xmlsecurity/inc/xsecctl.hxx

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /*
   3  * This file is part of the LibreOffice project.
   4  *
   5  * This Source Code Form is subject to the terms of the Mozilla Public
   6  * License, v. 2.0. If a copy of the MPL was not distributed with this
   7  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8  *
   9  * This file incorporates work covered by the following license notice:
  10  *
  11  *   Licensed to the Apache Software Foundation (ASF) under one or more
  12  *   contributor license agreements. See the NOTICE file distributed
  13  *   with this work for additional information regarding copyright
  14  *   ownership. The ASF licenses this file to you under the Apache
  15  *   License, Version 2.0 (the "License"); you may not use this file
  16  *   except in compliance with the License. You may obtain a copy of
  17  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  18  */
  19
  20 #pragma once
  21
  22 #include <svl/sigstruct.hxx>
  23
  24 #include <com/sun/star/xml/crypto/sax/XSAXEventKeeperStatusChangeListener.hpp>
  25 #include <com/sun/star/xml/crypto/sax/XSignatureCreationResultListener.hpp>
  26 #include <com/sun/star/xml/crypto/sax/XSignatureVerifyResultListener.hpp>
  27
  28 #include <rtl/ref.hxx>
  29 #include <cppuhelper/implbase.hxx>
  30
  31 #include <vector>
  32
  33 #include "xmlsignaturehelper2.hxx"
  34
  35 namespace com::sun::star::embed { class XStorage; }
  36 namespace com::sun::star::graphic { class XGraphic; }
  37 namespace com::sun::star::io { class XInputStream; }
  38 namespace com::sun::star::lang { class XInitialization; }
  39 namespace com::sun::star::uno { class XComponentContext; }
  40 namespace com::sun::star::xml::crypto { class XXMLSecurityContext; }
  41 namespace com::sun::star::xml::crypto { class XXMLSignature; }
  42 namespace com::sun::star::xml::crypto:: sax { class XReferenceResolvedListener; }
  43 namespace com::sun::star::xml::sax { class XDocumentHandler; }
  44
  45 #define NS_XMLDSIG "http://www.w3.org/2000/09/xmldsig#"
  46 #define NS_DC      "http://purl.org/dc/elements/1.1/"
  47 #define NS_XD      "http://uri.etsi.org/01903/v1.3.2#"
  48 #define NS_MDSSI   "http://schemas.openxmlformats.org/package/2006/digital-signature"
  49 #define NS_LOEXT   "urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0"
  50
  51 #define ALGO_C14N          "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
  52 #define ALGO_RSASHA1       "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
  53 #define ALGO_RSASHA256     "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
  54 #define ALGO_RSASHA512     "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
  55 #define ALGO_ECDSASHA1     "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"
  56 #define ALGO_ECDSASHA256   "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"
  57 #define ALGO_ECDSASHA512   "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"
  58 #define ALGO_XMLDSIGSHA1   "http://www.w3.org/2000/09/xmldsig#sha1"
  59 #define ALGO_XMLDSIGSHA256 "http://www.w3.org/2001/04/xmlenc#sha256"
  60 #define ALGO_XMLDSIGSHA512 "http://www.w3.org/2001/04/xmlenc#sha512"
  61 #define ALGO_RELATIONSHIP  "http://schemas.openxmlformats.org/package/2006/RelationshipTransform"
  62
  63 class XMLDocumentWrapper_XmlSecImpl;
  64 class SAXEventKeeperImpl;
  65 class XMLSignatureHelper;
  66 namespace svl::crypto { enum class SignatureMethodAlgorithm; }
  67
  68 class InternalSignatureInformation
  69 {
  70 public:
  71     SignatureInformation signatureInfor;
  72
  73     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > xReferenceResolvedListener;
  74
  75     ::std::vector< sal_Int32 > vKeeperIds;
  76
  77     InternalSignatureInformation(
  78         sal_Int32 nId,
  79         css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > const & xListener)
  80         :signatureInfor(nId)
  81     {
  82         xReferenceResolvedListener = xListener;
  83     }
  84
  85     void addReference( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri, sal_Int32 keeperId, const OUString& rType )
  86     {
  87         signatureInfor.vSignatureReferenceInfors.push_back(
  88                 SignatureReferenceInformation(type, digestID, uri, rType));
  89         vKeeperIds.push_back( keeperId );
  90     }
  91 };
  92
  93 class XSecController final : public cppu::WeakImplHelper
  94 <
  95     css::xml::crypto::sax::XSAXEventKeeperStatusChangeListener,
  96     css::xml::crypto::sax::XSignatureCreationResultListener,
  97     css::xml::crypto::sax::XSignatureVerifyResultListener
  98 >
  99 /****** XSecController.hxx/CLASS XSecController *******************************
 100  *
 101  *   NAME
 102  *  XSecController -- the xml security framework controller
 103  *
 104  *   FUNCTION
 105  *  Controls the whole xml security framework to create signatures or to
 106  *  verify signatures.
