nokogiri-xmlsec-instructure 0.10.3 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/ext/nokogiri_ext_xmlsec/extconf.rb +8 -16
- data/lib/nokogiri-xmlsec.rb +3 -1
- data/lib/nokogiri_ext_xmlsec.bundle +0 -0
- data/lib/xmlsec/version.rb +3 -1
- data/lib/xmlsec.rb +99 -88
- metadata +11 -181
- data/.github/workflows/push.yml +0 -40
- data/.gitignore +0 -23
- data/.rspec +0 -2
- data/.tool-versions +0 -1
- data/Appraisals +0 -9
- data/Gemfile +0 -4
- data/Guardfile +0 -13
- data/LICENSE.txt +0 -22
- data/README.md +0 -132
- data/Rakefile +0 -30
- data/ext/nokogiri_ext_xmlsec/common.h +0 -13
- data/ext/nokogiri_ext_xmlsec/init.c +0 -71
- data/ext/nokogiri_ext_xmlsec/nokogiri_decrypt_with_key.c +0 -84
- data/ext/nokogiri_ext_xmlsec/nokogiri_encrypt_with_key.c +0 -210
- data/ext/nokogiri_ext_xmlsec/nokogiri_helpers_set_attribute_id.c +0 -93
- data/ext/nokogiri_ext_xmlsec/nokogiri_init.c +0 -30
- data/ext/nokogiri_ext_xmlsec/nokogiri_sign.c +0 -254
- data/ext/nokogiri_ext_xmlsec/nokogiri_verify_with.c +0 -261
- data/ext/nokogiri_ext_xmlsec/options.c +0 -166
- data/ext/nokogiri_ext_xmlsec/options.h +0 -36
- data/ext/nokogiri_ext_xmlsec/shutdown.c +0 -12
- data/ext/nokogiri_ext_xmlsec/util.c +0 -140
- data/ext/nokogiri_ext_xmlsec/util.h +0 -42
- data/ext/nokogiri_ext_xmlsec/xmlsecrb.h +0 -49
- data/gemfiles/nokogiri_12.5.gemfile +0 -7
- data/gemfiles/nokogiri_13.10.gemfile +0 -7
- data/nokogiri-xmlsec-instructure.gemspec +0 -41
- data/spec/fixtures/cert/server.crt +0 -14
- data/spec/fixtures/cert/server.csr +0 -11
- data/spec/fixtures/cert/server.key.decrypted +0 -15
- data/spec/fixtures/cert/server.key.encrypted +0 -18
- data/spec/fixtures/hate.xml +0 -7
- data/spec/fixtures/pwned.xml +0 -1
- data/spec/fixtures/rsa.pem +0 -15
- data/spec/fixtures/rsa.pub +0 -6
- data/spec/fixtures/sign2-doc.xml +0 -6
- data/spec/fixtures/sign2-result.xml +0 -25
- data/spec/fixtures/sign3-result.xml +0 -39
- data/spec/lib/nokogiri/xml/document/encryption_and_decryption_spec.rb +0 -55
- data/spec/lib/nokogiri/xml/document/signing_and_verifying_spec.rb +0 -122
- data/spec/lib/nokogiri/xml/document/unsafe_xml_spec.rb +0 -61
- data/spec/spec_helper.rb +0 -10
data/README.md
DELETED
@@ -1,132 +0,0 @@
|
|
1
|
-
# nokogiri-xmlsec
|
2
|
-
|
3
|
-
[](https://travis-ci.org/omb-awong/xmlsec)
|
4
|
-
|
5
|
-
Adds support to Ruby for encrypting, decrypting, signing and validating
|
6
|
-
the signatures of XML documents, according to the [XML Encryption Syntax and
|
7
|
-
Processing](http://www.w3.org/TR/xmlenc-core/) standard, by wrapping around the
|
8
|
-
[xmlsec](http://www.aleksey.com/xmlsec) C library and adding relevant methods
|
9
|
-
to `Nokogiri::XML::Document`.
|
10
|
-
|
11
|
-
## Installation
|
12
|
-
|
13
|
-
Install this before attempting to install; or else it may fail (tested on CentOS 7) while trying to find -lltdl from the xmlsec1-openssl lib. I'm guessing it's a dependency. Someone else may know more.
|
14
|
-
|
15
|
-
# CentOS/RHEL
|
16
|
-
yum install libtool-ltdl-devel
|
17
|
-
|
18
|
-
# Debian/Ubuntu
|
19
|
-
apt install -y libxmlsec1-dev
|
20
|
-
|
21
|
-
Add this line to your application's Gemfile:
|
22
|
-
|
23
|
-
gem 'nokogiri-xmlsec'
|
24
|
-
|
25
|
-
And then execute:
|
26
|
-
|
27
|
-
$ bundle
|
28
|
-
|
29
|
-
Or install it yourself as:
|
30
|
-
|
31
|
-
$ gem install nokogiri-xmlsec
|
32
|
-
|
33
|
-
## Usage
|
34
|
-
|
35
|
-
Several methods are added to `Nokogiri::XML::Document` which expose this gem's
|
36
|
-
functionality.
