Actually use the correct patch versions

0005-tests-use-self-generated-certificate-to-sign-federat.patch

@@ -28,17 +28,17 @@ index c08cab69..84999a17 100644
 --- a/tests/basic_tests.c
 +++ b/tests/basic_tests.c
 @@ -1983,24 +1983,13 @@ START_TEST(test13_test_lasso_server_load_metadata)
-	block_lasso_logs;
-	check_good_rc(lasso_server_load_metadata(server, LASSO_PROVIDER_ROLE_IDP,
-				TESTSDATADIR "/metadata/renater-metadata.xml",
+ 	block_lasso_logs;
+ 	check_good_rc(lasso_server_load_metadata(server, LASSO_PROVIDER_ROLE_IDP,
+ 				TESTSDATADIR "/metadata/renater-metadata.xml",
 -				TESTSDATADIR "/metadata/metadata-federation-renater.crt",
 +				TESTSDATADIR "/rootCA.crt",
-				&blacklisted_1, &loaded_entity_ids,
-				LASSO_SERVER_LOAD_METADATA_FLAG_DEFAULT));
-	unblock_lasso_logs;
-	check_equals(g_hash_table_size(server->providers), 110);
-	check_equals(g_list_length(loaded_entity_ids), 110);
-
+ 				&blacklisted_1, &loaded_entity_ids,
+ 				LASSO_SERVER_LOAD_METADATA_FLAG_DEFAULT));
+ 	unblock_lasso_logs;
+ 	check_equals(g_hash_table_size(server->providers), 110);
+ 	check_equals(g_list_length(loaded_entity_ids), 110);
+ 
 -#if 0
 -	/* UK federation file are too big to distribute (and I don't even known if it's right to do
 -	 * it, disable this test for now ) */
@@ -50,9 +50,9 @@ index c08cab69..84999a17 100644
 -	check_equals(g_list_length(loaded_entity_ids), 283);
 -	check_equals(g_hash_table_size(server->providers), 393);
 -#endif
-	lasso_release_list_of_strings(loaded_entity_ids);
-
-	lasso_release_gobject(server);
+ 	lasso_release_list_of_strings(loaded_entity_ids);
+ 
+ 	lasso_release_gobject(server);
 diff --git a/tests/data/lasso.crt b/tests/data/lasso.crt
 new file mode 100644
 index 00000000..568a0b9c
@@ -242,9 +242,9 @@ index 868f9259..70517100 100644
  </ds:KeyInfo>
  </ds:Signature>
 @@ -1277,7 +1292,7 @@ Ugr24VE4pUTqq2xGSOazVN0EKSqULXvM9ZHupGDCJmRH4P3H/X4w8Cq5Y6c0pDtJ
-
+           
           <!-- source : http://idpdisc.tge-adonis.fr/exportmetadata.xml -->
-
+ 
 -            <EntityDescriptor entityID="https://opensso.tge-adonis.fr:8443/opensso" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 +            <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://opensso.tge-adonis.fr:8443/opensso">
    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
@@ -260,18 +260,18 @@ index 868f9259..70517100 100644
      <KeyDescriptor use="signing">
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 @@ -15545,7 +15560,7 @@ oZQx
-
+           
           <!-- source : http://science.thomsonreuters.com/m/xml/SP-Metadata.xml -->
-
+ 
 -            <!-- Thomson Reuters 23.08.2010 --><!-- *************************************** --><!-- SP https://sp.tshhosting.com/shibboleth --><!-- *************************************** --><EntityDescriptor entityID="https://sp.tshhosting.com/shibboleth" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 +            <!-- Thomson Reuters 23.08.2010 --><!-- *************************************** --><!-- SP https://sp.tshhosting.com/shibboleth --><!-- *************************************** --><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sp.tshhosting.com/shibboleth">
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
      <Extensions>