 107  *
 108  ******************************************************************************/
 109 {
 110     friend class XSecParser;
 111     friend class OOXMLSecParser;
 112
 113 private:
 114     css::uno::Reference< css::uno::XComponentContext> mxCtx;
 115
 116     /*
 117      * used to buffer SAX events
 118      */
 119     rtl::Reference<XMLDocumentWrapper_XmlSecImpl> m_xXMLDocumentWrapper;
 120
 121     /*
 122      * the SAX events keeper
 123      */
 124     rtl::Reference<SAXEventKeeperImpl> m_xSAXEventKeeper;
 125
 126     /*
 127      * the bridge component which creates/verifies signature
 128      */
 129     css::uno::Reference< css::xml::crypto::XXMLSignature > m_xXMLSignature;
 130
 131     /*
 132      * the Security Context
 133      */
 134     css::uno::Reference< css::xml::crypto::XXMLSecurityContext > m_xSecurityContext;
 135
 136     /*
 137      * the security id incrementer, in order to make any security id unique
 138      * to the SAXEventKeeper.
 139      * Because each XSecController has its own SAXEventKeeper, so this variable
 140      * is not necessary to be static.
 141      */
 142     sal_Int32 m_nNextSecurityId;
 143
 144     /*
 145      * Signature information
 146      */
 147     std::vector< InternalSignatureInformation > m_vInternalSignatureInformations;
 148
 149     /*
 150      * the previous node on the SAX chain.
 151      * The reason that use a Reference<XInterface> type variable
 152      * is that the previous components are different when exporting
 153      * and importing, and there is no other common interface they
 154      * can provided.
 155      */
 156     css::uno::Reference< css::uno::XInterface > m_xPreviousNodeOnSAXChain;
 157     /*
 158      * whether the previous node can provide an XInitialize interface,
 159      * use this variable in order to typecast the XInterface to the
 160      * correct interface type.
 161      */
 162     bool m_bIsPreviousNodeInitializable;
 163
 164     /*
 165      * a flag representing whether the SAXEventKeeper is now on the
 166      * SAX chain.
 167      */
 168     bool m_bIsSAXEventKeeperConnected;
 169
 170     /*
 171      * a flag representing whether it is collecting some element,
 172      * which means that the SAXEventKeeper can't be chained off the
 173      * SAX chain.
 174      */
 175     bool m_bIsCollectingElement;
 176
 177     /*
 178      * a flag representing whether the SAX event stream is blocking,
 179      * which also means that the SAXEventKeeper can't be chained off
 180      * the SAX chain.
 181      */
 182     bool m_bIsBlocking;
 183
 184     /*
 185      * a flag representing the current status of security related
 186      * components.
 187      */
 188
 189     /*
 190      * status of security related components
 191      */
 192     enum class InitializationState { UNINITIALIZED, INITIALIZED, FAILTOINITIALIZED } m_eStatusOfSecurityComponents;
 193
 194     /*
 195      * a flag representing whether the SAXEventKeeper need to be
 196      * on the SAX chain all the time.
 197      * This flag is used to the situation when creating signature.
 198      */
 199     bool m_bIsSAXEventKeeperSticky;
 200
 201     /*
 202      * the XSecParser which is used to parse the signature stream
 203      */
 204     css::uno::Reference<css::xml::sax::XDocumentHandler> m_xSecParser;
 205
 206     /*
 207      * the caller assigned signature id for the next signature in the
 208      * signature stream
 209      */
 210     sal_Int32 m_nReservedSignatureId;
 211
 212     /*
 213      * representing whether to verify the current signature
 214      */
 215     bool m_bVerifyCurrentSignature;
 216
 217     /*
 218      * An xUriBinding is provided to map Uris to XInputStream interfaces.
