[cpp-xmltooling] branch master updated: CPPXT-136 X509 tests
Rod Widdowson
rdw at steadingsoftware.com
Tue Oct 30 13:46:51 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=071ce75280bb47d8d519aa672654a33a9c0ade23
The following commit(s) were added to refs/heads/master by this push:
new 071ce75 CPPXT-136 X509 tests
071ce75 is described below
commit 071ce75280bb47d8d519aa672654a33a9c0ade23
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Oct 30 17:45:55 2018 +0000
CPPXT-136 X509 tests
https://issues.shibboleth.net/jira/browse/CPPXT-136
No surprises. A bad certificate fails in a new way, but
its "just" Santuario throwing an exception.
---
xmltoolingtest/BadKeyInfoTest.h | 102 ++++++++++++++++++---------
xmltoolingtest/data/BadKeyInfo/X509Bad.xml | 9 +++
xmltoolingtest/data/BadKeyInfo/X509Bad64.xml | 9 +++
xmltoolingtest/data/BadKeyInfo/X509Good.xml | 23 ++++++
xmltoolingtest/data/BadKeyInfo/X509None.xml | 8 +++
xmltoolingtest/data/BadKeyInfo/X509Null.xml | 9 +++
6 files changed, 128 insertions(+), 32 deletions(-)
diff --git a/xmltoolingtest/BadKeyInfoTest.h b/xmltoolingtest/BadKeyInfoTest.h
index fe5a104..21cbb46 100644
--- a/xmltoolingtest/BadKeyInfoTest.h
+++ b/xmltoolingtest/BadKeyInfoTest.h
@@ -185,7 +185,7 @@ private:
}
}
- void DSATest(const char* file, bool roundTripFails, bool nullTooling, bool nullXsec, bool verifyThrows, bool keyTypeNone = false) {
+ void DSATest(const char* file, bool roundTripFails, bool nullTooling, bool nullXsec, bool verifyOrLoadThrows) {
string path = keyInfoPath + file;
ifstream fs(path.c_str());
@@ -200,14 +200,11 @@ private:
TS_ASSERT(kiObject.get() != nullptr);
const scoped_ptr<const XSECEnv> env(new XSECEnv(doc));
- const scoped_ptr<DSIGKeyInfoList> xencKey(new DSIGKeyInfoList(env.get()));
- xencKey->loadListFromXML(doc->getDocumentElement());
const scoped_ptr<Credential> toolingCred(dynamic_cast<Credential*>(m_resolver->resolve(kiObject.get())));
TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
- const scoped_ptr<Credential> xsecCred(dynamic_cast<Credential*>(m_resolver->resolve(xencKey.get())));
if (nullTooling ) {
TSM_ASSERT_EQUALS("Expected null Public Key (tooling)", toolingCred->getPublicKey(), nullptr);
}
@@ -215,7 +212,7 @@ private:
TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
TSM_ASSERT_EQUALS("Expected DSA key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
const OpenSSLCryptoKeyDSA* toolingKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(toolingCred->getPublicKey());
- if (verifyThrows) {
+ if (verifyOrLoadThrows) {
TSM_ASSERT_THROWS("Bad DSA key throws an assert", toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
}
else {
@@ -228,31 +225,41 @@ private:
}
}
}
- if (nullXsec) {
- if (xsecCred) {
- TSM_ASSERT_EQUALS("Expected null xsec Cred or Public Key", xsecCred->getPublicKey(), nullptr);
- }
- }
- else {
- TSM_ASSERT("Unable to resolve DSIGKeyInfoList into Credential.", xsecCred.get() != nullptr);
-
- TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
- TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
- TSM_ASSERT_EQUALS("Expected DSA key", xsecCred->getPublicKey()->getKeyType(), keyTypeNone? XSECCryptoKey::KEY_NONE : XSECCryptoKey::KEY_DSA_PUBLIC);
- const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
- if (verifyThrows) {
- TSM_ASSERT_THROWS("Bad DSA key throws an assert", xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
- }
- else {
