| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| |
| /* |
| * XSEC |
| * |
| * templatesign := tool to sign a template XML signature file |
| * |
| * Author(s): Berin Lautenbach |
| * |
| * $Id$ |
| * |
| */ |
| |
| //XSEC includes |
| // XSEC |
| |
| #include <xsec/utils/XSECPlatformUtils.hpp> |
| #include <xsec/framework/XSECProvider.hpp> |
| #include <xsec/canon/XSECC14n20010315.hpp> |
| #include <xsec/dsig/DSIGSignature.hpp> |
| #include <xsec/dsig/DSIGKeyInfoX509.hpp> |
| #include <xsec/framework/XSECException.hpp> |
| #include <xsec/framework/XSECURIResolver.hpp> |
| #include <xsec/enc/XSECCryptoException.hpp> |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoKeyEC.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoKeyHMAC.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp> |
| # include <xsec/enc/OpenSSL/OpenSSLSupport.hpp> |
| |
| # include <openssl/bio.h> |
| # include <openssl/dsa.h> |
| # include <openssl/err.h> |
| # include <openssl/evp.h> |
| # include <openssl/pem.h> |
| |
| #endif |
| |
| #if defined(XSEC_HAVE_WINCAPI) |
| # include <xsec/enc/WinCAPI/WinCAPICryptoProvider.hpp> |
| # include <xsec/enc/WinCAPI/WinCAPICryptoKeyDSA.hpp> |
| # include <xsec/enc/WinCAPI/WinCAPICryptoKeyRSA.hpp> |
| # include <xsec/enc/WinCAPI/WinCAPICryptoKeyHMAC.hpp> |
| #endif |
| |
| #include "../../utils/XSECDOMUtils.hpp" |
| |
| #include <memory.h> |
| #include <string.h> |
| #include <iostream> |
| #include <stdlib.h> |
| |
| #if defined(HAVE_UNISTD_H) |
| # include <unistd.h> |
| #else |
| # if defined(HAVE_DIRECT_H) |
| # include <direct.h> |
| # endif |
| #endif |
| |
| #include <xercesc/util/PlatformUtils.hpp> |
| #include <xercesc/util/XMLString.hpp> |
| |
| #include <xercesc/dom/DOM.hpp> |
| #include <xercesc/parsers/XercesDOMParser.hpp> |
| #include <xercesc/util/XMLException.hpp> |
| #include <xercesc/util/XMLUniDefs.hpp> |
| #include <xercesc/util/XMLNetAccessor.hpp> |
| #include <xercesc/util/XMLUri.hpp> |
| |
| #ifdef XSEC_HAVE_XALAN |
| |
| // XALAN |
| |
| #include <xalanc/XPath/XPathEvaluator.hpp> |
| #include <xalanc/XalanTransformer/XalanTransformer.hpp> |
| |
| // If this isn't defined, we're on Xalan 1.12+ and require modern C++ |
| #ifndef XALAN_USING_XALAN |
| # define XALAN_USING_XALAN(NAME) using xalanc :: NAME; |
| #endif |
| |
| XALAN_USING_XALAN(XPathEvaluator) |
| XALAN_USING_XALAN(XalanTransformer) |
| |
| #endif |
| |
| using std::ostream; |
| using std::cout; |
| using std::cerr; |
| using std::endl; |
| using std::flush; |
| |
| // Uplift entire program into Xerces namespace |
| |
| XERCES_CPP_NAMESPACE_USE |
| |
| // -------------------------------------------------------------------------------- |
| // Much code taken from the DOMPrint Xerces example |
| // -------------------------------------------------------------------------------- |
| |
| static XMLFormatter* gFormatter = 0; |
| static XMLCh* gEncodingName = 0; |
| static XMLFormatter::UnRepFlags gUnRepFlags = XMLFormatter::UnRep_CharRef; |
| |
| |
| |
| |
| static const XMLCh gEndElement[] = { chOpenAngle, chForwardSlash, chNull }; |
| static const XMLCh gEndPI[] = { chQuestion, chCloseAngle, chNull}; |
| static const XMLCh gStartPI[] = { chOpenAngle, chQuestion, chNull }; |
| |
| static const XMLCh gStartCDATA[] = |
| { |
| chOpenAngle, chBang, chOpenSquare, chLatin_C, chLatin_D, |
| chLatin_A, chLatin_T, chLatin_A, chOpenSquare, chNull |
| }; |
| |
| static const XMLCh gEndCDATA[] = |
| { |
| chCloseSquare, chCloseSquare, chCloseAngle, chNull |
| }; |
| static const XMLCh gStartComment[] = |
| { |
| chOpenAngle, chBang, chDash, chDash, chNull |
| }; |
| |
| static const XMLCh gEndComment[] = |
| { |
| chDash, chDash, chCloseAngle, chNull |
| }; |
| |
| static const XMLCh gStartDoctype[] = |
| { |
| chOpenAngle, chBang, chLatin_D, chLatin_O, chLatin_C, chLatin_T, |
| chLatin_Y, chLatin_P, chLatin_E, chSpace, chNull |
| }; |
| static const XMLCh gPublic[] = |
| { |
| chLatin_P, chLatin_U, chLatin_B, chLatin_L, chLatin_I, |
| chLatin_C, chSpace, chDoubleQuote, chNull |
| }; |
| static const XMLCh gSystem[] = |
| { |
| chLatin_S, chLatin_Y, chLatin_S, chLatin_T, chLatin_E, |
| chLatin_M, chSpace, chDoubleQuote, chNull |
| }; |
| static const XMLCh gStartEntity[] = |
| { |
| chOpenAngle, chBang, chLatin_E, chLatin_N, chLatin_T, chLatin_I, |
| chLatin_T, chLatin_Y, chSpace, chNull |
| }; |
| static const XMLCh gNotation[] = |
| { |
| chLatin_N, chLatin_D, chLatin_A, chLatin_T, chLatin_A, |
| chSpace, chDoubleQuote, chNull |