|
37
|
-
|
38
|
-
### Signing
|
39
|
-
|
40
|
-
The `sign!` method adds a digital signature to the XML document so that it can
|
41
|
-
later be determined whether the document itself has been tampered with. If the
|
42
|
-
document changes, the signature will be invalid.
|
43
|
-
|
44
|
-
Signing a document will add XML nodes directly to the document itself, and
|
45
|
-
then returns itself.
|
46
|
-
|
47
|
-
# First, get an XML document
|
48
|
-
doc = Nokogiri::XML("<doc><greeting>Hello, World!</greeting></doc>")
|
49
|
-
|
50
|
-
# Sign the document with a certificate, a key, and a key name
|
51
|
-
doc.sign! cert: 'certificate data',
|
52
|
-
key: 'private key data',
|
53
|
-
name: 'private key name',
|
54
|
-
digest_alg: 'sha256',
|
55
|
-
signature_alg: 'rsa-sha256'
|
56
|
-
|
57
|
-
If you pass `cert`, the certificate will be included as part of the signature,
|
58
|
-
so that it can be later verified by certificate instead of by key.
|
59
|
-
|
60
|
-
`name` can be used to verify the signature with any of a set of keys, as in the
|
61
|
-
following example:
|
62
|
-
|
63
|
-
### Signature verification
|
64
|
-
|
65
|
-
Verification of signatures always returns `true` if successful, `false`
|
66
|
-
otherwise.
|
67
|
-
|
68
|
-
# Verify the document's signature to ensure it has not been tampered with
|
69
|
-
doc.verify_with({
|
70
|
-
'key-name-1' => 'public key contents',
|
71
|
-
'key-name-2' => 'another public key content'
|
72
|
-
})
|
73
|
-
|
74
|
-
In the above example, the `name` field from the signing process will be used
|
75
|
-
to determine which key to validate with. If you plan to always verify with the
|
76
|
-
same key, you can do it like so, effectively ignoring the `name` value:
|
77
|
-
|
78
|
-
# Verify the document's signature with a specific key
|
79
|
-
doc.verify_with key: 'public key contents'
|
80
|
-
|
81
|
-
Finally, you can also verify with a certificate:
|
82
|
-
|
83
|
-
# Verify the document's signature with a single certificate
|
84
|
-
doc.verify_with cert: 'certificate data'
|
85
|
-
|
86
|
-
# Verify the document's signature with multiple certificates. Any one match
|
87
|
-
# will pass verification.
|
88
|
-
doc.verify_with certs: [ 'cert1', 'cert2', 'cert3' ]
|
89
|
-
|
90
|
-
If the certificate has been installed to your system certificates, then you can
|
91
|
-
verify signatures like so:
|
92
|
-
|
93
|
-
# Verify with installed CA certificates
|
94
|
-
doc.verify_signature
|
95
|
-
|
96
|
-
### Encryption & Decryption
|
97
|
-
|
98
|
-
Encrypted documents can only be decrypted with the private key that corresponds
|
99
|
-
to the public key that was used to encrypt it. Thus, the party that encrypted
|
100
|
-
the document can be sure that the document will only be readable by its intended
|
101
|
-
recipient.
|
102
|
-
|
103
|
-
Both encryption and decryption of a document manipulates the XML nodes of the
|
104
|
-
document in-place. Both methods return the original document, after the changes
|
105
|
-
have been made to it.
|
106
|
-
|
107
|
-
To encrypt a document, use a public key:
|
108
|
-
|
109
|
-
doc.encrypt! key: 'public key content'
|
110
|
-
|
111
|
-
To decrypt a document, use a private key:
|
112
|
-
|
113
|
-
doc.decrypt! key: 'private key content'
|
114
|
-
|
115
|
-
|
116
|
-
## Limitations and Known Issues
|
117
|
-
|
118
|
-
Following is a list of limitations and/or issues I know about, but have no
|
119
|
-
immediate plan to resolve. This is probably because I haven't needed the
|
120
|
-
functionality, and no one has sent a pull request. (Hint, hint!)
|
121
|
-
|
122
|
-
- Currently, it is not possible to encrypt/decrypt individual XML nodes. The
|
123
|
-
`nokogiri-xmlsec` operations must be performed on the entire document.
|
124
|
-
You _can_ sign an individual node.
