[cpp-xmltooling] branch master updated: SSPCPP-805 - Change default signing algorithms to SHA-256
Scott Cantor
cantor.2 at osu.edu
Thu May 24 17:58:21 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=a46cbe684385a597c63266354c7fb5d95ef537d8
The following commit(s) were added to refs/heads/master by this push:
new a46cbe6 SSPCPP-805 - Change default signing algorithms to SHA-256
a46cbe6 is described below
commit a46cbe684385a597c63266354c7fb5d95ef537d8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 24 17:57:24 2018 -0400
SSPCPP-805 - Change default signing algorithms to SHA-256
https://issues.shibboleth.net/jira/browse/SSPCPP-805
Change XMLSignature default.
Revise SHA-2 detection logic to leverage underlying lib.
---
configure.ac | 4 ----
xmltooling/XMLToolingConfig.cpp | 25 ++++++++---------------
xmltooling/signature/impl/XMLSecSignatureImpl.cpp | 7 ++++++-
xmltoolingtest/SignatureTest.h | 4 ++--
4 files changed, 17 insertions(+), 23 deletions(-)
diff --git a/configure.ac b/configure.ac
index acd86d3..73ed083 100644
--- a/configure.ac
+++ b/configure.ac
@@ -246,10 +246,6 @@ if test x_$with_xmlsec != x_no; then
AC_TRY_LINK_FUNC([ERR_load_CRYPTO_strings],,AC_MSG_ERROR([unable to link with openssl libraries]))
AC_MSG_RESULT(yes)
- AC_CHECK_DECL(EVP_sha512,
- [AC_DEFINE([XMLTOOLING_OPENSSL_HAVE_SHA2],[1],[Define to 1 if OpenSSL supports the SHA-2 hash family.])],
- ,[#include <openssl/evp.h>])
-
# restore master libs
LIBS="$save_LIBS"
diff --git a/xmltooling/XMLToolingConfig.cpp b/xmltooling/XMLToolingConfig.cpp
index 1b69e07..5d7b799 100644
--- a/xmltooling/XMLToolingConfig.cpp
+++ b/xmltooling/XMLToolingConfig.cpp
@@ -84,13 +84,6 @@ using namespace xercesc;
using namespace boost;
using namespace std;
-#ifdef WIN32
-# if (OPENSSL_VERSION_NUMBER >= 0x00908000)
-# define XMLTOOLING_OPENSSL_HAVE_SHA2 1
-# endif
-#endif
-
-
DECL_XMLTOOLING_EXCEPTION_FACTORY(XMLParserException,xmltooling);
DECL_XMLTOOLING_EXCEPTION_FACTORY(XMLObjectException,xmltooling);
DECL_XMLTOOLING_EXCEPTION_FACTORY(MarshallingException,xmltooling);
@@ -737,51 +730,51 @@ void XMLToolingInternalConfig::registerXMLAlgorithms()
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIMD5, nullptr, 0, ALGTYPE_DIGEST);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURISHA1, nullptr, 0, ALGTYPE_DIGEST);
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURISHA224, nullptr, 0, ALGTYPE_DIGEST);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURISHA256, nullptr, 0, ALGTYPE_DIGEST);
#endif
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURISHA384, nullptr, 0, ALGTYPE_DIGEST);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURISHA512, nullptr, 0, ALGTYPE_DIGEST);
#endif
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIDSA_SHA1, "DSA", 0, ALGTYPE_SIGN);
-#if defined(URI_ID_DSA_SHA256) && defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
+#if defined(URI_ID_DSA_SHA256) && defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIDSA_SHA256, "DSA", 0, ALGTYPE_SIGN);
#endif
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_MD5, "RSA", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_SHA1, "RSA", 0, ALGTYPE_SIGN);
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_SHA224, "RSA", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_SHA256, "RSA", 0, ALGTYPE_SIGN);