| }; |
| |
| |
| |
| // --------------------------------------------------------------------------- |
| // Local classes |
| // --------------------------------------------------------------------------- |
| |
| class DOMPrintFormatTarget : public XMLFormatTarget |
| { |
| public: |
| DOMPrintFormatTarget() {}; |
| ~DOMPrintFormatTarget() {}; |
| |
| // ----------------------------------------------------------------------- |
| // Implementations of the format target interface |
| // ----------------------------------------------------------------------- |
| |
| void writeChars(const XMLByte* const toWrite, |
| const XMLSize_t count, |
| XMLFormatter * const formatter) |
| { |
| // Surprisingly, Solaris was the only platform on which |
| // required the char* cast to print out the string correctly. |
| // Without the cast, it was printing the pointer value in hex. |
| // Quite annoying, considering every other platform printed |
| // the string with the explicit cast to char* below. |
| cout.write((char *) toWrite, (int) count); |
| }; |
| |
| private: |
| // ----------------------------------------------------------------------- |
| // Unimplemented methods. |
| // ----------------------------------------------------------------------- |
| DOMPrintFormatTarget(const DOMPrintFormatTarget& other); |
| void operator=(const DOMPrintFormatTarget& rhs); |
| }; |
| |
| |
| // --------------------------------------------------------------------------- |
| // ostream << DOMNode |
| // |
| // Stream out a DOM node, and, recursively, all of its children. This |
| // function is the heart of writing a DOM tree out as XML source. Give it |
| // a document node and it will do the whole thing. |
| // --------------------------------------------------------------------------- |
| ostream& operator<<(ostream& target, DOMNode* toWrite) |
| { |
| // Get the name and value out for convenience |
| const XMLCh* nodeName = toWrite->getNodeName(); |
| const XMLCh* nodeValue = toWrite->getNodeValue(); |
| XMLSize_t lent = XMLString::stringLen(nodeValue); |
| |
| switch (toWrite->getNodeType()) |
| { |
| case DOMNode::TEXT_NODE: |
| { |
| gFormatter->formatBuf(nodeValue, |
| lent, XMLFormatter::CharEscapes); |
| break; |
| } |
| |
| |
| case DOMNode::PROCESSING_INSTRUCTION_NODE : |
| { |
| *gFormatter << XMLFormatter::NoEscapes << gStartPI << nodeName; |
| if (lent > 0) |
| { |
| *gFormatter << chSpace << nodeValue; |
| } |
| *gFormatter << XMLFormatter::NoEscapes << gEndPI; |
| break; |
| } |
| |
| |
| case DOMNode::DOCUMENT_NODE : |
| { |
| |
| DOMNode *child = toWrite->getFirstChild(); |
| while( child != 0) |
| { |
| target << child; |
| // add linefeed in requested output encoding |
| *gFormatter << chLF; |
| target << flush; |
| child = child->getNextSibling(); |
| } |
| break; |
| } |
| |
| |
| case DOMNode::ELEMENT_NODE : |
| { |
| // The name has to be representable without any escapes |
| *gFormatter << XMLFormatter::NoEscapes |
| << chOpenAngle << nodeName; |
| |
| // Output the element start tag. |
| |
| // Output any attributes on this element |
| DOMNamedNodeMap *attributes = toWrite->getAttributes(); |
| XMLSize_t attrCount = attributes->getLength(); |
| for (XMLSize_t i = 0; i < attrCount; i++) |
| { |
| DOMNode *attribute = attributes->item(i); |
| |
| // |
| // Again the name has to be completely representable. But the |
| // attribute can have refs and requires the attribute style |
| // escaping. |
| // |
| *gFormatter << XMLFormatter::NoEscapes |
| << chSpace << attribute->getNodeName() |
| << chEqual << chDoubleQuote |
| << XMLFormatter::AttrEscapes |
| << attribute->getNodeValue() |
| << XMLFormatter::NoEscapes |
| << chDoubleQuote; |
| } |
| |
| // |
| // Test for the presence of children, which includes both |
| // text content and nested elements. |
| // |
| DOMNode *child = toWrite->getFirstChild(); |
| if (child != 0) |
| { |
| // There are children. Close start-tag, and output children. |
| // No escapes are legal here |
| *gFormatter << XMLFormatter::NoEscapes << chCloseAngle; |
| |
| while( child != 0) |
| { |
| target << child; |
| child = child->getNextSibling(); |
| } |
| |
| // |
| // Done with children. Output the end tag. |
| // |
| *gFormatter << XMLFormatter::NoEscapes << gEndElement |
| << nodeName << chCloseAngle; |
| } |
| else |
| { |
| // |
| // There were no children. Output the short form close of |
| // the element start tag, making it an empty-element tag. |
| // |
