"
#include <memory>
@@ -59,89 +58,6 @@ using xercesc::chDigit_0;
namespace xmltooling {
- // The ManagedResource classes handle memory management, loading of the files
- // and staleness detection. A copy of the active objects is always stored in
- // these instances.
-
- class XMLTOOL_DLLLOCAL ManagedResource {
- protected:
- ManagedResource() : local(true), reloadChanges(true), filestamp(0), reloadInterval(0) {}
- ~ManagedResource() {}
-
- SOAPTransport* getTransport() {
- SOAPTransport::Address addr("FilesystemCredentialResolver", source.c_str(), source.c_str());
- string scheme(addr.m_endpoint, strchr(addr.m_endpoint,':') - addr.m_endpoint);
- SOAPTransport* ret = XMLToolingConfig::getConfig().SOAPTransportManager.newPlugin(scheme.c_str(), addr);
- if (ret)
- ret->setCacheTag(&cacheTag);
- return ret;
- }
-
- public:
- bool stale(Category& log, RWLock* lock=nullptr) {
- if (local) {
-#ifdef WIN32
- struct _stat stat_buf;
- if (_stat(source.c_str(), &stat_buf) != 0)
- return false;
-#else
- struct stat stat_buf;
- if (stat(source.c_str(), &stat_buf) != 0)
- return false;
-#endif
- if (filestamp >= stat_buf.st_mtime)
- return false;
-
- // If necessary, elevate lock and recheck.
- if (lock) {
- log.debug("timestamp of local resource changed, elevating to a write lock");
- lock->unlock();
- lock->wrlock();
- if (filestamp >= stat_buf.st_mtime) {
- // Somebody else handled it, just downgrade.
- log.debug("update of local resource handled by another thread, downgrading lock");
- lock->unlock();
- lock->rdlock();
- return false;
- }
- }
-
- // Update the timestamp regardless. No point in repeatedly trying.
- filestamp = stat_buf.st_mtime;
- log.info("change detected, reloading local resource...");
- }
- else {
- time_t now = time(nullptr);
-
- // Time to reload?
- if (now - filestamp < reloadInterval)
- return false;
-
- // If necessary, elevate lock and recheck.
- if (lock) {
- log.debug("reload interval for remote resource elapsed, elevating to a write lock");
- lock->unlock();
- lock->wrlock();
- if (now - filestamp < reloadInterval) {
- // Somebody else handled it, just downgrade.
- log.debug("update of remote resource handled by another thread, downgrading lock");
- lock->unlock();
- lock->rdlock();
- return false;
- }
- }
-
- filestamp = now;
- log.info("reloading remote resource...");
- }
- return true;
- }
-
- bool local,reloadChanges;
- string format,source,backing,cacheTag;
- time_t filestamp,reloadInterval;
- };
-
class XMLTOOL_DLLLOCAL ManagedKey : public ManagedResource {
public:
ManagedKey() : key(nullptr) {}
@@ -164,6 +80,7 @@ namespace xmltooling {
format = SecurityHelper::guessEncodingFormat(local ? source.c_str() : backing.c_str());
}
+ string format;
XSECCryptoKey* key;
};
@@ -188,6 +105,8 @@ namespace xmltooling {
if (format.empty())
format = SecurityHelper::guessEncodingFormat(local ? source.c_str() : backing.c_str());
}
+
+ string format;
vector<XSECCryptoX509*> certs;
};
@@ -212,6 +131,8 @@ namespace xmltooling {
if (format.empty())
format = SecurityHelper::guessEncodingFormat(local ? source.c_str() : backing.c_str());
}
+
+ string format;
vector<XSECCryptoX509CRL*> crls;
};
@@ -421,7 +342,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
while (e) {
if (e->hasChildNodes()) {
m_crls.push_back(ManagedCRL());
- ManagedResource& crl = m_crls.back();
+ ManagedCRL& crl = m_crls.back();
crl.format = crlformat;
prop = e->getFirstChild()->getNodeValue();
auto_ptr_char crlpath(prop);
@@ -437,7 +358,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
while (e) {
if (e->hasChildNodes()) {
m_crls.push_back(ManagedCRL());
- ManagedResource& crl = m_crls.back();
+ ManagedCRL& crl = m_crls.back();
crl.format = crlformat;
prop = e->getFirstChild()->getNodeValue();
auto_ptr_char crlpath(prop);
@@ -468,7 +389,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
while (e) {
if (e->hasChildNodes() && (XMLString::equals(e->getLocalName(), Path) || XMLString::equals(e->getLocalName(), CAPath))) {
m_certs.push_back(ManagedCert());
- ManagedResource& cert = m_certs.back();
+ ManagedCert& cert = m_certs.back();
cert.format = certformat;
prop = e->getFirstChild()->getNodeValue();
