| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| |
| /* |
| * XSEC |
| * |
| * XencInteropResolver := Class to resolve key elements into certificates for |
| * interop test |
| * |
| * $Id$ |
| * |
| */ |
| |
| // XSEC |
| |
| #include "XencInteropResolver.hpp" |
| |
| #include <xsec/framework/XSECDefs.hpp> |
| #include <xsec/framework/XSECProvider.hpp> |
| #include <xsec/enc/XSECKeyInfoResolver.hpp> |
| #include <xsec/dsig/DSIGKeyInfoName.hpp> |
| #include <xsec/dsig/DSIGKeyInfoX509.hpp> |
| #include <xsec/xenc/XENCCipher.hpp> |
| #include <xsec/xenc/XENCEncryptedKey.hpp> |
| |
| #include "../../utils/XSECDOMUtils.hpp" |
| |
| #include <xercesc/util/Janitor.hpp> |
| #include <xercesc/util/XMLUniDefs.hpp> |
| |
| XERCES_CPP_NAMESPACE_USE |
| |
| #include <iostream> |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| # include <openssl/x509.h> |
| # include <openssl/pem.h> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoSymmetricKey.hpp> |
| #endif |
| |
| #if defined (XSEC_HAVE_WINCAPI) |
| # include <xsec/enc/WinCAPI/WinCAPICryptoProvider.hpp> |
| # include <xsec/enc/WinCAPI/WinCAPICryptoSymmetricKey.hpp> |
| #endif |
| |
| #if defined (XSEC_HAVE_NSS) |
| # include <xsec/enc/NSS/NSSCryptoProvider.hpp> |
| # include <xsec/enc/NSS/NSSCryptoSymmetricKey.hpp> |
| #endif |
| |
| // -------------------------------------------------------------------------------- |
| // Merlin Xenc-Five keys and Strings |
| // -------------------------------------------------------------------------------- |
| |
| static XMLCh s_bobName[] = { |
| chLatin_b, |
| chLatin_o, |
| chLatin_b, |
| chNull |
| }; |
| |
| static XMLCh s_jobName[] = { |
| chLatin_j, |
| chLatin_o, |
| chLatin_b, |
| chNull |
| }; |
| |
| static XMLCh s_jebName[] = { |
| chLatin_j, |
| chLatin_e, |
| chLatin_b, |
| chNull |
| }; |
| |
| static XMLCh s_jedName[] = { |
| chLatin_j, |
| chLatin_e, |
| chLatin_d, |
| chNull |
| }; |
| |
| static char s_bobKey[] = "abcdefghijklmnopqrstuvwx"; |
| static char s_jobKey[] = "abcdefghijklmnop"; |
| static char s_jebKey[] = "abcdefghijklmnopqrstuvwx"; |
| static char s_jedKey[] = "abcdefghijklmnopqrstuvwxyz012345"; |
| |
| // -------------------------------------------------------------------------------- |
| // Phaos xenc-three strings and keys |
| // -------------------------------------------------------------------------------- |
| |
| static XMLCh s_phaosRSAName[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chLatin_r, |
| chLatin_s, |
| chLatin_a, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| static XMLCh s_phaosTripleDESName[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chLatin_t, |
| chLatin_r, |
| chLatin_i, |
| chLatin_p, |
| chLatin_l, |
| chLatin_e, |
| chLatin_d, |
| chLatin_e, |
| chLatin_s, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| static XMLCh s_phaos3DESName[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chDigit_3, |
| chLatin_d, |
| chLatin_e, |
| chLatin_s, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| static XMLCh s_phaosAES128Name[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chLatin_a, |
