xsec/tools/templatesign/templatesign.cpp (896 lines of code) (raw):
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/*
* XSEC
*
* templatesign := tool to sign a template XML signature file
*
* Author(s): Berin Lautenbach
*
* $Id$
*
*/
//XSEC includes
// XSEC
#include <xsec/utils/XSECPlatformUtils.hpp>
#include <xsec/framework/XSECProvider.hpp>
#include <xsec/canon/XSECC14n20010315.hpp>
#include <xsec/dsig/DSIGSignature.hpp>
#include <xsec/dsig/DSIGKeyInfoX509.hpp>
#include <xsec/framework/XSECException.hpp>
#include <xsec/framework/XSECURIResolver.hpp>
#include <xsec/enc/XSECCryptoException.hpp>
#if defined (XSEC_HAVE_OPENSSL)
# include <xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.hpp>
# include <xsec/enc/OpenSSL/OpenSSLCryptoKeyEC.hpp>
# include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp>
# include <xsec/enc/OpenSSL/OpenSSLCryptoKeyHMAC.hpp>
# include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
# include <xsec/enc/OpenSSL/OpenSSLSupport.hpp>
# include <openssl/bio.h>
# include <openssl/dsa.h>
# include <openssl/err.h>
# include <openssl/evp.h>
# include <openssl/pem.h>
#endif
#if defined(XSEC_HAVE_WINCAPI)
# include <xsec/enc/WinCAPI/WinCAPICryptoProvider.hpp>
# include <xsec/enc/WinCAPI/WinCAPICryptoKeyDSA.hpp>
# include <xsec/enc/WinCAPI/WinCAPICryptoKeyRSA.hpp>
# include <xsec/enc/WinCAPI/WinCAPICryptoKeyHMAC.hpp>
#endif
#include "../../utils/XSECDOMUtils.hpp"
#include <memory.h>
#include <string.h>
#include <iostream>
#include <stdlib.h>
#if defined(HAVE_UNISTD_H)
# include <unistd.h>
#else
# if defined(HAVE_DIRECT_H)
# include <direct.h>
# endif
#endif
#include <xercesc/util/PlatformUtils.hpp>
#include <xercesc/util/XMLString.hpp>
#include <xercesc/dom/DOM.hpp>
#include <xercesc/parsers/XercesDOMParser.hpp>
#include <xercesc/util/XMLException.hpp>
#include <xercesc/util/XMLUniDefs.hpp>
#include <xercesc/util/XMLNetAccessor.hpp>
#include <xercesc/util/XMLUri.hpp>
#ifdef XSEC_HAVE_XALAN
// XALAN
#include <xalanc/XPath/XPathEvaluator.hpp>
#include <xalanc/XalanTransformer/XalanTransformer.hpp>
// If this isn't defined, we're on Xalan 1.12+ and require modern C++
#ifndef XALAN_USING_XALAN
# define XALAN_USING_XALAN(NAME) using xalanc :: NAME;
#endif
XALAN_USING_XALAN(XPathEvaluator)
XALAN_USING_XALAN(XalanTransformer)
#endif
using std::ostream;
using std::cout;
using std::cerr;
using std::endl;
using std::flush;
// Uplift entire program into Xerces namespace
XERCES_CPP_NAMESPACE_USE
// --------------------------------------------------------------------------------
// Much code taken from the DOMPrint Xerces example
// --------------------------------------------------------------------------------
static XMLFormatter* gFormatter = 0;
static XMLCh* gEncodingName = 0;
static XMLFormatter::UnRepFlags gUnRepFlags = XMLFormatter::UnRep_CharRef;
static const XMLCh gEndElement[] = { chOpenAngle, chForwardSlash, chNull };
static const XMLCh gEndPI[] = { chQuestion, chCloseAngle, chNull};
static const XMLCh gStartPI[] = { chOpenAngle, chQuestion, chNull };
static const XMLCh gStartCDATA[] =
{
chOpenAngle, chBang, chOpenSquare, chLatin_C, chLatin_D,
chLatin_A, chLatin_T, chLatin_A, chOpenSquare, chNull
};
static const XMLCh gEndCDATA[] =
{
chCloseSquare, chCloseSquare, chCloseAngle, chNull
};
static const XMLCh gStartComment[] =
{
chOpenAngle, chBang, chDash, chDash, chNull
};
static const XMLCh gEndComment[] =
{
chDash, chDash, chCloseAngle, chNull
};
static const XMLCh gStartDoctype[] =
{
chOpenAngle, chBang, chLatin_D, chLatin_O, chLatin_C, chLatin_T,
chLatin_Y, chLatin_P, chLatin_E, chSpace, chNull
};
static const XMLCh gPublic[] =
{
chLatin_P, chLatin_U, chLatin_B, chLatin_L, chLatin_I,
chLatin_C, chSpace, chDoubleQuote, chNull
};
static const XMLCh gSystem[] =
{
chLatin_S, chLatin_Y, chLatin_S, chLatin_T, chLatin_E,
chLatin_M, chSpace, chDoubleQuote, chNull
};
static const XMLCh gStartEntity[] =
{
chOpenAngle, chBang, chLatin_E, chLatin_N, chLatin_T, chLatin_I,
chLatin_T, chLatin_Y, chSpace, chNull
};
static const XMLCh gNotation[] =
{
chLatin_N, chLatin_D, chLatin_A, chLatin_T, chLatin_A,
chSpace, chDoubleQuote, chNull
};
// ---------------------------------------------------------------------------
// Local classes
// ---------------------------------------------------------------------------
class DOMPrintFormatTarget : public XMLFormatTarget
{
public:
DOMPrintFormatTarget() {};
~DOMPrintFormatTarget() {};
// -----------------------------------------------------------------------
// Implementations of the format target interface
// -----------------------------------------------------------------------
void writeChars(const XMLByte* const toWrite,
const XMLSize_t count,
XMLFormatter * const formatter)
{
// Surprisingly, Solaris was the only platform on which
// required the char* cast to print out the string correctly.