|
125
|
-
|
126
|
-
## Contributing
|
127
|
-
|
128
|
-
1. Fork it
|
129
|
-
2. Create your feature branch (`git checkout -b my-new-feature`)
|
130
|
-
3. Commit your changes (`git commit -am 'Add some feature'`)
|
131
|
-
4. Push to the branch (`git push origin my-new-feature`)
|
132
|
-
5. Create new Pull Request
|
data/Rakefile
DELETED
@@ -1,30 +0,0 @@
|
|
1
|
-
require "bundler/gem_tasks"
|
2
|
-
require 'rake/extensiontask'
|
3
|
-
require 'rspec/core/rake_task'
|
4
|
-
|
5
|
-
Rake::ExtensionTask.new('nokogiri_ext_xmlsec')
|
6
|
-
|
7
|
-
RSpec::Core::RakeTask.new :rspec
|
8
|
-
|
9
|
-
desc 'clean out build files'
|
10
|
-
task :clean do
|
11
|
-
rm_rf File.expand_path('../tmp', __FILE__)
|
12
|
-
end
|
13
|
-
|
14
|
-
task :default => [:clean, :compile, :rspec]
|
15
|
-
|
16
|
-
desc 'code statistics, cause im a stats junky'
|
17
|
-
task :stats do
|
18
|
-
def count(glob)
|
19
|
-
Dir[glob].inject(0) do |count, fi|
|
20
|
-
next unless File.file?(fi)
|
21
|
-
count + File.read(fi).lines.length
|
22
|
-
end
|
23
|
-
end
|
24
|
-
|
25
|
-
rb_lines = count 'lib/**/*.rb'
|
26
|
-
c_lines = count 'ext/**/*.{c,h}'
|
27
|
-
|
28
|
-
puts "Lines of Ruby: #{rb_lines}"
|
29
|
-
puts "Lines of C: #{c_lines}"
|
30
|
-
end
|
@@ -1,71 +0,0 @@
|
|
1
|
-
#include "xmlsecrb.h"
|
2
|
-
#include "util.h"
|
3
|
-
|
4
|
-
#include <xmlsec/dl.h>
|
5
|
-
#include <xmlsec/errors.h>
|
6
|
-
|
7
|
-
#ifndef XMLSEC_NO_XSLT
|
8
|
-
#include <libxslt/xslt.h>
|
9
|
-
#include <libxslt/security.h>
|
10
|
-
#endif /* XMLSEC_NO_XSLT */
|
11
|
-
|
12
|
-
EXTENSION_EXPORT
|
13
|
-
void Init_nokogiri_ext_xmlsec() {
|
14
|
-
#ifndef XMLSEC_NO_XSLT
|
15
|
-
xsltSecurityPrefsPtr xsltSecPrefs = NULL;
|
16
|
-
#endif /* XMLSEC_NO_XSLT */
|
17
|
-
|
18
|
-
/* xmlsec proper */
|
19
|
-
// libxml
|
20
|
-
xmlInitParser();
|
21
|
-
LIBXML_TEST_VERSION
|
22
|
-
xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS;
|
23
|
-
// xslt
|
24
|
-
|
25
|
-
#ifndef XMLSEC_NO_XSLT
|
26
|
-
xmlIndentTreeOutput = 1;
|
27
|
-
|
28
|
-
/* Disable all XSLT options that give filesystem and network access. */
|
29
|
-
xsltSecPrefs = xsltNewSecurityPrefs();
|
30
|
-
xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityForbid);
|
31
|
-
xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_FILE, xsltSecurityForbid);
|
32
|
-
xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_CREATE_DIRECTORY, xsltSecurityForbid);
|
33
|
-
xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_NETWORK, xsltSecurityForbid);
|
34
|
-
xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_NETWORK, xsltSecurityForbid);
|
35
|
-
xsltSetDefaultSecurityPrefs(xsltSecPrefs);
|
36
|
-
#endif /* XMLSEC_NO_XSLT */
|
37
|
-
|
38
|
-
// xmlsec
|
39
|
-
|
40
|
-
if (xmlSecInit() < 0) {
|
41
|
-
rb_raise(rb_eRuntimeError, "xmlsec initialization failed");
|
42
|
-
return;
|
43
|
-
}
|
44
|
-
if (xmlSecCheckVersion() != 1) {
|
45
|
-
rb_raise(rb_eRuntimeError, "xmlsec version is not compatible");
|
46
|
-
return;
|
47
|
-
}
|
48
|
-
// load crypto
|
49
|
-
#ifdef XMLSEC_CRYPTO_DYNAMIC_LOADING
|
50
|
-
if(xmlSecCryptoDLLoadLibrary(NULL) < 0) {
|
51
|
-
rb_raise(rb_eRuntimeError,
|
52
|
-
"Error: unable to load default xmlsec-crypto library. Make sure"
|
53
|
-
"that you have it installed and check shared libraries path\n"
|
54
|
-
"(LD_LIBRARY_PATH) envornment variable.\n");
|
55
|
-
return;
|
56
|
-
}
|
57
|
-
#endif /* XMLSEC_CRYPTO_DYNAMIC_LOADING */
|
58
|
-
// init crypto
|