 219      */
 220     rtl::Reference<UriBindingHelper> m_xUriBinding;
 221
 222 private:
 223
 224     /*
 225      * Common methods
 226      */
 227     void createXSecComponent( );
 228     int findSignatureInfor( sal_Int32 nSecurityId ) const;
 229     bool chainOn();
 230     void chainOff();
 231     void checkChainingStatus();
 232     void initializeSAXChain();
 233
 234     css::uno::Reference< css::io::XInputStream > getObjectInputStream( const OUString& objectURL );
 235
 236         //sal_Int32 getFastPropertyIndex(sal_Int32 nHandle) const;
 237
 238     /*
 239      * For signature generation
 240      */
 241     static OUString createId();
 242     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToWrite(
 243         InternalSignatureInformation& signatureInfo,
 244         sal_Int32 nStorageFormat,
 245         bool bXAdESCompliantIfODF );
 246
 247     /*
 248      * For signature verification
 249      */
 250     void addSignature();
 251     /// Sets algorithm from <SignatureMethod Algorithm="...">.
 252     void setSignatureMethod(svl::crypto::SignatureMethodAlgorithm eAlgorithmID);
 253     void switchGpgSignature();
 254     void addReference(
 255         const OUString& ouUri,
 256         sal_Int32 nDigestID,
 257         const OUString& ouType );
 258     void addStreamReference(
 259         const OUString& ouUri,
 260         bool isBinary,
 261         sal_Int32 nDigestID );
 262     void setReferenceCount() const;
 263
 264     void setX509IssuerName( OUString const & ouX509IssuerName );
 265     void setX509SerialNumber( OUString const & ouX509SerialNumber );
 266     void setX509Certificate( OUString const & ouX509Certificate );
 267     void setSignatureValue( OUString const & ouSignatureValue );
 268     void setDigestValue( sal_Int32 nDigestID, OUString const & ouDigestValue );
 269     void setGpgKeyID( OUString const & ouKeyID );
 270     void setGpgCertificate( OUString const & ouGpgCert );
 271     void setGpgOwner( OUString const & ouGpgOwner );
 272
 273     void setDate( OUString const & ouDate );
 274     void setDescription(const OUString& rDescription);
 275     void setCertDigest(const OUString& rCertDigest);
 276     void setValidSignatureImage(const OUString& rValidSigImg);
 277     void setInvalidSignatureImage(const OUString& rInvalidSigImg);
 278     void setSignatureLineId(const OUString& rSignatureLineId);
 279
 280 public:
 281     void setSignatureBytes(const css::uno::Sequence<sal_Int8>& rBytes);
 282
 283 private:
 284     void setId( OUString const & ouId );
 285     void setPropertyId( OUString const & ouPropertyId );
 286
 287     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToRead(
 288         sal_Int32 nSecurityId );
 289
 290 public:
 291     explicit XSecController(const css::uno::Reference<css::uno::XComponentContext>& rxCtx);
 292     virtual ~XSecController() override;
 293
 294     sal_Int32 getNewSecurityId(  );
 295
 296     void startMission(const rtl::Reference<UriBindingHelper>& xUriBinding, const css::uno::Reference<css::xml::crypto::XXMLSecurityContext>& xSecurityContext);
 297
 298     void setSAXChainConnector(const css::uno::Reference< css::lang::XInitialization >& xInitialization);
 299
 300     void clearSAXChainConnector();
 301     void endMission();
 302
 303     SignatureInformation    getSignatureInformation( sal_Int32 nSecurityId ) const;
 304     SignatureInformations   getSignatureInformations() const;
 305
 306     static void exportSignature(
 307         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
 308         const SignatureInformation& signatureInfo,
 309         bool bXAdESCompliantIfODF );
 310
 311
 312     /*
 313      * For signature generation
 314      */
 315     void signAStream( sal_Int32 securityId, const OUString& uri, bool isBinary, bool bXAdESCompliantIfODF);
 316
 317
 318     /** sets data that describes the certificate.
 319
 320         It is absolutely necessary that the parameter ouX509IssuerName is set. It contains
 321         the base64 encoded certificate, which is DER encoded. The XMLSec needs it to find
 322         the private key. Although issuer name and certificate should be sufficient to identify
 323         the certificate the implementation in XMLSec is broken, both for Windows and mozilla.