// Without the cast, it was printing the pointer value in hex.
// Quite annoying, considering every other platform printed
// the string with the explicit cast to char* below.
cout.write((char *) toWrite, (int) count);
};
private:
// -----------------------------------------------------------------------
// Unimplemented methods.
// -----------------------------------------------------------------------
DOMPrintFormatTarget(const DOMPrintFormatTarget& other);
void operator=(const DOMPrintFormatTarget& rhs);
};
// ---------------------------------------------------------------------------
// ostream << DOMNode
//
// Stream out a DOM node, and, recursively, all of its children. This
// function is the heart of writing a DOM tree out as XML source. Give it
// a document node and it will do the whole thing.
// ---------------------------------------------------------------------------
ostream& operator<<(ostream& target, DOMNode* toWrite)
{
// Get the name and value out for convenience
const XMLCh* nodeName = toWrite->getNodeName();
const XMLCh* nodeValue = toWrite->getNodeValue();
XMLSize_t lent = XMLString::stringLen(nodeValue);
switch (toWrite->getNodeType())
{
case DOMNode::TEXT_NODE:
{
gFormatter->formatBuf(nodeValue,
lent, XMLFormatter::CharEscapes);
break;
}
case DOMNode::PROCESSING_INSTRUCTION_NODE :
{
*gFormatter << XMLFormatter::NoEscapes << gStartPI << nodeName;
if (lent > 0)
{
*gFormatter << chSpace << nodeValue;
}
*gFormatter << XMLFormatter::NoEscapes << gEndPI;
break;
}
case DOMNode::DOCUMENT_NODE :
{
DOMNode *child = toWrite->getFirstChild();
while( child != 0)
{
target << child;
// add linefeed in requested output encoding
*gFormatter << chLF;
target << flush;
child = child->getNextSibling();
}
break;
}
case DOMNode::ELEMENT_NODE :
{
// The name has to be representable without any escapes
*gFormatter << XMLFormatter::NoEscapes
<< chOpenAngle << nodeName;
// Output the element start tag.
// Output any attributes on this element
DOMNamedNodeMap *attributes = toWrite->getAttributes();
XMLSize_t attrCount = attributes->getLength();
for (XMLSize_t i = 0; i < attrCount; i++)
{
DOMNode *attribute = attributes->item(i);
//
// Again the name has to be completely representable. But the
// attribute can have refs and requires the attribute style
// escaping.
//
*gFormatter << XMLFormatter::NoEscapes
<< chSpace << attribute->getNodeName()
<< chEqual << chDoubleQuote
<< XMLFormatter::AttrEscapes
<< attribute->getNodeValue()
<< XMLFormatter::NoEscapes
<< chDoubleQuote;
}
//
// Test for the presence of children, which includes both
// text content and nested elements.
//
DOMNode *child = toWrite->getFirstChild();
if (child != 0)
{
// There are children. Close start-tag, and output children.
// No escapes are legal here
*gFormatter << XMLFormatter::NoEscapes << chCloseAngle;
while( child != 0)
{
target << child;
child = child->getNextSibling();
}
//
// Done with children. Output the end tag.
//
*gFormatter << XMLFormatter::NoEscapes << gEndElement
<< nodeName << chCloseAngle;
}
else
{
//
// There were no children. Output the short form close of
// the element start tag, making it an empty-element tag.
//
*gFormatter << XMLFormatter::NoEscapes << chForwardSlash << chCloseAngle;
}
break;
}
case DOMNode::ENTITY_REFERENCE_NODE:
{
//DOMNode *child;
#if 0
for (child = toWrite.getFirstChild();
child != 0;
child = child.getNextSibling())
{
target << child;
}
#else
//
// Instead of printing the refernece tree
// we'd output the actual text as it appeared in the xml file.