| *gFormatter << XMLFormatter::NoEscapes << chForwardSlash << chCloseAngle; |
| } |
| break; |
| } |
| |
| |
| case DOMNode::ENTITY_REFERENCE_NODE: |
| { |
| //DOMNode *child; |
| #if 0 |
| for (child = toWrite.getFirstChild(); |
| child != 0; |
| child = child.getNextSibling()) |
| { |
| target << child; |
| } |
| #else |
| // |
| // Instead of printing the refernece tree |
| // we'd output the actual text as it appeared in the xml file. |
| // This would be the case when -e option was chosen |
| // |
| *gFormatter << XMLFormatter::NoEscapes << chAmpersand |
| << nodeName << chSemiColon; |
| #endif |
| break; |
| } |
| |
| |
| case DOMNode::CDATA_SECTION_NODE: |
| { |
| *gFormatter << XMLFormatter::NoEscapes << gStartCDATA |
| << nodeValue << gEndCDATA; |
| break; |
| } |
| |
| |
| case DOMNode::COMMENT_NODE: |
| { |
| *gFormatter << XMLFormatter::NoEscapes << gStartComment |
| << nodeValue << gEndComment; |
| break; |
| } |
| |
| |
| case DOMNode::DOCUMENT_TYPE_NODE: |
| { |
| DOMDocumentType *doctype = (DOMDocumentType *)toWrite;; |
| |
| *gFormatter << XMLFormatter::NoEscapes << gStartDoctype |
| << nodeName; |
| |
| const XMLCh* id = doctype->getPublicId(); |
| if (id != 0) |
| { |
| *gFormatter << XMLFormatter::NoEscapes << chSpace << gPublic |
| << id << chDoubleQuote; |
| id = doctype->getSystemId(); |
| if (id != 0) |
| { |
| *gFormatter << XMLFormatter::NoEscapes << chSpace |
| << chDoubleQuote << id << chDoubleQuote; |
| } |
| } |
| else |
| { |
| id = doctype->getSystemId(); |
| if (id != 0) |
| { |
| *gFormatter << XMLFormatter::NoEscapes << chSpace << gSystem |
| << id << chDoubleQuote; |
| } |
| } |
| |
| id = doctype->getInternalSubset(); |
| if (id !=0) |
| *gFormatter << XMLFormatter::NoEscapes << chOpenSquare |
| << id << chCloseSquare; |
| |
| *gFormatter << XMLFormatter::NoEscapes << chCloseAngle; |
| break; |
| } |
| |
| |
| case DOMNode::ENTITY_NODE: |
| { |
| *gFormatter << XMLFormatter::NoEscapes << gStartEntity |
| << nodeName; |
| |
| const XMLCh * id = ((DOMEntity *)toWrite)->getPublicId(); |
| if (id != 0) |
| *gFormatter << XMLFormatter::NoEscapes << gPublic |
| << id << chDoubleQuote; |
| |
| id = ((DOMEntity *)toWrite)->getSystemId(); |
| if (id != 0) |
| *gFormatter << XMLFormatter::NoEscapes << gSystem |
| << id << chDoubleQuote; |
| |
| id = ((DOMEntity *)toWrite)->getNotationName(); |
| if (id != 0) |
| *gFormatter << XMLFormatter::NoEscapes << gNotation |
| << id << chDoubleQuote; |
| |
| *gFormatter << XMLFormatter::NoEscapes << chCloseAngle << chLF; |
| |
| break; |
| } |
| |
| default: |
| cerr << "Unrecognized node type = " |
| << (long)toWrite->getNodeType() << endl; |
| } |
| return target; |
| } |
| |
| |
| // -------------------------------------------------------------------------------- |
| // End of outputter |
| // -------------------------------------------------------------------------------- |
| |
| class DOMMemFormatTarget : public XMLFormatTarget |
| { |
| public: |
| |
| unsigned char * buffer; // Buffer to write to |
| |
| DOMMemFormatTarget() : buffer(NULL) {}; |
| ~DOMMemFormatTarget() {}; |
| |
| void setBuffer (unsigned char * toSet) {buffer = toSet;}; |
| |
| |
| // ----------------------------------------------------------------------- |
| // Implementations of the format target interface |
| // ----------------------------------------------------------------------- |
| |
| void writeChars(const XMLByte* const toWrite, |
| const XMLSize_t count, |
| XMLFormatter * const formatter) |
| { |
| // Surprisingly, Solaris was the only platform on which |
| // required the char* cast to print out the string correctly. |
| // Without the cast, it was printing the pointer value in hex. |
| // Quite annoying, considering every other platform printed |
| // the string with the explicit cast to char* below. |
| memcpy(buffer, (char *) toWrite, (int) count); |
| buffer[count] = '\0'; |
| }; |
| |
| private: |
| // ----------------------------------------------------------------------- |
| // Unimplemented methods. |
| // ----------------------------------------------------------------------- |
| DOMMemFormatTarget(const DOMMemFormatTarget& other); |
| void operator=(const DOMMemFormatTarget& rhs); |
| |
| |
| }; |
| |
| // --------------------------------------------------------------------------- |
| // ostream << DOMString |
| // |
| // Stream out a DOM string. Doing this requires that we first transcode |
| // to char * form in the default code page for the system |
