|
 |
db363b |
From 8b8fd22a168860c5034822472d1fb5745f8fa0f5 Mon Sep 17 00:00:00 2001
|
|
|
db363b |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
db363b |
Date: Wed, 16 Jun 2021 10:18:30 +0200
|
|
|
db363b |
Subject: [PATCH] Fix lasso_query_sign HMAC other than SHA1 (#54037)
|
|
|
db363b |
|
|
|
db363b |
The switch clause was using SHA1 digests for all digest types when
|
|
|
db363b |
signing. This obviously breaks verifying the signatures if HMAC-SHAXXX
|
|
|
db363b |
is used and XXX is something else than 1.
|
|
|
db363b |
---
|
|
|
db363b |
lasso/xml/tools.c | 35 +++++++++++++++++++++++------------
|
|
|
db363b |
tests/login_tests_saml2.c | 6 +++---
|
|
|
db363b |
2 files changed, 26 insertions(+), 15 deletions(-)
|
|
|
db363b |
|
|
|
db363b |
diff --git a/lasso/xml/tools.c b/lasso/xml/tools.c
|
|
|
db363b |
index 96d88a2c4..290fd55f2 100644
|
|
|
db363b |
--- a/lasso/xml/tools.c
|
|
|
db363b |
+++ b/lasso/xml/tools.c
|
|
|
db363b |
@@ -594,22 +594,20 @@ lasso_query_sign(char *query, LassoSignatureContext context)
|
|
|
db363b |
sigret_size = DSA_size(dsa);
|
|
|
db363b |
break;
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA1:
|
|
|
db363b |
+ md = EVP_sha1();
|
|
|
db363b |
+ sigret_size = EVP_MD_size(md);
|
|
|
db363b |
+ break;
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA256:
|
|
|
db363b |
+ md = EVP_sha256();
|
|
|
db363b |
+ sigret_size = EVP_MD_size(md);
|
|
|
db363b |
+ break;
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA384:
|
|
|
db363b |
+ md = EVP_sha384();
|
|
|
db363b |
+ sigret_size = EVP_MD_size(md);
|
|
|
db363b |
+ break;
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA512:
|
|
|
db363b |
- if ((rc = lasso_get_hmac_key(key, (void**)&hmac_key,
|
|
|
db363b |
- &hmac_key_length))) {
|
|
|
db363b |
- message(G_LOG_LEVEL_CRITICAL, "Failed to get hmac key (%s)", lasso_strerror(rc));
|
|
|
db363b |
- goto done;
|
|
|
db363b |
- }
|
|
|
db363b |
- g_assert(hmac_key);
|
|
|
db363b |
- md = EVP_sha1();
|
|
|
db363b |
+ md = EVP_sha512();
|
|
|
db363b |
sigret_size = EVP_MD_size(md);
|
|
|
db363b |
- /* key should be at least 128 bits long */
|
|
|
db363b |
- if (hmac_key_length < 16) {
|
|
|
db363b |
- critical("HMAC key should be at least 128 bits long");
|
|
|
db363b |
- goto done;
|
|
|
db363b |
- }
|
|
|
db363b |
break;
|
|
|
db363b |
default:
|
|
|
db363b |
g_assert_not_reached();
|
|
|
db363b |
@@ -645,6 +643,19 @@ lasso_query_sign(char *query, LassoSignatureContext context)
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA256:
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA384:
|
|
|
db363b |
case LASSO_SIGNATURE_METHOD_HMAC_SHA512:
|
|
|
db363b |
+ if ((rc = lasso_get_hmac_key(key, (void**)&hmac_key,
|
|
|
db363b |
+ &hmac_key_length))) {
|
|
|
db363b |
+ message(G_LOG_LEVEL_CRITICAL, "Failed to get hmac key (%s)", lasso_strerror(rc));
|
|
|
db363b |
+ goto done;
|
|
|
db363b |
+ }
|
|
|
db363b |
+ g_assert(hmac_key);
|
|
|
db363b |
+
|
|
|
db363b |
+ /* key should be at least 128 bits long */
|
|
|
db363b |
+ if (hmac_key_length < 16) {
|
|
|
db363b |
+ critical("HMAC key should be at least 128 bits long");
|
|
|
db363b |
+ goto done;
|
|
|
db363b |
+ }
|
|
|
db363b |
+
|
|
|
db363b |
HMAC(md, hmac_key, hmac_key_length, (unsigned char *)new_query,
|
|
|
db363b |
strlen(new_query), sigret, &siglen);
|
|
|
db363b |
status = 1;
|
|
|
db363b |
diff --git a/tests/login_tests_saml2.c b/tests/login_tests_saml2.c
|
|
|
db363b |
index e331c07a7..e1d78b5b1 100644
|
|
|
db363b |
--- a/tests/login_tests_saml2.c
|
|
|
db363b |
+++ b/tests/login_tests_saml2.c
|
|
|
db363b |
@@ -981,7 +981,7 @@ sso_initiated_by_sp(LassoServer *idp_context, LassoServer *sp_context, SsoCallba
|
|
|
db363b |
lasso_release_gobject(sp_login_context);
|
|
|
db363b |
}
|
|
|
db363b |
|
|
|
db363b |
-START_TEST(test07_sso_sp_with_hmac_sha1_signatures)
|
|
|
db363b |
+START_TEST(test07_sso_sp_with_hmac_sha256_signatures)
|
|
|
db363b |
{
|
|
|
db363b |
LassoServer *idp_context = NULL;
|
|
|
db363b |
LassoServer *sp_context = NULL;
|
|
|
db363b |
@@ -990,7 +990,7 @@ START_TEST(test07_sso_sp_with_hmac_sha1_signatures)
|
|
|
db363b |
|
|
|
db363b |
/* Create the shared key */
|
|
|
db363b |
key = lasso_key_new_for_signature_from_memory("xxxxxxxxxxxxxxxx", 16,
|
|
|
db363b |
- NULL, LASSO_SIGNATURE_METHOD_HMAC_SHA1, NULL);
|
|
|
db363b |
+ NULL, LASSO_SIGNATURE_METHOD_HMAC_SHA256, NULL);
|
|
|
db363b |
check_true(LASSO_IS_KEY(key));
|
|
|
db363b |
|
|
|
db363b |
/* Create an IdP context for IdP initiated SSO with provider metadata 1 */
|
|
|
db363b |
@@ -1640,7 +1640,7 @@ login_saml2_suite()
|
|
|
db363b |
tcase_add_test(tc_spSloSoap, test04_sso_then_slo_soap);
|
|
|
db363b |
tcase_add_test(tc_idpKeyRollover, test05_sso_idp_with_key_rollover);
|
|
|
db363b |
tcase_add_test(tc_spKeyRollover, test06_sso_sp_with_key_rollover);
|
|
|
db363b |
- tcase_add_test(tc_hmacSignature, test07_sso_sp_with_hmac_sha1_signatures);
|
|
|
db363b |
+ tcase_add_test(tc_hmacSignature, test07_sso_sp_with_hmac_sha256_signatures);
|
|
|
db363b |
tcase_add_test(tc_spLogin, test08_test_authnrequest_flags);
|
|
|
db363b |
tcase_add_test(tc_ecp, test09_ecp);
|
|
|
db363b |
tcase_add_test(tc_ecp, test10_ecp);
|
|
|
db363b |
--
|
|
|
db363b |
2.26.3
|
|
|
db363b |
|