        <idpdisc:DiscoveryResponse xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://www.isiknowledge.com/" index="1"/>
 @@ -30065,4 +30080,4 @@ ihb/MX5UR6g83EMmqZsFt57ANEORMNQywxFa4Q==
-
-
-
+ 
+ 
+ 
 -</EntitiesDescriptor>
 \ No newline at end of file
 +</EntitiesDescriptor>
@@ -377,5 +377,6 @@ index 00000000..8c619f27
 +++ b/tests/data/rootCA.srl
 @@ -0,0 +1 @@
 +02D3FA5376B8B25617BA76C4EA3AE7FE4AC318B1
---
+-- 
 2.20.1
+

0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch

@@ -45,15 +45,15 @@ index 028ffb31..91ff302d 100644
 +++ b/lasso/saml-2.0/login.c
 @@ -1107,18 +1107,31 @@ lasso_saml20_login_process_paos_response_msg(LassoLogin *login, gchar *msg)
  {
-	LassoSoapHeader *header = NULL;
-	LassoProfile *profile;
+ 	LassoSoapHeader *header = NULL;
+ 	LassoProfile *profile;
 -	int rc1, rc2;
 +	int rc;
-
-	lasso_null_param(msg);
-
-	profile = LASSO_PROFILE(login);
-
+ 
+ 	lasso_null_param(msg);
+ 
+ 	profile = LASSO_PROFILE(login);
+ 
 -	rc1 = lasso_saml20_profile_process_soap_response_with_headers(profile, msg, &header);
 +        /*
 +         * lasso_saml20_profile_process_soap_response_with_headers()
@@ -69,20 +69,20 @@ index 028ffb31..91ff302d 100644
 +        if (rc != 0 && rc != LASSO_DS_ERROR_SIGNATURE_NOT_FOUND) {
 +            return rc;
 +        }
-
-	/*
-	 * If the SOAP message contained a header check for the optional
+ 
+ 	/*
+ 	 * If the SOAP message contained a header check for the optional
 -     * paos:Response and ecp:RelayState elements, if they exist extract their
 -     * values into the profile.
 +	 * paos:Response and ecp:RelayState elements, if they exist extract their
 +	 * values into the profile.
-	 */
-	if (header) {
-		GList *i = NULL;
+ 	 */
+ 	if (header) {
+ 		GList *i = NULL;
 @@ -1142,12 +1155,8 @@ lasso_saml20_login_process_paos_response_msg(LassoLogin *login, gchar *msg)
-		lasso_release_gobject(header);
-	}
-
+ 		lasso_release_gobject(header);
+ 	}
+ 
 -	rc2 = lasso_saml20_login_process_response_status_and_assertion(login);
 -	if (rc1) {
 -		return rc1;
@@ -92,156 +92,156 @@ index 028ffb31..91ff302d 100644
 +	rc = lasso_saml20_login_process_response_status_and_assertion(login);
 +	return rc;
  }
-
+ 
  /**
 diff --git a/lasso/saml-2.0/profile.c b/lasso/saml-2.0/profile.c
 index 8171e79e..22a4e08c 100644
 --- a/lasso/saml-2.0/profile.c
 +++ b/lasso/saml-2.0/profile.c
 @@ -398,6 +398,7 @@ lasso_saml20_profile_process_artifact_resolve(LassoProfile *profile, const char
-
-	switch (lasso_profile_get_signature_verify_hint(profile)) {
-		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE:
+ 
+ 	switch (lasso_profile_get_signature_verify_hint(profile)) {
+ 		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE:
 +		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE:
-			rc = profile->signature_status;
-			break;
-		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE:
+ 			rc = profile->signature_status;
+ 			break;
+ 		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE:
 @@ -1559,6 +1560,7 @@ lasso_saml20_profile_process_soap_response_with_headers(LassoProfile *profile,
-			remote_provider, response_msg, "ID", LASSO_MESSAGE_FORMAT_SOAP);
-	switch (lasso_profile_get_signature_verify_hint(profile)) {
-		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE:
+ 			remote_provider, response_msg, "ID", LASSO_MESSAGE_FORMAT_SOAP);
+ 	switch (lasso_profile_get_signature_verify_hint(profile)) {
+ 		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE:
 +		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE:
-			rc = profile->signature_status;
-			break;
-		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE:
+ 			rc = profile->signature_status;
+ 			break;
+ 		case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE:
 diff --git a/tests/login_tests_saml2.c b/tests/login_tests_saml2.c
 index 54c7fb63..e331c07a 100644
 --- a/tests/login_tests_saml2.c
 +++ b/tests/login_tests_saml2.c
 @@ -1090,42 +1090,42 @@ START_TEST(test08_test_authnrequest_flags)
-	make_context(sp_context, "sp5-saml2", "", LASSO_PROVIDER_ROLE_IDP, "idp5-saml2", "")
-
-	block_lasso_logs;
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 	make_context(sp_context, "sp5-saml2", "", LASSO_PROVIDER_ROLE_IDP, "idp5-saml2", "")
+ 
+ 	block_lasso_logs;
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.use_assertion_consumer_service_idx = 1,
-				.assertion_consumer_service_idx = 0,
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.use_assertion_consumer_service_idx = 1,
+ 				.assertion_consumer_service_idx = 0,
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.assertion_consumer_service_url = "http://sp5/singleSignOnPost",
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.assertion_consumer_service_url = "http://sp5/singleSignOnPost",
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.assertion_consumer_service_url = "http://sp5/singleSignOnPost",
-				.protocol_binding = LASSO_SAML2_METADATA_BINDING_POST,
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.assertion_consumer_service_url = "http://sp5/singleSignOnPost",
+ 				.protocol_binding = LASSO_SAML2_METADATA_BINDING_POST,
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.assertion_consumer_service_url = "http://sp5/singleSignOnArtifact",
-				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.assertion_consumer_service_url = "http://sp5/singleSignOnArtifact",
+ 				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact",
-				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
-				.stop_after_build_assertion = 1,
-			});
--	sso_initiated_by_sp2(idp_context, sp_context,
--			(SsoSettings) {
+ 				.assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact",
+ 				.protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT,
+ 				.stop_after_build_assertion = 1,
+ 			});
+-	sso_initiated_by_sp2(idp_context, sp_context, 
+-			(SsoSettings) { 
 +	sso_initiated_by_sp2(idp_context, sp_context,
 +			(SsoSettings) {
-				.assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact",
-				.protocol_binding = LASSO_SAML2_METADATA_BINDING_POST,
-				.stop_after_build_assertion = 1,
+ 				.assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact",
+ 				.protocol_binding = LASSO_SAML2_METADATA_BINDING_POST,
+ 				.stop_after_build_assertion = 1,
 @@ -1278,7 +1278,9 @@ static void validate_idp_list(LassoEcp *ecp, EcpIdpListVariant ecpIDPListVariant
-	check_str_equals((char*)g_list_nth(ecp->known_idp_entity_ids_supporting_ecp, 0)->data, "http://idp5/metadata");
+ 	check_str_equals((char*)g_list_nth(ecp->known_idp_entity_ids_supporting_ecp, 0)->data, "http://idp5/metadata");
  }
-
+ 
 -void test_ecp(EcpIdpListVariant ecpIDPListVariant)