| // --------------------------------------------------------------------------- |
| |
| |
| DOMPrintFormatTarget *DOMtarget; |
| DOMMemFormatTarget *MEMtarget; |
| XMLFormatter *formatter, *MEMformatter; |
| unsigned char *charBuffer; |
| |
| void printUsage(void) { |
| |
| cerr << "\nUsage: templatesign <key options> <file to sign>\n\n"; |
| #if defined (XSEC_HAVE_OPENSSL) |
| cerr << " Where <key options> are one of :\n\n"; |
| cerr << " --x509subjectname/-s <distinguished name>\n"; |
| cerr << " <distinguished name> will be set as SubjectName in x509\n"; |
| cerr << " --dsakey/-d <dsa private key file> <password>\n"; |
| cerr << " <dsa private key file> contains a PEM encoded private key\n"; |
| cerr << " <password> is the password used to decrypt the key file\n"; |
| # if defined (XSEC_HAVE_WINCAPI) |
| cerr << " NOTE: Not usable if --wincapi previously set\n"; |
| # endif |
| # if defined(XSEC_OPENSSL_HAVE_EC) |
| cerr << " --eckey/-e <ec private key file> <password>\n"; |
| cerr << " <ec private key file> contains a PEM encoded private key\n"; |
| cerr << " <password> is the password used to decrypt the key file\n"; |
| # endif |
| # if defined (XSEC_HAVE_WINCAPI) |
| cerr << " NOTE: Not usable if --wincapi previously set\n"; |
| # endif |
| cerr << " --rsakey/-r <rsa private key file> <password>\n"; |
| cerr << " <rsa privatekey file> contains a PEM encoded private key\n"; |
| cerr << " <password> is the password used to decrypt the key file\n"; |
| cerr << " --x509cert/-x <filename>\n"; |
| cerr << " <filename> contains a PEM certificate to be added as a KeyInfo\n"; |
| #endif |
| cerr << " --hmackey/-h <string>\n"; |
| cerr << " <string> is the hmac key to set\n"; |
| cerr << " --clearkeys/-c\n"; |
| cerr << " Clears out any current KeyInfo elements in the file\n"; |
| #if defined(XSEC_HAVE_WINCAPI) |
| cerr << " --windss/-wd\n"; |
| cerr << " Use the default user AT_SIGNATURE key from default\n"; |
| cerr << " Windows DSS CSP\n"; |
| cerr << " --winrsa/-wr\n"; |
| cerr << " Use the default user AT_SIGNATURE key from default\n"; |
| cerr << " Windows RSA CSP\n"; |
| cerr << " --winhmac/-wh <string>\n"; |
| cerr << " Create a windows HMAC key using <string> as the password.\n"; |
| cerr << " Uses a SHA-1 hash of the password to derive a key\n"; |
| #if defined (CRYPT_ACQUIRE_CACHE_FLAG) |
| cerr << " --wincer/-wc <Subject Name>\n"; |
| cerr << " Use the private key associated with the named certificate in the Windows certificate store\n"; |
| #endif /* CRYPT_ACQUIRE_CACHE_FLAG */ |
| cerr << " --windsskeyinfo/-wdi\n"; |
| cerr << " Clear KeyInfo elements and insert DSS parameters from windows key\n"; |
| cerr << " --winrsakeyinfo/-wri\n"; |
| cerr << " Clear KeyInfo elements and insert RSA parameters from windows key\n"; |
| #endif |
| |
| |
| } |
| |
| int main(int argc, char **argv) { |
| |
| XSECCryptoKey * key = NULL; |
| DSIGKeyInfoX509 * keyInfoX509 = NULL; |
| const char * x509SubjectName = NULL; |
| #if defined (XSEC_HAVE_OPENSSL) |
| OpenSSLCryptoX509 * certs[128]; |
| #endif |
| int certCount = 0; |
| int paramCount; |
| bool clearKeyInfo = false; |
| #if defined(XSEC_HAVE_WINCAPI) |
| HCRYPTPROV win32DSSCSP = 0; // Crypto Provider |
| HCRYPTPROV win32RSACSP = 0; // Crypto Provider |
| bool winDssKeyInfo = false; |
| bool winRsaKeyInfo = false; |
| WinCAPICryptoKeyDSA * winKeyDSA = NULL; |
| WinCAPICryptoKeyRSA * winKeyRSA = NULL; |
| #endif |
| |
| // Initialise the XML system |
| |
| try { |
| |
| XMLPlatformUtils::Initialize(); |
| #ifdef XSEC_HAVE_XALAN |
| XPathEvaluator::initialize(); |
| XalanTransformer::initialize(); |
| #endif |
| XSECPlatformUtils::Initialise(); |
| |
| } |
| |
| catch (const XMLException &e) { |
| |
| cerr << "Error during initialisation of Xerces" << endl; |
| cerr << "Error Message = : " |
| << e.getMessage() << endl; |
| |
| } |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| |
| // Initialize OpenSSL |
| ERR_load_crypto_strings(); |
| BIO * bio_err; |
| |
| if ((bio_err=BIO_new(BIO_s_file())) != NULL) |
| BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT); |
| |
| #endif |
| |
| if (argc < 2) { |
| |
| printUsage(); |
| exit (1); |
| } |
| |
| paramCount = 1; |
| |
| while (paramCount < argc - 1) { |
| |
| // Run through all parameters |
| |
| if (_stricmp(argv[paramCount], "--x509subjectname") == 0 || _stricmp(argv[paramCount], "-s") == 0) { |
| |
| if (paramCount +2 >= argc) { |
| |
| printUsage(); |
| exit(1); |
| } |
| |
| // Get the subject name |
| |
| x509SubjectName = argv[paramCount + 1]; |
