[cpp-xmltooling] 01/02: CPPXT-136 DSA Keys with invalid P values
Rod Widdowson
rdw at steadingsoftware.com
Mon Sep 24 09:55:23 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=a5822130ad3fd425e5a7e71e7203e8064c11d885
commit a5822130ad3fd425e5a7e71e7203e8064c11d885
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Sep 20 16:23:28 2018 +0100
CPPXT-136 DSA Keys with invalid P values
https://issues.shibboleth.net/jira/browse/CPPXT-136
---
xmltoolingtest/BadKeyInfoTest.h | 61 ++++++++++++++++++++++++---------------
xmltoolingtest/data/DSABadP.xml | 17 +++++++++++
xmltoolingtest/data/DSABadP64.xml | 17 +++++++++++
3 files changed, 71 insertions(+), 24 deletions(-)
diff --git a/xmltoolingtest/BadKeyInfoTest.h b/xmltoolingtest/BadKeyInfoTest.h
index 3c24ced..7a75bfb 100644
--- a/xmltoolingtest/BadKeyInfoTest.h
+++ b/xmltoolingtest/BadKeyInfoTest.h
@@ -66,16 +66,16 @@ private:
unsigned int m_sigLenEC;
public:
- BadKeyInfoTest() : m_resolver(nullptr), m_sigLenDSA(0), m_sigLenEC(0){}
+ BadKeyInfoTest() : m_resolver(nullptr), m_sigLenDSA(0), m_sigLenEC(0) {}
void setUp() {
string config = data_path + "InlineKeyResolver.xml";
ifstream in(config.c_str());
- DOMDocument* doc=XMLToolingConfig::getConfig().getParser().parse(in);
+ DOMDocument* doc = XMLToolingConfig::getConfig().getParser().parse(in);
XercesJanitor<DOMDocument> janitor(doc);
- m_resolver=XMLToolingConfig::getConfig().KeyInfoResolverManager.newPlugin(
+ m_resolver = XMLToolingConfig::getConfig().KeyInfoResolverManager.newPlugin(
INLINE_KEYINFO_RESOLVER, doc->getDocumentElement(), false
- );
+ );
if (m_sigLenEC == 0 || m_sigLenDSA == 0) {
// Resolver for DSA and RSA signatures
@@ -119,26 +119,26 @@ public:
void tearDown() {
delete m_resolver;
- m_resolver=nullptr;
+ m_resolver = nullptr;
}
private:
- void RSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullKeys=false) {
+ void RSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullKeys = false) {
- string path=data_path + file;
+ string path = data_path + file;
ifstream fs(path.c_str());
- DOMDocument* doc=parser.parse(fs);
+ DOMDocument* doc = parser.parse(fs);
- TS_ASSERT(doc!=nullptr);
+ TS_ASSERT(doc != nullptr);
const XMLObjectBuilder* b = XMLObjectBuilder::getBuilder(doc->getDocumentElement());
- TS_ASSERT(b!=nullptr);
+ TS_ASSERT(b != nullptr);
const scoped_ptr<KeyInfo> kiObject(dynamic_cast<KeyInfo*>(b->buildFromDocument(doc)));
- TS_ASSERT(kiObject.get()!=nullptr);
+ TS_ASSERT(kiObject.get() != nullptr);
const scoped_ptr<Credential> toolingCred(dynamic_cast<Credential*>(m_resolver->resolve(kiObject.get())));
- TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get()!=nullptr);
- TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey()==nullptr);
+ TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
+ TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
const scoped_ptr<const XSECEnv> env(new XSECEnv(doc));
const scoped_ptr<DSIGKeyInfoList> xencKey(new DSIGKeyInfoList(env.get()));
if (nullKeys) {
@@ -153,7 +153,7 @@ private:
TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
- TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey()!=nullptr);
+ TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
TSM_ASSERT_EQUALS("Expected RSA key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_RSA_PUBLIC);
TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
@@ -175,8 +175,8 @@ private:
string xsecBuffer, toolingBuffer;
XMLHelper::serialize(xsecEncData->marshall(), xsecBuffer);
XMLHelper::serialize(toolingEncData->marshall(), toolingBuffer);
- const char* cx= xsecBuffer.c_str();
- const char* ct= toolingBuffer.c_str();
+ const char* cx = xsecBuffer.c_str();
+ const char* ct = toolingBuffer.c_str();
// The decrypted data is completely different. hmm.
// TSM_ASSERT_EQUALS("Encrytped Data differs", cx, ct);
@@ -222,13 +222,16 @@ private:
const OpenSSLCryptoKeyDSA* toolingKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(toolingCred->getPublicKey());
const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
- bool worked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- TSM_ASSERT("Round trip KeyInfo DSA failed", worked);
-
-
- worked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- TSM_ASSERT("Round trip KeyInfo DSA failed", worked);
-
+ bool toolingWorked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ bool xsecWorked = xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ if (fails) {
+ TSM_ASSERT("Round trip KeyInfo DSA worked (tooling)", !toolingWorked);
+ TSM_ASSERT("Round trip KeyInfo DSA worked (xsec)", !xsecWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo DSA failed (tooling)", toolingWorked);
+ TSM_ASSERT("Round trip KeyInfo DSA failed (xsec)", xsecWorked);
+ }
}
@@ -279,4 +282,14 @@ public:
{
DSATest("KeyInfoDSA.xml", false);
}
-};
+
+ void testDSABadP()
+ {
+ DSATest("DSABadP.xml", true, XMLToolingConfig::getConfig().getParser());
+ }
+
+ void testDSABadP64()
+ {
+ DSATest("DSABadP64.xml", true);
+ }
+};
\ No newline at end of file
diff --git a/xmltoolingtest/data/DSABadP.xml b/xmltoolingtest/data/DSABadP.xml
new file mode 100644
index 0000000..38377d8
--- /dev/null
+++ b/xmltoolingtest/data/DSABadP.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>NibbleAHappyWartHog
+</ds:P>
+ <ds:Q>AK/apfGsK5pA4iia1j9qAR0Tdaw1
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSABadP64.xml b/xmltoolingtest/data/DSABadP64.xml
new file mode 100644
index 0000000..e413a13
--- /dev/null
+++ b/xmltoolingtest/data/DSABadP64.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>RG1FUW9vK1lBVk5UVUdva2N5MWtpMDFXZ01mVEJzdlBxWWpSRHpjbUY3cDRvSjhuZVZDbjBCOTkwanY5Vzh2OGdwdnhyK3c1WnBRa0p5Ym5nSkZBanc9PQ==
+</ds:P>
+ <ds:Q>AK/apfGsK5pA4iia1j9qAR0Tdaw1
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list