// This would be the case when -e option was chosen
//
*gFormatter << XMLFormatter::NoEscapes << chAmpersand
<< nodeName << chSemiColon;
#endif
break;
}
case DOMNode::CDATA_SECTION_NODE:
{
*gFormatter << XMLFormatter::NoEscapes << gStartCDATA
<< nodeValue << gEndCDATA;
break;
}
case DOMNode::COMMENT_NODE:
{
*gFormatter << XMLFormatter::NoEscapes << gStartComment
<< nodeValue << gEndComment;
break;
}
case DOMNode::DOCUMENT_TYPE_NODE:
{
DOMDocumentType *doctype = (DOMDocumentType *)toWrite;;
*gFormatter << XMLFormatter::NoEscapes << gStartDoctype
<< nodeName;
const XMLCh* id = doctype->getPublicId();
if (id != 0)
{
*gFormatter << XMLFormatter::NoEscapes << chSpace << gPublic
<< id << chDoubleQuote;
id = doctype->getSystemId();
if (id != 0)
{
*gFormatter << XMLFormatter::NoEscapes << chSpace
<< chDoubleQuote << id << chDoubleQuote;
}
}
else
{
id = doctype->getSystemId();
if (id != 0)
{
*gFormatter << XMLFormatter::NoEscapes << chSpace << gSystem
<< id << chDoubleQuote;
}
}
id = doctype->getInternalSubset();
if (id !=0)
*gFormatter << XMLFormatter::NoEscapes << chOpenSquare
<< id << chCloseSquare;
*gFormatter << XMLFormatter::NoEscapes << chCloseAngle;
break;
}
case DOMNode::ENTITY_NODE:
{
*gFormatter << XMLFormatter::NoEscapes << gStartEntity
<< nodeName;
const XMLCh * id = ((DOMEntity *)toWrite)->getPublicId();
if (id != 0)
*gFormatter << XMLFormatter::NoEscapes << gPublic
<< id << chDoubleQuote;
id = ((DOMEntity *)toWrite)->getSystemId();
if (id != 0)
*gFormatter << XMLFormatter::NoEscapes << gSystem
<< id << chDoubleQuote;
id = ((DOMEntity *)toWrite)->getNotationName();
if (id != 0)
*gFormatter << XMLFormatter::NoEscapes << gNotation
<< id << chDoubleQuote;
*gFormatter << XMLFormatter::NoEscapes << chCloseAngle << chLF;
break;
}
default:
cerr << "Unrecognized node type = "
<< (long)toWrite->getNodeType() << endl;
}
return target;
}
// --------------------------------------------------------------------------------
// End of outputter
// --------------------------------------------------------------------------------
class DOMMemFormatTarget : public XMLFormatTarget
{
public:
unsigned char * buffer; // Buffer to write to
DOMMemFormatTarget() : buffer(NULL) {};
~DOMMemFormatTarget() {};
void setBuffer (unsigned char * toSet) {buffer = toSet;};
// -----------------------------------------------------------------------
// Implementations of the format target interface
// -----------------------------------------------------------------------
void writeChars(const XMLByte* const toWrite,
const XMLSize_t count,
XMLFormatter * const formatter)
{
// Surprisingly, Solaris was the only platform on which
// required the char* cast to print out the string correctly.
// Without the cast, it was printing the pointer value in hex.
// Quite annoying, considering every other platform printed
// the string with the explicit cast to char* below.
memcpy(buffer, (char *) toWrite, (int) count);
buffer[count] = '\0';
};
private:
// -----------------------------------------------------------------------
// Unimplemented methods.