| paramCount += 2; |
| } |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| |
| else if (_stricmp(argv[paramCount], "--dsakey") == 0 || _stricmp(argv[paramCount], "-d") == 0 |
| || _stricmp(argv[paramCount], "--rsakey") == 0 || _stricmp(argv[paramCount], "-r") == 0 |
| # if defined(XSEC_OPENSSL_HAVE_EC) |
| || _stricmp(argv[paramCount], "--eckey") == 0 || _stricmp(argv[paramCount], "-e") == 0 |
| # endif |
| ) { |
| |
| // OpenSSL Key |
| |
| if (paramCount + 3 >= argc) { |
| |
| printUsage(); |
| exit (1); |
| |
| } |
| |
| if (key != 0) { |
| |
| cerr << "\nError loading private key - another key already loaded\n\n"; |
| printUsage(); |
| exit(1); |
| |
| } |
| |
| // Load the signing key |
| // For now just read a particular file |
| |
| BIO * bioKey; |
| if ((bioKey = BIO_new(BIO_s_file())) == NULL) { |
| |
| cerr << "Error opening private key file\n\n"; |
| exit (1); |
| |
| } |
| |
| if (BIO_read_filename(bioKey, argv[paramCount + 1]) <= 0) { |
| |
| cerr << "Error opening private key file\n\n"; |
| exit (1); |
| |
| } |
| |
| EVP_PKEY * pkey; |
| pkey = PEM_read_bio_PrivateKey(bioKey,NULL,NULL,argv[paramCount + 2]); |
| |
| if (pkey == NULL) { |
| |
| cerr << "Error loading private key\n\n"; |
| ERR_print_errors(bio_err); |
| exit (1); |
| |
| } |
| |
| if (_stricmp(argv[paramCount], "--dsakey") == 0 || _stricmp(argv[paramCount], "-d") == 0) { |
| |
| // Check type is correct |
| |
| if (EVP_PKEY_id(pkey) != EVP_PKEY_DSA) { |
| cerr << "DSA Key requested, but OpenSSL loaded something else\n"; |
| exit (1); |
| } |
| |
| // Create the XSEC OpenSSL interface |
| key = new OpenSSLCryptoKeyDSA(pkey); |
| } |
| #if defined(XSEC_OPENSSL_HAVE_EC) |
| else if (_stricmp(argv[paramCount], "--eckey") == 0 || _stricmp(argv[paramCount], "-e") == 0) { |
| |
| // Check type is correct |
| |
| if (EVP_PKEY_id(pkey) != EVP_PKEY_EC) { |
| cerr << "EC Key requested, but OpenSSL loaded something else\n"; |
| exit (1); |
| } |
| |
| // Create the XSEC OpenSSL interface |
| key = new OpenSSLCryptoKeyEC(pkey); |
| } |
| #endif |
| else { |
| if (EVP_PKEY_id(pkey) != EVP_PKEY_RSA) { |
| cerr << "RSA Key requested, but OpenSSL loaded something else\n"; |
| exit (1); |
| } |
| key = new OpenSSLCryptoKeyRSA(pkey); |
| } |
| |
| EVP_PKEY_free(pkey); |
| BIO_free(bioKey); |
| |
| paramCount += 3; |
| |
| } /* argv[1] = "dsa/rsa/ec" */ |
| |
| |
| else if (_stricmp(argv[paramCount], "--x509cert") == 0 || _stricmp(argv[paramCount], "-x") == 0) { |
| |
| // X509Data keyInfo |
| |
| if (paramCount + 2 >= argc) { |
| |
| printUsage(); |
| exit (1); |
| |
| } |
| |
| // Load the cert. |
| // For now just read a particular file |
| |
| BIO * bioX509; |
| |
| if ((bioX509 = BIO_new(BIO_s_file())) == NULL) { |
| |
| cerr << "Error opening file\n\n"; |
| exit (1); |
| |
| } |
| |
| if (BIO_read_filename(bioX509, argv[paramCount + 1]) <= 0) { |
| |
| cerr << "Error opening X509 Certificate " << argv[paramCount + 1] << "\n\n"; |
| exit (1); |
| |
| } |
| |
| X509 * x |
| ; |
| x = PEM_read_bio_X509_AUX(bioX509,NULL,NULL,NULL); |
| |
| if (x == NULL) { |
| |
| cerr << "Error loading certificate\n\n"; |
| ERR_print_errors(bio_err); |
| exit (1); |
| |
| } |
| |
| // Create the XSEC OpenSSL interface - used only to translate to Base64 |
| |
| certs[certCount++] = new OpenSSLCryptoX509(x); |
| X509_free(x); |
| BIO_free(bioX509); |
| |
| paramCount += 2; |
| |
| } /* argv[1] = "--x509cert" */ |
| |
| else |
| #endif |
| if (_stricmp(argv[paramCount], "--hmackey") == 0 || _stricmp(argv[paramCount], "-h") == 0) { |
| XSECCryptoKeyHMAC* hmacKey = XSECPlatformUtils::g_cryptoProvider->keyHMAC(); |
| hmacKey->setKey((unsigned char *) argv[paramCount + 1], (unsigned int) strlen(argv[paramCount + 1])); |
| key = hmacKey; |
| paramCount += 2; |
| |
| } |
| |
| else if (_stricmp(argv[paramCount], "--clearkeys") == 0 || _stricmp(argv[paramCount], "-c") == 0) { |
| |
| clearKeyInfo = true; |
| paramCount += 1; |
| |
| } |
| |
| #if defined (XSEC_HAVE_WINCAPI) |
| else if (_stricmp(argv[paramCount], "--windss") == 0 || _stricmp(argv[paramCount], "-wd") == 0) { |
| |
| WinCAPICryptoProvider * cp; |
| // First set windows as the crypto provider |
| cp = new WinCAPICryptoProvider(); |
| XSECPlatformUtils::SetCryptoProvider(cp); |
| |
| // Now set the key |
| if (!CryptAcquireContext(&win32DSSCSP, |
| NULL, |
| NULL, |
| PROV_DSS, |
| 0)) { |
| |
| cerr << "Error acquiring Crypto context - Attempting to generate new key pair" << endl; |
| |
| // Attempt to gen a new keyset |
