| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| |
| /* |
| * XSEC |
| * |
| * InteropResolver := Class to resolve key elements into certificates for |
| * merlin-18 interop test |
| * |
| * $Id$ |
| * |
| */ |
| |
| // XSEC |
| |
| #include "InteropResolver.hpp" |
| |
| #include <xsec/framework/XSECDefs.hpp> |
| #include <xsec/enc/XSECKeyInfoResolver.hpp> |
| #include <xsec/dsig/DSIGKeyInfoX509.hpp> |
| #include <xsec/dsig/DSIGKeyInfoName.hpp> |
| #include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp> |
| |
| #include <xsec/enc/OpenSSL/OpenSSLCryptoBase64.hpp> |
| #include <xsec/enc/OpenSSL/OpenSSLSupport.hpp> |
| |
| #include "../../utils/XSECDOMUtils.hpp" |
| |
| #include <xercesc/util/Janitor.hpp> |
| #include <xercesc/util/XMLUniDefs.hpp> |
| |
| XERCES_CPP_NAMESPACE_USE |
| |
| #include <iostream> |
| |
| #if defined (XSEC_HAVE_OPENSSL) |
| |
| InteropResolver::InteropResolver(const XMLCh * baseURI) { |
| |
| if (baseURI != NULL) |
| mp_baseURI = XMLString::replicate(baseURI); |
| else |
| mp_baseURI = NULL; |
| |
| m_searchStarted = false; |
| m_searchFinished = false; |
| |
| #if !defined(_WIN32) |
| m_fcount = 0; |
| #endif |
| |
| } |
| |
| |
| InteropResolver::~InteropResolver() { |
| |
| if (mp_baseURI != NULL) |
| XSEC_RELEASE_XMLCH(mp_baseURI); |
| |
| } |
| |
| #if defined(_WIN32) |
| |
| void reverseSlash(safeBuffer &path) { |
| |
| for (int i = 0; i < (int) strlen(path.rawCharBuffer()); ++i) { |
| |
| if (path[i] == '/') |
| path[i] = '\\'; |
| |
| } |
| |
| } |
| |
| #endif |
| |
| |
| X509 * InteropResolver::nextFile2Cert(void) const { |
| |
| |
| if (m_searchFinished) |
| return NULL; |
| |
| int res; |
| |
| if (!m_searchStarted) { |
| |
| char * base = XMLString::transcode(mp_baseURI); |
| safeBuffer path = base; |
| XSEC_RELEASE_XMLCH(base); |
| |
| path.sbStrcatIn("/certs/*.crt"); |
| |
| #if defined(_WIN32) |
| |
| // Reverse the "backslash" characters |
| |
| reverseSlash(path); |
| |
| m_handle = (long) _findfirst(path.rawCharBuffer(), &m_finder); |
| res = m_handle; |
| #else |
| if (glob(path.rawCharBuffer(), 0, NULL, &m_globbuf) != 0) |
| res = -1; |
| else |
| res = 0; |
| #endif |
| |
| m_searchStarted = true; |
| |
| } |
| else { |
| |
| #if defined(_WIN32) |
| res = _findnext(m_handle, &m_finder); |
| #else |
| if (m_fcount == (int) m_globbuf.gl_pathc) |
| res = -1; |
| else |
| res = 0; |
| #endif |
| |
| } |
| |
| if (res == -1) { |
| |
| m_searchFinished = true; |
| return NULL; |
| |
| } |
| |
| /* |
| * Create the OpenSSL BIOs necessary to read in the X509 cert |
| */ |
| |
| BIO * bioCert; |
| if ((bioCert = BIO_new(BIO_s_file())) == NULL) { |
| |
| std::cerr << "Error opening certificate file\n\n"; |
| exit (1); |
| |
| } |
| |
| // Create the filename |
| safeBuffer fname; |
| #if defined(_WIN32) |
| fname.sbTranscodeIn(mp_baseURI); |
| fname.sbStrcatIn("/certs/"); |
