Changeset 1947
- Timestamp:
- 03/01/07 17:17:49 (14 years ago)
- Location:
- TI12-security/trunk/python
- Files:
-
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
TI12-security/trunk/python/ndg.security.common/ndg/security/common/XMLSec.py
r1946 r1947 1 1 """NDG XML Security - Encryption and Digital Signature 2 2 3 Wraps pyXMLSec package4 5 3 Nerc Data Grid Project 6 4 7 5 P J Kershaw 05/04/05 8 6 9 Copyright (C) 2006 CCLRC & NERC 7 P J Kershaw 03/01/07: Re-write to use M2Crypto, ZSI and DOM instead of 8 pyXMLSec 10 9 11 10 This software may be distributed under the terms of the Q Public License, … … 30 29 # associated note 31 30 from xml.dom.ext.reader.PyExpat import Reader 31 32 # Digest and signature/verify 33 from sha import sha 34 from M2Crypto import X509, BIO, RSA 35 import base64 36 37 # Canonicalization 38 from ZSI.wstools.c14n import Canonicalize 39 from xml.dom import Node 40 from xml.xpath.Context import Context 41 from xml import xpath 42 43 from ZSI.wstools.Namespaces import DSIG 32 44 33 45 … … 1481 1493 fdel=__delFilePath, 1482 1494 doc="File Path for XML document to apply security to") 1483 1484 1485 #_________________________________________________________________________ 1486 def __setCertFilePathList(self, filePath): 1495 1496 1497 def __getDocNode(self): 1498 """Get file path for file to be signed/encrypted.""" 1499 return self.__docNode 1500 1501 1502 def __delDocNode(self): 1503 """Prevent file path being deleted.""" 1504 raise AttributeError, "\"docNode\" cannot be deleted" 1505 1506 1507 # Publish attribute as read/write 1508 docNode = property(fget=__getDocNode, 1509 fdel=__delDocNode, 1510 doc="DOM document node for XML") 1511 1512 #_________________________________________________________________________ 1513 def __setCertdocNodeList(self, filePath): 1487 1514 """File path for certificate used to sign document / 1488 1515 list of certificates used to check the signature of a document""" … … 1627 1654 inclX509SubjName=True, 1628 1655 inclX509IssSerial=True, 1629 rtnAsString=False): 1656 rtnAsString=False, 1657 **c14nKw): 1630 1658 """Sign XML document using an X.509 certificate private key 1631 1659 … … 1657 1685 self.parse(xmlTxt) 1658 1686 1659 1687 if self.__docNode is None: 1688 XMLSecDocError, "XML to be signed has not been read in or parsed." 1689 1660 1690 # Set private key file 1661 1691 if signingKeyFilePath is not None: … … 1666 1696 if certFilePathList is not None: 1667 1697 self.__setCertFilePathList(certFilePathList) 1668 1669 # Return as required 1670 if rtnAsString: 1671 return self.asString() 1672 1673 1674 # Add X.509 cert as binary security token 1675 x509Cert = X509.load_cert(self.__certFilePathList[0]) 1676 1677 x509CertPat = re.compile(\ 1678 '-----BEGIN CERTIFICATE-----\n?(.*?)\n?-----END CERTIFICATE-----', 1679 re.S) 1680 x509CertStr = x509CertPat.findall(x509Cert.as_pem())[0] 1681 1682 soapWriter._header.setNamespaceAttribute('ds', DSIG.BASE) 1683 soapWriter._header.setNamespaceAttribute('ec', DSIG.C14N_EXCL) 1684 1685 1686 # Change value and encoding types to suite WebSphere 1687 # binSecTokElem.node.setAttribute('ValueType', "wsse:X509v3") 1688 valueType = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509" 1689 binSecTokElem.node.setAttribute('ValueType', valueType) 1690 # binSecTokElem.node.setAttribute('EncodingType', "wsse:Base64Binary") 1691 encodingType = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" 1692 binSecTokElem.node.setAttribute('EncodingType', encodingType) 1693 1694 # Add ID so that the binary token can be included in the signature 1695 binSecTokElem.node.setAttribute('wsu:Id', "binaryToken") 1696 1697 binSecTokElem.createAppendTextNode(x509CertStr) 1698 1699 self.__docNode.setNamespaceAttribute('ds', DSIG.BASE) 1700 self.__docNode.setNamespaceAttribute('ec', DSIG.C14N_EXCL) 1698 1701 1699 1702 1700 1703 # Signature 1701 signatureElem = wsseElem.createAppendElement(DSIG.BASE, 'Signature') 1704 signatureElem = self.__docNode.createAppendElement(DSIG.BASE, 1705 'Signature') 1702 1706 signatureElem.setNamespaceAttribute('ds', DSIG.BASE) 1703 1707 … … 1713 1717 c14nMethodElem.node.setAttribute('Algorithm', DSIG.C14N_EXCL) 1714 1718 c14nInclNamespacesElem = c14nMethodElem.createAppendElement(\ 1715 DSIG.C14N_EXCL,1716 'InclusiveNamespaces')1719 DSIG.C14N_EXCL, 1720 'InclusiveNamespaces') 1717 1721 c14nInclNamespacesElem.node.setAttribute('PrefixList', 1718 1722 ' '.join(signedInfoC14nKw['unsuppressedPrefixes'])) … … 1721 1725 sigMethodElem = signedInfoElem.createAppendElement(DSIG.BASE, 1722 1726 'SignatureMethod') 1723 #sigMethodElem.node.setAttribute('Algorithm', DSIG.DIGEST_SHA1)1724 1727 sigMethodElem.node.setAttribute('Algorithm', DSIG.SIG_RSA_SHA1) 1725 1728 … … 1741 1744 'ds': DSIG.BASE, 1742 1745 } 1743 ctxt = Context(docNode, processorNss=processorNss) 1744 idNodes = xpath.Evaluate('//*[@wsu:Id]', 1745 contextNode=docNode, 1746 context=ctxt) 1746 ctxt = Context(self.__docNode, processorNss=processorNss) 1747 1747 1748 1748 # 1) Reference Generation 1749 1749 # 1750 1750 # Find references 1751 c14nKw = {} 1752 c14nKw['unsuppressedPrefixes'] = ['xmlns', 'xsi', 'xsd', 'SOAP-ENV', 'wsu', 'wsse', 'ns1'] 1753 for idNode in idNodes: 1754 1755 # Set URI attribute to point to reference to be signed 1756 #uri = u"#" + idNode.getAttribute('wsu:Id') 1757 uri = u"#" + idNode.attributes[(_WSU.UTILITY, 'Id')].value 1758 1759 # Canonicalize reference 1760 c14nRef = Canonicalize(idNode, **c14nKw) 1761 1762 # Calculate digest for reference and base 64 encode 1763 # 1764 # Nb. encodestring adds a trailing newline char 1765 digestValue = base64.encodestring(sha(c14nRef).digest()).strip() 1766 1767 1768 # Add a new reference element to SignedInfo 1769 refElem = signedInfoElem.createAppendElement(DSIG.BASE, 1770 'Reference') 1771 refElem.node.setAttribute('URI', uri) 1772 1773 # Use ds:Transforms or wsse:TransformationParameters? 1774 transformsElem = refElem.createAppendElement(DSIG.BASE, 1775 'Transforms') 1776 transformElem = transformsElem.createAppendElement(DSIG.BASE, 1777 'Transform') 1778 transformElem.node.setAttribute('Algorithm', DSIG.C14N_EXCL) 1779 1780 inclNamespacesElem = transformElem.createAppendElement(\ 1781 DSIG.C14N_EXCL, 1782 'InclusiveNamespaces') 1783 inclNamespacesElem.node.setAttribute('PrefixList', 1784 ' '.join(c14nKw['unsuppressedPrefixes'])) 1785 1786 # Digest Method 1787 digestMethodElem = refElem.createAppendElement(DSIG.BASE, 1788 'DigestMethod') 1789 digestMethodElem.node.setAttribute('Algorithm', DSIG.DIGEST_SHA1) 1790 1791 # Digest Value 1792 digestValueElem = refElem.createAppendElement(DSIG.BASE, 1793 'DigestValue') 1794 digestValueElem.createAppendTextNode(digestValue) 1751 if not c14nKw: 1752 c14nKw['unsuppressedPrefixes'] = ['xmlns', 'ns1'] 1753 1754 # Canonicalize reference 1755 c14nRef = Canonicalize(idNode, **c14nKw) 1756 1757 # Calculate digest for reference and base 64 encode 1758 # 1759 # Nb. encodestring adds a trailing newline char 1760 digestValue = base64.encodestring(sha(c14nRef).digest()).strip() 1761 1762 1763 # Add a new reference element to SignedInfo 1764 refElem = signedInfoElem.createAppendElement(DSIG.BASE, 'Reference') 1765 1766 # Use ds:Transforms or wsse:TransformationParameters? 1767 transformsElem = refElem.createAppendElement(DSIG.BASE, 1768 'Transforms') 1769 transformElem = transformsElem.createAppendElement(DSIG.BASE, 1770 'Transform') 1771 transformElem.node.setAttribute('Algorithm', DSIG.C14N_EXCL) 1772 1773 inclNamespacesElem = transformElem.createAppendElement(\ 1774 DSIG.C14N_EXCL, 1775 'InclusiveNamespaces') 1776 inclNamespacesElem.node.setAttribute('PrefixList', 1777 ' '.join(c14nKw['unsuppressedPrefixes'])) 1778 1779 # Digest Method 1780 digestMethodElem = refElem.createAppendElement(DSIG.BASE, 1781 'DigestMethod') 1782 digestMethodElem.node.setAttribute('Algorithm', DSIG.DIGEST_SHA1) 1783 1784 # Digest Value 1785 digestValueElem = refElem.createAppendElement(DSIG.BASE, 1786 'DigestValue') 1787 digestValueElem.createAppendTextNode(digestValue) 1795 1788 1796 1789 … … 1845 1838 print "Signature Generated" 1846 1839 print str(soapWriter) 1840 1841 if inclX509Cert: 1842 # Add X.509 cert 1843 x509Cert = X509.load_cert(self.__certFilePathList[0]) 1844 1845 x509CertPat = re.compile(\ 1846 '-----BEGIN CERTIFICATE-----\n?(.*?)\n?-----END CERTIFICATE-----', 1847 re.S) 1848 x509CertStr = x509CertPat.findall(x509Cert.as_pem())[0] 1849 1850 x509CertElem.createAppendTextNode(x509CertStr) 1851 1852 # Return as required 1853 if rtnAsString: 1854 return self.asString() 1847 1855 1848 1856 -
TI12-security/trunk/python/ndg.security.test/ndg/security/test/XMLSecDoc/xmlSecDocTest.py
r1945 r1947 74 74 75 75 try: 76 certFilePathList = self.cfg['test2Sign']['certfile'] 77 signingKeyFilePath = self.cfg['test2Sign']['keyfile'] 76 78 self.xmlSecDoc.sign() 77 79 except: … … 82 84 83 85 try: 84 self.xmlSecDoc.filePath = self.cfg['test3Write'] .get('filePath')86 self.xmlSecDoc.filePath = self.cfg['test3Write']['filePath'] 85 87 self.xmlSecDoc.write() 86 88 except:
Note: See TracChangeset
for help on using the changeset viewer.