59
|
-
if (xmlSecCryptoAppInit(NULL) < 0) {
|
60
|
-
rb_raise(rb_eRuntimeError, "unable to initialize crypto engine");
|
61
|
-
return;
|
62
|
-
}
|
63
|
-
// init xmlsec-crypto library
|
64
|
-
if (xmlSecCryptoInit() < 0) {
|
65
|
-
rb_raise(rb_eRuntimeError, "xmlsec-crypto initialization failed");
|
66
|
-
}
|
67
|
-
|
68
|
-
/* ruby classes & objects */
|
69
|
-
Init_Nokogiri_ext();
|
70
|
-
}
|
71
|
-
|
@@ -1,84 +0,0 @@
|
|
1
|
-
#include "xmlsecrb.h"
|
2
|
-
#include "util.h"
|
3
|
-
|
4
|
-
VALUE decrypt_with_key(VALUE self, VALUE rb_key_name, VALUE rb_key) {
|
5
|
-
VALUE rb_exception_result = Qnil;
|
6
|
-
const char* exception_message = NULL;
|
7
|
-
|
8
|
-
xmlNodePtr node = NULL;
|
9
|
-
xmlSecEncCtxPtr encCtx = NULL;
|
10
|
-
xmlSecKeysMngrPtr keyManager = NULL;
|
11
|
-
char *key = NULL;
|
12
|
-
char *keyName = NULL;
|
13
|
-
unsigned int keyLength = 0;
|
14
|
-
|
15
|
-
resetXmlSecError();
|
16
|
-
|
17
|
-
Check_Type(rb_key, T_STRING);
|
18
|
-
Check_Type(rb_key_name, T_STRING);
|
19
|
-
Noko_Node_Get_Struct(self, xmlNode, node);
|
20
|
-
key = RSTRING_PTR(rb_key);
|
21
|
-
keyLength = RSTRING_LEN(rb_key);
|
22
|
-
keyName = StringValueCStr(rb_key_name);
|
23
|
-
|
24
|
-
keyManager = createKeyManagerWithSingleKey(key, keyLength, keyName,
|
25
|
-
&rb_exception_result,
|
26
|
-
&exception_message);
|
27
|
-
if (keyManager == NULL) {
|
28
|
-
// Propagate the exception.
|
29
|
-
goto done;
|
30
|
-
}
|
31
|
-
|
32
|
-
// create encryption context
|
33
|
-
encCtx = xmlSecEncCtxCreate(keyManager);
|
34
|
-
if(encCtx == NULL) {
|
35
|
-
rb_exception_result = rb_eDecryptionError;
|
36
|
-
exception_message = "failed to create encryption context";
|
37
|
-
goto done;
|
38
|
-
}
|
39
|
-
// don't let xmlsec free the node we're looking at out from under us
|
40
|
-
encCtx->flags |= XMLSEC_ENC_RETURN_REPLACED_NODE;
|
41
|
-
|
42
|
-
// decrypt the data
|
43
|
-
if((xmlSecEncCtxDecrypt(encCtx, node) < 0) || (encCtx->result == NULL)) {
|
44
|
-
rb_exception_result = rb_eDecryptionError;
|
45
|
-
exception_message = "decryption failed";
|
46
|
-
goto done;
|
47
|
-
}
|
48
|
-
|
49
|
-
if(encCtx->resultReplaced == 0) {
|
50
|
-
rb_exception_result = rb_eDecryptionError;
|
51
|
-
exception_message = "Not implemented: don't know how to handle decrypted, non-XML data yet";
|
52
|
-
goto done;
|
53
|
-
}
|
54
|
-
|
55
|
-
done:
|
56
|
-
// cleanup
|
57
|
-
if(encCtx != NULL) {
|
58
|
-
// the replaced node is orphaned, but not freed; let Nokogiri
|
59
|
-
// own it now
|
60
|
-
if(encCtx->replacedNodeList != NULL) {
|
61
|
-
noko_xml_document_pin_node(encCtx->replacedNodeList);
|
62
|
-
// no really, please don't free it
|
63
|
-
encCtx->replacedNodeList = NULL;
|
64
|
-
}
|
65
|
-
xmlSecEncCtxDestroy(encCtx);
|
66
|
-
}
|
67
|
-
|
68
|
-
if (keyManager != NULL) {
|
69
|
-
xmlSecKeysMngrDestroy(keyManager);
|
70
|
-
}
|
71
|
-
|
72
|
-
xmlSecErrorsSetCallback(xmlSecErrorsDefaultCallback);
|
73
|
-
|
74
|
-
if(rb_exception_result != Qnil) {
|
75
|
-
if (hasXmlSecLastError()) {
|
76
|
-
rb_raise(rb_exception_result, "%s, XmlSec error: %s", exception_message,
|
77
|
-
getXmlSecLastError());
|
78
|
-
} else {
|
79
|
-
rb_raise(rb_exception_result, "%s", exception_message);
|
80
|
-
}
|
81
|
-
}
|
82
|
-
|
83
|
-
return Qnil;
|
84
|
-
}
|
@@ -1,210 +0,0 @@
|
|
1
|
-
#include "xmlsecrb.h"
|
2
|
-
#include "options.h"
|
3
|
-
#include "util.h"
|
4
|
-
|
5
|
-
// Encrypes the XML Document document using XMLEnc.