| fname.sbStrcatIn(m_finder.name); |
| reverseSlash(fname); |
| #else |
| fname.sbStrcpyIn(m_globbuf.gl_pathv[m_fcount++]); |
| #endif |
| |
| if (BIO_read_filename(bioCert, fname.rawCharBuffer()) <= 0) { |
| |
| std::cerr << "Error opening certificate file\n" << fname.rawCharBuffer() << std::endl; |
| return NULL; |
| |
| } |
| |
| X509 * x509 = d2i_X509_bio(bioCert, NULL); |
| BIO_free(bioCert); |
| |
| return x509; |
| |
| |
| } |
| |
| X509_NAME * X509_NAME_create_from_txt(const char * n) { |
| |
| // I'm sure there must be a function to do this in OpenSSL, but I'm |
| // darned if I can find it. |
| |
| int idx = 0; |
| int j; |
| bool ok = true; |
| |
| X509_NAME_ENTRY * entries[10]; |
| int entCount = 0; |
| |
| char * name = new char[strlen(n)]; |
| char * value = new char[strlen(n)]; |
| while (true) { |
| |
| while (n[idx] == ' ' || |
| n[idx] == '\t' || |
| n[idx] == '\n' || |
| n[idx] == '\r') |
| idx++; |
| |
| if (n[idx] == 0) |
| break; |
| |
| j = 0; |
| while (n[idx] != 0 && n[idx] != '=') { |
| name[j++] = n[idx++]; |
| } |
| |
| if (j == 0 || n[idx] == 0) { |
| ok = false; |
| break; |
| } |
| |
| name[j] = '\0'; |
| idx++; |
| |
| // Now the value |
| j = 0; |
| while (n[idx] != 0 && n[idx] != '\n' && n[idx] != '\r') { |
| |
| if (n[idx] == ',') { |
| |
| // find out if this is a marker for end of RDN |
| int jdx = idx + 1; |
| while (n[jdx] != '\0' && n[jdx] != '=' && n[jdx] != ',') |
| ++jdx; |
| |
| if (n[jdx] != ',') |
| break; |
| |
| } |
| |
| value[j++] = n[idx++]; |
| |
| } |
| |
| if (j == 0) { |
| ok = false; |
| break; |
| } |
| |
| if (n[idx] != 0) |
| idx++; |
| |
| value[j] = '\0'; |
| X509_NAME_ENTRY * xne; |
| |
| xne = X509_NAME_ENTRY_create_by_txt(NULL, name, MBSTRING_ASC, (unsigned char *) value, -1); |
| |
| if (xne != NULL) { |
| entries[entCount++] = xne; |
| if (entCount == 10) { |
| ok = false; |
| break; |
| } |
| } |
| else { |
| ok = false; |
| break; |
| } |
| |
| } |
| |
| delete[] name; |
| delete[] value; |
| |
| X509_NAME *ret = NULL; |
| int i; |
| |
| if (ok) { |
| |
| // Create the return value |
| ret = X509_NAME_new(); |
| for (i = entCount - 1; i >= 0; --i) { |
| |
| if (!X509_NAME_add_entry(ret, entries[i], -1, 0)) { |
| X509_NAME_free(ret); |
| ret = NULL; |
| break; |
| } |
| } |
| |
| } |
| |
| // Clean out the entries |
| for (i = 0; i < entCount; ++i) { |
| X509_NAME_ENTRY_free(entries[i]); |
| } |
| |
| return ret; |
| } |
| |
| bool InteropResolver::checkMatch(const DSIGKeyInfoList * lst, X509 * x) const { |
| |
| // Check if the parameters in x match the required certificate |
| |
| |
| int sz = (int) lst->getSize(); |
| const DSIGKeyInfo* k; |
| |
| for (int i = 0; i < sz; ++i) { |
| |
| k = lst->item(i); |
| |
| if (k->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) { |
| |
| const DSIGKeyInfoX509 * kx = static_cast<const DSIGKeyInfoX509 *>(k); |