| chLatin_e, |
| chLatin_s, |
| chDigit_1, |
| chDigit_2, |
| chDigit_8, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| static XMLCh s_phaosAES192Name[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chLatin_a, |
| chLatin_e, |
| chLatin_s, |
| chDigit_1, |
| chDigit_9, |
| chDigit_2, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| static XMLCh s_phaosAES256Name[] = { |
| chLatin_m, |
| chLatin_y, |
| chDash, |
| chLatin_a, |
| chLatin_e, |
| chLatin_s, |
| chDigit_2, |
| chDigit_5, |
| chDigit_6, |
| chDash, |
| chLatin_k, |
| chLatin_e, |
| chLatin_y, |
| chNull |
| }; |
| |
| unsigned char s_phaos3DESKey[] = { |
| |
| 0xc8, 0x8f, 0x89, 0xd5, 0xfd, 0xe9, 0xb9, 0x80, |
| 0x04, 0x46, 0x32, 0x1c, 0x4f, 0xab, 0xdf, 0x83, |
| 0xa4, 0x62, 0xb6, 0x62, 0x97, 0xf2, 0x70, 0xf4 |
| |
| }; |
| |
| unsigned char s_phaosAES128Key[] = { |
| |
| 0xd3, 0x5f, 0xb2, 0xb9, 0x0d, 0xa1, 0xb8, 0xf4, |
| 0xb5, 0xf9, 0x0b, 0xf4, 0x2c, 0x7f, 0xb3, 0x69 |
| |
| }; |
| |
| unsigned char s_phaosAES192Key[] = { |
| |
| 0x22, 0x57, 0xee, 0x4b, 0x8d, 0x0b, 0xbd, 0x2b, |
| 0x55, 0x53, 0x43, 0x23, 0xf1, 0xe3, 0xeb, 0xac, |
| 0x61, 0xd5, 0x84, 0x06, 0xf8, 0xf3, 0x2f, 0xbe |
| |
| }; |
| |
| unsigned char s_phaosAES256Key[] = { |
| |
| 0x66, 0x16, 0x78, 0xbf, 0x74, 0x65, 0xc1, 0x39, |
| 0x42, 0x10, 0xea, 0x48, 0xac, 0x77, 0xcb, 0x29, |
| 0x5c, 0x89, 0x38, 0x10, 0xed, 0x10, 0x93, 0x8e, |
| 0x40, 0x36, 0xad, 0xff, 0x8c, 0x51, 0xd5, 0xb0 |
| |
| }; |
| |
| // -------------------------------------------------------------------------------- |
| // Construct/Destruct |
| // -------------------------------------------------------------------------------- |
| |
| |
| XencInteropResolver::XencInteropResolver(DOMDocument * doc, const XMLCh * baseURI) { |
| |
| if (baseURI != NULL) |
| mp_baseURI = XMLString::replicate(baseURI); |
| else |
| mp_baseURI = NULL; |
| |
| #if !defined(_WIN32) |
| m_fcount = 0; |
| #endif |
| |
| mp_doc = doc; |
| |
| } |
| |
| |
| XencInteropResolver::~XencInteropResolver() { |
| |
| if (mp_baseURI != NULL) |
| XSEC_RELEASE_XMLCH(mp_baseURI); |
| |
| } |
| // -------------------------------------------------------------------------------- |
| // Utility functions |
| // -------------------------------------------------------------------------------- |
| #if defined(_WIN32) |
| |
| void reverseSlash(safeBuffer &path) { |
| |
| for (int i = 0; i < (int) strlen(path.rawCharBuffer()); ++i) { |
| |
| if (path[i] == '/') |
| path[i] = '\\'; |
| |
| } |
| |
| } |
| |
| #endif |
| |
| XSECCryptoSymmetricKey * XencInteropResolver::makeSymmetricKey(XSECCryptoSymmetricKey::SymmetricKeyType type) { |
| |
| XSECCryptoSymmetricKey * k = XSECPlatformUtils::g_cryptoProvider->keySymmetric(type); |
| return k; |
| } |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| |
| BIO * createFileBIO(const XMLCh * baseURI, const char * name) { |
| |
| // Open file URI relative to the encrypted file |
| |
| BIO * bioFile; |
| if ((bioFile = BIO_new(BIO_s_file())) == NULL) { |
| |
| return NULL; |
| |
| } |
| |
| safeBuffer fname; |