#endif
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_SHA384, "RSA", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIRSA_SHA512, "RSA", 0, ALGTYPE_SIGN);
#endif
#ifdef XSEC_OPENSSL_HAVE_EC
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIECDSA_SHA1, "EC", 0, ALGTYPE_SIGN);
-# if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
+# if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIECDSA_SHA256, "EC", 0, ALGTYPE_SIGN);
# ifdef URI_ID_ECDSA_SHA224
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIECDSA_SHA224, "EC", 0, ALGTYPE_SIGN);
# endif
# endif
-# if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
+# if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIECDSA_SHA384, "EC", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIECDSA_SHA512, "EC", 0, ALGTYPE_SIGN);
# endif
#endif
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIHMAC_SHA1, "HMAC", 0, ALGTYPE_SIGN);
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA256)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIHMAC_SHA224, "HMAC", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIHMAC_SHA256, "HMAC", 0, ALGTYPE_SIGN);
#endif
-#if defined(XMLTOOLING_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
+#if defined(XSEC_OPENSSL_HAVE_SHA2) && !defined(OPENSSL_NO_SHA512)
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIHMAC_SHA384, "HMAC", 0, ALGTYPE_SIGN);
registerXMLAlgorithm(DSIGConstants::s_unicodeStrURIHMAC_SHA512, "HMAC", 0, ALGTYPE_SIGN);
#endif
diff --git a/xmltooling/signature/impl/XMLSecSignatureImpl.cpp b/xmltooling/signature/impl/XMLSecSignatureImpl.cpp
index 40abe9c..14b11f2 100644
--- a/xmltooling/signature/impl/XMLSecSignatureImpl.cpp
+++ b/xmltooling/signature/impl/XMLSecSignatureImpl.cpp
@@ -278,8 +278,13 @@ DOMElement* XMLSecSignatureImpl::marshall(DOMDocument* document, const vector<Si
DSIGSignature* temp=XMLToolingInternalConfig::getInternalConfig().m_xsecProvider->newSignature();
temp->setDSIGNSPrefix(XMLSIG_PREFIX);
const XMLCh* alg = getSignatureAlgorithm();
- if (!alg)
+ if (!alg) {
+#ifdef XSEC_OPENSSL_HAVE_SHA2
+ alg = DSIGConstants::s_unicodeStrURIRSA_SHA256;
+#else
alg = DSIGConstants::s_unicodeStrURIRSA_SHA1;
+#endif
+ }
cachedDOM=temp->createBlankSignature(document, getCanonicalizationMethod(), alg);
m_signature = temp;
}
diff --git a/xmltoolingtest/SignatureTest.h b/xmltoolingtest/SignatureTest.h
index cabff60..2aa7680 100644
--- a/xmltoolingtest/SignatureTest.h
+++ b/xmltoolingtest/SignatureTest.h
@@ -177,7 +177,7 @@ public:
}
void testSignatureDSA() {
-#ifdef XMLTOOLING_OPENSSL_HAVE_SHA2
+#ifdef XSEC_OPENSSL_HAVE_SHA2
xmltooling::QName qname(SimpleXMLObject::NAMESPACE,SimpleXMLObject::LOCAL_NAME);
const SimpleXMLObjectBuilder* b=dynamic_cast<const SimpleXMLObjectBuilder*>(XMLObjectBuilder::getBuilder(qname));
TS_ASSERT(b!=nullptr);
@@ -241,7 +241,7 @@ public:
void testSignatureEC() {
-#ifdef XMLTOOLING_OPENSSL_HAVE_EC
+#ifdef XSEC_OPENSSL_HAVE_EC
xmltooling::QName qname(SimpleXMLObject::NAMESPACE,SimpleXMLObject::LOCAL_NAME);
const SimpleXMLObjectBuilder* b=dynamic_cast<const SimpleXMLObjectBuilder*>(XMLObjectBuilder::getBuilder(qname));
TS_ASSERT(b!=nullptr);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list