xmlsecurity/inc/xsecctl.hxx

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /*
   3  * This file is part of the LibreOffice project.
   4  *
   5  * This Source Code Form is subject to the terms of the Mozilla Public
   6  * License, v. 2.0. If a copy of the MPL was not distributed with this
   7  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8  *
   9  * This file incorporates work covered by the following license notice:
  10  *
  11  *   Licensed to the Apache Software Foundation (ASF) under one or more
  12  *   contributor license agreements. See the NOTICE file distributed
  13  *   with this work for additional information regarding copyright
  14  *   ownership. The ASF licenses this file to you under the Apache
  15  *   License, Version 2.0 (the "License"); you may not use this file
  16  *   except in compliance with the License. You may obtain a copy of
  17  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  18  */
  19
  20 #ifndef INCLUDED_XMLSECURITY_SOURCE_HELPER_XSECCTL_HXX
  21 #define INCLUDED_XMLSECURITY_SOURCE_HELPER_XSECCTL_HXX
  22
  23 #include <svl/sigstruct.hxx>
  24
  25 #include <com/sun/star/uno/XComponentContext.hpp>
  26 #include <com/sun/star/xml/sax/XParser.hpp>
  27 #include <com/sun/star/lang/XInitialization.hpp>
  28 #include <com/sun/star/xml/sax/XDocumentHandler.hpp>
  29 #include <com/sun/star/xml/sax/XAttributeList.hpp>
  30 #include <com/sun/star/xml/crypto/XXMLSignature.hpp>
  31 #include <com/sun/star/xml/crypto/XSEInitializer.hpp>
  32 #include <com/sun/star/xml/crypto/sax/XElementStackKeeper.hpp>
  33 #include <com/sun/star/xml/crypto/sax/XSecuritySAXEventKeeper.hpp>
  34 #include <com/sun/star/xml/crypto/sax/XReferenceResolvedListener.hpp>
  35 #include <com/sun/star/xml/crypto/sax/XSAXEventKeeperStatusChangeListener.hpp>
  36 #include <com/sun/star/xml/crypto/sax/XSignatureCreationResultListener.hpp>
  37 #include <com/sun/star/xml/crypto/sax/XSignatureVerifyResultListener.hpp>
  38 #include <com/sun/star/xml/wrapper/XXMLDocumentWrapper.hpp>
  39 #include <com/sun/star/io/XOutputStream.hpp>
  40 #include <com/sun/star/io/XInputStream.hpp>
  41 #include <com/sun/star/embed/XStorage.hpp>
  42
  43 #include <rtl/ustrbuf.hxx>
  44 #include <rtl/ref.hxx>
  45
  46 #include <cppuhelper/implbase.hxx>
  47
  48 #include <vector>
  49
  50 #define NS_XMLDSIG "http://www.w3.org/2000/09/xmldsig#"
  51 #define NS_DC      "http://purl.org/dc/elements/1.1/"
  52 #define NS_XD      "http://uri.etsi.org/01903/v1.3.2#"
  53 #define NS_MDSSI   "http://schemas.openxmlformats.org/package/2006/digital-signature"
  54 #define NS_LOEXT   "urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0"
  55
  56 #define ALGO_C14N          "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
  57 #define ALGO_RSASHA1       "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
  58 #define ALGO_RSASHA256     "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
  59 #define ALGO_RSASHA512     "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
  60 #define ALGO_XMLDSIGSHA1   "http://www.w3.org/2000/09/xmldsig#sha1"
  61 #define ALGO_XMLDSIGSHA256 "http://www.w3.org/2001/04/xmlenc#sha256"
  62 #define ALGO_XMLDSIGSHA512 "http://www.w3.org/2001/04/xmlenc#sha512"
  63 #define ALGO_RELATIONSHIP  "http://schemas.openxmlformats.org/package/2006/RelationshipTransform"
  64
  65 class XSecParser;
  66 class XMLDocumentWrapper_XmlSecImpl;
  67 class SAXEventKeeperImpl;
  68 class XMLSignatureHelper;
  69
  70 class InternalSignatureInformation
  71 {
  72 public:
  73     SignatureInformation signatureInfor;
  74
  75     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > xReferenceResolvedListener;
  76
  77     ::std::vector< sal_Int32 > vKeeperIds;
  78
  79     InternalSignatureInformation(
  80         sal_Int32 nId,
  81         css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > const & xListener)
  82         :signatureInfor(nId)
  83     {
  84         xReferenceResolvedListener = xListener;
  85     }
  86
  87     void addReference( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri, sal_Int32 keeperId )
  88     {
  89         signatureInfor.vSignatureReferenceInfors.push_back(
  90                 SignatureReferenceInformation(type, digestID, uri));
  91         vKeeperIds.push_back( keeperId );
  92     }
  93 };
  94
  95 class XSecController : public cppu::WeakImplHelper
  96 <
  97     css::xml::crypto::sax::XSAXEventKeeperStatusChangeListener,
  98     css::xml::crypto::sax::XSignatureCreationResultListener,
  99     css::xml::crypto::sax::XSignatureVerifyResultListener
 100 >
 101 /****** XSecController.hxx/CLASS XSecController *******************************
 102  *
 103  *   NAME
 104  *  XSecController -- the xml security framework controller
 105  *
 106  *   FUNCTION
 107  *  Controls the whole xml security framework to create signatures or to
 108  *  verify signatures.