|
6
|
-
//
|
7
|
-
// Expects 3 positional arguments:
|
8
|
-
// rb_rsa_key_name - String with name of the rsa key. May be the empty.
|
9
|
-
// rb_rsa_key - A PEM encoded rsa key for signing.
|
10
|
-
// rb_opts - An ruby hash that configures the encryption options.
|
11
|
-
// See XmlEncOptions struct for possible values.
|
12
|
-
VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
|
13
|
-
VALUE rb_opts) {
|
14
|
-
VALUE rb_exception_result = Qnil;
|
15
|
-
VALUE rb_cert = Qnil;
|
16
|
-
const char* exception_message = NULL;
|
17
|
-
|
18
|
-
xmlDocPtr doc = NULL;
|
19
|
-
xmlNodePtr node = NULL;
|
20
|
-
xmlNodePtr encDataNode = NULL;
|
21
|
-
xmlNodePtr encKeyNode = NULL;
|
22
|
-
xmlNodePtr keyInfoNode = NULL;
|
23
|
-
xmlSecEncCtxPtr encCtx = NULL;
|
24
|
-
xmlSecKeysMngrPtr keyManager = NULL;
|
25
|
-
char *keyName = NULL;
|
26
|
-
char *key = NULL;
|
27
|
-
char *certificate = NULL;
|
28
|
-
unsigned int keyLength = 0;
|
29
|
-
unsigned int certificateLength = 0;
|
30
|
-
|
31
|
-
resetXmlSecError();
|
32
|
-
|
33
|
-
Check_Type(rb_rsa_key, T_STRING);
|
34
|
-
Check_Type(rb_opts, T_HASH);
|
35
|
-
|
36
|
-
key = RSTRING_PTR(rb_rsa_key);
|
37
|
-
keyLength = RSTRING_LEN(rb_rsa_key);
|
38
|
-
if (rb_rsa_key_name != Qnil) {
|
39
|
-
Check_Type(rb_rsa_key_name, T_STRING);
|
40
|
-
keyName = StringValueCStr(rb_rsa_key_name);
|
41
|
-
}
|
42
|
-
|
43
|
-
rb_cert = rb_hash_aref(rb_opts, ID2SYM(rb_intern("cert")));
|
44
|
-
if (!NIL_P(rb_cert)) {
|
45
|
-
Check_Type(rb_cert, T_STRING);
|
46
|
-
certificate = RSTRING_PTR(rb_cert);
|
47
|
-
certificateLength = RSTRING_LEN(rb_cert);
|
48
|
-
}
|
49
|
-
|
50
|
-
XmlEncOptions options;
|
51
|
-
if (!GetXmlEncOptions(rb_opts, &options, &rb_exception_result,
|
52
|
-
&exception_message)) {
|
53
|
-
goto done;
|
54
|
-
}
|
55
|
-
|
56
|
-
Noko_Node_Get_Struct(self, xmlNode, node);
|
57
|
-
doc = node->doc;
|
58
|
-
|
59
|
-
// create encryption template to encrypt XML file and replace
|
60
|
-
// its content with encryption result
|
61
|
-
encDataNode = xmlSecTmplEncDataCreate(doc, options.block_encryption, NULL,
|
62
|
-
xmlSecTypeEncElement, NULL, NULL);
|
63
|
-
if(encDataNode == NULL) {
|
64
|
-
rb_exception_result = rb_eEncryptionError;
|
65
|
-
exception_message = "failed to create encryption template";
|
66
|
-
goto done;
|
67
|
-
}
|
68
|
-
|
69
|
-
// we want to put encrypted data in the <enc:CipherValue/> node
|
70
|
-
if(xmlSecTmplEncDataEnsureCipherValue(encDataNode) == NULL) {
|
71
|
-
rb_exception_result = rb_eEncryptionError;
|
72
|
-
exception_message = "failed to add CipherValue node";
|
73
|
-
goto done;
|
74
|
-
}
|
75
|
-
|
76
|
-
// add <dsig:KeyInfo/> and <dsig:KeyName/> nodes to put key name in the
|
77
|
-
// signed document
|
78
|
-
keyInfoNode = xmlSecTmplEncDataEnsureKeyInfo(encDataNode, NULL);
|
79
|
-
if(keyInfoNode == NULL) {
|
80
|
-
rb_exception_result = rb_eEncryptionError;
|
81
|
-
exception_message = "failed to add key info";
|
82
|
-
goto done;
|
83
|
-
}
|
84
|
-
|
85
|
-
if(certificate) {
|
86
|
-
// add <dsig:X509Data/>
|
87
|
-
if(xmlSecTmplKeyInfoAddX509Data(keyInfoNode) == NULL) {
|
88
|
-
rb_exception_result = rb_eSigningError;
|
89
|
-
exception_message = "failed to add X509Data node";
|
90
|
-
goto done;
|
91
|
-
}
|
92
|
-
}
|
93
|
-
|
94
|
-
if(keyName != NULL) {
|
95
|
-
if(xmlSecTmplKeyInfoAddKeyName(keyInfoNode, NULL) == NULL) {
|
96
|
-
rb_exception_result = rb_eEncryptionError;
|
97
|
-
exception_message = "failed to add key name";
|
98
|
-
goto done;
|
99
|
-
}
|
100
|
-
}
|
101
|
-
|
102
|
-
if ((keyManager = createKeyManagerWithSingleKey(
|
103
|
-
key, keyLength, keyName,
|
104
|
-
&rb_exception_result,
|
105
|
-
&exception_message)) == NULL) {
|
106
|
-
// Propagate the exception.
|
107
|
-
goto done;
|
108
|
-
}
|
109
|
-
|
110
|
-
// create encryption context, we don't need keys manager in this example
|
111
|
-
encCtx = xmlSecEncCtxCreate(keyManager);
|
112
|
-
if(encCtx == NULL) {
|
113
|
-
rb_exception_result = rb_eEncryptionError;
|
114
|
-
exception_message = "failed to create encryption context";
|
115
|
-
goto done;
|
116
|
-
}
|
117
|
-
|
118
|
-
// Generate the symmetric key.
|
119
|
-
encCtx->encKey = xmlSecKeyGenerateByName(BAD_CAST options.key_type, options.key_bits,
|
120
|
-
xmlSecKeyDataTypeSession);
|
121
|
-
|
122
|
-
if(encCtx->encKey == NULL) {
|
123
|
-
rb_exception_result = rb_eDecryptionError;
|
124
|
-
exception_message = "failed to generate session key";
|
125
|
-
goto done;
|
126
|
-
}
|
127
|
-
|
128
|
-
if(certificate) {
|
129
|
-
// load certificate and add to the key
|
130
|
-
if(xmlSecCryptoAppKeyCertLoadMemory(encCtx->encKey,
|
131
|
-
(xmlSecByte *)certificate,
|
132
|
-
certificateLength,
|
133
|
-
xmlSecKeyDataFormatPem) < 0) {
|
134
|
-
rb_exception_result = rb_eSigningError;
|
135
|
-
exception_message = "failed to load certificate";
|
136
|
-
goto done;
|
137
|
-
}
|
138
|
-
}
|
139
|
-
|
140
|
-
// Set key name.
|
141
|
-
if(keyName) {
|
142
|
-
if(xmlSecKeySetName(encCtx->encKey, (xmlSecByte *)keyName) < 0) {
|
143
|
-
rb_exception_result = rb_eEncryptionError;
|
144
|
-
exception_message = "failed to set key name";
|
145
|
-
goto done;
|
146
|
-
}
|
147
|
-
}
|
148
|
-
|
149
|
-
// Add <enc:EncryptedKey/> node to the <dsig:KeyInfo/> tag to include
|
150
|
-
// the session key.
|
151
|
-
encKeyNode = xmlSecTmplKeyInfoAddEncryptedKey(keyInfoNode,
|
152
|
-
options.key_transport, // encMethodId encryptionMethod
|
153
|
-
NULL, // xmlChar *idAttribute
|
154
|
-
NULL, // xmlChar *typeAttribute
|
155
|
-
NULL // xmlChar *recipient
|
156
|
-
);
|
157
|
-
if (encKeyNode == NULL) {
|
158
|
-
rb_exception_result = rb_eEncryptionError;
|
159
|
-
exception_message = "failed to add encrypted key node";
|
160
|
-
goto done;
|
161
|
-
}
|
162
|
-
if (xmlSecTmplEncDataEnsureCipherValue(encKeyNode) == NULL) {
|
163
|
-
rb_exception_result = rb_eEncryptionError;
|
164
|
-
exception_message = "failed to add encrypted cipher value";
|
165
|
-
goto done;
|
166
|
-
}
|
167
|
-
|
168
|
-
// encrypt the data
|
169
|
-
if(xmlSecEncCtxXmlEncrypt(encCtx, encDataNode, node) < 0) {
|
170
|
-
rb_exception_result = rb_eEncryptionError;
|
171
|
-
exception_message = "encryption failed";
|
172
|
-
goto done;
|
173
|
-
}
|
174
|
-
|
175
|
-
// the template is inserted in the doc, so don't free it
|
176
|
-
encDataNode = NULL;
|
177
|
-
encKeyNode = NULL;
|
178
|
-
|
179
|
-
done:
|
180
|
-
|
181
|
-
/* cleanup */
|
182
|
-
if(encCtx != NULL) {
|
183
|
-
xmlSecEncCtxDestroy(encCtx);
|
184
|
-
}
|
185
|
-
|
186
|
-
if (encKeyNode != NULL) {
|
187
|
-
xmlFreeNode(encKeyNode);
|
188
|
-
}
|
189
|
-
|
190
|
-
if(encDataNode != NULL) {
|
191
|
-
xmlFreeNode(encDataNode);
|
192
|
-
}
|
193
|
-
|
194
|
-
if (keyManager != NULL) {
|
195
|
-
xmlSecKeysMngrDestroy(keyManager);
|
196
|
-
}
|
197
|
-
|
198
|
-
xmlSecErrorsSetCallback(xmlSecErrorsDefaultCallback);
|
199
|
-
|
200
|
-
if(rb_exception_result != Qnil) {
|
201
|
-
if (hasXmlSecLastError()) {
|
202
|
-
rb_raise(rb_exception_result, "%s, XmlSec error: %s", exception_message,
|
203
|
-
getXmlSecLastError());
|
204
|
-
} else {
|
205
|
-
rb_raise(rb_exception_result, "%s", exception_message);
|
206
|
-
}
|
207
|
-
}
|
208
|
-
|
209
|
-
return Qnil;
|
210
|
-
}
|
@@ -1,93 +0,0 @@
|
|
1
|
-
#include "xmlsecrb.h"
|
2
|
-
#include "util.h"
|
3
|
-
|
4
|
-
VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
|
5
|
-
VALUE rb_exception_result = Qnil;
|
6
|
-
const char* exception_message = NULL;
|
7
|
-
|
8
|
-
xmlNodePtr node = NULL;
|
9
|
-
xmlAttrPtr attr = NULL;
|
10
|
-
xmlAttrPtr tmp = NULL;
|
11
|
-
xmlChar *name = NULL;
|
12
|
-
char *idName = NULL;
|
13
|
-
char *exception_attribute_arg = NULL;
|
14
|
-
|
15
|
-
resetXmlSecError();
|
16
|
-
|
17
|
-
Noko_Node_Get_Struct(self, xmlNode, node);
|
18
|
-
Check_Type(rb_attr_name, T_STRING);
|
19
|
-
idName = StringValueCStr(rb_attr_name);
|
20
|
-
|
21
|
-
// find pointer to id attribute
|
22
|
-
attr = xmlHasProp(node, (const xmlChar* )idName);
|
23
|
-
if((attr == NULL) || (attr->children == NULL)) {
|
24
|
-
rb_exception_result = rb_eRuntimeError;
|
25
|
-
exception_message = "Can't find attribute to add register as id";
|
26
|
-
goto done;
|
27
|
-
}
|
28
|
-
|
29
|
-
// get the attribute (id) value
|
30
|
-
name = xmlNodeListGetString(node->doc, attr->children, 1);
|
31
|
-
if(name == NULL) {
|
32
|
-
rb_exception_result = rb_eRuntimeError;
|
33
|
-
exception_message = "has no value";
|
34
|
-
exception_attribute_arg = idName;
|
35
|
-
goto done;
|
36
|
-
}
|
37
|
-
|
38
|
-
// check that we don't have that id already registered
|
39
|
-
tmp = xmlGetID(node->doc, name);
|
40
|
-
if(tmp != NULL) {
|
41
|
-
