signer 1.2.1 → 1.3.0

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MGVmNjVlMGNlMjM5ZmIyMzczYWIzNzRmNWYzOWRlZTA2NzFmMWZiOA==
+    YjcwMWM0ZWJiMGRmZWVlZmYzMWJlZmNiZjk3MDViODMwMDk5ZGRiMg==
   data.tar.gz: !binary |-
-    ZDZjYWFiNmE2ODU5MGM4YjUxM2NjMzYyOTBmODBhZWQxYWJkYTFlNw==
+    YjgwNGI1ZDFmYTc4NWMyZWM1NTdhNTk1ZjFiY2MxMmY5MWYzYjMzZA==
 SHA512:
   metadata.gz: !binary |-
-    MzQ3NjE2NTgxZGFjNGI5NmE2NjAxZWQ0MjNhMDY1YjAzZWNlOGY2YmM1YzNl
-    ZDNhYjEwZmQwYzYzYjc3NDA5OGRmM2MzYjgwZWFiYTQzYjllODNmNTllNjBk
-    ZWI4MmIwNWE0ODg1OGRlNzk5NmUxYjNmODJlMjIxN2Y3ZDAzNTM=
+    MTRmNjU2NDM4MjRhM2ZlZTA2MmFjMWQyNDZmMDVkNTEwOTAwMGE1MDBmMjc5
+    ZTE4Mzg5MjBjMWViYmU0NTMwYzgzY2E4YmVkMzc2NWNlNjhmZWIzM2JiMzI3
+    MjVhNDU3YTQwMmQ1ZjYwOTNmMWMxOGQwOWY1NDNlNzM3ZjA0NTI=
   data.tar.gz: !binary |-
-    OTkzZWFiN2I4YmNiN2QyOWQ2N2E1MTZkMmQ0ODgwMGZhMjEzZTg4YzgzMzk4
-    NTJmNGY3ZWMzZTUzYzNjZWUzZmI2NTA0YWExM2EzZjY5ODEwY2ZhNGQ3NDRm
-    ZmI3ZWZmNTFlYWMyZjM3YjNlY2UwOTJiNDE5YzQ4N2Y0MWRiODI=
+    YmM4ZDhlYTU4YmQ3NDllYzYyZDg0MTU5Y2Q2OGY1ODM3YmI2Yzg4ODc4Yjkz
+    OTlhNDQ1NmM5OTliNmRkZmVlMzI5MzZlOWQxZjE3YTUyZjQ2MWQ2ZWU0Y2U1
+    NzRlODhjMjBjOWZhZDBmNGI0NjdmYWUyOGU5NjMxNDc3OWViMWE=

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.3.0 (2014-06-16)
+
+- Allow to sign with other digest algorithms - SHA1, SHA256, and GOST R 34.11-94 (#3, @Envek)
+
 ## 1.2.1 (2014-05-14)
 
 - Fix canonicalization: should be without comments (#2, @Envek)

data/README.md

@@ -200,6 +200,23 @@ Output:
 </s:Envelope>
 ```
 
+## Different signature and digest algorithms support
+
+You can change digest algorithms used for both node digesting and signing. Default for both is SHA1. Currently __SHA1__ `:sha1`, __SHA256__ `:sha256`, and __GOST R 34.11-94__ `:gostr3411` are supported out of the box.
+
+```ruby
+signer.digest_algorithm           = :sha256 # Set algorithm for node digesting
+signer.signature_digest_algorithm = :sha256 # Set algorithm for message digesting for signing
+```
+
+You can provide you own digest support by passing in these methods a `Hash` with `:id` and `:digester` keys. In `:id` should be a string for XML `//Reference/DigestMethod[Algorithm]`, in `:digester` should be a Ruby object, compatible by interface with `OpenSSL::Digest` class, at least it should respond to `digest` and `reset` methods.
