Author: atsushi
Date: 2006-12-08 02:25:13 -0500 (Fri, 08 Dec 2006)
New Revision: 69220
Modified:
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/ChangeLog
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/MessageSecurityUtility.cs
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/ChangeLog
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/SecurityMessageProperty.cs
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/ChangeLog
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/SecurityMessagePropertyTest.cs
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/WSSecurityTokenSerializerTest.cs
Log:
2006-12-08 Atsushi Enomoto <[EMAIL PROTECTED]>
* MessageSecurityUtility.cs : fixed EncryptedData decryption to
consider DerivedKeyTokens correctly.
When creating LocalId, don't add '#' here.
* SecurityMessageProperty.cs : initialize SenderIdPrefix as "_".
* SecurityMessagePropertyTest.cs : test SenderIdPrefix as well.
* WSSecurityTokenSerializerTest.cs : added test for writing
LocalIdKeyIdentifierClause.
Modified:
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/ChangeLog
===================================================================
---
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/ChangeLog
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/ChangeLog
2006-12-08 07:25:13 UTC (rev 69220)
@@ -1,3 +1,9 @@
+2006-12-08 Atsushi Enomoto <[EMAIL PROTECTED]>
+
+ * MessageSecurityUtility.cs : fixed EncryptedData decryption to
+ consider DerivedKeyTokens correctly.
+ When creating LocalId, don't add '#' here.
+
2006-12-07 Atsushi Enomoto <[EMAIL PROTECTED]>
* MessageSecurityUtility.cs :
Modified:
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/MessageSecurityUtility.cs
===================================================================
---
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/MessageSecurityUtility.cs
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/System.ServiceModel.Channels/MessageSecurityUtility.cs
2006-12-08 07:25:13 UTC (rev 69220)
@@ -338,7 +338,7 @@
edata.KeyInfo = new KeyInfo ();
LocalIdKeyIdentifierClause ident =
- new LocalIdKeyIdentifierClause ("#" + ekey.Id);
+ new LocalIdKeyIdentifierClause (ekey.Id);
KeyInfoClause kic = new SecurityTokenReferenceKeyInfo
(ident, serializer, doc);
edata.KeyInfo.AddClause (kic);
edata.CipherData.CipherValue = encrypted;
@@ -467,32 +467,36 @@
// create derived keys
// FIXME: an alternative approach is to make use of
// EncryptedXml.AddKeyNameMapping().
- Dictionary<string,byte[]> map = GetUriKeyMappings
(security, nsmgr, decryptedKey);
- foreach (XmlElement rlist in security.SelectNodes
("e:ReferenceList", nsmgr))
- foreach (XmlElement encref in rlist.SelectNodes
("e:DataReference | e:KeyReference", nsmgr))
- map [StripUri (encref.GetAttribute
("URI"))] = decryptedKey;
- Rijndael aes = RijndaelManaged.Create ();
+ Dictionary<string,byte[]> map = ResolveDerivedKeys
(security, nsmgr, decryptedKey);
+ if (encryptedKey.Id != null)
+ map [encryptedKey.Id] = decryptedKey;
+ Rijndael aes = RijndaelManaged.Create (); // it is
reused with every key
aes.Key = map [String.Empty];
aes.Mode = CipherMode.CBC;
// decrypt the body with the decrypted key
+ Collection<string> references = new Collection<string>
();
+ foreach (XmlElement rlist in security.SelectNodes
("e:ReferenceList", nsmgr))
+ foreach (XmlElement encref in rlist.SelectNodes
("e:DataReference | e:KeyReference", nsmgr))
+ references.Add (StripUri
(encref.GetAttribute ("URI")));
+
Collection<XmlElement> list = new
Collection<XmlElement> ();
- foreach (string uri in map.Keys) {
- if (uri == String.Empty)
- continue; // skip
+ foreach (string uri in references) {
XmlElement el = doc.SelectSingleNode
("//e:EncryptedData [EMAIL PROTECTED]'" + uri + "' or @u:Id='" + uri + "']",
nsmgr) as XmlElement;
if (el != null)
list.Add (el);
else
- throw new MessageSecurityException
(String.Format ("On decrypting EncryptedData, a referenced element with Id
'{0}' was not found.", uri));
-}
+ throw new MessageSecurityException
(String.Format ("On decryption, EncryptedData with Id '{0}', referenced by
ReferenceData, was not found.", uri));
+ }
foreach (XmlElement el in list) {
EncryptedData ed2 = new EncryptedData ();
ed2.LoadXml (el);
- if (map.ContainsKey (ed2.Id))
- aes.Key = map [ed2.Id];
+ XmlElement keyRefNode = el.SelectSingleNode
("dsig:KeyInfo/o:SecurityTokenReference/o:Reference", nsmgr) as XmlElement;
+ string keyUri = (keyRefNode != null) ? StripUri
(keyRefNode.GetAttribute ("URI")) : String.Empty;
+ if (map.ContainsKey (keyUri))
+ aes.Key = map [keyUri];
else
- throw new XmlException (String.Format
("Encryption key for '{0}' was not found.", ed2.Id));
+ throw new XmlException (String.Format
("Encryption key for '{0}' was not found. URI is '{1}'", ed2.Id, keyUri));
encXml.ReplaceData (el, DecryptLax (encXml,
ed2, aes));
}
@@ -502,11 +506,11 @@
// FIXME: this should consider the referent SecurityToken of
// each DerivedKeyToken element.