// -----------------------------------------------------------------------
DOMMemFormatTarget(const DOMMemFormatTarget& other);
void operator=(const DOMMemFormatTarget& rhs);
};
// ---------------------------------------------------------------------------
// ostream << DOMString
//
// Stream out a DOM string. Doing this requires that we first transcode
// to char * form in the default code page for the system
// ---------------------------------------------------------------------------
DOMPrintFormatTarget *DOMtarget;
DOMMemFormatTarget *MEMtarget;
XMLFormatter *formatter, *MEMformatter;
unsigned char *charBuffer;
void printUsage(void) {
cerr << "\nUsage: templatesign <key options> <file to sign>\n\n";
#if defined (XSEC_HAVE_OPENSSL)
cerr << " Where <key options> are one of :\n\n";
cerr << " --x509subjectname/-s <distinguished name>\n";
cerr << " <distinguished name> will be set as SubjectName in x509\n";
cerr << " --dsakey/-d <dsa private key file> <password>\n";
cerr << " <dsa private key file> contains a PEM encoded private key\n";
cerr << " <password> is the password used to decrypt the key file\n";
# if defined (XSEC_HAVE_WINCAPI)
cerr << " NOTE: Not usable if --wincapi previously set\n";
# endif
# if defined(XSEC_OPENSSL_HAVE_EC)
cerr << " --eckey/-e <ec private key file> <password>\n";
cerr << " <ec private key file> contains a PEM encoded private key\n";
cerr << " <password> is the password used to decrypt the key file\n";
# endif
# if defined (XSEC_HAVE_WINCAPI)
cerr << " NOTE: Not usable if --wincapi previously set\n";
# endif
cerr << " --rsakey/-r <rsa private key file> <password>\n";
cerr << " <rsa privatekey file> contains a PEM encoded private key\n";
cerr << " <password> is the password used to decrypt the key file\n";
cerr << " --x509cert/-x <filename>\n";
cerr << " <filename> contains a PEM certificate to be added as a KeyInfo\n";
#endif
cerr << " --hmackey/-h <string>\n";
cerr << " <string> is the hmac key to set\n";
cerr << " --clearkeys/-c\n";
cerr << " Clears out any current KeyInfo elements in the file\n";
#if defined(XSEC_HAVE_WINCAPI)
cerr << " --windss/-wd\n";
cerr << " Use the default user AT_SIGNATURE key from default\n";
cerr << " Windows DSS CSP\n";
cerr << " --winrsa/-wr\n";
cerr << " Use the default user AT_SIGNATURE key from default\n";
cerr << " Windows RSA CSP\n";
cerr << " --winhmac/-wh <string>\n";
cerr << " Create a windows HMAC key using <string> as the password.\n";
cerr << " Uses a SHA-1 hash of the password to derive a key\n";
#if defined (CRYPT_ACQUIRE_CACHE_FLAG)
cerr << " --wincer/-wc <Subject Name>\n";
cerr << " Use the private key associated with the named certificate in the Windows certificate store\n";
#endif /* CRYPT_ACQUIRE_CACHE_FLAG */
cerr << " --windsskeyinfo/-wdi\n";
cerr << " Clear KeyInfo elements and insert DSS parameters from windows key\n";
cerr << " --winrsakeyinfo/-wri\n";
cerr << " Clear KeyInfo elements and insert RSA parameters from windows key\n";
#endif
}
int main(int argc, char **argv) {
XSECCryptoKey * key = NULL;
DSIGKeyInfoX509 * keyInfoX509 = NULL;
const char * x509SubjectName = NULL;
#if defined (XSEC_HAVE_OPENSSL)
OpenSSLCryptoX509 * certs[128];
#endif
int certCount = 0;
int paramCount;
bool clearKeyInfo = false;
#if defined(XSEC_HAVE_WINCAPI)
HCRYPTPROV win32DSSCSP = 0; // Crypto Provider
HCRYPTPROV win32RSACSP = 0; // Crypto Provider
bool winDssKeyInfo = false;
bool winRsaKeyInfo = false;
WinCAPICryptoKeyDSA * winKeyDSA = NULL;
WinCAPICryptoKeyRSA * winKeyRSA = NULL;
#endif
// Initialise the XML system
try {
XMLPlatformUtils::Initialize();
#ifdef XSEC_HAVE_XALAN
XPathEvaluator::initialize();
XalanTransformer::initialize();
#endif
XSECPlatformUtils::Initialise();
}
catch (const XMLException &e) {
cerr << "Error during initialisation of Xerces" << endl;
cerr << "Error Message = : "
<< e.getMessage() << endl;
}
