[cpp-xmltooling] 02/02: CPPXT-136 DSA Keys with nonexistent P values
Rod Widdowson
rdw at steadingsoftware.com
Mon Sep 24 09:55:24 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=8089cc0c6eab22a179b93dfc11bd6e26124c837c
commit 8089cc0c6eab22a179b93dfc11bd6e26124c837c
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Sep 24 14:26:22 2018 +0100
CPPXT-136 DSA Keys with nonexistent P values
https://issues.shibboleth.net/jira/browse/CPPXT-136
---
xmltoolingtest/BadKeyInfoTest.h | 83 ++++++++++++++++++++++++++--------------
xmltoolingtest/data/DSANoP.xml | 15 ++++++++
xmltoolingtest/data/DSANullP.xml | 16 ++++++++
3 files changed, 85 insertions(+), 29 deletions(-)
diff --git a/xmltoolingtest/BadKeyInfoTest.h b/xmltoolingtest/BadKeyInfoTest.h
index 7a75bfb..5d2df64 100644
--- a/xmltoolingtest/BadKeyInfoTest.h
+++ b/xmltoolingtest/BadKeyInfoTest.h
@@ -183,7 +183,7 @@ private:
}
}
- void DSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullKeys = false) {
+ void DSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullTooling = false, bool nullXsec = false, bool badKey= false) {
string path = data_path + file;
ifstream fs(path.c_str());
@@ -196,41 +196,55 @@ private:
const scoped_ptr<KeyInfo> kiObject(dynamic_cast<KeyInfo*>(b->buildFromDocument(doc)));
TS_ASSERT(kiObject.get() != nullptr);
- const scoped_ptr<X509Credential> toolingCred(dynamic_cast<X509Credential*>(m_resolver->resolve(kiObject.get())));
- TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
- TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
-
const scoped_ptr<const XSECEnv> env(new XSECEnv(doc));
const scoped_ptr<DSIGKeyInfoList> xencKey(new DSIGKeyInfoList(env.get()));
- if (nullKeys) {
- TSM_ASSERT_EQUALS("Expected null Public Key", toolingCred->getPublicKey(), nullptr);
- TSM_ASSERT_THROWS("Lack of data should make xsec throw", xencKey->loadListFromXML(doc->getDocumentElement()), XSECException);
- return;
- }
xencKey->loadListFromXML(doc->getDocumentElement());
+ const scoped_ptr<X509Credential> toolingCred(dynamic_cast<X509Credential*>(m_resolver->resolve(kiObject.get())));
+ TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
+ if (!badKey) {
+ TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
+ }
+
const scoped_ptr<X509Credential> xsecCred(dynamic_cast<X509Credential*>(m_resolver->resolve(xencKey.get())));
- TSM_ASSERT("Unable to resolve DSIGKeyInfoList into Credential.", xsecCred.get() != nullptr);
- TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
-
- TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
- TSM_ASSERT_EQUALS("Expected DSA key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
-
- TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
- TSM_ASSERT_EQUALS("Expected DSA key", xsecCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
-
- const OpenSSLCryptoKeyDSA* toolingKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(toolingCred->getPublicKey());
- const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
-
- bool toolingWorked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- bool xsecWorked = xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- if (fails) {
- TSM_ASSERT("Round trip KeyInfo DSA worked (tooling)", !toolingWorked);
- TSM_ASSERT("Round trip KeyInfo DSA worked (xsec)", !xsecWorked);
+ if (nullTooling || badKey) {
+ TSM_ASSERT_EQUALS("Expected null Public Key (tooling)", toolingCred->getPublicKey(), nullptr);
+ }
+ else {
+ TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
+ TSM_ASSERT_EQUALS("Expected DSA key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
+ const OpenSSLCryptoKeyDSA* toolingKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(toolingCred->getPublicKey());
+ bool toolingWorked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ if (fails) {
+ TSM_ASSERT("Round trip KeyInfo DSA worked (tooling)", !toolingWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo DSA failed (tooling)", toolingWorked);
+ }
+ }
+ if (nullXsec) {
+ if (xsecCred) {
+ TSM_ASSERT_EQUALS("Expected null xsec Cred or Public Key", xsecCred->getPublicKey(), nullptr);
+ }
}
else {
- TSM_ASSERT("Round trip KeyInfo DSA failed (tooling)", toolingWorked);
- TSM_ASSERT("Round trip KeyInfo DSA failed (xsec)", xsecWorked);
+ TSM_ASSERT("Unable to resolve DSIGKeyInfoList into Credential.", xsecCred.get() != nullptr);
+ TSM_ASSERT("Expected null Private Key", xsecCred->getPrivateKey() == nullptr);
+ TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
+ TSM_ASSERT_EQUALS("Expected DSA key", xsecCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
+ const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
+ if (badKey) {
+ TSM_ASSERT_THROWS("Bad DSA key throws an assert", xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
+ }
+ else {
+ bool xsecWorked = xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ if (fails) {
+ TSM_ASSERT("Round trip KeyInfo DSA worked (xsec)", !xsecWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo DSA failed (xsec)", xsecWorked);
+ }
+ }
}
}
@@ -292,4 +306,15 @@ public:
{
DSATest("DSABadP64.xml", true);
}
+
+ void testDSANoP()
+ {
+ DSATest("DSANoP.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
+ }
+
+ void testDSANullP()
+ {
+ DSATest("DSANullP.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
+ }
+
};
\ No newline at end of file
diff --git a/xmltoolingtest/data/DSANoP.xml b/xmltoolingtest/data/DSANoP.xml
new file mode 100644
index 0000000..10d2022
--- /dev/null
+++ b/xmltoolingtest/data/DSANoP.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:Q>AK/apfGsK5pA4iia1j9qAR0Tdaw1
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSANullP.xml b/xmltoolingtest/data/DSANullP.xml
new file mode 100644
index 0000000..c06fbf0
--- /dev/null
+++ b/xmltoolingtest/data/DSANullP.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P/>
+ <ds:Q>AK/apfGsK5pA4iia1j9qAR0Tdaw1
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list