 324         The reason is that they use functions to find the certificate which take as parameter
 325         the DER encoded ASN.1 issuer name. The issuer name is a DName, where most attributes
 326         are of type DirectoryName, which is a choice of 5 string types. This information is
 327         not contained in the issuer string and while it is converted to the ASN.1 name the
 328         conversion function must assume a particular type, which is often wrong. For example,
 329         the Windows function CertStrToName will use a T.61 string if the string does not contain
 330         special characters. So if the certificate uses simple characters but encodes the
 331         issuer attributes in Utf8, then CertStrToName will use T.61. The resulting DER encoded
 332         ASN.1 name now contains different bytes which indicate the string type. The functions
 333         for finding the certificate apparently use memcmp - hence they fail to find the
 334         certificate.
 335      */
 336     void setX509Certificate(
 337         sal_Int32 nSecurityId,
 338         const OUString& ouX509IssuerName,
 339         const OUString& ouX509SerialNumber,
 340         const OUString& ouX509Cert,
 341         const OUString& ouX509CertDigest,
 342         svl::crypto::SignatureMethodAlgorithm eAlgorithmID);
 343
 344     void addEncapsulatedX509Certificate(const OUString& rEncapsulatedX509Certificate);
 345
 346     void setGpgCertificate(
 347         sal_Int32 nSecurityId,
 348         const OUString& ouCertDigest,
 349         const OUString& ouCert,
 350         const OUString& ouOwner);
 351
 352     void setDate(
 353         sal_Int32 nSecurityId,
 354         const css::util::DateTime& rDateTime );
 355     void setDescription(sal_Int32 nSecurityId, const OUString& rDescription);
 356     void setSignatureLineId(sal_Int32 nSecurityId, const OUString& rSignatureLineId);
 357     void
 358     setSignatureLineValidGraphic(sal_Int32 nSecurityId,
 359                                  const css::uno::Reference<css::graphic::XGraphic>& xValidGraphic);
 360     void setSignatureLineInvalidGraphic(
 361         sal_Int32 nSecurityId, const css::uno::Reference<css::graphic::XGraphic>& xInvalidGraphic);
 362
 363     bool WriteSignature(
 364         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
 365         bool bXAdESCompliantIfODF);
 366
 367     /*
 368      * For signature verification
 369      */
 370     void collectToVerify( std::u16string_view referenceId );
 371     void addSignature( sal_Int32 nSignatureId );
 372     css::uno::Reference< css::xml::sax::XDocumentHandler > const & createSignatureReader(XMLSignatureHelper& rXMLSignatureHelper, sal_Int32 nType = 0);
 373     void releaseSignatureReader();
 374
 375 public:
 376     /* Interface methods */
 377
 378     /*
 379      * XSAXEventKeeperStatusChangeListener
 380      */
 381     virtual void SAL_CALL blockingStatusChanged( sal_Bool isBlocking ) override;
 382     virtual void SAL_CALL collectionStatusChanged(
 383         sal_Bool isInsideCollectedElement ) override;
 384     virtual void SAL_CALL bufferStatusChanged( sal_Bool isBufferEmpty ) override;
 385
 386     /*
 387      * XSignatureCreationResultListener
 388      */
 389     virtual void SAL_CALL signatureCreated( sal_Int32 securityId, css::xml::crypto::SecurityOperationStatus nResult ) override;
 390
 391     /*
 392      * XSignatureVerifyResultListener
 393      */
 394     virtual void SAL_CALL signatureVerified( sal_Int32 securityId, css::xml::crypto::SecurityOperationStatus nResult ) override;
 395
 396     /// Writes XML elements inside a single OOXML signature's <Signature> element.
 397     bool WriteOOXMLSignature(const css::uno::Reference<css::embed::XStorage>& xRootStorage, const css::uno::Reference<css::xml::sax::XDocumentHandler>& xDocumentHandler);
 398     /// Exports an OOXML signature, called by WriteOOXMLSignature().
 399     void exportOOXMLSignature(const css::uno::Reference<css::embed::XStorage>& xRootStorage, const css::uno::Reference<css::xml::sax::XDocumentHandler>& xDocumentHandler, const SignatureInformation& rInformation);
 400 };
 401
 402 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */