Re: Usage of XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN
Frank Gross <[email protected]> Thu, 20 Jun 2019 15:10:08 +0200
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1182184291==
Content-Type: multipart/alternative;
boundary="------------6A7DAC1B5FAD082C55E4841B"
Content-Language: en-US
This is a multi-part message in MIME format.
--------------6A7DAC1B5FAD082C55E4841B
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Yes, I found in keyinfo.c (line 692) where to stop the process and
return (see following):
tmpKey = xmlSecKeysMngrFindKey(keyInfoCtx->keysMngr, newName, keyInfoCtx);
if(tmpKey != NULL) {
XXXX
} else if (keyInfoCtx->flags&XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN) {
xmlSecOtherError(XMLSEC_ERRORS_R_KEY_NOT_FOUND, xmlSecKeyDataKlassGetName(id), "Unknown key name");
xmlFree(newName);
return(-1);
}
But then at some point I return from xmlSecKeyDataEncryptedKeyXmlRead()
with a return value of 0, instead of -1, because
xmlSecEncCtxDecryptToBuffer(keyInfoCtx->encCtx, node) result is NULL at
line 1354,
and I finally go back in function xmlSecKeysMngrGetKey() where
xmlSecKeyInfoNodeRead() returns 0 and without a valid key (what is
expected), but there is no status saying that the key was not found due
to the name. Then, as there is a keystore set, we go for a new run in
xmlSecKeysMngrFindKey(keyInfoCtx->keysMngr, NULL, keyInfoCtx) where of
course, we gonna find the key without name.
Actually, in xmlSecKeysMngrGetKey() when xmlSecKeyInfoNodeRead() is
called and no key is found (in the key store), we search again for a key
in the key store, isn't is doing twice the same job ? And is there a way
to return a status from xmlSecKeyInfoNodeRead(), saying that the key was
not found due to the name, to avoid searching again ?
Thanks,
Frank
Le 19/06/2019 à 18:40, Aleksey Sanin a écrit :
> Doesn't look like it was implemented :)
>
> https://github.com/lsh123/xmlsec/search?q=XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN
>
>
> https://github.com/lsh123/xmlsec/commit/914f5ba36b26682b1857caecd63145c141f98663
>
>
> Should be a simple change around here:
>
> https://github.com/lsh123/xmlsec/blob/a181a96b5f73a4ac27be2fc51644326c2b89fe4d/src/keyinfo.c#L663
>
>
>
>
>
> Aleksey
>
> On 6/19/19 3:50 AM, Frank Gross wrote:
>> Hi,
>>
>> Can someone tell me how the flag
>> XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN is suppose to work ?
>>
>> I was expecting that xmlSecEncCtxDecrypt() fails when that flag is
>> set because the KeyName in my encrypted document is not available in
>> the key store, but it found actually the key because I registered
>> that same key but with a different name.
>>
>> Thanks,
>>
>> Frank
>>
>
--
Frank GROSS
Software Engineer - Web Services
Four J's Development Tools - http://www.4js.com
--------------6A7DAC1B5FAD082C55E4841B
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Yes, I found in keyinfo.c (line 692) where to stop the process
and return (see following):</p>
<pre> tmpKey = xmlSecKeysMngrFindKey(keyInfoCtx->keysMngr, newName, keyInfoCtx);
if(tmpKey != NULL) {</pre>
<pre> XXXX
</pre>
<pre> } else if (keyInfoCtx->flags&XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN) {
xmlSecOtherError(XMLSEC_ERRORS_R_KEY_NOT_FOUND, xmlSecKeyDataKlassGetName(id), "Unknown key name");
xmlFree(newName);
return(-1);
}</pre>
<p><br>
</p>
<p>But then at some point I return from
xmlSecKeyDataEncryptedKeyXmlRead() with a return value of 0,
instead of -1, because
xmlSecEncCtxDecryptToBuffer(keyInfoCtx->encCtx, node) result is
NULL at line 1354,</p>
<p>and I finally go back in function xmlSecKeysMngrGetKey() where
xmlSecKeyInfoNodeRead() returns 0 and without a valid key (what is
expected), but there is no status saying that the key was not
found due to the name. Then, as there is a keystore set, we go for
a new run in xmlSecKeysMngrFindKey(keyInfoCtx->keysMngr, NULL,
keyInfoCtx) where of course, we gonna find the key without name.</p>
<p>Actually, in xmlSecKeysMngrGetKey() when xmlSecKeyInfoNodeRead()
is called and no key is found (in the key store), we search again
for a key in the key store, isn't is doing twice the same job ?
And is there a way to return a status from
xmlSecKeyInfoNodeRead(), saying that the key was not found due to
the name, to avoid searching again ?<br>
</p>
<p>Thanks,<br>
</p>
<p>Frank<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">Le 19/06/2019 à 18:40, Aleksey Sanin a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">Doesn't
look like it was implemented :)
<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/lsh123/xmlsec/search?q=XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN">https://github.com/lsh123/xmlsec/search?q=XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN</a>
<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/lsh123/xmlsec/commit/914f5ba36b26682b1857caecd63145c141f98663">https://github.com/lsh123/xmlsec/commit/914f5ba36b26682b1857caecd63145c141f98663</a>
<br>
<br>
Should be a simple change around here:
<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/lsh123/xmlsec/blob/a181a96b5f73a4ac27be2fc51644326c2b89fe4d/src/keyinfo.c#L663">https://github.com/lsh123/xmlsec/blob/a181a96b5f73a4ac27be2fc51644326c2b89fe4d/src/keyinfo.c#L663</a>
<br>
<br>
<br>
<br>
<br>
Aleksey
<br>
<br>
On 6/19/19 3:50 AM, Frank Gross wrote:
<br>
<blockquote type="cite">Hi,
<br>
<br>
Can someone tell me how the flag
XMLSEC_KEYINFO_FLAGS_KEYNAME_STOP_ON_UNKNOWN is suppose to work
?
<br>
<br>
I was expecting that xmlSecEncCtxDecrypt() fails when that flag
is set because the KeyName in my encrypted document is not
available in the key store, but it found actually the key
because I registered that same key but with a different name.
<br>
<br>
Thanks,
<br>
<br>
Frank
<br>
<br>
</blockquote>
<br>
</blockquote>
<pre class="moz-signature" cols="72">--
Frank GROSS
Software Engineer - Web Services
Four J's Development Tools - <a class="moz-txt-link-freetext" href="http://www.4js.com">http://www.4js.com</a>
</pre>
</body>
</html>
--------------6A7DAC1B5FAD082C55E4841B--
--===============1182184291==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h
aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls
bWFuL2xpc3RpbmZvL3htbHNlYwo=
--===============1182184291==--