o
gQ2 @ s d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl m
Z
ddl m Z m
Z
zddlZW n ey9 dZY nw d Zd
d Zd d
Zdd ZG dd dZG dd deZG dd deZdd Z d&ddZdd Zd d Zd d Zd d! Z d"d# Z d'd$d%Z dS )(av Functions for WS-Security (WSSE) signature creation and verification.
Heavily based on test examples in https://github.com/mehcode/python-xmlsec as
well as the xmlsec documentation at https://www.aleksey.com/xmlsec/.
Reading the xmldsig, xmlenc, and ws-security standards documents, though
admittedly painful, will likely assist in understanding the code in this
module.
)etree)QName)ns)SignatureVerificationFailed)detect_soap_env) ensure_idget_security_headerNz)http://schemas.xmlsoap.org/soap/envelope/c C s6 t | d }| W d S 1 sw Y d S )Nrb)openread)f_namef r L/home/ubuntu/webapp/venv/lib/python3.10/site-packages/zeep/wsse/signature.py
_read_file s $r c C s( t j| t jj|}||t jj |S N)xmlsecKey from_memory KeyFormatPEMload_cert_from_memory)key_data cert_datapasswordkeyr r r _make_sign_key# s r c C s t j| t jjd }|S r )r r r r CERT_PEM)r r r r r _make_verify_key) s r c @ s0 e Zd ZdZ d ddZdd Zdd ZdS )
MemorySignaturez@Sign given SOAP envelope with WSSE sig using given key and cert.Nc C s( t || _|| _|| _|| _|| _d S r )check_xmlsec_importr r r
digest_methodsignature_method)selfr r r r" r! r r r __init__1 s
zMemorySignature.__init__c C , t | j| j| j}t||| j| j ||fS r )r r r r _sign_envelope_with_keyr" r! r# envelopeheadersr r r r applyA
zMemorySignature.applyc C s t | j}t|| |S r )r r _verify_envelope_with_key)r# r( r r r r verifyH s
zMemorySignature.verifyNNN)__name__
__module__ __qualname____doc__r$ r* r- r r r r r . s
r c s( e Zd ZdZ d fdd Z ZS ) SignaturezJSign given SOAP envelope with WSSE sig using given key file and cert file.Nc s t t|t|||| d S r )superr$ r )r# key_filecertfiler r" r! __class__r r r$ Q s zSignature.__init__r. )r/ r0 r1 r2 r$
__classcell__r r r7 r r3 N s r3 c @ s e Zd ZdZdd ZdS )BinarySignaturezSign given SOAP envelope with WSSE sig using given key file and cert file.
Place the key information into BinarySecurityElement.c C r% r )r r r r _sign_envelope_with_key_binaryr" r! r' r r r r* g r+ zBinarySignature.applyN)r/ r0 r1 r2 r* r r r r r: b s r: c C s t d u rtdd S )NzThe xmlsec module is required for wsse.Signature()
You can install xmlsec with: pip install xmlsec
or install zeep via: pip install zeep[xmlsec]
)r ImportErrorr r r r r o s
r c C s" t t|t||}t| |||S )a
Sign given SOAP envelope with WSSE sig using given key and cert.
Sign the wsu:Timestamp node in the wsse:Security header and the soap:Body;
both must be present.
Add a ds:Signature node in the wsse:Security header containing the
signature.
Use EXCL-C14N transforms to normalize the signed XML (so that irrelevant
whitespace or attribute ordering changes don't invalidate the
signature). Use SHA1 signatures.
Expects to sign an incoming document something like this (xmlns attributes
omitted for readability):
2015-06-25T21:53:25.246276+00:00
2015-06-25T21:58:25.246276+00:00
...
After signing, the sample document would look something like this (note the
added wsu:Id attr on the soap:Body and wsu:Timestamp nodes, and the added
ds:Signature node in the header, with ds:Reference nodes with URI attribute
referencing the wsu:Id of the signed nodes):
nnjjqTKxwl1hT/2RUsBuszgjTbI=
qAATZaSqAr9fta9ApbGrFWDuCCQ=
Hz8jtQb...bOdT6ZdTQ==
MIIDnzC...Ia2qKQ==
...
...
2015-06-25T22:00:29.821700+00:00
2015-06-25T22:05:29.821700+00:00
...
)r r r& )r( keyfiler6 r r" r! r r r r
sign_envelopex s `r> c C s t | }tj| tjj|ptjj}tj|}tj|}tj | tj
| t | }| d| t
} || _t| || t|d| |ttjd}
|
dkr\t| ||
| | | t|ttjd} || |fS )zPrepare envelope and sign.r Body TimestampNSecurityTokenReference)r r templatecreate Transform EXCL_C14NRSA_SHA1ensure_key_info
add_x509_datax509_data_add_issuer_serialx509_data_add_certificater insertSignatureContextr
_sign_nodefindr r WSUsignr
SubElementWSSE) r( r r" r! soap_env signaturekey_info x509_datasecurityctx timestamp
sec_token_refr r r _signature_prepare s*
r[ c C s" t | |||\}}}|| d S r )r[ append)r( r r" r! _rZ rV r r r r& s
r& c C s t | |||\}}}t|ttjdddi}tttjdddd}dt| |jd< | ttj
d j |_ | d
| |
| d S ) N Reference ValueTypezUhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3BinarySecurityTokenz^http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary)r_ EncodingType#URIX509Certificate )r[ r rQ r r rR Elementr attribrN DStextrK getparentremove) r( r r" r! rW rZ rV refbintokr r r r;
s&
r; c C s t t|}t| |S )zVerify WS-Security signature on given SOAP envelope with given cert.
Expects a document like that found in the sample XML in the ``sign()``
docstring.
Raise SignatureVerificationFailed on failure, silent on success.
)r r r, )r( r6 r r r r verify_envelope% s
rn c C s t | }| t|d}|d u rt |ttjd}|ttjd}t }|j ddtjid}|D ]!}|
ddd } | j d | d
tj idd }
| |
d tj q5||_
z|| W d S tjym t w )
NHeaderSecurityr3 zds:SignedInfo/ds:Referenceds)
namespacesrc re z//*[@wsu:Id='%s']wsur Id)r rN r r r rR rh r rL xpathgetrO register_idr r- Error) r( r rS headerrW rT rX refsrl
referenced_id
referencedr r r r, 2 s, r, c C sL t |}| |dtj tjj||ptjjd| d}tj |tjj
dS )a Add sig for ``target`` in ``signature`` node, using ``ctx`` context.
Doesn't actually perform the signing; ``ctx.sign(signature)`` should be
called later to do that.
Adds a Reference node to the signature with URI attribute pointing to the
target node, and registers the target node's ID so XMLSec will be able to
find the target node by ID when it signs.
rt rb )uriN) r rw r rO r rB
add_referencerD SHA1
add_transformrE )rX rT targetr! node_idrl r r r rM R s
rM r. r ) r2 lxmlr
lxml.etreer zeepr zeep.exceptionsr
zeep.utilsr zeep.wsse.utilsr r r r< SOAP_NSr r r r r3 r: r r> r[ r& r; rn r, rM r r r r s<
d'