[cpp-xmltooling] branch master updated: CPPXT-136 Test cases for malformed/missing EC (NamedCurve only)
Rod Widdowson
rdw at steadingsoftware.com
Tue Oct 9 07:25:17 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=aa9d0445ece9c3076f95325841780d636469cc43
The following commit(s) were added to refs/heads/master by this push:
new aa9d044 CPPXT-136 Test cases for malformed/missing EC (NamedCurve only)
aa9d044 is described below
commit aa9d0445ece9c3076f95325841780d636469cc43
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Oct 9 12:24:32 2018 +0100
CPPXT-136 Test cases for malformed/missing EC (NamedCurve only)
https://issues.shibboleth.net/jira/browse/CPPXT-136
---
xmltoolingtest/BadKeyInfoTest.h | 149 +++++++++++++++++++++++++++++++-----
xmltoolingtest/data/ECBadCurve.xml | 9 +++
xmltoolingtest/data/ECBadKey.xml | 8 ++
xmltoolingtest/data/ECBadKey64.xml | 8 ++
xmltoolingtest/data/ECNoCurve.xml | 8 ++
xmltoolingtest/data/ECNoKey.xml | 7 ++
xmltoolingtest/data/ECNullCurve.xml | 9 +++
xmltoolingtest/data/ECNullKey.xml | 8 ++
8 files changed, 188 insertions(+), 18 deletions(-)
diff --git a/xmltoolingtest/BadKeyInfoTest.h b/xmltoolingtest/BadKeyInfoTest.h
index 018ebc0..d02881b 100644
--- a/xmltoolingtest/BadKeyInfoTest.h
+++ b/xmltoolingtest/BadKeyInfoTest.h
@@ -254,57 +254,119 @@ private:
}
}
+#ifdef XSEC_OPENSSL_HAVE_EC
-public:
+ void ECTest(const char* file, bool roundTripFails, bool xsecLoadThrows, bool resolveFails)
+ {
+
+ string path = data_path + file;
+ ifstream fs(path.c_str());
+ ParserPool& parser = XMLToolingConfig::getConfig().getParser();
+ DOMDocument* doc = parser.parse(fs);
+
+ TS_ASSERT(doc != nullptr);
+
+ const XMLObjectBuilder* b = XMLObjectBuilder::getBuilder(doc->getDocumentElement());
+ TS_ASSERT(b != nullptr);
+ const scoped_ptr<KeyInfo> kiObject(dynamic_cast<KeyInfo*>(b->buildFromDocument(doc)));
+ TS_ASSERT(kiObject.get() != nullptr);
+
+ const scoped_ptr<const XSECEnv> env(new XSECEnv(doc));
+ const scoped_ptr<DSIGKeyInfoList> xencKey(new DSIGKeyInfoList(env.get()));
+ if (xsecLoadThrows) {
+ TSM_ASSERT_THROWS("Bad EC key throws during load", xencKey->loadListFromXML(doc->getDocumentElement()), XSECException);
+ }
+ else {
+ xencKey->loadListFromXML(doc->getDocumentElement());
+ const scoped_ptr<X509Credential> xsecCred(dynamic_cast<X509Credential*>(m_resolver->resolve(xencKey.get())));
+ if (resolveFails) {
+ TSM_ASSERT("XsecCred was non null", xsecCred.get() == nullptr)
+ }
+ else {
+ TSM_ASSERT("Unable to resolve DSIGKeyInfoList into Credential.", xsecCred.get() != nullptr);
+
+ TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
+ TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
+ TSM_ASSERT_EQUALS("Expected EC key", xsecCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_EC_PUBLIC);
+ const OpenSSLCryptoKeyEC* xsecKeyInfoEC = dynamic_cast<const OpenSSLCryptoKeyEC*>(xsecCred->getPublicKey());
+ bool xsecWorked = xsecKeyInfoEC->verifyBase64SignatureDSA(m_toSign, 20, m_outSigEC, m_sigLenEC);
+ if (roundTripFails) {
+ TSM_ASSERT("Round trip KeyInfo EC worked (xsec)", !xsecWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo EC failed (xsec)", xsecWorked);
+ }
+ }
+ }
+ const scoped_ptr<X509Credential> toolingCred(dynamic_cast<X509Credential*>(m_resolver->resolve(kiObject.get())));