| fname.sbTranscodeIn(baseURI); |
| fname.sbStrcatIn("/"); |
| fname.sbStrcatIn(name); |
| |
| #if defined(_WIN32) |
| reverseSlash(fname); |
| #endif |
| |
| if (BIO_read_filename(bioFile, fname.rawCharBuffer()) <= 0) { |
| |
| return NULL; |
| |
| } |
| |
| return bioFile; |
| } |
| #endif |
| // -------------------------------------------------------------------------------- |
| // Resolver |
| // -------------------------------------------------------------------------------- |
| |
| XSECCryptoKey * XencInteropResolver::resolveKey(const DSIGKeyInfoList * lst) const { |
| |
| int lstSize = (int) lst->getSize(); |
| |
| for (int i = 0; i < lstSize; ++i) { |
| |
| const DSIGKeyInfo * ki = lst->item(i); |
| |
| if (ki->getKeyInfoType() == DSIGKeyInfo::KEYINFO_NAME) { |
| |
| const DSIGKeyInfoName * kn = static_cast<const DSIGKeyInfoName*>(ki); |
| |
| const XMLCh * name = kn->getKeyName(); |
| |
| // Check if this is a key we know |
| |
| if (strEquals(s_bobName, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_3DES_192); |
| try { |
| k->setKey((unsigned char *) s_bobKey, (unsigned int) strlen(s_bobKey)); |
| } catch (...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_jobName, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_128); |
| try { |
| k->setKey((unsigned char *) s_jobKey, (unsigned int) strlen(s_jobKey)); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_jebName, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_192); |
| try { |
| k->setKey((unsigned char *) s_jebKey, (unsigned int) strlen(s_jebKey)); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_jedName, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_256); |
| try { |
| k->setKey((unsigned char *) s_jedKey, (unsigned int) strlen(s_jedKey)); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| // PHAOS Keys |
| if (strEquals(s_phaos3DESName, name) || strEquals(s_phaosTripleDESName, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_3DES_192); |
| try { |
| k->setKey(s_phaos3DESKey, 24); |
| } catch (...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_phaosAES128Name, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_128); |
| try { |
| k->setKey(s_phaosAES128Key, 16); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_phaosAES192Name, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_192); |
| try { |
| k->setKey(s_phaosAES192Key, 24); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| if (strEquals(s_phaosAES256Name, name)) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_256); |
| try { |
| k->setKey(s_phaosAES256Key, 32); |
| } catch(...) { |
| delete k; |
| throw; |
| } |
| return k; |
| } |
| #if defined (XSEC_HAVE_OPENSSL) |
| if (strEquals(s_phaosRSAName, name)) { |
| |
| // This is the Phaos RSA key |
| BIO * rsaFile = createFileBIO(mp_baseURI, "rsa-priv-key.der"); |
| if (rsaFile == NULL) |
| return NULL; |
| |
| PKCS8_PRIV_KEY_INFO * p8inf; |
| p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(rsaFile, NULL); |
| |
| EVP_PKEY * pk = EVP_PKCS82PKEY(p8inf); |
| OpenSSLCryptoKeyRSA * k = new OpenSSLCryptoKeyRSA(pk); |