| |
| const XMLCh * serial = kx->getX509IssuerSerialNumber(); |
| |
| if (serial != NULL) { |
| |
| char * cserial = XMLString::transcode(serial); |
| char * xserial; |
| |
| BIGNUM * bnserial = ASN1_INTEGER_to_BN(X509_get_serialNumber(x), NULL); |
| xserial = BN_bn2dec(bnserial); |
| BN_free(bnserial); |
| |
| if (strcmp(xserial, cserial) == 0) { |
| |
| OPENSSL_free(xserial); |
| XSEC_RELEASE_XMLCH(cserial); |
| return true; |
| |
| } |
| //delete[] xserial; |
| XSEC_RELEASE_XMLCH(cserial); |
| OPENSSL_free(xserial); |
| |
| } |
| |
| /* |
| * Either it's not a serial number, or we didn't pass, so lets |
| * look at the next option. |
| */ |
| |
| const XMLCh * ski = kx->getX509SKI(); |
| |
| if (ski != NULL) { |
| |
| char * cski = XMLString::transcode(ski); |
| int clen = (int) strlen(cski); |
| unsigned char * xski = new unsigned char[clen]; |
| ArrayJanitor <unsigned char> j_xski(xski); |
| |
| // Decode |
| |
| OpenSSLCryptoBase64 b64; |
| b64.decodeInit(); |
| int xlen = b64.decode((unsigned char *) cski, clen, xski, clen); |
| xlen += b64.decodeFinish(&xski[xlen], clen - xlen); |
| XSEC_RELEASE_XMLCH(cski); |
| |
| if (xlen != 0) { |
| |
| // Have a buffer with a number in it |
| const STACK_OF(X509_EXTENSION) *exts; |
| exts = X509_get0_extensions(x); |
| |
| if (exts != NULL) { |
| |
| // Find the Subject Key Identifier OID |
| X509_EXTENSION * ext; |
| ASN1_OBJECT * objski = OBJ_nid2obj(NID_subject_key_identifier); |
| int extn = X509v3_get_ext_by_OBJ(exts, objski, -1); |
| if (extn != -1) { |
| // Dummy up an OCTET_STRING from the xski |
| unsigned char * octxski = new unsigned char[xlen + 2]; |
| ArrayJanitor<unsigned char> j_octxski(octxski); |
| |
| octxski[0] = 4; |
| octxski[1] = xlen; |
| memcpy(&octxski[2], xski, xlen); |
| |
| ext = sk_X509_EXTENSION_value(exts,extn); |
| ASN1_OCTET_STRING *skid = X509_EXTENSION_get_data(ext); |
| ASN1_OCTET_STRING * xskid = ASN1_OCTET_STRING_new(); |
| |
| ASN1_STRING_set(xskid, octxski, xlen+2); |
| |
| if (ASN1_OCTET_STRING_cmp(xskid, skid) == 0) { |
| ASN1_OCTET_STRING_free(xskid); |
| return true; |
| } |
| } |
| |
| } |
| |
| } |
| |
| } |
| |
| /* Not a subject key identifier */ |
| const XMLCh *sn = kx->getX509SubjectName(); |
| |
| if (sn != NULL) { |
| |
| char * csn = XMLString::transcode(sn); |
| |
| X509_NAME * x509name = X509_get_subject_name(x); |
| X509_NAME * snname = X509_NAME_create_from_txt(csn); |
| XSEC_RELEASE_XMLCH(csn); |
| |
| if (snname != NULL) { |
| |
| if (!X509_NAME_cmp(x509name, snname)) { |
| X509_NAME_free(snname); |
| return true; |
| } |
| |
| X509_NAME_free(snname); |
| } |
| } |
| } |
| } |
| |
| return false; |
| |
| } |
| |
| |
| XSECCryptoKey * InteropResolver::openCertURI(const XMLCh * uri) const { |
| |
| // Open a certificate from a file URI relative to the signature file |
| BIO * bioCert; |