 109  *
 110  ******************************************************************************/
 111 {
 112     friend class XSecParser;
 113     friend class OOXMLSecParser;
 114
 115 private:
 116     css::uno::Reference< css::uno::XComponentContext> mxCtx;
 117
 118     /*
 119      * used to buffer SAX events
 120      */
 121     rtl::Reference<XMLDocumentWrapper_XmlSecImpl> m_xXMLDocumentWrapper;
 122
 123     /*
 124      * the SAX events keeper
 125      */
 126     rtl::Reference<SAXEventKeeperImpl> m_xSAXEventKeeper;
 127
 128     /*
 129      * the bridge component which creates/verifies signature
 130      */
 131     css::uno::Reference< css::xml::crypto::XXMLSignature > m_xXMLSignature;
 132
 133     /*
 134      * the Security Context
 135      */
 136     css::uno::Reference< css::xml::crypto::XXMLSecurityContext > m_xSecurityContext;
 137
 138     /*
 139      * the security id incrementer, in order to make any security id unique
 140      * to the SAXEventKeeper.
 141      * Because each XSecController has its own SAXEventKeeper, so this variable
 142      * is not necessary to be static.
 143      */
 144     sal_Int32 m_nNextSecurityId;
 145
 146     /*
 147      * Signature information
 148      */
 149     std::vector< InternalSignatureInformation > m_vInternalSignatureInformations;
 150
 151     /*
 152      * the previous node on the SAX chain.
 153      * The reason that use a Reference<XInterface> type variable
 154      * is that the previous components are different when exporting
 155      * and importing, and there is no other common interface they
 156      * can provided.
 157      */
 158     css::uno::Reference< css::uno::XInterface > m_xPreviousNodeOnSAXChain;
 159     /*
 160      * whether the previous node can provide an XInitialize interface,
 161      * use this variable in order to typecast the XInterface to the
 162      * correct interface type.
 163      */
 164     bool m_bIsPreviousNodeInitializable;
 165
 166     /*
 167      * the next node on the SAX chain.
 168      * it can always provide an XDocumentHandler interface.
 169      */
 170     css::uno::Reference< css::xml::sax::XDocumentHandler > m_xNextNodeOnSAXChain;
 171
 172     /*
 173      * the ElementStackKeeper is used to reserve the key SAX events.
 174      * when the SAXEventKeeper is chained on the SAX chain, it need
 175      * first get all missed key SAX events in order to make sure the
 176      * DOM tree it buffering has the same structure with the original
 177      * document.
 178      *
 179      * For a given section of a SAX event stream, the key SAX events
 180      * are the minimal SAX event subset of that section, which,
 181      * combining with SAX events outside of this section, has the same
 182      * structure with the original document.
 183      *
 184      * For example, sees the following dom fragment:
 185      *     <A>
 186      *      <B/>
 187      *      <C>
 188      *       <D>
 189      *        <E/>
 190      *       </D>
 191      *      </C>
 192      *     </A>
 193      *
 194      * If we consider the SAX event section from startElement(<A>) to
 195      * startElement(<D>), then the key SAX events are:
 196      *
 197      *    startElement(<A>), startElement(<C>), startElement(<D>)
 198      *
 199      * The startElement(<B>) and endElement(<B>) is ignored, because
 200      * they are unimportant for the tree structure in this section.
 201      *
 202      * If we consider the SAX event section from startElement(<D>) to
 203      * endElement(<A>), the key SAX events are:
 204      *
 205      *    startElement(<D>), endElement(<D>), endElement(<C>),
 206      *    endElement(<A>).
 207      */
 208     css::uno::Reference< css::xml::crypto::sax::XElementStackKeeper > m_xElementStackKeeper;
 209
 210     /*
 211      * a flag representing whether the SAXEventKeeper is now on the
 212      * SAX chain.
 213      */
 214     bool m_bIsSAXEventKeeperConnected;
 215
 216     /*
 217      * a flag representing whether it is collecting some element,
 218      * which means that the SAXEventKeeper can't be chained off the
 219      * SAX chain.