| PKCS8_PRIV_KEY_INFO_free(p8inf); |
| BIO_free_all(rsaFile); |
| return k; |
| |
| } |
| #endif |
| |
| // If we get this far, we don't know it. So look for EncryptedKey elements |
| // containing this name as a CarriedKeyName |
| |
| DOMNode * c = mp_doc->getDocumentElement()->getFirstChild(); |
| while (c != NULL) { |
| |
| if (c->getNodeType() == DOMNode::ELEMENT_NODE && |
| strEquals(getDSIGLocalName(c), MAKE_UNICODE_STRING("KeyInfo"))) { |
| |
| DOMNode * ek = c->getFirstChild(); |
| while (ek != NULL) { |
| |
| if (ek->getNodeType() == DOMNode::ELEMENT_NODE && |
| strEquals(getXENCLocalName(ek), MAKE_UNICODE_STRING("EncryptedKey"))) { |
| |
| // Load |
| XSECProvider prov; |
| XENCCipher * cipher = prov.newCipher(mp_doc); |
| |
| XENCEncryptedKey * xek = cipher->loadEncryptedKey(static_cast<DOMElement*>(ek)); |
| Janitor<XENCEncryptedKey> j_xek(xek); |
| |
| if (strEquals(xek->getCarriedKeyName(), name) && |
| strEquals(xek->getRecipient(), MAKE_UNICODE_STRING("you"))) { |
| |
| // This is it! |
| cipher->setKeyInfoResolver(this); |
| unsigned char keyBuf[1024]; |
| int sz = cipher->decryptKey(xek, keyBuf, 1024); |
| |
| if (sz > 0) { |
| XSECCryptoSymmetricKey * k = |
| XSECPlatformUtils::g_cryptoProvider->keySymmetric(XSECCryptoSymmetricKey::KEY_AES_256); |
| try { |
| k->setKey(keyBuf, sz); |
| } catch (...) { |
| delete k; |
| throw; |
| } |
| |
| return k; |
| } |
| } |
| } |
| ek = ek->getNextSibling(); |
| } |
| } |
| |
| c = c->getNextSibling(); |
| } |
| |
| } |
| |
| else if (ki->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) { |
| |
| DSIGKeyInfoX509 * kix = (DSIGKeyInfoX509 *) ki; |
| |
| XSECCryptoX509 * XCX509 = kix->getCertificateCryptoItem(0); |
| |
| if (XCX509 != 0) { |
| #if defined (XSEC_HAVE_OPENSSL) |
| |
| |
| if (strEquals(XCX509->getProviderName(),DSIGConstants::s_unicodeStrPROVOpenSSL)) { |
| |
| OpenSSLCryptoX509 * OSSLX509 = (OpenSSLCryptoX509 *) XCX509; |
| X509 * x509 = OSSLX509->getOpenSSLX509(); |
| |
| // Check the serial number |
| |
| BIGNUM * bnserial = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL); |
| BN_free(bnserial); |
| |
| BIO * rsaFile = createFileBIO(mp_baseURI, "rsa.p8"); |
| if (rsaFile == NULL) |
| return NULL; |
| |
| PKCS8_PRIV_KEY_INFO * p8inf; |
| p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(rsaFile, NULL); |
| |
| EVP_PKEY * pk = EVP_PKCS82PKEY(p8inf); |
| OpenSSLCryptoKeyRSA * k = new OpenSSLCryptoKeyRSA(pk); |
| PKCS8_PRIV_KEY_INFO_free(p8inf); |
| BIO_free_all(rsaFile); |
| return k; |
| |
| } |
| #if defined (XSEC_HAVE_WINCAPI) |
| else { |
| #endif /* XSEC_HAVE_WINCAPI */ |
| #endif /* XSEC_HAVE_OPENSSL */ |
| |
| #if defined (XSEC_HAVE_WINCAPI) |
| std::cerr << "WARNING - Unable to load PKCS8 private key file into Windows CAPI" << std::endl; |
| #if defined (XSEC_HAVE_OPENSSL) |
| } |
| #endif /* XSEC_HAVE_WINCAPI */ |
| #endif /* XSEC_HAVE_OPENSSL */ |
| } |
| } |
| } |
| |
| return NULL; |
| |
| } |
| |
| XSECKeyInfoResolver * XencInteropResolver::clone(void) const { |
| |
| return new XencInteropResolver(mp_doc, mp_baseURI); |
| |
| } |
