From 6f111db5e884c57eae0bd969ea2df42469e916c8 Mon Sep 17 00:00:00 2001 From: Tom Crossland Date: Thu, 17 Oct 2019 11:09:13 +0200 Subject: [PATCH 1/2] feat: support for trusted_fingerprints 'any' option --- include/esaml.hrl | 2 +- src/esaml_sp.erl | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/include/esaml.hrl b/include/esaml.hrl index 5fb08a1..91d7af3 100644 --- a/include/esaml.hrl +++ b/include/esaml.hrl @@ -107,7 +107,7 @@ idp_signs_envelopes = true :: boolean(), idp_signs_logout_requests = true :: boolean(), sp_sign_metadata = false :: boolean(), - trusted_fingerprints = [] :: [string() | binary()], + trusted_fingerprints = [] :: [string() | binary()] | any, metadata_uri = "" :: string(), consume_uri = "" :: string(), logout_uri :: string() | undefined, diff --git a/src/esaml_sp.erl b/src/esaml_sp.erl index 3a1abf4..4bb8569 100644 --- a/src/esaml_sp.erl +++ b/src/esaml_sp.erl @@ -146,7 +146,10 @@ generate_metadata(SP = #esaml_sp{org = Org, tech = Tech}) -> -spec setup(esaml:sp()) -> esaml:sp(). setup(SP = #esaml_sp{trusted_fingerprints = FPs, metadata_uri = MetaURI, consume_uri = ConsumeURI}) -> - Fingerprints = esaml_util:convert_fingerprints(FPs), + Fingerprints = case FPs of + any -> any; + _ -> esaml_util:convert_fingerprints(FPs) + end, case MetaURI of "" -> error("must specify metadata URI"); _ -> ok end, case ConsumeURI of "" -> error("must specify consume URI"); _ -> ok end, if (SP#esaml_sp.key =:= undefined) andalso (SP#esaml_sp.sp_sign_requests) -> From b967daec49e6de6cb11651647af5195e71187e9b Mon Sep 17 00:00:00 2001 From: Tom Crossland Date: Thu, 3 Jun 2021 11:11:32 +0200 Subject: [PATCH 2/2] refactor: use new crypto api --- src/esaml_sp.erl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/esaml_sp.erl b/src/esaml_sp.erl index 4bb8569..458194c 100644 --- a/src/esaml_sp.erl +++ b/src/esaml_sp.erl @@ -337,18 +337,18 @@ block_decrypt("http://www.w3.org/2009/xmlenc11#aes128-gcm", SymmetricKey, Cipher %% IV: 12 bytes and Tag data: 16 bytes EncryptedDataSize = byte_size(CipherValue) - 12 - 16, <> = CipherValue, - DecryptedData = crypto:block_decrypt(aes_gcm, SymmetricKey, IV, {<<>>, EncryptedData, Tag}), + DecryptedData = crypto:crypto_one_time_aead(aes_128_gcm, SymmetricKey, IV, EncryptedData, <<>>, Tag, false), binary_to_list(DecryptedData); block_decrypt("http://www.w3.org/2001/04/xmlenc#aes128-cbc", SymmetricKey, CipherValue) -> <> = CipherValue, - DecryptedData = crypto:block_decrypt(aes_cbc128, SymmetricKey, IV, EncryptedData), + DecryptedData = crypto:crypto_one_time(aes_128_cbc, SymmetricKey, IV, EncryptedData, false), IsPadding = fun(X) -> X < 16 end, lists:reverse(lists:dropwhile(IsPadding, lists:reverse(binary_to_list(DecryptedData)))); block_decrypt("http://www.w3.org/2001/04/xmlenc#aes256-cbc", SymmetricKey, CipherValue) -> <> = CipherValue, - DecryptedData = crypto:block_decrypt(aes_cbc256, SymmetricKey, IV, EncryptedData), + DecryptedData = crypto:crypto_one_time(aes_256_cbc, SymmetricKey, IV, EncryptedData, false), IsPadding = fun(X) -> X < 16 end, lists:reverse(lists:dropwhile(IsPadding, lists:reverse(binary_to_list(DecryptedData)))).