 +void test_ecp(EcpIdpListVariant ecpIDPListVariant,
 +              LassoProfileSignatureHint signature_hint,
 +              LassoProfileSignatureVerifyHint signature_verify_hint)
  {
-	char *serviceProviderContextDump = NULL, *identityProviderContextDump = NULL;
-	LassoServer *spContext = NULL, *ecpContext=NULL, *idpContext = NULL;
+ 	char *serviceProviderContextDump = NULL, *identityProviderContextDump = NULL;
+ 	LassoServer *spContext = NULL, *ecpContext=NULL, *idpContext = NULL;
 @@ -1286,7 +1288,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	LassoEcp *ecp = NULL;
-	LassoSamlp2AuthnRequest *request = NULL;
-	gboolean is_passive = FALSE;
+ 	LassoEcp *ecp = NULL;
+ 	LassoSamlp2AuthnRequest *request = NULL;
+ 	gboolean is_passive = FALSE;
 -    char *provider_name = NULL;
 +	char *provider_name = NULL;
-	char *relayState = NULL;
-	char *messageID = NULL;
-	char *extracted_messageID = NULL;
+ 	char *relayState = NULL;
+ 	char *messageID = NULL;
+ 	char *extracted_messageID = NULL;
 @@ -1296,7 +1298,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	char *ecpPaosResponseMsg = NULL;
-	char *spLoginDump = NULL;
-	LassoSaml2Assertion *assertion;
+ 	char *ecpPaosResponseMsg = NULL;
+ 	char *spLoginDump = NULL;
+ 	LassoSaml2Assertion *assertion;
 -    LassoSamlp2IDPList *idp_list = NULL;
 +	LassoSamlp2IDPList *idp_list = NULL;
-
-	/*
-	 * SAML2 Profile for ECP (Section 4.2) defines these steps for an ECP
+ 
+ 	/*
+ 	 * SAML2 Profile for ECP (Section 4.2) defines these steps for an ECP
 @@ -1322,6 +1324,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	spContext = lasso_server_new_from_dump(serviceProviderContextDump);
-	spLoginContext = lasso_login_new(spContext);
-	check_not_null(spLoginContext);
+ 	spContext = lasso_server_new_from_dump(serviceProviderContextDump);
+ 	spLoginContext = lasso_login_new(spContext);
+ 	check_not_null(spLoginContext);
 +	lasso_profile_set_signature_hint(LASSO_PROFILE(spLoginContext), signature_hint);
 +	lasso_profile_set_signature_verify_hint(LASSO_PROFILE(spLoginContext), signature_verify_hint);
-
-	check_good_rc(lasso_login_init_authn_request(spLoginContext, "http://idp5/metadata",
-												 LASSO_HTTP_METHOD_PAOS));
+ 
+ 	check_good_rc(lasso_login_init_authn_request(spLoginContext, "http://idp5/metadata",
+ 												 LASSO_HTTP_METHOD_PAOS));
 @@ -1419,6 +1423,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	idpContext = lasso_server_new_from_dump(identityProviderContextDump);
-	idpLoginContext = lasso_login_new(idpContext);
-	check_not_null(idpLoginContext);
+ 	idpContext = lasso_server_new_from_dump(identityProviderContextDump);
+ 	idpLoginContext = lasso_login_new(idpContext);
+ 	check_not_null(idpLoginContext);
 +	lasso_profile_set_signature_hint(LASSO_PROFILE(idpLoginContext), signature_hint);
 +	lasso_profile_set_signature_verify_hint(LASSO_PROFILE(idpLoginContext), signature_verify_hint);
-
-	/* Parse the ecpSoapRequestMsg */
-	check_good_rc(lasso_login_process_authn_request_msg(idpLoginContext, ecpSoapRequestMsg));
+ 
+ 	/* Parse the ecpSoapRequestMsg */
+ 	check_good_rc(lasso_login_process_authn_request_msg(idpLoginContext, ecpSoapRequestMsg));
 @@ -1465,7 +1471,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	check_str_equals(ecp->relaystate, relayState);