#if defined (XSEC_HAVE_OPENSSL)
// Initialize OpenSSL
ERR_load_crypto_strings();
BIO * bio_err;
if ((bio_err=BIO_new(BIO_s_file())) != NULL)
BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
#endif
if (argc < 2) {
printUsage();
exit (1);
}
paramCount = 1;
while (paramCount < argc - 1) {
// Run through all parameters
if (_stricmp(argv[paramCount], "--x509subjectname") == 0 || _stricmp(argv[paramCount], "-s") == 0) {
if (paramCount +2 >= argc) {
printUsage();
exit(1);
}
// Get the subject name
x509SubjectName = argv[paramCount + 1];
paramCount += 2;
}
#if defined (XSEC_HAVE_OPENSSL)
else if (_stricmp(argv[paramCount], "--dsakey") == 0 || _stricmp(argv[paramCount], "-d") == 0
|| _stricmp(argv[paramCount], "--rsakey") == 0 || _stricmp(argv[paramCount], "-r") == 0
# if defined(XSEC_OPENSSL_HAVE_EC)
|| _stricmp(argv[paramCount], "--eckey") == 0 || _stricmp(argv[paramCount], "-e") == 0
# endif
) {
// OpenSSL Key
if (paramCount + 3 >= argc) {
printUsage();
exit (1);
}
if (key != 0) {
cerr << "\nError loading private key - another key already loaded\n\n";
printUsage();
exit(1);
}
// Load the signing key
// For now just read a particular file
BIO * bioKey;
if ((bioKey = BIO_new(BIO_s_file())) == NULL) {
cerr << "Error opening private key file\n\n";
exit (1);
}
if (BIO_read_filename(bioKey, argv[paramCount + 1]) <= 0) {
cerr << "Error opening private key file\n\n";
exit (1);
}
EVP_PKEY * pkey;
pkey = PEM_read_bio_PrivateKey(bioKey,NULL,NULL,argv[paramCount + 2]);
if (pkey == NULL) {
cerr << "Error loading private key\n\n";
ERR_print_errors(bio_err);
exit (1);
}
if (_stricmp(argv[paramCount], "--dsakey") == 0 || _stricmp(argv[paramCount], "-d") == 0) {
// Check type is correct
if (EVP_PKEY_id(pkey) != EVP_PKEY_DSA) {
cerr << "DSA Key requested, but OpenSSL loaded something else\n";
exit (1);
}
// Create the XSEC OpenSSL interface
key = new OpenSSLCryptoKeyDSA(pkey);
}
#if defined(XSEC_OPENSSL_HAVE_EC)
else if (_stricmp(argv[paramCount], "--eckey") == 0 || _stricmp(argv[paramCount], "-e") == 0) {
// Check type is correct
if (EVP_PKEY_id(pkey) != EVP_PKEY_EC) {
cerr << "EC Key requested, but OpenSSL loaded something else\n";
exit (1);
}
// Create the XSEC OpenSSL interface
key = new OpenSSLCryptoKeyEC(pkey);
}
#endif
else {
if (EVP_PKEY_id(pkey) != EVP_PKEY_RSA) {
cerr << "RSA Key requested, but OpenSSL loaded something else\n";
exit (1);
}
key = new OpenSSLCryptoKeyRSA(pkey);
}
EVP_PKEY_free(pkey);
BIO_free(bioKey);
paramCount += 3;
} /* argv[1] = "dsa/rsa/ec" */
else if (_stricmp(argv[paramCount], "--x509cert") == 0 || _stricmp(argv[paramCount], "-x") == 0) {
// X509Data keyInfo
if (paramCount + 2 >= argc) {
printUsage();
exit (1);
}
// Load the cert.
// For now just read a particular file
BIO * bioX509;
if ((bioX509 = BIO_new(BIO_s_file())) == NULL) {
cerr << "Error opening file\n\n";
exit (1);
}
if (BIO_read_filename(bioX509, argv[paramCount + 1]) <= 0) {
cerr << "Error opening X509 Certificate " << argv[paramCount + 1] << "\n\n";
exit (1);
}
X509 * x
;
x = PEM_read_bio_X509_AUX(bioX509,NULL,NULL,NULL);
if (x == NULL) {
cerr << "Error loading certificate\n\n";
ERR_print_errors(bio_err);
exit (1);
}
// Create the XSEC OpenSSL interface - used only to translate to Base64
certs[certCount++] = new OpenSSLCryptoX509(x);
X509_free(x);
BIO_free(bioX509);
paramCount += 2;
} /* argv[1] = "--x509cert" */
else
#endif
if (_stricmp(argv[paramCount], "--hmackey") == 0 || _stricmp(argv[paramCount], "-h") == 0) {
XSECCryptoKeyHMAC* hmacKey = XSECPlatformUtils::g_cryptoProvider->keyHMAC();
hmacKey->setKey((unsigned char *) argv[paramCount + 1], (unsigned int) strlen(argv[paramCount + 1]));
key = hmacKey;
paramCount += 2;
}
else if (_stricmp(argv[paramCount], "--clearkeys") == 0 || _stricmp(argv[paramCount], "-c") == 0) {
clearKeyInfo = true;
paramCount += 1;
}
#if defined (XSEC_HAVE_WINCAPI)