+
+Signature algorithm is dependent from keypair used for signing and can't be changed. Usually it's __RSA__. Currently gem recognizes __GOST R 34.10-2001__ certificates and sets up a XML identifier for it. If used signature algorithm and signature digest doesn't corresponds with XML identifier, you can change identifier with `signature_algorithm_id` method.
+
+Please note, that these settings will be changed or reset on certificate assignment, please change them after setting certificate!
+
+__NOTE__: To sign XMLs with __GOST R 34.10-2001__, you need to have Ruby compiled with patches from https://bugs.ruby-lang.org/issues/9830 and correctly configured OpenSSL (see https://github.com/openssl/openssl/blob/master/engines/ccgost/README.gost)
+
 ## Miscellaneous
 
 If you need to digest a `BinarySecurityToken` tag, you need to construct it yourself **before** signing.

data/lib/signer.rb

@@ -3,22 +3,66 @@ require "base64"
 require "digest/sha1"
 require "openssl"
 
+require "signer/digester"
 require "signer/version"
 
 class Signer
-  attr_accessor :document, :cert, :private_key
+  attr_accessor :document, :private_key, :signature_algorithm_id
+  attr_reader :cert
   attr_writer :security_node, :security_token_id
 
   WSU_NAMESPACE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
 
   def initialize(document)
     self.document = Nokogiri::XML(document.to_s, &:noblanks)
+    self.digest_algorithm = :sha1
+    self.set_default_signature_method!
   end
 
   def to_xml
     document.to_xml(:save_with => 0)
   end
 
+  # Return symbol name for supported digest algorithms and string name for custom ones.
+  def digest_algorithm
+    @digester.symbol || @digester.digest_name
+  end
+
+  # Allows to change algorithm for node digesting (default is SHA1).
+  #
+  # You may pass either a one of +:sha1+, +:sha256+ or +:gostr3411+ symbols
+  # or +Hash+ with keys +:id+ with a string, which will denote algorithm in XML Reference tag
+  # and +:digester+ with instance of class with interface compatible with +OpenSSL::Digest+ class.
+  def digest_algorithm=(algorithm)
+    @digester = Signer::Digester.new(algorithm)
+  end
+
+  # Return symbol name for supported digest algorithms and string name for custom ones.
+  def signature_digest_algorithm
+    @sign_digester.symbol || @sign_digester.digest_name
+  end
+
+  # Allows to change digesting algorithm for signature creation. Same as +digest_algorithm=+
+  def signature_digest_algorithm=(algorithm)
+    @sign_digester = Signer::Digester.new(algorithm)
+  end
+
+  # Receives certificate for signing and tries to guess a digest algorithm for signature creation.
+  #
+  # Will change +signature_digest_algorithm+ and +signature_algorithm_id+ for known certificate types and reset to defaults for others.
+  def cert=(certificate)
+    @cert = certificate
+    # Try to guess a digest algorithm for signature creation
+    case @cert.signature_algorithm
+      when 'GOST R 34.11-94 with GOST R 34.10-2001'
+        self.signature_digest_algorithm = :gostr3411
+        self.signature_algorithm_id = 'http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411'
+      # Add clauses for other types of keys that require other digest algorithms and identifiers
+      else # most common 'sha1WithRSAEncryption' type included here
+        self.set_default_signature_method! # Reset any changes as they can become malformed
+    end
+  end
+
   def security_token_id
     @security_token_id ||= "uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"
   end
@@ -56,7 +100,7 @@ class Signer
       canonicalization_method_node['Algorithm'] = 'http://www.w3.org/2001/10/xml-exc-c14n#'
       node.add_child(canonicalization_method_node)
       signature_method_node = Nokogiri::XML::Node.new('SignatureMethod', document)
-      signature_method_node['Algorithm'] = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
+      signature_method_node['Algorithm'] = self.signature_algorithm_id
       node.add_child(signature_method_node)
     end
     node
@@ -146,7 +190,7 @@ class Signer
       target_node["#{wsu_ns}:Id"] = id.to_s
     end
     target_canon = canonicalize(target_node)
-    target_digest = Base64.encode64(OpenSSL::Digest::SHA1.digest(target_canon)).strip
+    target_digest = Base64.encode64(@digester.digest(target_canon)).strip
 
     reference_node = Nokogiri::XML::Node.new('Reference', document)
     reference_node['URI'] = id.to_s.size > 0 ? "##{id}" : ""
@@ -164,7 +208,7 @@ class Signer
     transforms_node.add_child(transform_node)
 
     digest_method_node = Nokogiri::XML::Node.new('DigestMethod', document)
-    digest_method_node['Algorithm'] = 'http://www.w3.org/2000/09/xmldsig#sha1'
+    digest_method_node['Algorithm'] = @digester.digest_id
     reference_node.add_child(digest_method_node)
 
     digest_value_node = Nokogiri::XML::Node.new('DigestValue', document)
@@ -185,7 +229,7 @@ class Signer
 
     signed_info_canon = canonicalize(signed_info_node)
 
-    signature = private_key.sign(OpenSSL::Digest::SHA1.new, signed_info_canon)
+    signature = private_key.sign(@sign_digester.digester, signed_info_canon)
     signature_value_digest = Base64.encode64(signature).gsub("\n", '')
 
     signature_value_node = Nokogiri::XML::Node.new('SignatureValue', document)
@@ -196,6 +240,12 @@ class Signer
 
   protected
 
+  # Reset digest algorithm for signature creation and signature algorithm identifier
+  def set_default_signature_method!
+    self.signature_digest_algorithm = :sha1
+    self.signature_algorithm_id = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
+  end
+
   ##
   # Searches in namespaces, defined on +target_node+ or its ancestors,
   # for the +namespace+ with given URI and returns its prefix.

data/lib/signer/digester.rb

@@ -0,0 +1,74 @@
+require 'openssl'
+
+class Signer
+
+  # Digest algorithms supported "out of the box"
+  DIGEST_ALGORITHMS = {
+    # SHA 1
+    sha1: {
+      name: 'SHA1',
+      id: 'http://www.w3.org/2000/09/xmldsig#sha1',
+      digester: lambda { OpenSSL::Digest::SHA1.new },
+    },
+    # SHA 256
+    sha256: {
+        name: 'SHA256',
+        id: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
+        digester: lambda { OpenSSL::Digest::SHA256.new },
+    },
+    # GOST R 34-11 94
+    gostr3411: {
+      name: 'GOST R 34.11-94',
+      id: 'http://www.w3.org/2001/04/xmldsig-more#gostr3411',
+      digester: lambda {
+        OpenSSL::Engine.load
+        gost_engine = OpenSSL::Engine.by_id('gost')
+        gost_engine.set_default(0xFFFF)
+        gost_engine.digest('md_gost94')
+      },
+    },
+  }
+
+  # Class that holds +OpenSSL::Digest+ instance with some meta information for digesting in XML.
+  class Digester
+
+    # You may pass either a one of +:sha1+, +:sha256+ or +:gostr3411+ symbols
+    # or +Hash+ with keys +:id+ with a string, which will denote algorithm in XML Reference tag
+    # and +:digester+ with instance of class with interface compatible with +OpenSSL::Digest+ class.