auto_ptr_char certpath(prop);
@@ -479,7 +400,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
}
else if (e->hasChildNodes() && XMLString::equals(e->getLocalName(), _URL)) {
m_certs.push_back(ManagedCert());
- ManagedResource& cert = m_certs.back();
+ ManagedCert& cert = m_certs.back();
cert.format = certformat;
prop = e->getFirstChild()->getNodeValue();
auto_ptr_char certpath(prop);
diff --git a/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp b/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp
index fc64a96..d9421ca 100644
--- a/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp
+++ b/xmltooling/security/impl/StaticDataSealerKeyStrategy.cpp
@@ -26,7 +26,6 @@
*/
#include "internal.h"
-#include "logging.h"
#include "security/DataSealer.h"
#include "util/XMLHelper.h"
@@ -39,11 +38,14 @@ using namespace std;
namespace xmltooling {
- class StaticDataSealerKeyStrategy : public DataSealerKeyStrategy {
+ class XMLTOOL_DLLLOCAL StaticDataSealerKeyStrategy : public DataSealerKeyStrategy {
public:
StaticDataSealerKeyStrategy(const DOMElement* e);
virtual ~StaticDataSealerKeyStrategy();
+ Lockable* lock() { return this; }
+ void unlock() {}
+
pair<string,const XSECCryptoSymmetricKey*> getDefaultKey() const;
const XSECCryptoSymmetricKey* getKey(const char* name) const;
diff --git a/xmltoolingtest/DataSealerTest.h b/xmltoolingtest/DataSealerTest.h
index 1ee35b0..90e6dc1 100644
--- a/xmltoolingtest/DataSealerTest.h
+++ b/xmltoolingtest/DataSealerTest.h
@@ -23,6 +23,7 @@
#include <xmltooling/exceptions.h>
#include <xmltooling/security/DataSealer.h>
+#include <fstream>
#include <xercesc/util/Base64.hpp>
#include <xsec/utils/XSECPlatformUtils.hpp>
@@ -53,11 +54,14 @@ public:
)
);
+ keyStrategy->lock();
pair<string,const XSECCryptoSymmetricKey*> key = keyStrategy->getDefaultKey();
TS_ASSERT_EQUALS("static", key.first);
TSM_ASSERT_EQUALS("Wrong key type", key.second->getSymmetricKeyType(), XSECCryptoSymmetricKey::KEY_AES_256);
+ keyStrategy->unlock();
auto_ptr<DataSealer> sealer(new DataSealer(keyStrategy.get()));
+ keyStrategy.release();
string data = "this is a test";
@@ -73,4 +77,51 @@ public:
wrapped.insert(0, "invalid");
TSM_ASSERT_THROWS("DataSealer did not throw on wrong key label.", sealer->unwrap(wrapped.c_str()), IOException);
}
+
+ void testVersionedDataSealer() {
+
+ DOMDocument* doc = XMLToolingConfig::getConfig().getParser().newDocument();
+ Janitor<DOMDocument> jdoc(doc);
+
+ static const XMLCh _path[] = UNICODE_LITERAL_4(p, a, t, h);
+ DOMElement* root = doc->createElementNS(nullptr, _path);
+ auto_ptr_XMLCh widepath("../xmltoolingtest/data/sealer.keys");
+ root->setAttributeNS(nullptr, _path, widepath.get());
+ doc->appendChild(root);
+
+ auto_ptr<DataSealerKeyStrategy> keyStrategy(
+ XMLToolingConfig::getConfig().DataSealerKeyStrategyManager.newPlugin(
+ VERSIONED_DATA_SEALER_KEY_STRATEGY, doc->getDocumentElement()
+ )
+ );
+
+ keyStrategy->lock();
+
+ pair<string, const XSECCryptoSymmetricKey*> key = keyStrategy->getDefaultKey();
+ TS_ASSERT_EQUALS("4", key.first);
+ TSM_ASSERT_EQUALS("Wrong key type", key.second->getSymmetricKeyType(), XSECCryptoSymmetricKey::KEY_AES_128);
+
+ key.second = keyStrategy->getKey("1");
+ TS_ASSERT(key.second != nullptr);
+ TSM_ASSERT_EQUALS("Wrong key type", key.second->getSymmetricKeyType(), XSECCryptoSymmetricKey::KEY_AES_128);
+
+ keyStrategy->unlock();
+
+ auto_ptr<DataSealer> sealer(new DataSealer(keyStrategy.get()));
+ keyStrategy.release();
+
+ string data = "this is a test";
+
+ string wrapped = sealer->wrap(data.c_str(), time(nullptr) + 500);
+ string unwrapped = sealer->unwrap(wrapped.c_str());
+
+ TSM_ASSERT_EQUALS("DataSealer output did not match.", data, unwrapped);
+
+ wrapped = sealer->wrap(data.c_str(), time(nullptr) - 500);
+ TSM_ASSERT_THROWS("DataSealer did not throw on expired data.", sealer->unwrap(wrapped.c_str()), IOException);
+
+ wrapped = sealer->wrap(data.c_str(), time(nullptr) - 500);
+ wrapped.insert(0, "invalid");
+ TSM_ASSERT_THROWS("DataSealer did not throw on wrong key label.", sealer->unwrap(wrapped.c_str()), IOException);
+ }
};
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list