 220      */
 221     bool m_bIsCollectingElement;
 222
 223     /*
 224      * a flag representing whether the SAX event stream is blocking,
 225      * which also means that the SAXEventKeeper can't be chained off
 226      * the SAX chain.
 227      */
 228     bool m_bIsBlocking;
 229
 230     /*
 231      * a flag representing the current status of security related
 232      * components.
 233      */
 234
 235     /*
 236      * status of security related components
 237      */
 238     enum class InitializationState { UNINITIALIZED, INITIALIZED, FAILTOINITIALIZED } m_eStatusOfSecurityComponents;
 239
 240     /*
 241      * a flag representing whether the SAXEventKeeper need to be
 242      * on the SAX chain all the time.
 243      * This flag is used to the situation when creating signature.
 244      */
 245     bool m_bIsSAXEventKeeperSticky;
 246
 247     /*
 248      * the XSecParser which is used to parse the signature stream
 249      */
 250     css::uno::Reference<css::xml::sax::XDocumentHandler> m_xSecParser;
 251
 252     /*
 253      * the caller assigned signature id for the next signature in the
 254      * signature stream
 255      */
 256     sal_Int32 m_nReservedSignatureId;
 257
 258     /*
 259      * representing whether to verify the current signature
 260      */
 261     bool m_bVerifyCurrentSignature;
 262
 263 public:
 264     /*
 265      * An xUriBinding is provided to map Uris to XInputStream interfaces.
 266      */
 267     css::uno::Reference< css::xml::crypto::XUriBinding > m_xUriBinding;
 268
 269 private:
 270
 271     /*
 272      * Common methods
 273      */
 274     void createXSecComponent( );
 275     int findSignatureInfor( sal_Int32 nSecurityId ) const;
 276     bool chainOn( bool bRetrievingLastEvent );
 277     void chainOff();
 278     void checkChainingStatus();
 279     void initializeSAXChain();
 280
 281     css::uno::Reference< css::io::XInputStream > getObjectInputStream( const OUString& objectURL );
 282
 283         //sal_Int32 getFastPropertyIndex(sal_Int32 nHandle) const;
 284
 285     /*
 286      * For signature generation
 287      */
 288     static OUString createId();
 289     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToWrite(
 290         InternalSignatureInformation& signatureInfo,
 291         sal_Int32 nStorageFormat,
 292         bool bXAdESCompliantIfODF );
 293
 294     /*
 295      * For signature verification
 296      */
 297     void addSignature();
 298     void switchGpgSignature();
 299     void addReference(
 300         const OUString& ouUri,
 301         sal_Int32 nDigestID );
 302     void addStreamReference(
 303         const OUString& ouUri,
 304         bool isBinary,
 305         sal_Int32 nDigestID );
 306     void setReferenceCount() const;
 307
 308     void setX509IssuerName( OUString const & ouX509IssuerName );
 309     void setX509SerialNumber( OUString const & ouX509SerialNumber );
 310     void setX509Certificate( OUString const & ouX509Certificate );
 311     void setSignatureValue( OUString const & ouSignatureValue );
 312     void setDigestValue( sal_Int32 nDigestID, OUString const & ouDigestValue );
 313     void setGpgKeyID( OUString const & ouKeyID );
 314     void setGpgCertificate( OUString const & ouGpgCert );
 315     void setGpgOwner( OUString const & ouGpgOwner );
 316
 317     void setDate( OUString const & ouDate );
 318     void setDescription(const OUString& rDescription);
 319     void setCertDigest(const OUString& rCertDigest);
 320
 321 public:
 322     void setSignatureBytes(const css::uno::Sequence<sal_Int8>& rBytes);
 323
 324 private:
 325     void setId( OUString const & ouId );
 326     void setPropertyId( OUString const & ouPropertyId );
 327
 328     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToRead(
 329         sal_Int32 nSecurityId );
 330
 331 public:
 332     explicit XSecController(const css::uno::Reference<css::uno::XComponentContext>& rxCtx);
 333     virtual ~XSecController() override;
 334
 335     sal_Int32 getNewSecurityId(  );
 336
 337     void startMission( const css::uno::Reference<
 338         css::xml::crypto::XUriBinding >& xUriBinding,
 339         const css::uno::Reference<
 340             css::xml::crypto::XXMLSecurityContext >& xSecurityContext );
 341
 342     void setSAXChainConnector(
 343         const css::uno::Reference< css::lang::XInitialization >& xInitialization,
 344         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
 345         const css::uno::Reference< css::xml::crypto::sax::XElementStackKeeper >& xElementStackKeeper);
 346
 347     void clearSAXChainConnector();
 348     void endMission();
 349
 350     SignatureInformation    getSignatureInformation( sal_Int32 nSecurityId ) const;
 351     SignatureInformations   getSignatureInformations() const;
 352
 353     static void exportSignature(
 354         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
 355         const SignatureInformation& signatureInfo,
 356         bool bXAdESCompliantIfODF );
 357
 358
 359     /*
 360      * For signature generation
 361      */
 362     void signAStream( sal_Int32 securityId, const OUString& uri, bool isBinary, bool bXAdESCompliantIfODF);
 363
 364
 365     /** sets data that describes the certificate.