+    def initialize(algorithm)
+      if algorithm.kind_of? Symbol
+        @digest_info = DIGEST_ALGORITHMS[algorithm].dup
+        @digest_info[:digester] = @digest_info[:digester].call
+        @symbol = algorithm
+      else
+        @digest_info = algorithm
+      end
+    end
+
+    attr_reader :symbol
+
+    # Digest
+    def digest(message)
+      self.digester.digest(message)
+    end
+
+    alias call digest
+
+    # Returns +OpenSSL::Digest+ (or derived class) instance
+    def digester
+      @digest_info[:digester].reset
+    end
+
+    # Human-friendly name
+    def digest_name
+      @digest_info[:name]
+    end
+
+    # XML-friendly name (for specifying in XML +DigestMethod+ node +Algorithm+ attribute)
+    def digest_id
+      @digest_info[:id]
+    end
+
+  end
+
+end

data/lib/signer/version.rb

@@ -1,3 +1,3 @@
 class Signer
-  VERSION = "1.2.1"
+  VERSION = "1.3.0"
 end

data/spec/fixtures/output_1_sha256.xml

@@ -0,0 +1,2 @@
+<?xml version="1.0"?>
+<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:wsurandom="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://tempuri.org/IDocumentService/SearchDocuments</a:Action><a:MessageID>urn:uuid:30db5d4f-ab84-46be-907c-be690a92979b</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><To xmlns="http://www.w3.org/2005/08/addressing" xmlns:a="http://www.w3.org/2003/05/soap-envelope" a:mustUnderstand="1">http://tempuri.org/PublicServices/Test/1.0.12/PublicServices/DocumentService.svc</To><o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"><wsurandom:Timestamp><wsurandom:Created>2012-05-02T18:17:14.467Z</wsurandom:Created><wsurandom:Expires>2012-05-02T18:22:14.467Z</wsurandom:Expires></wsurandom:Timestamp><o:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsurandom:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</o:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>frx76VWYEsTF+bL6gMKAs3NSkziiB2pRLVb2zZNOWZ0=</DigestValue></Reference></SignedInfo><SignatureValue>FqbJM5mu4LGECjGLNsGoV37qvMBbnukAbAUjHU9BeOkN8reoLfLdsoGvnl+T6+nv7Oaw5LrCDWVdA31RmbqVMn0qPm39CtIAPncUJD0Zr1XKvL2oIA8ySgR4pqQR/GM8fdOkQPRIXXAjTxg6UuVYmXn0vfpLeH2uqoQR1L98Rj8=</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></o:Security></s:Header><s:Body><SearchDocuments xmlns="http://tempuri.org/"><searchCriteria xmlns:b="http://schemas.datacontract.org/2004/07/BusinessLogic.Data.Documents.Integration" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><b:RegistrationNo>1</b:RegistrationNo></searchCriteria></SearchDocuments></s:Body></s:Envelope>

data/spec/signer_spec.rb

@@ -47,6 +47,27 @@ describe Signer do
     signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
   end
 
+  it "should digest and sign SOAP XML with SHA256" do
+    input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_1.xml')
+    cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
+    private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
+
+    signer = Signer.new(File.read(input_xml_file))
+    signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+    signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
+    signer.digest_algorithm = :sha256
+    signer.signature_digest_algorithm = :sha256
+    signer.signature_algorithm_id = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
+
+    signer.digest!(signer.binary_security_token_node)
+
+    signer.sign!
+
+    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_1_sha256.xml')
+
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+  end
+
   it "should sign simple XML" do
     input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
     cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: signer
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - Edgars Beigarts
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-05-14 00:00:00.000000000 Z
+date: 2014-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   version_requirements: !ruby/object:Gem::Requirement
@@ -59,6 +59,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- lib/signer/digester.rb
 - lib/signer/version.rb
 - lib/signer.rb
 - README.md
@@ -70,6 +71,7 @@ files:
 - spec/fixtures/input_3_c14n_comments.xml
 - spec/fixtures/key.pem
 - spec/fixtures/output_1.xml
+- spec/fixtures/output_1_sha256.xml
 - spec/fixtures/output_2.xml
 - spec/fixtures/output_3_c14n_comments.xml
 - spec/signer_spec.rb
@@ -104,6 +106,7 @@ test_files:
 - spec/fixtures/input_3_c14n_comments.xml
 - spec/fixtures/key.pem
 - spec/fixtures/output_1.xml
+- spec/fixtures/output_1_sha256.xml
 - spec/fixtures/output_2.xml
 - spec/fixtures/output_3_c14n_comments.xml
 - spec/signer_spec.rb