else if (_stricmp(argv[paramCount], "--windss") == 0 || _stricmp(argv[paramCount], "-wd") == 0) {
WinCAPICryptoProvider * cp;
// First set windows as the crypto provider
cp = new WinCAPICryptoProvider();
XSECPlatformUtils::SetCryptoProvider(cp);
// Now set the key
if (!CryptAcquireContext(&win32DSSCSP,
NULL,
NULL,
PROV_DSS,
0)) {
cerr << "Error acquiring Crypto context - Attempting to generate new key pair" << endl;
// Attempt to gen a new keyset
if (!CryptAcquireContext(&win32DSSCSP,
NULL,
NULL,
PROV_DSS,
CRYPT_NEWKEYSET)) {
cerr << "Error acquiring DSS Crypto Service Provider with new keyset" << endl;
return 2;
}
else {
HCRYPTKEY k;
if (!CryptGenKey(win32DSSCSP, AT_SIGNATURE, CRYPT_EXPORTABLE, &k)) {
cerr << "Error generating DSS keyset" << endl;
return 2;
}
CryptDestroyKey(k);
}
}
winKeyDSA = new WinCAPICryptoKeyDSA(win32DSSCSP, AT_SIGNATURE, true);
key = winKeyDSA;
paramCount++;
}
else if (_stricmp(argv[paramCount], "--winrsa") == 0 || _stricmp(argv[paramCount], "-wr") == 0) {
WinCAPICryptoProvider * cp;
cp = new WinCAPICryptoProvider();
XSECPlatformUtils::SetCryptoProvider(cp);
if (!CryptAcquireContext(&win32RSACSP,
NULL,
NULL,
PROV_RSA_FULL,
0)) {
cerr << "Error acquiring Crypto context - Attempting to generate new RSA key pair" << endl;
// Attempt to gen a new keyset
if (!CryptAcquireContext(&win32RSACSP,
NULL,
NULL,
PROV_RSA_FULL,
CRYPT_NEWKEYSET)) {
cerr << "Error acquiring RSA Crypto Service Provider with new keyset" << endl;
return 2;
}
else {
HCRYPTKEY k;
if (!CryptGenKey(win32RSACSP, AT_SIGNATURE, CRYPT_EXPORTABLE, &k)) {
cerr << "Error generating RSA keyset" << endl;
return 2;
}
CryptDestroyKey(k);
}
}
winKeyRSA = new WinCAPICryptoKeyRSA(win32RSACSP, AT_SIGNATURE, true);
key = winKeyRSA;
paramCount++;
}
else if (_stricmp(argv[paramCount], "--winhmac") == 0 || _stricmp(argv[paramCount], "-wh") == 0) {
WinCAPICryptoProvider * cp;
// Obtain default PROV_RSA, with default user key container
// Note we open in VERIFYCONTEXT as we do not require a assymetric key pair
if (!CryptAcquireContext(&win32RSACSP,
NULL,
NULL,
PROV_RSA_FULL,
CRYPT_VERIFYCONTEXT)) {
cerr << "Error acquiring RSA Crypto Service Provider" << endl;
return 2;
}
cp = new WinCAPICryptoProvider();
XSECPlatformUtils::SetCryptoProvider(cp);
paramCount++;
HCRYPTKEY k;
HCRYPTHASH h;
BOOL fResult = CryptCreateHash(
win32RSACSP,
CALG_SHA,
0,
0,
&h);
if (fResult == 0) {
cerr << "Error creating hash to create windows hmac key from password" << endl;
return 2;
}
fResult = CryptHashData(
h,
(unsigned char *) argv[paramCount],
(DWORD) strlen(argv[paramCount]),
0);
if (fResult == 0) {
cerr << "Error hashing password to create windows hmac key" << endl;
return 2;
}
// Now create a key
fResult = CryptDeriveKey(
win32RSACSP,
CALG_RC2,
h,
CRYPT_EXPORTABLE,
&k);
if (fResult == 0) {
cerr << "Error deriving key from hash value" << endl;
return 2;
}
// Wrap in a WinCAPI object
WinCAPICryptoKeyHMAC * hk;
hk = new WinCAPICryptoKeyHMAC(win32RSACSP);
hk->setWinKey(k);
key = hk;
CryptDestroyHash(h);
paramCount++;
}
else if (_stricmp(argv[paramCount], "--windsskeyinfo") == 0 || _stricmp(argv[paramCount], "-wdi") == 0) {
winDssKeyInfo = true;
paramCount++;
}
else if (_stricmp(argv[paramCount], "--winrsakeyinfo") == 0 || _stricmp(argv[paramCount], "-wri") == 0) {
winRsaKeyInfo = true;
paramCount++;
}
// Need to find a better way to check this
// If CryptAcquireCertificatePrivateKey is not defined in the included
// version of wincapi.h, CRYPT_ACQUIRE_CACHE_FLAG will not be set
#if defined (CRYPT_ACQUIRE_CACHE_FLAG)
// Code provided by Milan Tomic
//Please note that this example below use CryptAcquireCertificatePrivateKey() function
//which is not declared in wincrypt.h that ships with VC++ 6. If you would like to run
//this example you'll need to replace your old wincrypt.h and crypt32.lib with new versions.
//This example below is compatible with Windows 98/IE 5 and above OS/IE versions.
else if (_stricmp(argv[paramCount], "--wincer") == 0 || _stricmp(argv[paramCount], "-wc") == 0) {
WinCAPICryptoProvider * cp;
PCCERT_CONTEXT pSignerCert = NULL;
DWORD dwKeySpec;
HCERTSTORE hStoreHandle;
#define MY_ENCODING_TYPE (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING)
// Obtain default PROV_DSS with default user key container
if (!CryptAcquireContext(&win32DSSCSP,
NULL,
NULL,
PROV_DSS,
0)) {
cerr << "Error acquiring DSS Crypto Service Provider" << endl;
return 2;
}//*/
// Open 'Personal' certificate store
if (!(hStoreHandle = CertOpenStore(CERT_STORE_PROV_SYSTEM,
0,
NULL,
CERT_SYSTEM_STORE_CURRENT_USER,
L"MY"))) {
cerr << "Error opening 'Personal' store." << endl;
return 2;
}
// Find desired cerificate
if (!(pSignerCert = CertFindCertificateInStore(hStoreHandle,
MY_ENCODING_TYPE,
0,
CERT_FIND_SUBJECT_STR_A,
argv[paramCount+1],
NULL))) {
cerr << "Can't find '" << argv[paramCount+1] << "' certificate in 'Personal' store." << endl;
return 2;
}
// Now get certificate's private key
if (!CryptAcquireCertificatePrivateKey(pSignerCert,
0,
NULL,
&win32RSACSP,
&dwKeySpec,
NULL)) {
cerr << "Can't acquire private key of '" << argv[paramCount+1] << "' certificate." << endl;
exit(1);
}
cp = new WinCAPICryptoProvider();
XSECPlatformUtils::SetCryptoProvider(cp);
HCRYPTKEY k;
BOOL fResult = CryptGetUserKey(
win32RSACSP,
dwKeySpec,
&k);
if (!fResult || k == 0) {
cerr << "Error obtaining default user (AT_SIGNATURE or AT_KEYEXCHANGE) key from windows RSA provider.\n";
exit(1);
};
winKeyRSA = new WinCAPICryptoKeyRSA(win32RSACSP, k);
key = winKeyRSA;
paramCount += 2;
CertFreeCertificateContext(pSignerCert);
CertCloseStore(hStoreHandle, 0);
}
#endif /* CRYPT_ACQUIRE_CACHE_FLAG */
#endif /* XSEC_HAVE_WINCAPI */
else {
printUsage();
exit(1);
}
}
// Create and set up the parser
XercesDOMParser * parser = new XercesDOMParser;
parser->setDoNamespaces(true);
parser->setCreateEntityReferenceNodes(true);
// Now parse out file
bool errorsOccured = false;
XMLSize_t errorCount = 0;
try
{
parser->parse(argv[argc - 1]);
errorCount = parser->getErrorCount();
if (errorCount > 0)
errorsOccured = true;
}
catch (const XMLException& e)
{
cerr << "An error occurred during parsing\n Message: "
<< e.getMessage() << endl;
errorsOccured = true;
}
catch (const DOMException& e)
{
cerr << "A DOM error occurred during parsing\n DOMException code: "
<< e.code << endl;
errorsOccured = true;
}
if (errorsOccured) {
cout << "Errors during parse" << endl;
exit (1);
}
/*
Now that we have the parsed file, get the DOM document and start looking at it
*/
DOMNode *doc; // The document that we parsed
doc = parser->getDocument();
DOMDocument *theDOM = parser->getDocument();
// Find the signature node
DOMNode *sigNode = findDSIGNode(doc, "Signature");
// Create the signature checker
if (sigNode == 0) {
cerr << "Could not find <Signature> node in " << argv[argc-1] << endl;
exit(1);
}
XSECProvider * prov = new XSECProvider;
DSIGSignature * sig = prov->newSignatureFromDOM(theDOM, sigNode);
// Map out base path of the file
char * filename=argv[argc-1];
#if XSEC_HAVE_GETCWD_DYN
char *path = getcwd(NULL, 0);
char *baseURI = (char*)malloc(strlen(path) + 8 + 1 + strlen(filename) + 1);
#else
char path[PATH_MAX];
char baseURI[(PATH_MAX * 2) + 10];
getcwd(path, PATH_MAX);
#endif
strcpy(baseURI, "file:///");
// Ugly and nasty but quick
if (filename[0] != '\\' && filename[0] != '/' && filename[1] != ':') {
strcat(baseURI, path);
strcat(baseURI, "/");
} else if (path[1] == ':') {
path[2] = '\0';
strcat(baseURI, path);
}
strcat(baseURI, filename);
// Find any ':' and "\" characters
int lastSlash = 0;
for (unsigned int i = 8; i < strlen(baseURI); ++i) {
if (baseURI[i] == '\\') {
lastSlash = i;
baseURI[i] = '/';
}
else if (baseURI[i] == '/')
lastSlash = i;
}
// The last "\\" must prefix the filename
baseURI[lastSlash + 1] = '\0';
sig->getURIResolver()->setBaseURI(MAKE_UNICODE_STRING(baseURI));
#if XSEC_HAVE_GETCWD_DYN
free(path);
free(baseURI);
#endif
try {
