[cpp-xmltooling] 01/03: CPPXT-136 DSA Keys with bad Q values
Rod Widdowson
rdw at steadingsoftware.com
Thu Sep 27 08:43:54 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=05a39e2e91e621d94e7cc8d508e220c8aac2066d
commit 05a39e2e91e621d94e7cc8d508e220c8aac2066d
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Sep 27 13:19:35 2018 +0100
CPPXT-136 DSA Keys with bad Q values
https://issues.shibboleth.net/jira/browse/CPPXT-136
Test absense of P & Q as well as absense of Q, also badly formed Q
---
xmltoolingtest/BadKeyInfoTest.h | 56 ++++++++++++++++++++++++++++++++-------
xmltoolingtest/data/DSABadQ.xml | 17 ++++++++++++
xmltoolingtest/data/DSABadQ64.xml | 17 ++++++++++++
xmltoolingtest/data/DSABadQP.xml | 17 ++++++++++++
xmltoolingtest/data/DSANoQ.xml | 15 +++++++++++
xmltoolingtest/data/DSANoQP.xml | 13 +++++++++
xmltoolingtest/data/DSANullQ.xml | 16 +++++++++++
xmltoolingtest/data/DSANullQP.xml | 15 +++++++++++
8 files changed, 157 insertions(+), 9 deletions(-)
diff --git a/xmltoolingtest/BadKeyInfoTest.h b/xmltoolingtest/BadKeyInfoTest.h
index 5d2df64..2b98865 100644
--- a/xmltoolingtest/BadKeyInfoTest.h
+++ b/xmltoolingtest/BadKeyInfoTest.h
@@ -183,7 +183,7 @@ private:
}
}
- void DSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullTooling = false, bool nullXsec = false, bool badKey= false) {
+ void DSATest(const char* file, bool fails, ParserPool& parser = XMLToolingConfig::getConfig().getValidatingParser(), bool nullTooling = false, bool nullXsec = false, bool verifyThrows= false) {
string path = data_path + file;
ifstream fs(path.c_str());
@@ -202,24 +202,29 @@ private:
const scoped_ptr<X509Credential> toolingCred(dynamic_cast<X509Credential*>(m_resolver->resolve(kiObject.get())));
TSM_ASSERT("Unable to resolve KeyInfo into Credential.", toolingCred.get() != nullptr);
- if (!badKey) {
+// if (!verifyThrows) {//@@@
TSM_ASSERT("Expected null Private Key", toolingCred->getPrivateKey() == nullptr);
- }
+// }
const scoped_ptr<X509Credential> xsecCred(dynamic_cast<X509Credential*>(m_resolver->resolve(xencKey.get())));
- if (nullTooling || badKey) {
+ if (nullTooling ) {
TSM_ASSERT_EQUALS("Expected null Public Key (tooling)", toolingCred->getPublicKey(), nullptr);
}
else {
TSM_ASSERT("Expected non-null Public Key", toolingCred->getPublicKey() != nullptr);
TSM_ASSERT_EQUALS("Expected DSA key", toolingCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
const OpenSSLCryptoKeyDSA* toolingKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(toolingCred->getPublicKey());
- bool toolingWorked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
- if (fails) {
- TSM_ASSERT("Round trip KeyInfo DSA worked (tooling)", !toolingWorked);
+ if (verifyThrows) {
+ TSM_ASSERT_THROWS("Bad DSA key throws an assert", toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
}
else {
- TSM_ASSERT("Round trip KeyInfo DSA failed (tooling)", toolingWorked);
+ bool toolingWorked = toolingKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA);
+ if (fails) {
+ TSM_ASSERT("Round trip KeyInfo DSA worked (tooling)", !toolingWorked);
+ }
+ else {
+ TSM_ASSERT("Round trip KeyInfo DSA failed (tooling)", toolingWorked);
+ }
}
}
if (nullXsec) {
@@ -233,7 +238,7 @@ private:
TSM_ASSERT("Expected non-null Public Key", xsecCred->getPublicKey() != nullptr);
TSM_ASSERT_EQUALS("Expected DSA key", xsecCred->getPublicKey()->getKeyType(), XSECCryptoKey::KEY_DSA_PUBLIC);
const OpenSSLCryptoKeyDSA* xsecKeyInfoDSA = dynamic_cast<const OpenSSLCryptoKeyDSA*>(xsecCred->getPublicKey());
- if (badKey) {
+ if (verifyThrows) {
TSM_ASSERT_THROWS("Bad DSA key throws an assert", xsecKeyInfoDSA->verifyBase64Signature(m_toSign, 20, m_outSigDSA, m_sigLenDSA), XSECCryptoException);
}
else {
@@ -291,12 +296,14 @@ public:
RSATest("RSAEmpty.xml", true, XMLToolingConfig::getConfig().getParser(), true);
}
