[xmlsec] bug or failure to undestand ?

Mon, 22 Apr 2002 18:08:36 -0700

--------------080903020000080404030205
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Hi, Skip!

Since you've not described what exactly you want to select
using XPath expression I will try to guess that your goal is
to select all <location> nodes and the text these nodes contain.
In this assumpiton I would recommend to use following XPath
expression:

    <XPath>
        ancestor-or-self::location
    </XPath>

In your example this expression will select following nodes
(line breaks are added for better formatting, original result
is one line):

<location>
Monterey, Monterey Peninsula Airport, CA,
United States (KMRY) 36-35-26N 121-50-51W 66M
</location>
<location>
San Francisco, San Francisco International Airport, CA,
United States (KSFO) 37-37-11N 122-21-53W 26M </location>
<location>
Vineyard Haven, Marthas Vineyard Airport, MA,
United States (KMVY) 41-23-32N 070-37-00W 16M
</location>

LibXML2 has a nice utility xmllint that allows you to play with different
XML features including XPath. You can try different XPath expressions
on your document and immidiatelly see results.
Also (in case you don't know about this) there is a nice XPath tutorial with
examples:
    http://www.zvon.org/xxl/XPathTutorial/General/examples.html

About "/usr/local/ssl": I am really surprised that configuration script
was not able to find OpenSSL in this case. What Linux distribution do
you use? Will you try the latest 0.0.4 XML Sec library, please?

Thanks,

Aleksey.

Skip Carter wrote:

>Hi,
>
>I am experimenting with your XMLsec library (0.0.3 on
>Linux) and have found it to be very helpful in the
>practical aspects of learning XML Digital Signatures.
>Between reading the specs and playing with your
>code (I compiled it with debugging turned on
>and used testDSig) I think I mostly have the hang of it.
>
>Everything seemed to be going along just fine until
>I started playing with using XPath.  I created a
>test file (attached) and tried to set up a signature
>with an XPath transformation to just sign one elements of
>the file (all the 'location' nodes).  I tried a couple of
>different XPath statements but whatever I did, either
>signed the entire document or signed none of the document
>(I tested by changing the doc and then using testDSig
>in verify mode).
>
>Does your library presently support XPath ?
>If so, I'd appreciate a pointer on how to do what I
>am trying to do.
>
>I tried:
>  <XPath> self::document/content/weather/location </XPath>
>and:
>  <XPath> .//location </XPath>
>
>which should be equivalent in selecting all of the
>location nodes, but they did not seem to
>work (they looked to me to act as if none of the file
>was signed).
>
>I have searched around the Web a bit, but I haven't
>found any COMPLETE examples of the use of XPath,
>so I built my tests from what I understood from the
>XPath documentation.
>
>
>Also, a minor problem with the configure script:
>It failed to automatically find the location of
>my openSSL installation in spite of it being in
>the standard location ( /usr/local/ssl ), I had
>to explicitly provide it with the switch
>      --with-openssl=/usr/local/ssl
>
>before the library would compile.
>
>
>Thanks in advance for your help,
>
>Skip
>
>
>
>
> ------------------------------------------------------------------------
>
> Monterey, Monterey Peninsula Airport, CA, United States (KMRY) 
> 36-35-26N 121-50-51W 66M Apr 19, 2002 - 10:54 AM EST / 2002.04.19 1554 
> UTC from the WNW (300 degrees) at 6 MPH (5 KT) 10 mile(s) clear 54.0 F 
> (12.2 C) 46.0 F (7.8 C) 74% 30.15 in. Hg (1020 hPa) San Francisco, San 
> Francisco International Airport, CA, United States (KSFO) 37-37-11N 
> 122-21-53W 26M Apr 19, 2002 - 10:56 AM EST / 2002.04.19 1556 UTC from 
> the W (260 degrees) at 5 MPH (4 KT) 10 mile(s) clear 55.9 F (13.3 C) 
> 39.0 F (3.9 C) 52% 30.15 in. Hg (1020 hPa) Vineyard Haven, Marthas 
> Vineyard Airport, MA, United States (KMVY) 41-23-32N 070-37-00W 16M 
> Apr 19, 2002 - 10:53 AM EST / 2002.04.19 1553 UTC from the S (170 
> degrees) at 9 MPH (8 KT) 6 mile(s) overcast haze 55.0 F (12.8 C) 48.9 
> F (9.4 C) 79% 30 in. Hg (1015 hPa)
>
>
>------------------------------------------------------------------------
>
><?xml version="1.0" encoding="UTF-8"?>
><Envelope xmlns="urn:envelope">
>  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
>    <SignedInfo>
>      <CanonicalizationMethod
>               Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
>      <SignatureMethod
>               Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
>      <Reference URI="file:///home/skip/xml/weather.xml">
>        <Transforms>
>	  <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
>	  <XPath>
>	   .//location
>	  </XPath>
>	  </Transform>
>        </Transforms>
>        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
>        <DigestValue></DigestValue>
>      </Reference>
>    </SignedInfo>
>    <SignatureValue/>
>    <KeyInfo>
>	<KeyValue/>
>    </KeyInfo>
>  </Signature>
></Envelope>
>