+ if (resolveFails) {
+ TSM_ASSERT("ToolCred was non null", toolingCred.get() == nullptr)
+ }
+ else {
+ TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
+ TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
+ TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
+ TSM_ASSERT_EQUALS("Expected EC key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_EC_PUBLIC);
+ const OpenSSLCryptoKeyEC* toolingKeyInfoEC = dynamic_cast<const OpenSSLCryptoKeyEC*>(toolingCred->getPublicKey());
+ bool toolingWorked = toolingKeyInfoEC->verifyBase64SignatureDSA(m_toSign, 20, m_outSigEC, m_sigLenEC);
+ if (roundTripFails) {
+ TSM_ASSERT("Round trip KeyInfo EC worked (tooling)", !toolingWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo EC failed (tooling)", toolingWorked);
+ }
+ }
+ }
+#endif
+public:
void testRSABadMod()
{
- // Encryption Throws, but keys are present
- RSATest("RSABadMod.xml", true, false);
+ // Encryption Throws, but keys are present
+ RSATest("RSABadMod.xml", true, false);
}
void testRSABadMod64()
{
- // Encryption Throws, but keys are present
- RSATest("RSABadMod64.xml", true, false);
+ // Encryption Throws, but keys are present
+ RSATest("RSABadMod64.xml", true, false);
}
void testRSABadExp()
{
- // Encryption "works", and keys are present
- RSATest("RSABadExp.xml", false, false);
+ // Encryption "works", and keys are present
+ RSATest("RSABadExp.xml", false, false);
}
void testRSABadExp64()
{
- // Encryption "works", and keys are present
- RSATest("RSABadExp64.xml", false, false);
+ // Encryption "works", and keys are present
+ RSATest("RSABadExp64.xml", false, false);
}
void testRSANullMod()
{
- // Encryption throws, no keys
- RSATest("RSANullMod.xml", true, true);
+ // Encryption throws, no keys
+ RSATest("RSANullMod.xml", true, true);
}
void testRSANullExp()
{
- // Encryption throws, no keys
- RSATest("RSANullExp.xml", true, true);
+ // Encryption throws, no keys
+ RSATest("RSANullExp.xml", true, true);
}
void testRSANullBoth()
{
- // Encryption throws, no keys
- RSATest("RSANullBoth.xml", true, true);
+ // Encryption throws, no keys
+ RSATest("RSANullBoth.xml", true, true);
}
void testRSAEmpty()
{
- // Encryption throws, no keys
- RSATest("RSAEmpty.xml", true, true);
+ // Encryption throws, no keys
+ RSATest("RSAEmpty.xml", true, true);
}
-
// DSA
void testDSAGood()
@@ -474,4 +536,55 @@ public:
// Works xsec, No XMLTooling Key
DSATest("DSANullCounter.xml", false, true, false, false);
}
+
+#ifdef XSEC_OPENSSL_HAVE_EC
+ void testECGood()
+ {
+ // Works ! All keys available, no exceptions, no failures
+ ECTest("KeyInfoEC.xml", false, false, false);
+ }
+
+ void testECBadKey()
+ {
+ // Fails, No exception from santuario Load, but resolve fails
+ ECTest("ECBadKey.xml", false, false, true);
+ }
+
+ void testECBadKey64()
+ {
+ // Fails, No exception from santuario Load, but resolve fails
+ ECTest("ECBadKey.xml", false, false, true);
+ }
+
+ void testECNullKey()
+ {
+ // Fails, Exception from santuario Load and Shib resolve fails
+ ECTest("ECNullKey.xml", false, true, true);
+ }
+
+ void testECNoKey()
+ {
+ // Fails, Exception from santuario Load and Shib resolve fails
+ ECTest("ECNoKey.xml", false, true, true);