- static Dictionary<string,byte[]> GetUriKeyMappings (XmlElement
security, XmlNamespaceManager nsmgr, byte [] decryptedKey)
+ static Dictionary<string,byte[]> ResolveDerivedKeys (XmlElement
security, XmlNamespaceManager nsmgr, byte [] decryptedKey)
{
XmlDocument doc = security.OwnerDocument;
- // create derived keys
+ // create mapping from Id to derived keys
Dictionary<string,byte[]> keys = new
Dictionary<string,byte[]> ();
// default, unless overriden by the default
DerivedKeyToken.
keys [String.Empty] = decryptedKey;
@@ -515,25 +519,16 @@
new InMemorySymmetricSecurityKey (decryptedKey);
byte [] currentKey = decryptedKey;
- bool hasSpecificMap = false;
foreach (XmlNode n in security.ChildNodes) {
XmlElement el = n as XmlElement;
if (el == null)
continue;
if (el.LocalName == "DerivedKeyToken" &&
el.NamespaceURI == Constants.WsscNamespace)
{
- if (!hasSpecificMap)
- keys [String.Empty] =
currentKey;
- hasSpecificMap = false;
- currentKey = GetDerivedKeyBytes (el,
skey, nsmgr);
- } else if (el.LocalName == "ReferenceList" &&
- el.NamespaceURI ==
EncryptedXml.XmlEncNamespaceUrl) {
- hasSpecificMap = true;
-
- foreach (XmlElement r in el.SelectNodes
("e:DataReference", nsmgr))
- keys [StripUri (r.GetAttribute
("URI"))] = currentKey;
- foreach (XmlElement r in el.SelectNodes
("e:KeyReference", nsmgr))
- keys [StripUri (r.GetAttribute
("URI"))] = currentKey;
+ byte [] key = GetDerivedKeyBytes (el,
skey, nsmgr);
+ string id = el.GetAttribute ("Id",
Constants.WsuNamespace);
+ id = (id == null) ? String.Empty : id;
+ keys [id] = key;
}
}
Modified:
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/ChangeLog
===================================================================
---
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/ChangeLog
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/ChangeLog
2006-12-08 07:25:13 UTC (rev 69220)
@@ -1,5 +1,9 @@
2006-12-08 Atsushi Emomoto <[EMAIL PROTECTED]>
+ * SecurityMessageProperty.cs : initialize SenderIdPrefix as "_".
+
+2006-12-08 Atsushi Emomoto <[EMAIL PROTECTED]>
+
* SecurityContextKeyIdentifierClause.cs,
SecurityAccessDeniedException.cs,
ExpiredSecurityTokenException.cs : added missing types.
Modified:
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/SecurityMessageProperty.cs
===================================================================
---
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/SecurityMessageProperty.cs
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/System.ServiceModel.Security/SecurityMessageProperty.cs
2006-12-08 07:25:13 UTC (rev 69220)
@@ -42,12 +42,11 @@
Collection<SupportingTokenSpecification> incoming_supp_tokens =
new Collection<SupportingTokenSpecification> ();
ReadOnlyCollection<IAuthorizationPolicy> policies;
- string sender_id_prefix;
- ServiceSecurityContext context;
+ string sender_id_prefix = "_";
+ ServiceSecurityContext context =
ServiceSecurityContext.Anonymous;
public SecurityMessageProperty ()
{
- context = ServiceSecurityContext.Anonymous;
}
public bool HasIncomingSupportingTokens {
Modified:
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/ChangeLog
===================================================================
---
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/ChangeLog
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/ChangeLog
2006-12-08 07:25:13 UTC (rev 69220)
@@ -1,5 +1,11 @@
2006-12-08 Atsushi Enomoto <[EMAIL PROTECTED]>
+ * SecurityMessagePropertyTest.cs : test SenderIdPrefix as well.
