/*
* Copyright (c) 2007-2013, Oracle and/or its affiliates. All rights reserved.
* ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
*/
/*
* Copyright 1999-2004 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package com.sun.org.apache.xml.internal.security.signature;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.OutputStream;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.XMLConstants;
import javax.xml.parsers.ParserConfigurationException;
import com.sun.org.apache.xml.internal.security.algorithms.SignatureAlgorithm;
import com.sun.org.apache.xml.internal.security.c14n.CanonicalizationException;
import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;
import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;
import com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException;
import com.sun.org.apache.xml.internal.security.utils.Constants;
import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
import com.sun.org.apache.xml.internal.security.transforms.params.InclusiveNamespaces;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.xml.sax.SAXException;
/**
* Handles <code><ds:SignedInfo></code> elements
* This <code>SignedInfo<code> element includes the canonicalization algorithm,
* a signature algorithm, and one or more references.
*
* @author Christian Geuer-Pollmann
*/
public class SignedInfo extends Manifest {
/** Field _signatureAlgorithm */
private SignatureAlgorithm _signatureAlgorithm = null;
/** Field _c14nizedBytes */
private byte[] _c14nizedBytes = null;
private Element c14nMethod;
private Element signatureMethod;
/**
* Overwrites {@link Manifest#addDocument} because it creates another
* Element.
*
* @param doc the {@link Document} in which <code>XMLsignature</code> will
* be placed
* @throws XMLSecurityException
*/
public SignedInfo(Document doc) throws XMLSecurityException {
this(doc, XMLSignature.ALGO_ID_SIGNATURE_DSA,
Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS);
}
/**
* Constructs {@link SignedInfo} using given Canonicalization algorithm and
* Signature algorithm.
*
* @param doc <code>SignedInfo</code> is placed in this document
* @param signatureMethodURI URI representation of the Digest and
* Signature algorithm
* @param canonicalizationMethodURI URI representation of the
* Canonicalization method
* @throws XMLSecurityException
*/
public SignedInfo(Document doc, String signatureMethodURI,
String canonicalizationMethodURI)
throws XMLSecurityException {
this(doc, signatureMethodURI, 0, canonicalizationMethodURI);
}
/**
* Constructor SignedInfo
*
* @param doc <code>SignedInfo</code> is placed in this document
* @param signatureMethodURI URI representation of the Digest and
* Signature algorithm
* @param hMACOutputLength
* @param canonicalizationMethodURI URI representation of the
* Canonicalization method
* @throws XMLSecurityException
*/
public SignedInfo(Document doc, String signatureMethodURI,
int hMACOutputLength, String canonicalizationMethodURI)
throws XMLSecurityException {
super(doc);
c14nMethod = XMLUtils.createElementInSignatureSpace(this._doc,
Constants._TAG_CANONICALIZATIONMETHOD);
c14nMethod.setAttributeNS(null, Constants._ATT_ALGORITHM,
canonicalizationMethodURI);
this._constructionElement.appendChild(c14nMethod);
XMLUtils.addReturnToElement(this._constructionElement);
if (hMACOutputLength > 0) {
this._signatureAlgorithm = new SignatureAlgorithm(this._doc,
signatureMethodURI, hMACOutputLength);
} else {
this._signatureAlgorithm = new SignatureAlgorithm(this._doc,
signatureMethodURI);
}
signatureMethod = this._signatureAlgorithm.getElement();
this._constructionElement.appendChild(signatureMethod);
XMLUtils.addReturnToElement(this._constructionElement);
}
/**
* @param doc
* @param signatureMethodElem
* @param canonicalizationMethodElem
* @throws XMLSecurityException
*/
public SignedInfo(Document doc, Element signatureMethodElem,
Element canonicalizationMethodElem) throws XMLSecurityException {
super(doc);
// Check this?
this.c14nMethod = canonicalizationMethodElem;
this._constructionElement.appendChild(c14nMethod);
XMLUtils.addReturnToElement(this._constructionElement);
this._signatureAlgorithm =
new SignatureAlgorithm(signatureMethodElem, null);
signatureMethod = this._signatureAlgorithm.getElement();
this._constructionElement.appendChild(signatureMethod);
XMLUtils.addReturnToElement(this._constructionElement);
}
/**
* Build a {@link SignedInfo} from an {@link Element}
*
* @param element <code>SignedInfo</code>
* @param baseURI the URI of the resource where the XML instance was stored
* @throws XMLSecurityException
* @see <A HREF="http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2001OctDec/0033.html">Question</A>
* @see <A HREF="http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2001OctDec/0054.html">Answer</A>
*/
public SignedInfo(Element element, String baseURI)
throws XMLSecurityException {
// Parse the Reference children and Id attribute in the Manifest
super(element, baseURI);
/* canonicalize ds:SignedInfo, reparse it into a new document
* and replace the original not-canonicalized ds:SignedInfo by
* the re-parsed canonicalized one.
*/
c14nMethod = XMLUtils.getNextElement(element.getFirstChild());
String c14nMethodURI = this.getCanonicalizationMethodURI();
if (!(c14nMethodURI.equals(Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS) ||
c14nMethodURI.equals(Canonicalizer.ALGO_ID_C14N_WITH_COMMENTS) ||
c14nMethodURI.equals(Canonicalizer.ALGO_ID_C14N_EXCL_OMIT_COMMENTS) ||
c14nMethodURI.equals(Canonicalizer.ALGO_ID_C14N_EXCL_WITH_COMMENTS))) {
// the c14n is not a secure one and can rewrite the URIs or like
// that reparse the SignedInfo to be sure
try {
Canonicalizer c14nizer =
Canonicalizer.getInstance(this.getCanonicalizationMethodURI());
this._c14nizedBytes =
c14nizer.canonicalizeSubtree(this._constructionElement);
javax.xml.parsers.DocumentBuilderFactory dbf =
javax.xml.parsers.DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
Document newdoc =
db.parse(new ByteArrayInputStream(this._c14nizedBytes));
Node imported =
this._doc.importNode(newdoc.getDocumentElement(), true);
this._constructionElement.getParentNode().replaceChild(imported,
this._constructionElement);
this._constructionElement = (Element) imported;
} catch (ParserConfigurationException ex) {
throw new XMLSecurityException("empty", ex);
} catch (IOException ex) {
throw new XMLSecurityException("empty", ex);
} catch (SAXException ex) {
throw new XMLSecurityException("empty", ex);
}
}
signatureMethod = XMLUtils.getNextElement(c14nMethod.getNextSibling());
this._signatureAlgorithm =
new SignatureAlgorithm(signatureMethod, this.getBaseURI());
}
/**
* Tests core validation process
*
* @return true if verification was successful
* @throws MissingResourceFailureException
* @throws XMLSecurityException
*/
public boolean verify()
throws MissingResourceFailureException, XMLSecurityException {
return super.verifyReferences(false);
}
/**
* Tests core validation process
*
* @param followManifests defines whether the verification process has to verify referenced <CODE>ds:Manifest</CODE>s, too
* @return true if verification was successful
* @throws MissingResourceFailureException
* @throws XMLSecurityException
*/
public boolean verify(boolean followManifests)
throws MissingResourceFailureException, XMLSecurityException {
return super.verifyReferences(followManifests);
}
/**
* Returns getCanonicalizedOctetStream
*
* @return the canonicalization result octedt stream of <code>SignedInfo</code> element
* @throws CanonicalizationException
* @throws InvalidCanonicalizerException
* @throws XMLSecurityException
*/
public byte[] getCanonicalizedOctetStream()
throws CanonicalizationException, InvalidCanonicalizerException,
XMLSecurityException {
if ((this._c14nizedBytes == null)
/*&& (this._state == ElementProxy.MODE_SIGN)*/) {
Canonicalizer c14nizer =
Canonicalizer.getInstance(this.getCanonicalizationMethodURI());
this._c14nizedBytes =
c14nizer.canonicalizeSubtree(this._constructionElement);
}
// make defensive copy
byte[] output = new byte[this._c14nizedBytes.length];
System.arraycopy(this._c14nizedBytes, 0, output, 0, output.length);
return output;
}
/**
* Output the C14n stream to the give outputstream.
* @param os
* @throws CanonicalizationException
* @throws InvalidCanonicalizerException
* @throws XMLSecurityException
*/
public void signInOctectStream(OutputStream os)
throws CanonicalizationException, InvalidCanonicalizerException,
XMLSecurityException {
if ((this._c14nizedBytes == null)) {
Canonicalizer c14nizer =
Canonicalizer.getInstance(this.getCanonicalizationMethodURI());
c14nizer.setWriter(os);
String inclusiveNamespaces = this.getInclusiveNamespaces();
if(inclusiveNamespaces == null)
c14nizer.canonicalizeSubtree(this._constructionElement);
else
c14nizer.canonicalizeSubtree(this._constructionElement, inclusiveNamespaces);
} else {
try {
os.write(this._c14nizedBytes);
} catch (IOException e) {
throw new RuntimeException(""+e);
}
}
}
/**
* Returns the Canonicalization method URI
*
* @return the Canonicalization method URI
*/
public String getCanonicalizationMethodURI() {
return c14nMethod.getAttributeNS(null, Constants._ATT_ALGORITHM);
}
/**
* Returns the Signature method URI
*
* @return the Signature method URI
*/
public String getSignatureMethodURI() {
Element signatureElement = this.getSignatureMethodElement();
if (signatureElement != null) {
return signatureElement.getAttributeNS(null, Constants._ATT_ALGORITHM);
}
return null;
}
/**
* Method getSignatureMethodElement
* @return gets The SignatureMethod Node.
*
*/
public Element getSignatureMethodElement() {
return signatureMethod;
}
/**
* Creates a SecretKey for the appropriate Mac algorithm based on a
* byte[] array password.
*
* @param secretKeyBytes
* @return the secret key for the SignedInfo element.
*/
public SecretKey createSecretKey(byte[] secretKeyBytes)
{
return new SecretKeySpec(secretKeyBytes,
this._signatureAlgorithm
.getJCEAlgorithmString());
}
protected SignatureAlgorithm getSignatureAlgorithm() {
return _signatureAlgorithm;
}
/**
* Method getBaseLocalName
* @inheritDoc
*
*/
public String getBaseLocalName() {
return Constants._TAG_SIGNEDINFO;
}
public String getInclusiveNamespaces() {
String c14nMethodURI = c14nMethod.getAttributeNS(null, Constants._ATT_ALGORITHM);
if(!(c14nMethodURI.equals("http://www.w3.org/2001/10/xml-exc-c14n#") ||
c14nMethodURI.equals("http://www.w3.org/2001/10/xml-exc-c14n#WithComments"))) {
return null;
}
Element inclusiveElement = XMLUtils.getNextElement(
c14nMethod.getFirstChild());
if(inclusiveElement != null)
{
try
{
String inclusiveNamespaces = new InclusiveNamespaces(inclusiveElement,
InclusiveNamespaces.ExclusiveCanonicalizationNamespace).getInclusiveNamespaces();
return inclusiveNamespaces;
}
catch (XMLSecurityException e)
{
return null;
}
}
return null;
}
}