| if (!CryptAcquireContext(&win32DSSCSP, |
| NULL, |
| NULL, |
| PROV_DSS, |
| CRYPT_NEWKEYSET)) { |
| cerr << "Error acquiring DSS Crypto Service Provider with new keyset" << endl; |
| return 2; |
| } |
| else { |
| HCRYPTKEY k; |
| if (!CryptGenKey(win32DSSCSP, AT_SIGNATURE, CRYPT_EXPORTABLE, &k)) { |
| cerr << "Error generating DSS keyset" << endl; |
| return 2; |
| } |
| CryptDestroyKey(k); |
| } |
| } |
| |
| winKeyDSA = new WinCAPICryptoKeyDSA(win32DSSCSP, AT_SIGNATURE, true); |
| key = winKeyDSA; |
| paramCount++; |
| } |
| |
| else if (_stricmp(argv[paramCount], "--winrsa") == 0 || _stricmp(argv[paramCount], "-wr") == 0) { |
| WinCAPICryptoProvider * cp; |
| cp = new WinCAPICryptoProvider(); |
| XSECPlatformUtils::SetCryptoProvider(cp); |
| |
| if (!CryptAcquireContext(&win32RSACSP, |
| NULL, |
| NULL, |
| PROV_RSA_FULL, |
| 0)) { |
| |
| cerr << "Error acquiring Crypto context - Attempting to generate new RSA key pair" << endl; |
| |
| // Attempt to gen a new keyset |
| if (!CryptAcquireContext(&win32RSACSP, |
| NULL, |
| NULL, |
| PROV_RSA_FULL, |
| CRYPT_NEWKEYSET)) { |
| cerr << "Error acquiring RSA Crypto Service Provider with new keyset" << endl; |
| return 2; |
| } |
| else { |
| HCRYPTKEY k; |
| if (!CryptGenKey(win32RSACSP, AT_SIGNATURE, CRYPT_EXPORTABLE, &k)) { |
| cerr << "Error generating RSA keyset" << endl; |
| return 2; |
| } |
| CryptDestroyKey(k); |
| } |
| } |
| |
| winKeyRSA = new WinCAPICryptoKeyRSA(win32RSACSP, AT_SIGNATURE, true); |
| key = winKeyRSA; |
| paramCount++; |
| } |
| |
| else if (_stricmp(argv[paramCount], "--winhmac") == 0 || _stricmp(argv[paramCount], "-wh") == 0) { |
| |
| WinCAPICryptoProvider * cp; |
| // Obtain default PROV_RSA, with default user key container |
| // Note we open in VERIFYCONTEXT as we do not require a assymetric key pair |
| if (!CryptAcquireContext(&win32RSACSP, |
| NULL, |
| NULL, |
| PROV_RSA_FULL, |
| CRYPT_VERIFYCONTEXT)) { |
| cerr << "Error acquiring RSA Crypto Service Provider" << endl; |
| return 2; |
| } |
| cp = new WinCAPICryptoProvider(); |
| XSECPlatformUtils::SetCryptoProvider(cp); |
| |
| paramCount++; |
| HCRYPTKEY k; |
| HCRYPTHASH h; |
| BOOL fResult = CryptCreateHash( |
| win32RSACSP, |
| CALG_SHA, |
| 0, |
| 0, |
| &h); |
| |
| if (fResult == 0) { |
| cerr << "Error creating hash to create windows hmac key from password" << endl; |
| return 2; |
| } |
| fResult = CryptHashData( |
| h, |
| (unsigned char *) argv[paramCount], |
| (DWORD) strlen(argv[paramCount]), |
| 0); |
| |
| if (fResult == 0) { |
| cerr << "Error hashing password to create windows hmac key" << endl; |
| return 2; |
| } |
| |
| // Now create a key |
| fResult = CryptDeriveKey( |
| win32RSACSP, |
| CALG_RC2, |
| h, |
| CRYPT_EXPORTABLE, |
| &k); |
| |
| if (fResult == 0) { |
| cerr << "Error deriving key from hash value" << endl; |
| return 2; |
| } |
| |
| // Wrap in a WinCAPI object |
| WinCAPICryptoKeyHMAC * hk; |
| hk = new WinCAPICryptoKeyHMAC(win32RSACSP); |
| hk->setWinKey(k); |
| |
| key = hk; |
| |
| CryptDestroyHash(h); |
| paramCount++; |
| |
| } |
| |
| else if (_stricmp(argv[paramCount], "--windsskeyinfo") == 0 || _stricmp(argv[paramCount], "-wdi") == 0) { |
| winDssKeyInfo = true; |
| paramCount++; |
| } |
| |
| else if (_stricmp(argv[paramCount], "--winrsakeyinfo") == 0 || _stricmp(argv[paramCount], "-wri") == 0) { |
| winRsaKeyInfo = true; |
| paramCount++; |
| } |
| |
| // Need to find a better way to check this |
| // If CryptAcquireCertificatePrivateKey is not defined in the included |
| // version of wincapi.h, CRYPT_ACQUIRE_CACHE_FLAG will not be set |
| |
| #if defined (CRYPT_ACQUIRE_CACHE_FLAG) |
| |
| // Code provided by Milan Tomic |
| |
| //Please note that this example below use CryptAcquireCertificatePrivateKey() function |
| //which is not declared in wincrypt.h that ships with VC++ 6. If you would like to run |
| //this example you'll need to replace your old wincrypt.h and crypt32.lib with new versions. |
| //This example below is compatible with Windows 98/IE 5 and above OS/IE versions. |
| |
| else if (_stricmp(argv[paramCount], "--wincer") == 0 || _stricmp(argv[paramCount], "-wc") == 0) { |
| WinCAPICryptoProvider * cp; |
| PCCERT_CONTEXT pSignerCert = NULL; |
| DWORD dwKeySpec; |
| HCERTSTORE hStoreHandle; |
| #define MY_ENCODING_TYPE (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING) |
| |
| // Obtain default PROV_DSS with default user key container |
| if (!CryptAcquireContext(&win32DSSCSP, |
| NULL, |
| NULL, |
| PROV_DSS, |
| 0)) { |
| cerr << "Error acquiring DSS Crypto Service Provider" << endl; |
| return 2; |
| }//*/ |
| |
| // Open 'Personal' certificate store |
| if (!(hStoreHandle = CertOpenStore(CERT_STORE_PROV_SYSTEM, |
| 0, |
| NULL, |
| CERT_SYSTEM_STORE_CURRENT_USER, |
| L"MY"))) { |
| cerr << "Error opening 'Personal' store." << endl; |
| return 2; |
| } |
| |
| // Find desired cerificate |
| if (!(pSignerCert = CertFindCertificateInStore(hStoreHandle, |
| MY_ENCODING_TYPE, |
| 0, |
| CERT_FIND_SUBJECT_STR_A, |
| argv[paramCount+1], |
| NULL))) { |
| cerr << "Can't find '" << argv[paramCount+1] << "' certificate in 'Personal' store." << endl; |
| return 2; |
| } |
| |
| // Now get certificate's private key |
| if (!CryptAcquireCertificatePrivateKey(pSignerCert, |
| 0, |
| NULL, |
| &win32RSACSP, |
| &dwKeySpec, |
| NULL)) { |
| cerr << "Can't acquire private key of '" << argv[paramCount+1] << "' certificate." << endl; |
| exit(1); |
| } |
| |
| cp = new WinCAPICryptoProvider(); |
| XSECPlatformUtils::SetCryptoProvider(cp); |
| |
| HCRYPTKEY k; |
| BOOL fResult = CryptGetUserKey( |
| win32RSACSP, |
| dwKeySpec, |
| &k); |
| |
| if (!fResult || k == 0) { |
| cerr << "Error obtaining default user (AT_SIGNATURE or AT_KEYEXCHANGE) key from windows RSA provider.\n"; |
| exit(1); |
| }; |
| |
| winKeyRSA = new WinCAPICryptoKeyRSA(win32RSACSP, k); |
| key = winKeyRSA; |
| paramCount += 2; |
| |
| CertFreeCertificateContext(pSignerCert); |
| CertCloseStore(hStoreHandle, 0); |
| } |
| |
| #endif /* CRYPT_ACQUIRE_CACHE_FLAG */ |
| |
| #endif /* XSEC_HAVE_WINCAPI */ |
| |
| else { |
| |
| printUsage(); |
| exit(1); |
| |
| } |
| |
| } |
| |
| // Create and set up the parser |
| |
| XercesDOMParser * parser = new XercesDOMParser; |
| |
| parser->setDoNamespaces(true); |
| parser->setCreateEntityReferenceNodes(true); |
| |
| // Now parse out file |
| |
| bool errorsOccured = false; |
| XMLSize_t errorCount = 0; |
| try |
| { |
| parser->parse(argv[argc - 1]); |
| errorCount = parser->getErrorCount(); |
| if (errorCount > 0) |
| errorsOccured = true; |
| } |
| |
| catch (const XMLException& e) |
| { |
| cerr << "An error occurred during parsing\n Message: " |
| << e.getMessage() << endl; |
| errorsOccured = true; |
| } |
| |
| |
| catch (const DOMException& e) |
| { |
| cerr << "A DOM error occurred during parsing\n DOMException code: " |
| << e.code << endl; |
| errorsOccured = true; |
| } |
| |
| if (errorsOccured) { |
| |
| cout << "Errors during parse" << endl; |
| exit (1); |
| |
| } |
| |
| /* |
| |
| Now that we have the parsed file, get the DOM document and start looking at it |
| |
| */ |
| |
| DOMNode *doc; // The document that we parsed |
| |
| doc = parser->getDocument(); |
| DOMDocument *theDOM = parser->getDocument(); |
| |
| // Find the signature node |
| |
| DOMNode *sigNode = findDSIGNode(doc, "Signature"); |
| |
| // Create the signature checker |
| |
| if (sigNode == 0) { |
| |
| cerr << "Could not find <Signature> node in " << argv[argc-1] << endl; |
| exit(1); |
| } |
| |
| |
| XSECProvider * prov = new XSECProvider; |
| DSIGSignature * sig = prov->newSignatureFromDOM(theDOM, sigNode); |
| |
| // Map out base path of the file |
| char * filename=argv[argc-1]; |
| #if XSEC_HAVE_GETCWD_DYN |
| char *path = getcwd(NULL, 0); |
| char *baseURI = (char*)malloc(strlen(path) + 8 + 1 + strlen(filename) + 1); |
| #else |
| char path[PATH_MAX]; |
| char baseURI[(PATH_MAX * 2) + 10]; |
| getcwd(path, PATH_MAX); |
| #endif |
| strcpy(baseURI, "file:///"); |
| |
| // Ugly and nasty but quick |
| if (filename[0] != '\\' && filename[0] != '/' && filename[1] != ':') { |
| strcat(baseURI, path); |
| strcat(baseURI, "/"); |
| } else if (path[1] == ':') { |
| path[2] = '\0'; |
| strcat(baseURI, path); |
| } |
| |
| strcat(baseURI, filename); |
| |
| // Find any ':' and "\" characters |
| int lastSlash = 0; |
| for (unsigned int i = 8; i < strlen(baseURI); ++i) { |
| if (baseURI[i] == '\\') { |
| lastSlash = i; |
| baseURI[i] = '/'; |
| } |
| else if (baseURI[i] == '/') |
| lastSlash = i; |
| } |
| |
| // The last "\\" must prefix the filename |
| baseURI[lastSlash + 1] = '\0'; |
| |
| sig->getURIResolver()->setBaseURI(MAKE_UNICODE_STRING(baseURI)); |
| #if XSEC_HAVE_GETCWD_DYN |
| free(path); |
| free(baseURI); |
| #endif |
| |
| try { |
| sig->load(); |
| if (clearKeyInfo == true) |
| sig->clearKeyInfo(); |
| if (key != NULL) |
| sig->setSigningKey(key); |
| sig->sign(); |
| |
| // Add any KeyInfo elements |
| |
| #if defined(XSEC_HAVE_WINCAPI) |