- bool xsecWorked = xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- if (roundTripFails) {
- TSM_ASSERT("Round trip KeyInfo DSA worked (xsec)", !xsecWorked);
- }
- else {
- TSM_ASSERT("Round trip KeyInfo DSA failed (xsec)", xsecWorked);
- }
- }
- }
+
+ const scoped_ptr<DSIGKeyInfoList> xsecKey(new DSIGKeyInfoList(env.get()));
+ if (nullXsec && verifyOrLoadThrows) {
+ TSM_ASSERT_THROWS("Bad DSA key throws an assert during Load", xsecKey->loadListFromXML(doc->getDocumentElement()), XSECCryptoException);
+ }
+ else {
+ xsecKey->loadListFromXML(doc->getDocumentElement());
+ const scoped_ptr<Credential> xsecCred(dynamic_cast<Credential*>(m_resolver->resolve(xsecKey.get())));
+
+ if (nullXsec) {
+ if (xsecCred) {
+ TSM_ASSERT_EQUALS("Expected null xsec Cred or Public Key", xsecCred->getPublicKey(), nullptr);
+ }
+ }
+ else {
+ TSM_ASSERT("Unable to resolve DSIGKeyInfoList into Credential.", xsecCred.get() != nullptr);
+
+ TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
+ TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
+ TSM_ASSERT_EQUALS("Expected DSA key", xsecCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
+ const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
+ if (verifyOrLoadThrows) {
+ TSM_ASSERT_THROWS("Bad DSA key throws an assert", xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
+ }
+ else {
+ bool xsecWorked = xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ if (roundTripFails) {
+ TSM_ASSERT("Round trip KeyInfo DSA worked (xsec)", !xsecWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo DSA failed (xsec)", xsecWorked);
+ }
+ }
+ }
+ }
}
#ifdef XSEC_OPENSSL_HAVE_EC
@@ -547,13 +554,13 @@ public:
void testDSANoY()
{
// Round trip fails, XmlTooling returns NO public key, Santuario returns NO public key
- DSATest("DSANoY.xml", true, true, true, true, true);
+ DSATest("DSANoY.xml", true, true, true, false);
}
void testDSANullY()
{
// Round trip fails, XmlTooling returns NO public key, Santuario returns NO public key
- DSATest("DSANullY.xml", true, true, true, true, true);
+ DSATest("DSANullY.xml", true, true, true, false);
}
void testDSANullJ()
@@ -705,4 +712,35 @@ public:
{
DERTest("DERValueNull.xml", true);
}
+
+ // X509Data
+ void testX509Good()
+ {
+ // Round trip work, XmlTooling returns a public key, Santuario returns a public key, verifyBase64Signature doesn't throw (both cases)
+ DSATest("X509Good.xml", false, false, false, false);
+ }
+
+ void testX509Bad()
+ {
+ // Round trip fails, XmlTooling returns NO public key, Santuario returns no public key because it throws
+ DSATest("X509Bad.xml", true, true, true, true);
+ }
+
+ void testX509Bad64()
+ {
+ // Round trip fails, XmlTooling returns NO public key, Santuario returns no public key because it throws
+ DSATest("X509Bad64.xml", true, true, true, true);
+ }
+
+ void testX509Null()
+ {
+ // Round trip fails, XmlTooling returns NO public key, Santuario returns NO public key
+ DSATest("X509Null.xml", true, true, true, false);
+ }
+
+ void testX509None()
+ {
+ // Round trip fails, XmlTooling returns NO public key, Santuario returns NO public key
+ DSATest("X509None.xml", true, true, true, false);
+ }
};
diff --git a/xmltoolingtest/data/BadKeyInfo/X509Bad.xml b/xmltoolingtest/data/BadKeyInfo/X509Bad.xml
new file mode 100644
index 0000000..afc3b43
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/X509Bad.xml
@@ -0,0 +1,9 @@