| if ((bioCert = BIO_new(BIO_s_file())) == NULL) { |
| |
| return NULL; |
| |
| } |
| |
| safeBuffer fname; |
| char * u = XMLString::transcode(uri); |
| fname.sbTranscodeIn(mp_baseURI); |
| fname.sbStrcatIn("/"); |
| fname.sbStrcatIn(u); |
| XSEC_RELEASE_XMLCH(u); |
| |
| #if defined(_WIN32) |
| reverseSlash(fname); |
| #endif |
| |
| if (BIO_read_filename(bioCert, fname.rawCharBuffer()) <= 0) { |
| |
| return NULL; |
| |
| } |
| |
| X509 * x509 = d2i_X509_bio(bioCert, NULL); |
| BIO_free(bioCert); |
| |
| OpenSSLCryptoX509 oX509(x509); |
| X509_free(x509); |
| |
| return oX509.clonePublicKey(); |
| |
| } |
| |
| XSECCryptoKey * InteropResolver::resolveKey(const DSIGKeyInfoList * lst) const { |
| |
| |
| // First check if this has an X509 cert + an X509 CRL |
| const XMLCh * b64cert = NULL; |
| const XMLCh * b64crl = NULL; |
| |
| int lstSize = (int) lst->getSize(); |
| |
| for (int i = 0; i < lstSize; ++i) { |
| |
| const DSIGKeyInfo * ki; |
| ki = lst->item(i); |
| const XMLCh * rawuri; |
| |
| if (ki->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) { |
| |
| const DSIGKeyInfoX509 * kix509 = static_cast<const DSIGKeyInfoX509 *>(ki); |
| |
| if ((rawuri = kix509->getRawRetrievalURI()) != NULL) { |
| |
| // We have a raw certificate by de-reference |
| // Assume it is just a file dereference and open the cert |
| |
| return openCertURI(rawuri); |
| |
| } |
| |
| if (kix509->getCertificateListSize() == 1) { |
| |
| b64cert = kix509->getCertificateItem(0); |
| |
| } |
| |
| if (b64crl == NULL) { |
| |
| b64crl = kix509->getX509CRL(); |
| |
| } |
| } |
| |
| else if (ki->getKeyInfoType() == DSIGKeyInfo::KEYINFO_NAME) { |
| |
| const DSIGKeyInfoName * kn = static_cast<const DSIGKeyInfoName *>(ki); |
| |
| if (kn->getKeyName() != NULL) { |
| |
| static XMLCh certStr[] = { |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_c, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_e, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_r, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_t, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_s, |
| XERCES_CPP_NAMESPACE_QUALIFIER chForwardSlash, |
| XERCES_CPP_NAMESPACE_QUALIFIER chNull |
| }; |
| static XMLCh extStr[] = { |
| XERCES_CPP_NAMESPACE_QUALIFIER chPeriod, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_c, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_r, |
| XERCES_CPP_NAMESPACE_QUALIFIER chLatin_t, |
| XERCES_CPP_NAMESPACE_QUALIFIER chNull |
| }; |
| |
| safeBuffer fname; |
| fname = certStr; |
| fname.sbXMLChCat(kn->getKeyName()); |
| fname.sbXMLChCat(extStr); |
| |
| fname.sbStrlwr(); |
| |
| return openCertURI(fname.rawXMLChBuffer()); |
| |
| } |
| |
| } |
| |
| } |
| |
| if (b64cert != NULL && b64crl != NULL) { |
| |
| // We have a certificate and a crl, lets get the cert and check in the crl |
| |
| OpenSSLCryptoBase64 b64; |