rb_exception_result = rb_eRuntimeError;
|
42
|
-
exception_message = "is already an ID";
|
43
|
-
exception_attribute_arg = idName;
|
44
|
-
goto done;
|
45
|
-
}
|
46
|
-
|
47
|
-
// finally register id
|
48
|
-
xmlAddID(NULL, node->doc, name, attr);
|
49
|
-
|
50
|
-
done:
|
51
|
-
// and do not forget to cleanup
|
52
|
-
if (name) {
|
53
|
-
xmlFree(name);
|
54
|
-
}
|
55
|
-
|
56
|
-
xmlSecErrorsSetCallback(xmlSecErrorsDefaultCallback);
|
57
|
-
|
58
|
-
if(rb_exception_result != Qnil) {
|
59
|
-
if (exception_attribute_arg) {
|
60
|
-
if (hasXmlSecLastError()) {
|
61
|
-
rb_raise(rb_exception_result, "Attribute %s %s, XmlSec error: %s",
|
62
|
-
exception_attribute_arg, exception_message, getXmlSecLastError());
|
63
|
-
} else {
|
64
|
-
rb_raise(rb_exception_result, "Attribute %s %s",
|
65
|
-
exception_attribute_arg, exception_message);
|
66
|
-
}
|
67
|
-
} else {
|
68
|
-
if (hasXmlSecLastError()) {
|
69
|
-
rb_raise(rb_exception_result, "%s, XmlSec error: %s", exception_message,
|
70
|
-
getXmlSecLastError());
|
71
|
-
} else {
|
72
|
-
rb_raise(rb_exception_result, "%s", exception_message);
|
73
|
-
}
|
74
|
-
}
|
75
|
-
}
|
76
|
-
|
77
|
-
return Qtrue;
|
78
|
-
}
|
79
|
-
|
80
|
-
VALUE get_id(VALUE self, VALUE rb_id)
|
81
|
-
{
|
82
|
-
xmlAttrPtr prop;
|
83
|
-
xmlDocPtr doc;
|
84
|
-
|
85
|
-
Check_Type(rb_id, T_STRING);
|
86
|
-
Noko_Node_Get_Struct(self, xmlDoc, doc);
|
87
|
-
prop = xmlGetID(doc, (const xmlChar *)StringValueCStr(rb_id));
|
88
|
-
if (prop) {
|
89
|
-
return noko_xml_node_wrap(Qnil, (xmlNodePtr)prop);
|
90
|
-
} else {
|
91
|
-
return Qnil;
|
92
|
-
}
|
93
|
-
}
|
@@ -1,30 +0,0 @@
|
|
1
|
-
#include "xmlsecrb.h"
|
2
|
-
|
3
|
-
VALUE rb_cNokogiri_XML_Document = Qnil;
|
4
|
-
VALUE rb_cNokogiri_XML_Node = Qnil;
|
5
|
-
VALUE rb_eSigningError = Qnil;
|
6
|
-
VALUE rb_eVerificationError = Qnil;
|
7
|
-
VALUE rb_eKeystoreError = Qnil;
|
8
|
-
VALUE rb_eEncryptionError = Qnil;
|
9
|
-
VALUE rb_eDecryptionError = Qnil;
|
10
|
-
|
11
|
-
void Init_Nokogiri_ext() {
|
12
|
-
VALUE XMLSec = rb_define_module("XMLSec");
|
13
|
-
VALUE Nokogiri = rb_define_module("Nokogiri");
|
14
|
-
VALUE Nokogiri_XML = rb_define_module_under(Nokogiri, "XML");
|
15
|
-
rb_cNokogiri_XML_Document = rb_const_get(Nokogiri_XML, rb_intern("Document"));
|
16
|
-
rb_cNokogiri_XML_Node = rb_const_get(Nokogiri_XML, rb_intern("Node"));
|
17
|
-
|
18
|
-
rb_define_method(rb_cNokogiri_XML_Node, "sign!", sign, 1);
|
19
|
-
rb_define_method(rb_cNokogiri_XML_Node, "verify_with", verify_with, 1);
|
20
|
-
rb_define_method(rb_cNokogiri_XML_Node, "encrypt_with_key", encrypt_with_key, 3);
|
21
|
-
rb_define_method(rb_cNokogiri_XML_Node, "decrypt_with_key", decrypt_with_key, 2);
|
22
|
-
rb_define_method(rb_cNokogiri_XML_Document, "get_id", get_id, 1);
|
23
|
-
rb_define_method(rb_cNokogiri_XML_Node, "set_id_attribute", set_id_attribute, 1);
|
24
|
-
|
25
|
-
rb_eSigningError = rb_define_class_under(XMLSec, "SigningError", rb_eRuntimeError);
|
26
|
-
rb_eVerificationError = rb_define_class_under(XMLSec, "VerificationError", rb_eRuntimeError);
|
27
|
-
rb_eKeystoreError = rb_define_class_under(XMLSec, "KeystoreError", rb_eRuntimeError);
|
28
|
-
rb_eEncryptionError = rb_define_class_under(XMLSec, "EncryptionError", rb_eRuntimeError);
|
29
|
-
rb_eDecryptionError = rb_define_class_under(XMLSec, "DecryptionError", rb_eRuntimeError);
|
30
|
-
}
|