+ }
+
+ void testECBadCurve()
+ {
+ // Fails, No exception from santuario Load, but resolve fails
+ ECTest("ECBadCurve.xml", false, false, true);
+ }
+
+ void testECNullCurve()
+ {
+ // Fails, No exception from santuario Load, but resolve fails
+ ECTest("ECNullCurve.xml", false, false, true);
+ }
+
+ void testECNoCurve()
+ {
+ // Fails, Exception from santuario Load and Shib resolve fails
+ ECTest("ECNoCurve.xml", false, true, true);
+ }
+
+#endif
};
\ No newline at end of file
diff --git a/xmltoolingtest/data/ECBadCurve.xml b/xmltoolingtest/data/ECBadCurve.xml
new file mode 100644
index 0000000..4811327
--- /dev/null
+++ b/xmltoolingtest/data/ECBadCurve.xml
@@ -0,0 +1,9 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve URI="BAYIncGnewJiUxZdqjsBiRpzGGnXTQWSZFUxkVPmPr25FH1ckqX+2xiYsA=="/>
+ <ds11:PublicKey>BAYIncGnewJiUxZdqjsBiRpzGGnXTQWSZFUxkVPmPr25FH1ckqX+2xiYsA==
+ </ds11:PublicKey>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECBadKey.xml b/xmltoolingtest/data/ECBadKey.xml
new file mode 100644
index 0000000..51fde22
--- /dev/null
+++ b/xmltoolingtest/data/ECBadKey.xml
@@ -0,0 +1,8 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve URI="urn:oid:2.23.43.1.4.5"/>
+ <ds11:PublicKey>This Is An Invalid ECKeyValue</ds11:PublicKey>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECBadKey64.xml b/xmltoolingtest/data/ECBadKey64.xml
new file mode 100644
index 0000000..ef79db5
--- /dev/null
+++ b/xmltoolingtest/data/ECBadKey64.xml
@@ -0,0 +1,8 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve URI="urn:oid:2.23.43.1.4.5"/>
+ <ds11:PublicKey>RG1FUW9vK1lBVk5UVUdva2N5MWtpMDFXZ01mVEJzdlBxWWpSRHpjbUY3cDRvSjhuZVZDbjBCOTkwanY5Vzh2OGdwdnhyK3c1WnBRa0p5Ym5nSkZBanc9PQ==</ds11:PublicKey>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECNoCurve.xml b/xmltoolingtest/data/ECNoCurve.xml
new file mode 100644
index 0000000..f3c5d5f
--- /dev/null
+++ b/xmltoolingtest/data/ECNoCurve.xml
@@ -0,0 +1,8 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:PublicKey>BAYIncGnewJiUxZdqjsBiRpzGGnXTQWSZFUxkVPmPr25FH1ckqX+2xiYsA==
+ </ds11:PublicKey>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECNoKey.xml b/xmltoolingtest/data/ECNoKey.xml
new file mode 100644
index 0000000..48e7d67
--- /dev/null
+++ b/xmltoolingtest/data/ECNoKey.xml
@@ -0,0 +1,7 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve URI="urn:oid:2.23.43.1.4.5"/>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECNullCurve.xml b/xmltoolingtest/data/ECNullCurve.xml
new file mode 100644
index 0000000..83fb172
--- /dev/null
+++ b/xmltoolingtest/data/ECNullCurve.xml
@@ -0,0 +1,9 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve/>
+ <ds11:PublicKey>BAYIncGnewJiUxZdqjsBiRpzGGnXTQWSZFUxkVPmPr25FH1ckqX+2xiYsA==
+ </ds11:PublicKey>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/ECNullKey.xml b/xmltoolingtest/data/ECNullKey.xml
new file mode 100644
index 0000000..d87f6b9
--- /dev/null
+++ b/xmltoolingtest/data/ECNullKey.xml
@@ -0,0 +1,8 @@
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ds11="http://www.w3.org/2009/xmldsig11#">
+ <ds:KeyValue>
+ <ds11:ECKeyValue>
+ <ds11:NamedCurve URI="urn:oid:2.23.43.1.4.5"/>
+ <ds11:PublicKey/>
+ </ds11:ECKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list