diff options
Diffstat (limited to 'docs/api/xmlsec-verify-with-restrictions.html')
-rw-r--r-- | docs/api/xmlsec-verify-with-restrictions.html | 127 |
1 files changed, 55 insertions, 72 deletions
diff --git a/docs/api/xmlsec-verify-with-restrictions.html b/docs/api/xmlsec-verify-with-restrictions.html index b910c137..0350798f 100644 --- a/docs/api/xmlsec-verify-with-restrictions.html +++ b/docs/api/xmlsec-verify-with-restrictions.html @@ -103,15 +103,15 @@ * certificates management policies for another crypto library may break it. * * Usage: - * verify4 <signed-file> <trusted-cert-pem-file1> [<trusted-cert-pem-file2> [...]] + * verify4 <signed-file> <trusted-cert-pem-file1> [<trusted-cert-pem-file2> [...]] * * Example (sucecess): - * ./verify4 verify4-res.xml rootcert.pem + * ./verify4 verify4-res.xml rootcert.pem * * Example (failure): - * ./verify4 verify4-bad-res.xml rootcert.pem + * ./verify4 verify4-bad-res.xml rootcert.pem * In the same time, verify3 example successfuly verifies this signature: - * ./verify3 verify4-bad-res.xml rootcert.pem + * ./verify3 verify4-bad-res.xml rootcert.pem * * This is free software; see Copyright file in the source * distribution for preciese wording. @@ -128,7 +128,6 @@ #ifndef XMLSEC_NO_XSLT #include <libxslt/xslt.h> -#include <libxslt/security.h> #endif /* XMLSEC_NO_XSLT */ #include <xmlsec/xmlsec.h> @@ -141,17 +140,14 @@ int verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file); int main(int argc, char **argv) { -#ifndef XMLSEC_NO_XSLT - xsltSecurityPrefsPtr xsltSecPrefs = NULL; -#endif /* XMLSEC_NO_XSLT */ xmlSecKeysMngrPtr mngr; assert(argv); if(argc < 3) { - fprintf(stderr, "Error: wrong number of arguments.\n"); - fprintf(stderr, "Usage: %s <xml-file> <cert-file1> [<cert-file2> [...]]\n", argv[0]); - return(1); + fprintf(stderr, "Error: wrong number of arguments.\n"); + fprintf(stderr, "Usage: %s <xml-file> <cert-file1> [<cert-file2> [...]]\n", argv[0]); + return(1); } /* Init libxml and libxslt libraries */ @@ -162,29 +158,17 @@ main(int argc, char **argv) { #ifndef XMLSEC_NO_XSLT xmlIndentTreeOutput = 1; #endif /* XMLSEC_NO_XSLT */ - - /* Init libxslt */ -#ifndef XMLSEC_NO_XSLT - /* disable everything */ - xsltSecPrefs = xsltNewSecurityPrefs(); - xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityForbid); - xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_FILE, xsltSecurityForbid); - xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_CREATE_DIRECTORY, xsltSecurityForbid); - xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_NETWORK, xsltSecurityForbid); - xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_NETWORK, xsltSecurityForbid); - xsltSetDefaultSecurityPrefs(xsltSecPrefs); -#endif /* XMLSEC_NO_XSLT */ - + /* Init xmlsec library */ if(xmlSecInit() < 0) { - fprintf(stderr, "Error: xmlsec initialization failed.\n"); - return(-1); + fprintf(stderr, "Error: xmlsec initialization failed.\n"); + return(-1); } /* Check loaded library version */ if(xmlSecCheckVersion() != 1) { - fprintf(stderr, "Error: loaded xmlsec library version is not compatible.\n"); - return(-1); + fprintf(stderr, "Error: loaded xmlsec library version is not compatible.\n"); + return(-1); } /* Load default crypto engine if we are supporting dynamic @@ -194,35 +178,35 @@ main(int argc, char **argv) { */ #ifdef XMLSEC_CRYPTO_DYNAMIC_LOADING if(xmlSecCryptoDLLoadLibrary(BAD_CAST XMLSEC_CRYPTO) < 0) { - fprintf(stderr, "Error: unable to load default xmlsec-crypto library. Make sure\n" - "that you have it installed and check shared libraries path\n" - "(LD_LIBRARY_PATH) envornment variable.\n"); - return(-1); + fprintf(stderr, "Error: unable to load default xmlsec-crypto library. Make sure\n" + "that you have it installed and check shared libraries path\n" + "(LD_LIBRARY_PATH) envornment variable.\n"); + return(-1); } #endif /* XMLSEC_CRYPTO_DYNAMIC_LOADING */ /* Init crypto library */ if(xmlSecCryptoAppInit(NULL) < 0) { - fprintf(stderr, "Error: crypto initialization failed.\n"); - return(-1); + fprintf(stderr, "Error: crypto initialization failed.\n"); + return(-1); } /* Init xmlsec-crypto library */ if(xmlSecCryptoInit() < 0) { - fprintf(stderr, "Error: xmlsec-crypto initialization failed.\n"); - return(-1); + fprintf(stderr, "Error: xmlsec-crypto initialization failed.\n"); + return(-1); } /* create keys manager and load trusted certificates */ mngr = load_trusted_certs(&(argv[2]), argc - 2); if(mngr == NULL) { - return(-1); + return(-1); } /* verify file */ if(verify_file(mngr, argv[1]) < 0) { - xmlSecKeysMngrDestroy(mngr); - return(-1); + xmlSecKeysMngrDestroy(mngr); + return(-1); } /* destroy keys manager */ @@ -239,7 +223,6 @@ main(int argc, char **argv) { /* Shutdown libxslt/libxml */ #ifndef XMLSEC_NO_XSLT - xsltFreeSecurityPrefs(xsltSecPrefs); xsltCleanupGlobals(); #endif /* XMLSEC_NO_XSLT */ xmlCleanupParser(); @@ -249,8 +232,8 @@ main(int argc, char **argv) { /** * load_trusted_certs: - * @files: the list of filenames. - * @files_size: the number of filenames in #files. + * @files: the list of filenames. + * @files_size: the number of filenames in #files. * * Creates simple keys manager and load trusted certificates from PEM #files. * The caller is responsible for destroing returned keys manager using @@ -273,24 +256,24 @@ load_trusted_certs(char** files, int files_size) { */ mngr = xmlSecKeysMngrCreate(); if(mngr == NULL) { - fprintf(stderr, "Error: failed to create keys manager.\n"); - return(NULL); + fprintf(stderr, "Error: failed to create keys manager.\n"); + return(NULL); } if(xmlSecCryptoAppDefaultKeysMngrInit(mngr) < 0) { - fprintf(stderr, "Error: failed to initialize keys manager.\n"); - xmlSecKeysMngrDestroy(mngr); - return(NULL); + fprintf(stderr, "Error: failed to initialize keys manager.\n"); + xmlSecKeysMngrDestroy(mngr); + return(NULL); } for(i = 0; i < files_size; ++i) { - assert(files[i]); - - /* load trusted cert */ - if(xmlSecCryptoAppKeysMngrCertLoad(mngr, files[i], xmlSecKeyDataFormatPem, xmlSecKeyDataTypeTrusted) < 0) { - fprintf(stderr,"Error: failed to load pem certificate from \"%s\"\n", files[i]); - xmlSecKeysMngrDestroy(mngr); - return(NULL); - } + assert(files[i]); + + /* load trusted cert */ + if(xmlSecCryptoAppKeysMngrCertLoad(mngr, files[i], xmlSecKeyDataFormatPem, xmlSecKeyDataTypeTrusted) < 0) { + fprintf(stderr,"Error: failed to load pem certificate from \"%s\"\n", files[i]); + xmlSecKeysMngrDestroy(mngr); + return(NULL); + } } return(mngr); @@ -298,8 +281,8 @@ load_trusted_certs(char** files, int files_size) { /** * verify_file: - * @mngr: the pointer to keys manager. - * @xml_file: the signed XML file name. + * @mngr: the pointer to keys manager. + * @xml_file: the signed XML file name. * * Verifies XML signature in #xml_file. * @@ -318,22 +301,22 @@ verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file) { /* load file */ doc = xmlParseFile(xml_file); if ((doc == NULL) || (xmlDocGetRootElement(doc) == NULL)){ - fprintf(stderr, "Error: unable to parse file \"%s\"\n", xml_file); - goto done; + fprintf(stderr, "Error: unable to parse file \"%s\"\n", xml_file); + goto done; } /* find start node */ node = xmlSecFindNode(xmlDocGetRootElement(doc), xmlSecNodeSignature, xmlSecDSigNs); if(node == NULL) { - fprintf(stderr, "Error: start node not found in \"%s\"\n", xml_file); - goto done; + fprintf(stderr, "Error: start node not found in \"%s\"\n", xml_file); + goto done; } /* create signature context */ dsigCtx = xmlSecDSigCtxCreate(mngr); if(dsigCtx == NULL) { fprintf(stderr,"Error: failed to create signature context\n"); - goto done; + goto done; } /* limit the Reference URI attributes to empty or NULL */ @@ -346,7 +329,7 @@ verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file) { (xmlSecDSigCtxEnableSignatureTransform(dsigCtx, xmlSecTransformRsaSha1Id) < 0)) { fprintf(stderr,"Error: failed to limit allowed siganture transforms\n"); - goto done; + goto done; } if((xmlSecDSigCtxEnableReferenceTransform(dsigCtx, xmlSecTransformInclC14NId) < 0) || (xmlSecDSigCtxEnableReferenceTransform(dsigCtx, xmlSecTransformExclC14NId) < 0) || @@ -354,34 +337,34 @@ verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file) { (xmlSecDSigCtxEnableReferenceTransform(dsigCtx, xmlSecTransformEnvelopedId) < 0)) { fprintf(stderr,"Error: failed to limit allowed reference transforms\n"); - goto done; + goto done; } /* in addition, limit possible key data to valid X509 certificates only */ if(xmlSecPtrListAdd(&(dsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecKeyDataX509Id) < 0) { fprintf(stderr,"Error: failed to limit allowed key data\n"); - goto done; + goto done; } /* Verify signature */ if(xmlSecDSigCtxVerify(dsigCtx, node) < 0) { fprintf(stderr,"Error: signature verify\n"); - goto done; + goto done; } /* check that we have only one Reference */ if((dsigCtx->status == xmlSecDSigStatusSucceeded) && (xmlSecPtrListGetSize(&(dsigCtx->signedInfoReferences)) != 1)) { - + fprintf(stderr,"Error: only one reference is allowed\n"); - goto done; + goto done; } /* print verification result to stdout */ if(dsigCtx->status == xmlSecDSigStatusSucceeded) { - fprintf(stdout, "Signature is OK\n"); + fprintf(stdout, "Signature is OK\n"); } else { - fprintf(stdout, "Signature is INVALID\n"); + fprintf(stdout, "Signature is INVALID\n"); } /* success */ @@ -390,11 +373,11 @@ verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file) { done: /* cleanup */ if(dsigCtx != NULL) { - xmlSecDSigCtxDestroy(dsigCtx); + xmlSecDSigCtxDestroy(dsigCtx); } if(doc != NULL) { - xmlFreeDoc(doc); + xmlFreeDoc(doc); } return(res); } |