sig->load();
if (clearKeyInfo == true)
sig->clearKeyInfo();
if (key != NULL)
sig->setSigningKey(key);
sig->sign();
// Add any KeyInfo elements
#if defined(XSEC_HAVE_WINCAPI)
if (winDssKeyInfo == true && winKeyDSA != NULL) {
char pBuf[1024];
char qBuf[1024];
char gBuf[1024];
char yBuf[1024];
unsigned int i;
i = winKeyDSA->getPBase64BigNums((char *) pBuf, 1024);
pBuf[i] = '\0';
i = winKeyDSA->getQBase64BigNums((char *) qBuf, 1024);
qBuf[i] = '\0';
i = winKeyDSA->getGBase64BigNums((char *) gBuf, 1024);
gBuf[i] = '\0';
i = winKeyDSA->getYBase64BigNums((char *) yBuf, 1024);
yBuf[i] = '\0';
sig->clearKeyInfo();
sig->appendDSAKeyValue(
MAKE_UNICODE_STRING(pBuf),
MAKE_UNICODE_STRING(qBuf),
MAKE_UNICODE_STRING(gBuf),
MAKE_UNICODE_STRING(yBuf));
}
if (winRsaKeyInfo == true && winKeyRSA != NULL) {
char eBuf[1024];
char mBuf[1024];
unsigned int i;
i = winKeyRSA->getExponentBase64BigNums((char *) eBuf, 1024);
eBuf[i] = '\0';
i = winKeyRSA->getModulusBase64BigNums((char *) mBuf, 1024);
mBuf[i] = '\0';
sig->clearKeyInfo();
sig->appendRSAKeyValue(
MAKE_UNICODE_STRING(mBuf),
MAKE_UNICODE_STRING(eBuf));
}
#endif
#if defined (XSEC_HAVE_OPENSSL)
if (certCount > 0) {
int i;
// Have some certificates - see if there is already an X509 list
DSIGKeyInfoList * kiList = sig->getKeyInfoList();
int kiSize = (int) kiList->getSize();
for (i = 0; i < kiSize; ++i) {
if (kiList->item(i)->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) {
keyInfoX509 = (DSIGKeyInfoX509 *) kiList->item(i);
break;
}
}
if (keyInfoX509 == 0) {
// Not found - need to create
keyInfoX509 = sig->appendX509Data();
}
for (i = 0; i < certCount; ++i) {
keyInfoX509->appendX509Certificate(certs[i]->getDEREncodingSB().sbStrToXMLCh());
}
} /* certCount > 0 */
#endif
if (x509SubjectName != NULL) {
int i;
// Have some certificates - see if there is already an X509 list
DSIGKeyInfoList * kiList = sig->getKeyInfoList();
int kiSize = (int) kiList->getSize();
for (i = 0; i < kiSize; ++i) {
if (kiList->item(i)->getKeyInfoType() == DSIGKeyInfo::KEYINFO_X509) {
keyInfoX509 = (DSIGKeyInfoX509 *) kiList->item(i);
break;
}
}
if (keyInfoX509 == 0) {
// Not found - need to create
keyInfoX509 = sig->appendX509Data();
}
keyInfoX509->setX509SubjectName(MAKE_UNICODE_STRING(x509SubjectName));
} /* certCount > 0 */
}
catch (const XSECException &e) {
char * m = XMLString::transcode(e.getMsg());
cerr << "An error occurred during signing operation\n Message: "
<< m << endl;
XSEC_RELEASE_XMLCH(m);
errorsOccured = true;
exit (1);
}
catch (const XSECCryptoException &e) {
cerr << "A cryptographic error occurred during signature operation\n Message: "
<< e.getMsg() << endl;
errorsOccured = true;
exit(1);
}
catch (const NetAccessorException&) {
cerr << "A network error occurred during signing operation\n" << endl;
errorsOccured = true;
exit(1);
}
// Print out the result
DOMPrintFormatTarget* formatTarget = new DOMPrintFormatTarget();
const XMLCh* encNameStr = XMLString::transcode("UTF-8");
DOMNode *aNode = doc->getFirstChild();
if (aNode->getNodeType() == DOMNode::ENTITY_NODE)
{
const XMLCh* aStr = ((DOMEntity *)aNode)->getInputEncoding();
if (!strEquals(aStr, ""))
{
encNameStr = aStr;
}
}
XMLSize_t lent = XMLString::stringLen(encNameStr);
gEncodingName = new XMLCh[lent + 1];
XMLString::copyNString(gEncodingName, encNameStr, lent);
gEncodingName[lent] = 0;
gFormatter = new XMLFormatter("UTF-8", 0, formatTarget,
XMLFormatter::NoEscapes, gUnRepFlags);
cout << doc;
delete [] gEncodingName;
XMLCh * toRelease = (XMLCh *) encNameStr;
XSEC_RELEASE_XMLCH(toRelease);
delete gFormatter;
delete formatTarget;
#if defined (_WIN32) && defined (XSEC_HAVE_WINCAPI)
if (win32DSSCSP != 0)
CryptReleaseContext(win32DSSCSP,0);
if (win32RSACSP != 0)
CryptReleaseContext(win32RSACSP,0);
#endif
prov->releaseSignature(sig);
delete parser;
delete prov;
XSECPlatformUtils::Terminate();
#ifdef XSEC_HAVE_XALAN
XalanTransformer::terminate();
XPathEvaluator::terminate();
#endif
XMLPlatformUtils::Terminate();
return 0;
}