| |
| if (winDssKeyInfo == true && winKeyDSA != NULL) { |
| char pBuf[1024]; |
| char qBuf[1024]; |
| char gBuf[1024]; |
| char yBuf[1024]; |
| |
| unsigned int i; |
| i = winKeyDSA->getPBase64BigNums((char *) pBuf, 1024); |
| pBuf[i] = '\0'; |
| i = winKeyDSA->getQBase64BigNums((char *) qBuf, 1024); |
| qBuf[i] = '\0'; |
| i = winKeyDSA->getGBase64BigNums((char *) gBuf, 1024); |
| gBuf[i] = '\0'; |
| i = winKeyDSA->getYBase64BigNums((char *) yBuf, 1024); |
| yBuf[i] = '\0'; |
| |
| sig->clearKeyInfo(); |
| sig->appendDSAKeyValue( |
| MAKE_UNICODE_STRING(pBuf), |
| MAKE_UNICODE_STRING(qBuf), |
| MAKE_UNICODE_STRING(gBuf), |
| MAKE_UNICODE_STRING(yBuf)); |
| } |
| |
| if (winRsaKeyInfo == true && winKeyRSA != NULL) { |
| char eBuf[1024]; |
| char mBuf[1024]; |
| |
| unsigned int i; |
| i = winKeyRSA->getExponentBase64BigNums((char *) eBuf, 1024); |
| eBuf[i] = '\0'; |
| i = winKeyRSA->getModulusBase64BigNums((char *) mBuf, 1024); |
| mBuf[i] = '\0'; |
| |
| sig->clearKeyInfo(); |
| sig->appendRSAKeyValue( |
| MAKE_UNICODE_STRING(mBuf), |
| MAKE_UNICODE_STRING(eBuf)); |
| } |
| |
| #endif |
| #if defined (XSEC_HAVE_OPENSSL) |
| if (certCount > 0) { |
| |
| int i; |
| // Have some certificates - see if there is already an X509 list |
| DSIGKeyInfoList * kiList = sig->getKeyInfoList(); |
| int kiSize = (int) kiList->getSize(); |
| |
| for (i = 0; i < kiSize; ++i) { |
| |
| if (kiList->item(i)->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) { |
| keyInfoX509 = (DSIGKeyInfoX509 *) kiList->item(i); |
| break; |
| } |
| } |
| |
| if (keyInfoX509 == 0) { |
| |
| // Not found - need to create |
| keyInfoX509 = sig->appendX509Data(); |
| |
| } |
| |
| for (i = 0; i < certCount; ++i) { |
| |
| keyInfoX509->appendX509Certificate(certs[i]->getDEREncodingSB().sbStrToXMLCh()); |
| |
| } |
| |
| } /* certCount > 0 */ |
| #endif |
| if (x509SubjectName != NULL) { |
| |
| int i; |
| // Have some certificates - see if there is already an X509 list |
| DSIGKeyInfoList * kiList = sig->getKeyInfoList(); |
| int kiSize = (int) kiList->getSize(); |
| |
| for (i = 0; i < kiSize; ++i) { |
| |
| if (kiList->item(i)->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) { |
| keyInfoX509 = (DSIGKeyInfoX509 *) kiList->item(i); |
| break; |
| } |
| } |
| |
| if (keyInfoX509 == 0) { |
| |
| // Not found - need to create |
| keyInfoX509 = sig->appendX509Data(); |
| |
| } |
| |
| keyInfoX509->setX509SubjectName(MAKE_UNICODE_STRING(x509SubjectName)); |
| |
| } /* certCount > 0 */ |
| } |
| |
| catch (const XSECException &e) { |
| char * m = XMLString::transcode(e.getMsg()); |
| cerr << "An error occurred during signing operation\n Message: " |
| << m << endl; |
| XSEC_RELEASE_XMLCH(m); |
| errorsOccured = true; |
| exit (1); |
| } |
| |
| catch (const XSECCryptoException &e) { |
| cerr << "A cryptographic error occurred during signature operation\n Message: " |
| << e.getMsg() << endl; |
| errorsOccured = true; |
| exit(1); |
| } |
| |
| catch (const NetAccessorException&) { |
| cerr << "A network error occurred during signing operation\n" << endl; |
| errorsOccured = true; |
| exit(1); |
| } |
| |
| // Print out the result |
| |
| DOMPrintFormatTarget* formatTarget = new DOMPrintFormatTarget(); |
| |
| const XMLCh* encNameStr = XMLString::transcode("UTF-8"); |
| DOMNode *aNode = doc->getFirstChild(); |
| if (aNode->getNodeType() == DOMNode::ENTITY_NODE) |
| { |
| const XMLCh* aStr = ((DOMEntity *)aNode)->getInputEncoding(); |
| if (!strEquals(aStr, "")) |
| { |
| encNameStr = aStr; |
| } |
| } |
| XMLSize_t lent = XMLString::stringLen(encNameStr); |
| gEncodingName = new XMLCh[lent + 1]; |
| XMLString::copyNString(gEncodingName, encNameStr, lent); |
| gEncodingName[lent] = 0; |
| |
| gFormatter = new XMLFormatter("UTF-8", 0, formatTarget, |
| XMLFormatter::NoEscapes, gUnRepFlags); |
| |
| cout << doc; |
| |
| delete [] gEncodingName; |
| XMLCh * toRelease = (XMLCh *) encNameStr; |
| XSEC_RELEASE_XMLCH(toRelease); |
| delete gFormatter; |
| delete formatTarget; |
| |
| #if defined (_WIN32) && defined (XSEC_HAVE_WINCAPI) |
| if (win32DSSCSP != 0) |
| CryptReleaseContext(win32DSSCSP,0); |
| if (win32RSACSP != 0) |
| CryptReleaseContext(win32RSACSP,0); |
| #endif |
| |
| prov->releaseSignature(sig); |
| delete parser; |
| delete prov; |
| |
| XSECPlatformUtils::Terminate(); |
| #ifdef XSEC_HAVE_XALAN |
| XalanTransformer::terminate(); |
| XPathEvaluator::terminate(); |
| #endif |
| XMLPlatformUtils::Terminate(); |
| |
| |
| return 0; |
| } |
