forked from xmlsec/python-xmlsec
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtest_enc.py
More file actions
139 lines (113 loc) · 6.39 KB
/
test_enc.py
File metadata and controls
139 lines (113 loc) · 6.39 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
from tests import base
import xmlsec
consts = xmlsec.constants
class TestEncryptionContext(base.TestMemoryLeaks):
def test_init(self):
ctx = xmlsec.EncryptionContext(manager=xmlsec.KeysManager())
del ctx
def test_key(self):
ctx = xmlsec.EncryptionContext(manager=xmlsec.KeysManager())
self.assertIsNone(ctx.key)
ctx.key = xmlsec.Key.from_file(self.path("rsacert.pem"), format=consts.KeyDataFormatCertPem)
self.assertIsNotNone(ctx.key)
def test_encrypt_xml(self):
root = self.load_xml('enc1-in.xml')
enc_data = xmlsec.template.encrypted_data_create(
root, consts.TransformAes128Cbc, type=consts.TypeEncElement, ns="xenc"
)
xmlsec.template.encrypted_data_ensure_cipher_value(enc_data)
ki = xmlsec.template.encrypted_data_ensure_key_info(enc_data, ns="dsig")
ek = xmlsec.template.add_encrypted_key(ki, consts.TransformRsaOaep)
xmlsec.template.encrypted_data_ensure_cipher_value(ek)
data = root.find('./Data')
self.assertIsNotNone(data)
manager = xmlsec.KeysManager()
manager.add_key(xmlsec.Key.from_file(self.path("rsacert.pem"), format=consts.KeyDataFormatCertPem))
ctx = xmlsec.EncryptionContext(manager)
ctx.key = xmlsec.Key.generate(consts.KeyDataAes, 128, consts.KeyDataTypeSession)
encrypted = ctx.encrypt_xml(enc_data, data)
self.assertIsNotNone(encrypted)
enc_method = xmlsec.tree.find_child(enc_data, consts.NodeEncryptionMethod, consts.EncNs)
self.assertIsNotNone(enc_method)
self.assertEqual("http://www.w3.org/2001/04/xmlenc#aes128-cbc", enc_method.get("Algorithm"))
ki = xmlsec.tree.find_child(enc_data, consts.NodeKeyInfo, consts.DSigNs)
self.assertIsNotNone(ki)
enc_method2 = xmlsec.tree.find_node(ki, consts.NodeEncryptionMethod, consts.EncNs)
self.assertIsNotNone(enc_method2)
self.assertEqual("http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", enc_method2.get("Algorithm"))
cipher_value = xmlsec.tree.find_node(ki, consts.NodeCipherValue, consts.EncNs)
self.assertIsNotNone(cipher_value)
def test_encrypt_binary(self):
root = self.load_xml('enc2-in.xml')
enc_data = xmlsec.template.encrypted_data_create(
root, consts.TransformAes128Cbc, type=consts.TypeEncContent, ns="xenc", mime_type="binary/octet-stream"
)
xmlsec.template.encrypted_data_ensure_cipher_value(enc_data)
ki = xmlsec.template.encrypted_data_ensure_key_info(enc_data, ns="dsig")
ek = xmlsec.template.add_encrypted_key(ki, consts.TransformRsaOaep)
xmlsec.template.encrypted_data_ensure_cipher_value(ek)
manager = xmlsec.KeysManager()
manager.add_key(xmlsec.Key.from_file(self.path("rsacert.pem"), format=consts.KeyDataFormatCertPem))
ctx = xmlsec.EncryptionContext(manager)
ctx.key = xmlsec.Key.generate(consts.KeyDataAes, 128, consts.KeyDataTypeSession)
encrypted = ctx.encrypt_binary(enc_data, b'test')
self.assertIsNotNone(encrypted)
self.assertEqual("{%s}%s" % (consts.EncNs, consts.NodeEncryptedData), encrypted.tag)
enc_method = xmlsec.tree.find_child(enc_data, consts.NodeEncryptionMethod, consts.EncNs)
self.assertIsNotNone(enc_method)
self.assertEqual("http://www.w3.org/2001/04/xmlenc#aes128-cbc", enc_method.get("Algorithm"))
ki = xmlsec.tree.find_child(enc_data, consts.NodeKeyInfo, consts.DSigNs)
self.assertIsNotNone(ki)
enc_method2 = xmlsec.tree.find_node(ki, consts.NodeEncryptionMethod, consts.EncNs)
self.assertIsNotNone(enc_method2)
self.assertEqual("http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", enc_method2.get("Algorithm"))
cipher_value = xmlsec.tree.find_node(ki, consts.NodeCipherValue, consts.EncNs)
self.assertIsNotNone(cipher_value)
def test_decrypt1(self):
self.check_decrypt(1)
def test_decrypt2(self):
self.check_decrypt(2)
def test_decrypt_key(self):
root = self.load_xml('enc3-out.xml')
enc_key = xmlsec.tree.find_child(root, consts.NodeEncryptedKey, consts.EncNs)
self.assertIsNotNone(enc_key)
manager = xmlsec.KeysManager()
manager.add_key(xmlsec.Key.from_file(self.path("rsakey.pem"), format=consts.KeyDataFormatPem))
ctx = xmlsec.EncryptionContext(manager)
keydata = ctx.decrypt(enc_key)
ctx.reset()
root.remove(enc_key)
ctx.key = xmlsec.Key.from_binary_data(consts.KeyDataAes, keydata)
enc_data = xmlsec.tree.find_child(root, consts.NodeEncryptedData, consts.EncNs)
self.assertIsNotNone(enc_data)
decrypted = ctx.decrypt(enc_data)
self.assertIsNotNone(decrypted)
self.assertEqual(self.load_xml("enc3-in.xml"), decrypted)
def check_decrypt(self, i):
root = self.load_xml('enc%d-out.xml' % i)
enc_data = xmlsec.tree.find_child(root, consts.NodeEncryptedData, consts.EncNs)
self.assertIsNotNone(enc_data)
manager = xmlsec.KeysManager()
manager.add_key(xmlsec.Key.from_file(self.path("rsakey.pem"), format=consts.KeyDataFormatPem))
ctx = xmlsec.EncryptionContext(manager)
decrypted = ctx.decrypt(enc_data)
self.assertIsNotNone(decrypted)
self.assertEqual(self.load_xml("enc%d-in.xml" % i), root)
def check_no_segfault(self):
namespaces = {
'soap': 'http://schemas.xmlsoap.org/soap/envelope/'
}
manager = xmlsec.KeysManager()
key = xmlsec.Key.from_file(self.path("rsacert.pem"), format=consts.KeyDataFormatCertPem)
manager.add_key(key)
template = self.load_xml('enc-bad-in.xml')
enc_data = xmlsec.template.encrypted_data_create(
template, xmlsec.Transform.AES128, type=xmlsec.EncryptionType.CONTENT, ns='xenc')
xmlsec.template.encrypted_data_ensure_cipher_value(enc_data)
key_info = xmlsec.template.encrypted_data_ensure_key_info(enc_data, ns='dsig')
enc_key = xmlsec.template.add_encrypted_key(key_info, xmlsec.Transform.RSA_PKCS1)
xmlsec.template.encrypted_data_ensure_cipher_value(enc_key)
data = template.find('soap:Body', namespaces=namespaces)
enc_ctx = xmlsec.EncryptionContext(manager)
enc_ctx.key = xmlsec.Key.generate(xmlsec.KeyData.AES, 192, xmlsec.KeyDataType.SESSION)
self.assertRaises(Exception, enc_ctx.encrypt_xml(enc_data, data))