| char * transb64cert = XMLString::transcode(b64cert); |
| unsigned char * x509buf = new unsigned char[strlen(transb64cert)]; |
| ArrayJanitor<unsigned char> j_x509buf(x509buf); |
| |
| int x509bufLen; |
| |
| X509 *x; |
| |
| b64.decodeInit(); |
| x509bufLen = b64.decode((unsigned char *) transb64cert, (unsigned int) strlen(transb64cert), x509buf, (unsigned int) strlen(transb64cert)); |
| x509bufLen += b64.decodeFinish(&x509buf[x509bufLen], (unsigned int) strlen(transb64cert) - x509bufLen); |
| XSEC_RELEASE_XMLCH(transb64cert); |
| |
| if (x509bufLen > 0) { |
| #if defined(XSEC_OPENSSL_D2IX509_CONST_BUFFER) |
| x = d2i_X509(NULL, (const unsigned char **) (&x509buf), x509bufLen |
| ); |
| #else |
| x = d2i_X509(NULL, &x509buf, x509bufLen); |
| #endif |
| } |
| else |
| return NULL; // Something has gone wrong |
| |
| if (x == NULL) |
| return NULL; |
| |
| // Now the CRL |
| char * transb64crl = XMLString::transcode(b64crl); |
| unsigned char * crlbuf = new unsigned char[strlen(transb64crl)]; |
| ArrayJanitor<unsigned char> j_crlbuf(crlbuf); |
| |
| int crlbufLen; |
| |
| X509_CRL * c; |
| |
| b64.decodeInit(); |
| crlbufLen = b64.decode((unsigned char*) transb64crl, (unsigned int) strlen(transb64crl), crlbuf, (unsigned int) strlen(transb64crl)); |
| crlbufLen += b64.decodeFinish(&crlbuf[crlbufLen], (unsigned int) strlen(transb64crl) - crlbufLen); |
| XSEC_RELEASE_XMLCH(transb64crl); |
| |
| if (crlbufLen > 0) { |
| #if defined(XSEC_OPENSSL_D2IX509_CONST_BUFFER) |
| c = d2i_X509_CRL(NULL, (const unsigned char **) (&crlbuf), crlbufLen); |
| #else |
| c = d2i_X509_CRL(NULL, &crlbuf, crlbufLen); |
| #endif |
| } |
| else |
| return NULL; // Something has gone wrong |
| |
| if (c == NULL) |
| return NULL; |
| |
| // Now check if the cert is in the CRL (code lifted from OpenSSL x509_vfy.c |
| |
| int idx; |
| X509_REVOKED *rtmp = X509_REVOKED_new(); |
| |
| /* Look for serial number of certificate in CRL */ |
| X509_REVOKED_set_serialNumber(rtmp, X509_get_serialNumber(x)); |
| idx = sk_X509_REVOKED_find(X509_CRL_get_REVOKED(c), rtmp); |
| |
| X509_REVOKED_free(rtmp); |
| |
| /* Not found: OK */ |
| |
| if(idx != -1) { |
| |
| std::cerr << "Warning - certificate revoked in attached CRL" << std::endl; |
| |
| } |
| |
| OpenSSLCryptoX509 ox(x); |
| X509_free(x); |
| X509_CRL_free(c); |
| return ox.clonePublicKey(); |
| |
| } |
| |
| // Do a run through each match in the directory |
| |
| while (m_searchFinished == false) { |
| |
| X509 * x = nextFile2Cert(); |
| |
| if (x != NULL) { |
| |
| if (checkMatch(lst, x)) { |
| |
| OpenSSLCryptoX509 ox(x); |
| X509_free(x); |
| return ox.clonePublicKey(); |
| |
| } |
| |
| } |
| X509_free(x); |
| |
| } |
| |
| return NULL; |
| |
| } |
| |
| |
| |
| XSECKeyInfoResolver * InteropResolver::clone(void) const { |
| |
| return new InteropResolver(mp_baseURI); |
| |
| } |
| |
| |
| |
| #endif /* XSEC_HAVE_OPENSSL */ |