+ // DSA
void testDSAGood()
{
DSATest("KeyInfoDSA.xml", false);
}
+ // P: tests
void testDSABadP()
{
DSATest("DSABadP.xml", true, XMLToolingConfig::getConfig().getParser());
@@ -317,4 +324,35 @@ public:
DSATest("DSANullP.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
}
+ // Q: TEsts
+ void testDSABadQ()
+ {
+ DSATest("DSABadQ.xml", true, XMLToolingConfig::getConfig().getParser(), false, false, true);
+ }
+
+ void testDSABadQ64()
+ {
+ DSATest("DSABadQ64.xml", true, XMLToolingConfig::getConfig().getParser(), false, false, true);
+ }
+
+ void testDSANoQ()
+ {
+ DSATest("DSANoQ.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
+ }
+
+ void testDSANoPQ()
+ {
+ DSATest("DSANoQP.xml", true, XMLToolingConfig::getConfig().getParser(), false, false, true);
+ }
+
+ void testDSANullQ()
+ {
+ DSATest("DSANullQ.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
+ }
+
+ void testDSANullPQ()
+ {
+ DSATest("DSANullQP.xml", true, XMLToolingConfig::getConfig().getParser(), true, false, true);
+ }
+
};
\ No newline at end of file
diff --git a/xmltoolingtest/data/DSABadQ.xml b/xmltoolingtest/data/DSABadQ.xml
new file mode 100644
index 0000000..a926c2f
--- /dev/null
+++ b/xmltoolingtest/data/DSABadQ.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>ANVGAtN1Mxr3ZkxKcQqZaMxw2Qbre4jG8G+KFhcPYJQNjhpYH2O+DVWx02vV4H9ypCnPaANktCitKuQSiDA9l1U=
+</ds:P>
+ <ds:Q>NibbleAHappyWartHog
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSABadQ64.xml b/xmltoolingtest/data/DSABadQ64.xml
new file mode 100644
index 0000000..246a82d
--- /dev/null
+++ b/xmltoolingtest/data/DSABadQ64.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>ANVGAtN1Mxr3ZkxKcQqZaMxw2Qbre4jG8G+KFhcPYJQNjhpYH2O+DVWx02vV4H9ypCnPaANktCitKuQSiDA9l1U=
+</ds:P>
+ <ds:Q>RG1FUW9vK1lBVk5UVUdva2N5MWtpMDFXZ01mVEJzdlBxWWpSRHpjbUY3cDRvSjhuZVZDbjBCOTkwanY5Vzh2OGdwdnhyK3c1WnBRa0p5Ym5nSkZBanc9PQ==
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSABadQP.xml b/xmltoolingtest/data/DSABadQP.xml
new file mode 100644
index 0000000..f0c3ebb
--- /dev/null
+++ b/xmltoolingtest/data/DSABadQP.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>ANVGAtN1Mxr3ZkxKcQqZaMxw2Qbre4jG8G+KFhcPYJQNjhpYH2O+DVWx02vV4H9ypCnPaANktCitKuQSiDA9l1U=
+</ds:P>
+ <ds:Q>AK/apfGsK5pA4iia1j9qAR0Tdaw1
+</ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSANoQ.xml b/xmltoolingtest/data/DSANoQ.xml
new file mode 100644
index 0000000..467ad1f
--- /dev/null
+++ b/xmltoolingtest/data/DSANoQ.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>ANVGAtN1Mxr3ZkxKcQqZaMxw2Qbre4jG8G+KFhcPYJQNjhpYH2O+DVWx02vV4H9ypCnPaANktCitKuQSiDA9l1U=
+</ds:P>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSANoQP.xml b/xmltoolingtest/data/DSANoQP.xml
new file mode 100644
index 0000000..8235b9b
--- /dev/null
+++ b/xmltoolingtest/data/DSANoQP.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSANullQ.xml b/xmltoolingtest/data/DSANullQ.xml
new file mode 100644
index 0000000..80f6621
--- /dev/null
+++ b/xmltoolingtest/data/DSANullQ.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P>ANVGAtN1Mxr3ZkxKcQqZaMxw2Qbre4jG8G+KFhcPYJQNjhpYH2O+DVWx02vV4H9ypCnPaANktCitKuQSiDA9l1U=
+</ds:P>
+ <ds:Q></ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
diff --git a/xmltoolingtest/data/DSANullQP.xml b/xmltoolingtest/data/DSANullQP.xml
new file mode 100644
index 0000000..e3040e4
--- /dev/null
+++ b/xmltoolingtest/data/DSANullQP.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>Bar</ds:KeyName>
+ <ds:KeyValue>
+ <ds:DSAKeyValue>
+ <ds:P></ds:P>
+ <ds:Q></ds:Q>
+ <ds:G>DmEQoo+YAVNTUGokcy1ki01WgMfTBsvPqYjRDzcmF7p4oJ8neVCn0B990jv9W8v8gpvxr+w5ZpQkJybngJFAjw==
+</ds:G>
+ <ds:Y>AMJPFxCB9Kp6ekdM90H23zv4JNEhkm1qXNix44Xdl6IABgE896kpNzGQDCKf6iecO7oX+eTJl3KwT3oNE+8EQxk=
+</ds:Y>
+ </ds:DSAKeyValue>
+ </ds:KeyValue>
+</ds:KeyInfo>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list