 366
 367         It is absolutely necessary that the parameter ouX509IssuerName is set. It contains
 368         the base64 encoded certificate, which is DER encoded. The XMLSec needs it to find
 369         the private key. Although issuer name and certificate should be sufficient to identify
 370         the certificate the implementation in XMLSec is broken, both for Windows and mozilla.
 371         The reason is that they use functions to find the certificate which take as parameter
 372         the DER encoded ASN.1 issuer name. The issuer name is a DName, where most attributes
 373         are of type DirectoryName, which is a choice of 5 string types. This information is
 374         not contained in the issuer string and while it is converted to the ASN.1 name the
 375         conversion function must assume a particular type, which is often wrong. For example,
 376         the Windows function CertStrToName will use a T.61 string if the string does not contain
 377         special characters. So if the certificate uses simple characters but encodes the
 378         issuer attributes in Utf8, then CertStrToName will use T.61. The resulting DER encoded
 379         ASN.1 name now contains different bytes which indicate the string type. The functions
 380         for finding the certificate apparently use memcmp - hence they fail to find the
 381         certificate.
 382      */
 383     void setX509Certificate(
 384         sal_Int32 nSecurityId,
 385         const OUString& ouX509IssuerName,
 386         const OUString& ouX509SerialNumber,
 387         const OUString& ouX509Cert,
 388         const OUString& ouX509CertDigest);
 389
 390     void addEncapsulatedX509Certificate(const OUString& rEncapsulatedX509Certificate);
 391
 392     void setGpgCertificate(
 393         sal_Int32 nSecurityId,
 394         const OUString& ouCertDigest,
 395         const OUString& ouCert,
 396         const OUString& ouOwner);
 397
 398     void setDate(
 399         sal_Int32 nSecurityId,
 400         const css::util::DateTime& rDateTime );
 401     void setDescription(sal_Int32 nSecurityId, const OUString& rDescription);
 402
 403     bool WriteSignature(
 404         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
 405         bool bXAdESCompliantIfODF);
 406
 407     /*
 408      * For signature verification
 409      */
 410     void collectToVerify( const OUString& referenceId );
 411     void addSignature( sal_Int32 nSignatureId );
 412     css::uno::Reference< css::xml::sax::XDocumentHandler > const & createSignatureReader(XMLSignatureHelper& rXMLSignatureHelper, sal_Int32 nType = 0);
 413     void releaseSignatureReader();
 414
 415 public:
 416     /* Interface methods */
 417
 418     /*
 419      * XSAXEventKeeperStatusChangeListener
 420      */
 421     virtual void SAL_CALL blockingStatusChanged( sal_Bool isBlocking ) override;
 422     virtual void SAL_CALL collectionStatusChanged(
 423         sal_Bool isInsideCollectedElement ) override;
 424     virtual void SAL_CALL bufferStatusChanged( sal_Bool isBufferEmpty ) override;
 425
 426     /*
 427      * XSignatureCreationResultListener
 428      */
 429     virtual void SAL_CALL signatureCreated( sal_Int32 securityId, css::xml::crypto::SecurityOperationStatus nResult ) override;
 430
 431     /*
 432      * XSignatureVerifyResultListener
 433      */
 434     virtual void SAL_CALL signatureVerified( sal_Int32 securityId, css::xml::crypto::SecurityOperationStatus nResult ) override;
 435
 436     /// Writes XML elements inside a single OOXML signature's <Signature> element.
 437     bool WriteOOXMLSignature(const css::uno::Reference<css::embed::XStorage>& xRootStorage, const css::uno::Reference<css::xml::sax::XDocumentHandler>& xDocumentHandler);
 438     /// Exports an OOXML signature, called by WriteOOXMLSignature().
 439     void exportOOXMLSignature(const css::uno::Reference<css::embed::XStorage>& xRootStorage, const css::uno::Reference<css::xml::sax::XDocumentHandler>& xDocumentHandler, const SignatureInformation& rInformation);
 440 };
 441
 442 #endif
 443
 444 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */