From f965badc5728a2125426ee5307c278969e175afd Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 17 Jun 2019 14:00:01 +0200 Subject: [PATCH] Actually use the correct patch versions --- ...enerated-certificate-to-sign-federat.patch | 41 +-- ...e-not-found-error-when-only-assertio.patch | 251 +++++++++--------- lasso.spec | 1 + 3 files changed, 148 insertions(+), 145 deletions(-) diff --git a/0005-tests-use-self-generated-certificate-to-sign-federat.patch b/0005-tests-use-self-generated-certificate-to-sign-federat.patch index 8a1e370..e53d685 100644 --- a/0005-tests-use-self-generated-certificate-to-sign-federat.patch +++ b/0005-tests-use-self-generated-certificate-to-sign-federat.patch @@ -28,17 +28,17 @@ index c08cab69..84999a17 100644 --- a/tests/basic_tests.c +++ b/tests/basic_tests.c @@ -1983,24 +1983,13 @@ START_TEST(test13_test_lasso_server_load_metadata) - block_lasso_logs; - check_good_rc(lasso_server_load_metadata(server, LASSO_PROVIDER_ROLE_IDP, - TESTSDATADIR "/metadata/renater-metadata.xml", + block_lasso_logs; + check_good_rc(lasso_server_load_metadata(server, LASSO_PROVIDER_ROLE_IDP, + TESTSDATADIR "/metadata/renater-metadata.xml", - TESTSDATADIR "/metadata/metadata-federation-renater.crt", + TESTSDATADIR "/rootCA.crt", - &blacklisted_1, &loaded_entity_ids, - LASSO_SERVER_LOAD_METADATA_FLAG_DEFAULT)); - unblock_lasso_logs; - check_equals(g_hash_table_size(server->providers), 110); - check_equals(g_list_length(loaded_entity_ids), 110); - + &blacklisted_1, &loaded_entity_ids, + LASSO_SERVER_LOAD_METADATA_FLAG_DEFAULT)); + unblock_lasso_logs; + check_equals(g_hash_table_size(server->providers), 110); + check_equals(g_list_length(loaded_entity_ids), 110); + -#if 0 - /* UK federation file are too big to distribute (and I don't even known if it's right to do - * it, disable this test for now ) */ @@ -50,9 +50,9 @@ index c08cab69..84999a17 100644 - check_equals(g_list_length(loaded_entity_ids), 283); - check_equals(g_hash_table_size(server->providers), 393); -#endif - lasso_release_list_of_strings(loaded_entity_ids); - - lasso_release_gobject(server); + lasso_release_list_of_strings(loaded_entity_ids); + + lasso_release_gobject(server); diff --git a/tests/data/lasso.crt b/tests/data/lasso.crt new file mode 100644 index 00000000..568a0b9c @@ -242,9 +242,9 @@ index 868f9259..70517100 100644 @@ -1277,7 +1292,7 @@ Ugr24VE4pUTqq2xGSOazVN0EKSqULXvM9ZHupGDCJmRH4P3H/X4w8Cq5Y6c0pDtJ - + - + - + @@ -260,18 +260,18 @@ index 868f9259..70517100 100644 @@ -15545,7 +15560,7 @@ oZQx - + - + - + @@ -30065,4 +30080,4 @@ ihb/MX5UR6g83EMmqZsFt57ANEORMNQywxFa4Q== - - - + + + - \ No newline at end of file + @@ -377,5 +377,6 @@ index 00000000..8c619f27 +++ b/tests/data/rootCA.srl @@ -0,0 +1 @@ +02D3FA5376B8B25617BA76C4EA3AE7FE4AC318B1 --- +-- 2.20.1 + diff --git a/0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch b/0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch index e13c18b..0a3c750 100644 --- a/0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch +++ b/0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch @@ -45,15 +45,15 @@ index 028ffb31..91ff302d 100644 +++ b/lasso/saml-2.0/login.c @@ -1107,18 +1107,31 @@ lasso_saml20_login_process_paos_response_msg(LassoLogin *login, gchar *msg) { - LassoSoapHeader *header = NULL; - LassoProfile *profile; + LassoSoapHeader *header = NULL; + LassoProfile *profile; - int rc1, rc2; + int rc; - - lasso_null_param(msg); - - profile = LASSO_PROFILE(login); - + + lasso_null_param(msg); + + profile = LASSO_PROFILE(login); + - rc1 = lasso_saml20_profile_process_soap_response_with_headers(profile, msg, &header); + /* + * lasso_saml20_profile_process_soap_response_with_headers() @@ -69,20 +69,20 @@ index 028ffb31..91ff302d 100644 + if (rc != 0 && rc != LASSO_DS_ERROR_SIGNATURE_NOT_FOUND) { + return rc; + } - - /* - * If the SOAP message contained a header check for the optional + + /* + * If the SOAP message contained a header check for the optional - * paos:Response and ecp:RelayState elements, if they exist extract their - * values into the profile. + * paos:Response and ecp:RelayState elements, if they exist extract their + * values into the profile. - */ - if (header) { - GList *i = NULL; + */ + if (header) { + GList *i = NULL; @@ -1142,12 +1155,8 @@ lasso_saml20_login_process_paos_response_msg(LassoLogin *login, gchar *msg) - lasso_release_gobject(header); - } - + lasso_release_gobject(header); + } + - rc2 = lasso_saml20_login_process_response_status_and_assertion(login); - if (rc1) { - return rc1; @@ -92,156 +92,156 @@ index 028ffb31..91ff302d 100644 + rc = lasso_saml20_login_process_response_status_and_assertion(login); + return rc; } - + /** diff --git a/lasso/saml-2.0/profile.c b/lasso/saml-2.0/profile.c index 8171e79e..22a4e08c 100644 --- a/lasso/saml-2.0/profile.c +++ b/lasso/saml-2.0/profile.c @@ -398,6 +398,7 @@ lasso_saml20_profile_process_artifact_resolve(LassoProfile *profile, const char - - switch (lasso_profile_get_signature_verify_hint(profile)) { - case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE: + + switch (lasso_profile_get_signature_verify_hint(profile)) { + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE: + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE: - rc = profile->signature_status; - break; - case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE: + rc = profile->signature_status; + break; + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE: @@ -1559,6 +1560,7 @@ lasso_saml20_profile_process_soap_response_with_headers(LassoProfile *profile, - remote_provider, response_msg, "ID", LASSO_MESSAGE_FORMAT_SOAP); - switch (lasso_profile_get_signature_verify_hint(profile)) { - case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE: + remote_provider, response_msg, "ID", LASSO_MESSAGE_FORMAT_SOAP); + switch (lasso_profile_get_signature_verify_hint(profile)) { + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE: + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE: - rc = profile->signature_status; - break; - case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE: + rc = profile->signature_status; + break; + case LASSO_PROFILE_SIGNATURE_VERIFY_HINT_IGNORE: diff --git a/tests/login_tests_saml2.c b/tests/login_tests_saml2.c index 54c7fb63..e331c07a 100644 --- a/tests/login_tests_saml2.c +++ b/tests/login_tests_saml2.c @@ -1090,42 +1090,42 @@ START_TEST(test08_test_authnrequest_flags) - make_context(sp_context, "sp5-saml2", "", LASSO_PROVIDER_ROLE_IDP, "idp5-saml2", "") - - block_lasso_logs; -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + make_context(sp_context, "sp5-saml2", "", LASSO_PROVIDER_ROLE_IDP, "idp5-saml2", "") + + block_lasso_logs; +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .use_assertion_consumer_service_idx = 1, - .assertion_consumer_service_idx = 0, - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .use_assertion_consumer_service_idx = 1, + .assertion_consumer_service_idx = 0, + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .assertion_consumer_service_url = "http://sp5/singleSignOnPost", - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .assertion_consumer_service_url = "http://sp5/singleSignOnPost", + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .assertion_consumer_service_url = "http://sp5/singleSignOnPost", - .protocol_binding = LASSO_SAML2_METADATA_BINDING_POST, - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .assertion_consumer_service_url = "http://sp5/singleSignOnPost", + .protocol_binding = LASSO_SAML2_METADATA_BINDING_POST, + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .assertion_consumer_service_url = "http://sp5/singleSignOnArtifact", - .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .assertion_consumer_service_url = "http://sp5/singleSignOnArtifact", + .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact", - .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, - .stop_after_build_assertion = 1, - }); -- sso_initiated_by_sp2(idp_context, sp_context, -- (SsoSettings) { + .assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact", + .protocol_binding = LASSO_SAML2_METADATA_BINDING_ARTIFACT, + .stop_after_build_assertion = 1, + }); +- sso_initiated_by_sp2(idp_context, sp_context, +- (SsoSettings) { + sso_initiated_by_sp2(idp_context, sp_context, + (SsoSettings) { - .assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact", - .protocol_binding = LASSO_SAML2_METADATA_BINDING_POST, - .stop_after_build_assertion = 1, + .assertion_consumer_service_url = "http://sp5/singleSignOnPostAndArtifact", + .protocol_binding = LASSO_SAML2_METADATA_BINDING_POST, + .stop_after_build_assertion = 1, @@ -1278,7 +1278,9 @@ static void validate_idp_list(LassoEcp *ecp, EcpIdpListVariant ecpIDPListVariant - check_str_equals((char*)g_list_nth(ecp->known_idp_entity_ids_supporting_ecp, 0)->data, "http://idp5/metadata"); + check_str_equals((char*)g_list_nth(ecp->known_idp_entity_ids_supporting_ecp, 0)->data, "http://idp5/metadata"); } - + -void test_ecp(EcpIdpListVariant ecpIDPListVariant) +void test_ecp(EcpIdpListVariant ecpIDPListVariant, + LassoProfileSignatureHint signature_hint, + LassoProfileSignatureVerifyHint signature_verify_hint) { - char *serviceProviderContextDump = NULL, *identityProviderContextDump = NULL; - LassoServer *spContext = NULL, *ecpContext=NULL, *idpContext = NULL; + char *serviceProviderContextDump = NULL, *identityProviderContextDump = NULL; + LassoServer *spContext = NULL, *ecpContext=NULL, *idpContext = NULL; @@ -1286,7 +1288,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - LassoEcp *ecp = NULL; - LassoSamlp2AuthnRequest *request = NULL; - gboolean is_passive = FALSE; + LassoEcp *ecp = NULL; + LassoSamlp2AuthnRequest *request = NULL; + gboolean is_passive = FALSE; - char *provider_name = NULL; + char *provider_name = NULL; - char *relayState = NULL; - char *messageID = NULL; - char *extracted_messageID = NULL; + char *relayState = NULL; + char *messageID = NULL; + char *extracted_messageID = NULL; @@ -1296,7 +1298,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - char *ecpPaosResponseMsg = NULL; - char *spLoginDump = NULL; - LassoSaml2Assertion *assertion; + char *ecpPaosResponseMsg = NULL; + char *spLoginDump = NULL; + LassoSaml2Assertion *assertion; - LassoSamlp2IDPList *idp_list = NULL; + LassoSamlp2IDPList *idp_list = NULL; - - /* - * SAML2 Profile for ECP (Section 4.2) defines these steps for an ECP + + /* + * SAML2 Profile for ECP (Section 4.2) defines these steps for an ECP @@ -1322,6 +1324,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - spContext = lasso_server_new_from_dump(serviceProviderContextDump); - spLoginContext = lasso_login_new(spContext); - check_not_null(spLoginContext); + spContext = lasso_server_new_from_dump(serviceProviderContextDump); + spLoginContext = lasso_login_new(spContext); + check_not_null(spLoginContext); + lasso_profile_set_signature_hint(LASSO_PROFILE(spLoginContext), signature_hint); + lasso_profile_set_signature_verify_hint(LASSO_PROFILE(spLoginContext), signature_verify_hint); - - check_good_rc(lasso_login_init_authn_request(spLoginContext, "http://idp5/metadata", - LASSO_HTTP_METHOD_PAOS)); + + check_good_rc(lasso_login_init_authn_request(spLoginContext, "http://idp5/metadata", + LASSO_HTTP_METHOD_PAOS)); @@ -1419,6 +1423,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - idpContext = lasso_server_new_from_dump(identityProviderContextDump); - idpLoginContext = lasso_login_new(idpContext); - check_not_null(idpLoginContext); + idpContext = lasso_server_new_from_dump(identityProviderContextDump); + idpLoginContext = lasso_login_new(idpContext); + check_not_null(idpLoginContext); + lasso_profile_set_signature_hint(LASSO_PROFILE(idpLoginContext), signature_hint); + lasso_profile_set_signature_verify_hint(LASSO_PROFILE(idpLoginContext), signature_verify_hint); - - /* Parse the ecpSoapRequestMsg */ - check_good_rc(lasso_login_process_authn_request_msg(idpLoginContext, ecpSoapRequestMsg)); + + /* Parse the ecpSoapRequestMsg */ + check_good_rc(lasso_login_process_authn_request_msg(idpLoginContext, ecpSoapRequestMsg)); @@ -1465,7 +1471,7 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - check_str_equals(ecp->relaystate, relayState); - check_str_equals(ecp->issuer->content, "http://sp5/metadata"); - check_str_equals(ecp->provider_name, provider_name); + check_str_equals(ecp->relaystate, relayState); + check_str_equals(ecp->issuer->content, "http://sp5/metadata"); + check_str_equals(ecp->provider_name, provider_name); - check_equals(ecp->is_passive, is_passive); + check_equals(ecp->is_passive, is_passive); - - /* Validate ECP IdP list info */ - validate_idp_list(ecp, ecpIDPListVariant, idp_list); + + /* Validate ECP IdP list info */ + validate_idp_list(ecp, ecpIDPListVariant, idp_list); @@ -1480,6 +1486,8 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - spContext = lasso_server_new_from_dump(serviceProviderContextDump); - spLoginContext = lasso_login_new(spContext); - check_not_null(spLoginContext); + spContext = lasso_server_new_from_dump(serviceProviderContextDump); + spLoginContext = lasso_login_new(spContext); + check_not_null(spLoginContext); + lasso_profile_set_signature_hint(LASSO_PROFILE(spLoginContext), signature_hint); + lasso_profile_set_signature_verify_hint(LASSO_PROFILE(spLoginContext), signature_verify_hint); - - /* Parse the ecpPaosResponseMsg */ - check_good_rc(lasso_login_process_paos_response_msg(spLoginContext, ecpPaosResponseMsg)); + + /* Parse the ecpPaosResponseMsg */ + check_good_rc(lasso_login_process_paos_response_msg(spLoginContext, ecpPaosResponseMsg)); @@ -1515,19 +1523,61 @@ void test_ecp(EcpIdpListVariant ecpIDPListVariant) - + START_TEST(test09_ecp) { - test_ecp(ECP_IDP_LIST_NONE); @@ -250,7 +250,7 @@ index 54c7fb63..e331c07a 100644 + LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE); } END_TEST - + START_TEST(test10_ecp) { - test_ecp(ECP_IDP_LIST_ECP); @@ -259,7 +259,7 @@ index 54c7fb63..e331c07a 100644 + LASSO_PROFILE_SIGNATURE_VERIFY_HINT_MAYBE); } END_TEST - + START_TEST(test11_ecp) { - test_ecp(ECP_IDP_LIST_BOGUS); @@ -304,25 +304,26 @@ index 54c7fb63..e331c07a 100644 + } END_TEST - + @@ -1538,7 +1588,7 @@ void check_digest_method(G_GNUC_UNUSED LassoLogin *idp_login_context, LassoLogin - lasso_release_string(dump) + lasso_release_string(dump) } - + -START_TEST(test12_sso_sp_with_rsa_sha256_signatures) +START_TEST(test13_sso_sp_with_rsa_sha256_signatures) { - LassoServer *idp_context = NULL; - LassoServer *sp_context = NULL; + LassoServer *idp_context = NULL; + LassoServer *sp_context = NULL; @@ -1595,7 +1645,8 @@ login_saml2_suite() - tcase_add_test(tc_ecp, test09_ecp); - tcase_add_test(tc_ecp, test10_ecp); - tcase_add_test(tc_ecp, test11_ecp); + tcase_add_test(tc_ecp, test09_ecp); + tcase_add_test(tc_ecp, test10_ecp); + tcase_add_test(tc_ecp, test11_ecp); - tcase_add_test(tc_spLogin, test12_sso_sp_with_rsa_sha256_signatures); + tcase_add_test(tc_ecp, test12_ecp); + tcase_add_test(tc_spLogin, test13_sso_sp_with_rsa_sha256_signatures); - return s; + return s; } - --- + +-- 2.20.1 + diff --git a/lasso.spec b/lasso.spec index c702ebe..1c792be 100644 --- a/lasso.spec +++ b/lasso.spec @@ -68,6 +68,7 @@ Patch2: build-scripts-py3-compatible.patch Patch3: duplicate-python-LogoutTestCase.patch Patch4: versioned-python-configure.patch Patch5: 0005-tests-use-self-generated-certificate-to-sign-federat.patch +Patch6: 0006-Fix-ECP-signature-not-found-error-when-only-assertio.patch BuildRequires: autoconf BuildRequires: automake