+ * WSSecurityTokenSerializerTest.cs : added test for writing
+ LocalIdKeyIdentifierClause.
+
+2006-12-08 Atsushi Enomoto <[EMAIL PROTECTED]>
+
* ServiceSecurityContextTest.cs : new test.
* SecurityMessagePropertyTest.cs : after making several effort to
make GetOrCreateSecureMessage() pass (with new
Modified:
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/SecurityMessagePropertyTest.cs
===================================================================
---
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/SecurityMessagePropertyTest.cs
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/SecurityMessagePropertyTest.cs
2006-12-08 07:25:13 UTC (rev 69220)
@@ -149,6 +149,7 @@
// Assert.AreEqual (0,
p.ExternalAuthorizationPolicies.Count, "#5");
Assert.IsFalse (p.HasIncomingSupportingTokens, "#6");
Assert.IsNotNull (p.IncomingSupportingTokens, "#6-2");
+ Assert.AreEqual ("_", p.SenderIdPrefix, "#6-3");
ServiceSecurityContext ssc = p.ServiceSecurityContext;
Assert.IsNotNull (ssc, "#7");
@@ -245,6 +246,8 @@
Assert.IsNull (p.ExternalAuthorizationPolicies, "#5");
// Assert.AreEqual (0,
p.ExternalAuthorizationPolicies.Count, "#5");
Assert.IsFalse (p.HasIncomingSupportingTokens, "#6");
+ Assert.IsNotNull (p.IncomingSupportingTokens, "#6-2");
+ Assert.AreEqual ("_", p.SenderIdPrefix, "#6-3");
ServiceSecurityContext ssc = p.ServiceSecurityContext;
Assert.IsNotNull (ssc, "#7");
@@ -274,6 +277,8 @@
Assert.IsNull (p.ExternalAuthorizationPolicies, "#5");
// Assert.AreEqual (0,
p.ExternalAuthorizationPolicies.Count, "#5");
Assert.IsFalse (p.HasIncomingSupportingTokens, "#6");
+ Assert.IsNotNull (p.IncomingSupportingTokens, "#6-2");
+ Assert.AreEqual ("_", p.SenderIdPrefix, "#6-3");
ServiceSecurityContext ssc = p.ServiceSecurityContext;
Assert.IsNotNull (ssc, "#7");
Modified:
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/WSSecurityTokenSerializerTest.cs
===================================================================
---
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/WSSecurityTokenSerializerTest.cs
2006-12-08 05:02:31 UTC (rev 69219)
+++
trunk/olive/class/System.ServiceModel/Test/System.ServiceModel.Security/WSSecurityTokenSerializerTest.cs
2006-12-08 07:25:13 UTC (rev 69220)
@@ -243,6 +243,29 @@
}
[Test]
+ public void WriteLocalIdKeyIdentifierClause1 ()
+ {
+ StringWriter sw = new StringWriter ();
+ LocalIdKeyIdentifierClause ic = new
LocalIdKeyIdentifierClause ("urn:myIDValue");
+ using (XmlWriter w = XmlWriter.Create (sw,
GetWriterSettings ())) {
+
WSSecurityTokenSerializer.DefaultInstance.WriteKeyIdentifierClause (w, ic);
+ }
+ Assert.AreEqual ("<o:SecurityTokenReference
xmlns:o=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\";><o:Reference
URI=\"#urn:myIDValue\" /></o:SecurityTokenReference>", sw.ToString (), "#1");
+ }
+
+ [Test]
+ public void WriteLocalIdKeyIdentifierClause2 ()
+ {
+ StringWriter sw = new StringWriter ();
+ LocalIdKeyIdentifierClause ic = new
LocalIdKeyIdentifierClause ("#urn:myIDValue");
+ using (XmlWriter w = XmlWriter.Create (sw,
GetWriterSettings ())) {
+
WSSecurityTokenSerializer.DefaultInstance.WriteKeyIdentifierClause (w, ic);
+ }
+ // ... so, specifying an URI including '#' does not
make sense
+ Assert.AreEqual ("<o:SecurityTokenReference
xmlns:o=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\";><o:Reference
URI=\"##urn:myIDValue\" /></o:SecurityTokenReference>", sw.ToString (), "#2");
+ }
+
+ [Test]
public void ReadKeyIdentifierClause ()
{
string xml = @"<o:SecurityTokenReference
xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