+<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig# ../../schemas/xmldsig-core-schema.xsd"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Public Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509Certificate> Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:X509Certificate>
+ </ds:X509Data>
+
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/BadKeyInfo/X509Bad64.xml b/xmltoolingtest/data/BadKeyInfo/X509Bad64.xml
new file mode 100644
index 0000000..25d2def
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/X509Bad64.xml
@@ -0,0 +1,9 @@
+<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig# ../../schemas/xmldsig-core-schema.xsd"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Public Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509Certificate>IEtleSBmb3IgQ049eG1sZGFwLm9yZywgT1U9RG9tYWluIENvbnRyb2wgVmFsaWRhdGVkLCBPPXhtbGRhcC5vcmc=</ds:X509Certificate>
+ </ds:X509Data>
+
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/BadKeyInfo/X509Good.xml b/xmltoolingtest/data/BadKeyInfo/X509Good.xml
new file mode 100644
index 0000000..c7cb769
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/X509Good.xml
@@ -0,0 +1,23 @@
+<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig# ../../schemas/xmldsig-core-schema.xsd"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Public Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509Certificate>MIIClDCCAlGgAwIBAgIJALnyJ1BTkPBhMAsGCWCGSAFlAwQDAjAxMQswCQYDVQQG
+EwJVSzETMBEGA1UECBMKU29tZS1TdGF0ZTENMAsGA1UEChMEdGVzdDAgFw0xNjEw
+MjQxNTU5NDZaGA8zMDE2MDIyNTE1NTk0NlowMTELMAkGA1UEBhMCVUsxEzARBgNV
+BAgTClNvbWUtU3RhdGUxDTALBgNVBAoTBHRlc3QwgfEwgagGByqGSM44BAEwgZwC
+QQDVRgLTdTMa92ZMSnEKmWjMcNkG63uIxvBvihYXD2CUDY4aWB9jvg1VsdNr1eB/
+cqQpz2gDZLQorSrkEogwPZdVAhUAr9ql8awrmkDiKJrWP2oBHRN1rDUCQA5hEKKP
+mAFTU1BqJHMtZItNVoDH0wbLz6mI0Q83Jhe6eKCfJ3lQp9AffdI7/VvL/IKb8a/s
+OWaUJCcm54CRQI8DRAACQQDCTxcQgfSqenpHTPdB9t87+CTRIZJtalzYseOF3Zei
+AAYBPPepKTcxkAwin+onnDu6F/nkyZdysE96DRPvBEMZo4G1MIGyMB0GA1UdDgQW
+BBSy0QAHIB9quPNjOHpxHhHexNRTWzBhBgNVHSMEWjBYgBSy0QAHIB9quPNjOHpx
+HhHexNRTW6E1pDMwMTELMAkGA1UEBhMCVUsxEzARBgNVBAgTClNvbWUtU3RhdGUx
+DTALBgNVBAoTBHRlc3SCCQC58idQU5DwYTALBgNVHQ8EBAMCBeAwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDAYDVR0TBAUwAwEB/zALBglghkgBZQMEAwIDMAAwLQIUfPKR
+rqQ3+6LKO7rzK5EX3eps/NoCFQCUJnFAWt1brsfWj/w15nqBYWm7WA==</ds:X509Certificate>
+ <ds:X509CRL/>
+ </ds:X509Data>
+
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/BadKeyInfo/X509None.xml b/xmltoolingtest/data/BadKeyInfo/X509None.xml
new file mode 100644
index 0000000..1031c41
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/X509None.xml
@@ -0,0 +1,8 @@
+<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig# ../../schemas/xmldsig-core-schema.xsd"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Public Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:KeyName>
+ <ds:X509Data>
+ </ds:X509Data>
+
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/BadKeyInfo/X509Null.xml b/xmltoolingtest/data/BadKeyInfo/X509Null.xml
new file mode 100644
index 0000000..7aa8c55
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/X509Null.xml
@@ -0,0 +1,9 @@
+<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig# ../../schemas/xmldsig-core-schema.xsd"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Public Key for CN=xmldap.org, OU=Domain Control Validated, O=xmldap.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509Certificate/>
+ </ds:X509Data>
+
+</ds:KeyInfo>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list