--------------080903020000080404030205
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<html>
<head>
</head>
<body>
Hi, Skip! 
 
Since you've not described what exactly you want to select 
using XPath expression I will try to guess that your goal is 
to select all &lt;location&gt; nodes and the text these nodes contain. 
In this assumpiton I would recommend to use following XPath 
expression: 
 
&nbsp;&nbsp;&nbsp; &lt;XPath&gt; 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ancestor-or-self::location 
&nbsp;&nbsp;&nbsp; &lt;/XPath&gt; 
 
In your example this expression will select following nodes 
(line breaks are added for better formatting, original result 
is one line): 
 
&lt;location&gt; 
Monterey, Monterey Peninsula Airport, CA, 
United States (KMRY) 36-35-26N 121-50-51W 66M 
&lt;/location&gt; 
&lt;location&gt; 
San Francisco, San Francisco International Airport, CA, 
United States (KSFO) 37-37-11N 122-21-53W 26M &lt;/location&gt; 
&lt;location&gt; 
Vineyard Haven, Marthas Vineyard Airport, MA, 
United States (KMVY) 41-23-32N 070-37-00W 16M 
&lt;/location&gt; 
 
LibXML2 has a nice utility xmllint that allows you to play with different 
XML features including XPath. You can try different XPath expressions 
on your document and immidiatelly see results. 
Also (in case you don't know about this) there is a nice XPath tutorial with 
examples: 
&nbsp;&nbsp;&nbsp; <a class="moz-txt-link-freetext" href="http://www.zvon.org/xxl/XPathTutorial/General/examples.html">http://www.zvon.org/xxl/XPathTutorial/General/examples.html</a> 
 
 
About "/usr/local/ssl": I am really surprised that configuration script 
was not able to find OpenSSL in this case. What Linux distribution do 
you use? Will you try the latest 0.0.4 XML Sec library, please? 
 
 
Thanks, 
 
Aleksey. 
 
 
Skip Carter wrote: 
<blockquote type="cite" cite="mid:3CC4ACA6.65B0535@taygeta.com">
 <pre wrap="">Hi, I am experimenting with your XMLsec library (0.0.3 on Linux) and have found it to be very helpful in the practical aspects of learning XML Digital Signatures. Between reading the specs and playing with your code (I compiled it with debugging turned on and used testDSig) I think I mostly have the hang of it. Everything seemed to be going along just fine until I started playing with using XPath. I created a test file (attached) and tried to set up a signature with an XPath transformation to just sign one elements of the file (all the 'location' nodes). I tried a couple of different XPath statements but whatever I did, either signed the entire document or signed none of the document (I tested by changing the doc and then using testDSig in verify mode). Does your library presently support XPath ? If so, I'd appreciate a pointer on how to do what I am trying to do. I tried: &lt;XPath
&gt; self::document/content/weather/location &lt;/XPath&gt; and: &lt;XPath&gt; .//location &lt;/XPath&gt; which should be equivalent in selecting all of the location nodes, but they did not seem to work (they looked to me to act as if none of the file was signed). I have searched around the Web a bit, but I haven't found any COMPLETE examples of the use of XPath, so I built my tests from what I understood from the XPath documentation. Also, a minor problem with the configure script: It failed to automatically find the location of my openSSL installation in spite of it being in the standard location ( /usr/local/ssl ), I had to explicitly provide it with the switch --with-openssl=/usr/local/ssl before the library would compile. Thanks in advance for your help, Skip </pre>
 
 <hr width="90%" size="4"> 
 <document><header>
 <title>The latest weather</title>
 </header><content><weather id="KMRY"><location> Monterey, Monterey Peninsula
Airport, CA, United States (KMRY) 36-35-26N 121-50-51W 66M </location><time>
 Apr 19, 2002 - 10:54 AM EST / 2002.04.19 1554 UTC </time><wind> from the
WNW (300 degrees) at 6 MPH (5 KT) </wind><visibility> 10 mile(s) </visibility><sky>
 clear </sky><temperature> 54.0 F (12.2 C) </temperature><dewpt> 46.0 F
(7.8 C) </dewpt><humidity> 74% </humidity><press> 30.15 in. Hg (1020 hPa)
 </press></weather><weather id="KSFO"><location>
 San Francisco, San Francisco International Airport, CA, United States (KSFO)
37-37-11N 122-21-53W 26M </location><time> Apr 19, 2002 - 10:56 AM EST /
2002.04.19 1556 UTC </time><wind> from the W (260 degrees) at 5 MPH (4 KT)
 </wind><visibility> 10 mile(s) </visibility><sky> clear </sky><temperature>
 55.9 F (13.3 C) </temperature><dewpt> 39.0 F (3.9 C) </dewpt><humidity>
 52% </humidity><press> 30.15 in. Hg (1020 hPa) </press></weather><weather id="KMVY"><location>
 Vineyard Haven, Marthas Vineyard Airport, MA, United States (KMVY) 41-23-32N
070-37-00W 16M </location><time> Apr 19, 2002 - 10:53 AM EST / 2002.04.19
1553 UTC </time><wind> from the S (170 degrees) at 9 MPH (8 KT) </wind><visibility>
 6 mile(s) </visibility><sky> overcast </sky><note> haze </note><temperature>
 55.0 F (12.8 C) </temperature><dewpt> 48.9 F (9.4 C) </dewpt><humidity>
 79% </humidity><press> 30 in. Hg (1015 hPa) </press></weather></content></document>
 <pre wrap=""> <hr width="90%" size="4"> &lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;Envelope xmlns="urn:envelope"&gt; &lt;Signature xmlns=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>&gt; &lt;SignedInfo&gt; &lt;CanonicalizationMethod Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/TR/2001/REC-xml-c14n-20010315">"http://www.w3.org/TR/2001/REC-xml-c14n-20010315"</a> /&gt; &lt;SignatureMethod Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">"http://www.w3.org/2000/09/xmldsig#rsa-sha1"</a> /&gt; &lt;Reference URI=<a class="moz-txt-link-rfc2396E" href="file:///home/skip/xml/weather.xml">"file:///home/skip/xml/weather.xml"</a>&gt; &lt;Transforms&gt; 	 &lt;Transform Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/TR/1999/REC-xpat
h-19991116">"http://www.w3.org/TR/1999/REC-xpath-19991116"</a>&gt; 	 &lt;XPath&gt; 	 .//location 	 &lt;/XPath&gt; 	 &lt;/Transform&gt; &lt;/Transforms&gt; &lt;DigestMethod Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2000/09/xmldsig#sha1">"http://www.w3.org/2000/09/xmldsig#sha1"</a> /&gt; &lt;DigestValue&gt;&lt;/DigestValue&gt; &lt;/Reference&gt; &lt;/SignedInfo&gt; &lt;SignatureValue/&gt; &lt;KeyInfo&gt; 	&lt;KeyValue/&gt; &lt;/KeyInfo&gt; &lt;/Signature&gt; &lt;/Envelope&gt; </pre>
 </blockquote>
 
 </body>
 </html>

--------------080903020000080404030205--