-	check_str_equals(ecp->issuer->content, "http://sp5/metadata");
-	check_str_equals(ecp->provider_name, provider_name);
+ 	check_str_equals(ecp->relaystate, relayState);
+ 	check_str_equals(ecp->issuer->content, "http://sp5/metadata");
+ 	check_str_equals(ecp->provider_name, provider_name);
 -    check_equals(ecp->is_passive, is_passive);
 +	check_equals(ecp->is_passive, is_passive);
-
-	/* Validate ECP IdP list info */
-	validate_idp_list(ecp, ecpIDPListVariant, idp_list);
+ 
+ 	/* Validate ECP IdP list info */
+ 	validate_idp_list(ecp, ecpIDPListVariant, idp_list);
 @@ -1480,6 +1486,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-	spContext = lasso_server_new_from_dump(serviceProviderContextDump);
-	spLoginContext = lasso_login_new(spContext);
-	check_not_null(spLoginContext);
+ 	spContext = lasso_server_new_from_dump(serviceProviderContextDump);
+ 	spLoginContext = lasso_login_new(spContext);
+ 	check_not_null(spLoginContext);
 +	lasso_profile_set_signature_hint(LASSO_PROFILE(spLoginContext), signature_hint);
 +	lasso_profile_set_signature_verify_hint(LASSO_PROFILE(spLoginContext), signature_verify_hint);
-
-	/* Parse the ecpPaosResponseMsg */
-	check_good_rc(lasso_login_process_paos_response_msg(spLoginContext, ecpPaosResponseMsg));
+ 
+ 	/* Parse the ecpPaosResponseMsg */
+ 	check_good_rc(lasso_login_process_paos_response_msg(spLoginContext, ecpPaosResponseMsg));
 @@ -1515,19 +1523,61 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant)
-
+ 
  START_TEST(test09_ecp)
  {
 -	test_ecp(ECP_IDP_LIST_NONE);
@@ -250,7 +250,7 @@ index 54c7fb63..e331c07a 100644
 +		 LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE);
  }
  END_TEST
-
+ 
  START_TEST(test10_ecp)
  {
 -	test_ecp(ECP_IDP_LIST_ECP);
@@ -259,7 +259,7 @@ index 54c7fb63..e331c07a 100644
 +		 LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE);
  }
  END_TEST
-
+ 
  START_TEST(test11_ecp)
  {
 -	test_ecp(ECP_IDP_LIST_BOGUS);
@@ -304,25 +304,26 @@ index 54c7fb63..e331c07a 100644
 +
  }
  END_TEST
-
+ 
 @@ -1538,7 +1588,7 @@ void check_digest_method(G_GNUC_UNUSED LassoLogin *idp_login_context, LassoLogin
-	lasso_release_string(dump)
+ 	lasso_release_string(dump)
  }
-
+ 
 -START_TEST(test12_sso_sp_with_rsa_sha256_signatures)
 +START_TEST(test13_sso_sp_with_rsa_sha256_signatures)
  {
-	LassoServer *idp_context = NULL;
-	LassoServer *sp_context = NULL;
+ 	LassoServer *idp_context = NULL;
+ 	LassoServer *sp_context = NULL;
 @@ -1595,7 +1645,8 @@ login_saml2_suite()
-	tcase_add_test(tc_ecp, test09_ecp);
-	tcase_add_test(tc_ecp, test10_ecp);
-	tcase_add_test(tc_ecp, test11_ecp);
+ 	tcase_add_test(tc_ecp, test09_ecp);
+ 	tcase_add_test(tc_ecp, test10_ecp);
+ 	tcase_add_test(tc_ecp, test11_ecp);
 -	tcase_add_test(tc_spLogin, test12_sso_sp_with_rsa_sha256_signatures);
 +	tcase_add_test(tc_ecp, test12_ecp);
 +	tcase_add_test(tc_spLogin, test13_sso_sp_with_rsa_sha256_signatures);
-	return s;
+ 	return s;
  }
-
---
+ 
+-- 
 2.20.1
+

lasso.spec

@@ -68,6 +68,7 @@ Patch2: build-scripts-py3-compatible.patch
 Patch3: duplicate-python-LogoutTestCase.patch
 Patch4: versioned-python-configure.patch
 Patch5: 0005-tests-use-self-generated-certificate-to-sign-federat.patch
+Patch6: 0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch
 
 BuildRequires: autoconf
 BuildRequires: automake