1 /**
2 * XML Security Library example: Verifying a file signed with X509 certificate
3 *
4 * Verifies a file signed with X509 certificate.
5 *
6 * This example was developed and tested with OpenSSL crypto library. The
7 * certificates management policies for another crypto library may break it.
8 *
9 * Usage:
10 * verify3 <signed-file> <trusted-cert-pem-file1> [<trusted-cert-pem-file2> [...]]
11 *
12 * Example:
13 * ./verify3 sign3-res.xml ca2cert.pem cacert.pem
14 *
15 * This is free software; see Copyright file in the source
16 * distribution for preciese wording.
17 *
18 * Copyright (C) 2002-2016 Aleksey Sanin <aleksey@aleksey.com>. All Rights Reserved.
19 */
20 #include <stdlib.h>
21 #include <string.h>
22 #include <assert.h>
23
24 #include <libxml/tree.h>
25 #include <libxml/xmlmemory.h>
26 #include <libxml/parser.h>
27
28 #ifndef XMLSEC_NO_XSLT
29 #include <libxslt/xslt.h>
30 #include <libxslt/security.h>
31 #endif /* XMLSEC_NO_XSLT */
32
33 #include <xmlsec/xmlsec.h>
34 #include <xmlsec/xmltree.h>
35 #include <xmlsec/xmldsig.h>
36 #include <xmlsec/crypto.h>
37
38 xmlSecKeysMngrPtr load_trusted_certs(char** files, int files_size);
39 int verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file);
40
41 int
main(int argc,char ** argv)42 main(int argc, char **argv) {
43 #ifndef XMLSEC_NO_XSLT
44 xsltSecurityPrefsPtr xsltSecPrefs = NULL;
45 #endif /* XMLSEC_NO_XSLT */
46 xmlSecKeysMngrPtr mngr;
47
48 assert(argv);
49
50 if(argc < 3) {
51 fprintf(stderr, "Error: wrong number of arguments.\n");
52 fprintf(stderr, "Usage: %s <xml-file> <cert-file1> [<cert-file2> [...]]\n", argv[0]);
53 return(1);
54 }
55
56 /* Init libxml and libxslt libraries */
57 xmlInitParser();
58 LIBXML_TEST_VERSION
59 xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS;
60 xmlSubstituteEntitiesDefault(1);
61 #ifndef XMLSEC_NO_XSLT
62 xmlIndentTreeOutput = 1;
63 #endif /* XMLSEC_NO_XSLT */
64
65 /* Init libxslt */
66 #ifndef XMLSEC_NO_XSLT
67 /* disable everything */
68 xsltSecPrefs = xsltNewSecurityPrefs();
69 xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityForbid);
70 xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_FILE, xsltSecurityForbid);
71 xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_CREATE_DIRECTORY, xsltSecurityForbid);
72 xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_READ_NETWORK, xsltSecurityForbid);
73 xsltSetSecurityPrefs(xsltSecPrefs, XSLT_SECPREF_WRITE_NETWORK, xsltSecurityForbid);
74 xsltSetDefaultSecurityPrefs(xsltSecPrefs);
75 #endif /* XMLSEC_NO_XSLT */
76
77 /* Init xmlsec library */
78 if(xmlSecInit() < 0) {
79 fprintf(stderr, "Error: xmlsec initialization failed.\n");
80 return(-1);
81 }
82
83 /* Check loaded library version */
84 if(xmlSecCheckVersion() != 1) {
85 fprintf(stderr, "Error: loaded xmlsec library version is not compatible.\n");
86 return(-1);
87 }
88
89 /* Load default crypto engine if we are supporting dynamic
90 * loading for xmlsec-crypto libraries. Use the crypto library
91 * name ("openssl", "nss", etc.) to load corresponding
92 * xmlsec-crypto library.
93 */
94 #ifdef XMLSEC_CRYPTO_DYNAMIC_LOADING
95 if(xmlSecCryptoDLLoadLibrary(NULL) < 0) {
96 fprintf(stderr, "Error: unable to load default xmlsec-crypto library. Make sure\n"
97 "that you have it installed and check shared libraries path\n"
98 "(LD_LIBRARY_PATH and/or LTDL_LIBRARY_PATH) environment variables.\n");
99 return(-1);
100 }
101 #endif /* XMLSEC_CRYPTO_DYNAMIC_LOADING */
102
103 /* Init crypto library */
104 if(xmlSecCryptoAppInit(NULL) < 0) {
105 fprintf(stderr, "Error: crypto initialization failed.\n");
106 return(-1);
107 }
108
109 /* Init xmlsec-crypto library */
110 if(xmlSecCryptoInit() < 0) {
111 fprintf(stderr, "Error: xmlsec-crypto initialization failed.\n");
112 return(-1);
113 }
114
115 /* create keys manager and load trusted certificates */
116 mngr = load_trusted_certs(&(argv[2]), argc - 2);
117 if(mngr == NULL) {
118 return(-1);
119 }
120
121 /* verify file */
122 if(verify_file(mngr, argv[1]) < 0) {
123 xmlSecKeysMngrDestroy(mngr);
124 return(-1);
125 }
126
127 /* destroy keys manager */
128 xmlSecKeysMngrDestroy(mngr);
129
130 /* Shutdown xmlsec-crypto library */
131 xmlSecCryptoShutdown();
132
133 /* Shutdown crypto library */
134 xmlSecCryptoAppShutdown();
135
136 /* Shutdown xmlsec library */
137 xmlSecShutdown();
138
139 /* Shutdown libxslt/libxml */
140 #ifndef XMLSEC_NO_XSLT
141 xsltFreeSecurityPrefs(xsltSecPrefs);
142 xsltCleanupGlobals();
143 #endif /* XMLSEC_NO_XSLT */
144 xmlCleanupParser();
145
146 return(0);
147 }
148
149 /**
150 * load_trusted_certs:
151 * @files: the list of filenames.
152 * @files_size: the number of filenames in #files.
153 *
154 * Creates simple keys manager and load trusted certificates from PEM #files.
155 * The caller is responsible for destroying returned keys manager using
156 * @xmlSecKeysMngrDestroy.
157 *
158 * Returns the pointer to newly created keys manager or NULL if an error
159 * occurs.
160 */
161 xmlSecKeysMngrPtr
load_trusted_certs(char ** files,int files_size)162 load_trusted_certs(char** files, int files_size) {
163 xmlSecKeysMngrPtr mngr;
164 int i;
165
166 assert(files);
167 assert(files_size > 0);
168
169 /* create and initialize keys manager, we use a simple list based
170 * keys manager, implement your own xmlSecKeysStore klass if you need
171 * something more sophisticated
172 */
173 mngr = xmlSecKeysMngrCreate();
174 if(mngr == NULL) {
175 fprintf(stderr, "Error: failed to create keys manager.\n");
176 return(NULL);
177 }
178 if(xmlSecCryptoAppDefaultKeysMngrInit(mngr) < 0) {
179 fprintf(stderr, "Error: failed to initialize keys manager.\n");
180 xmlSecKeysMngrDestroy(mngr);
181 return(NULL);
182 }
183
184 for(i = 0; i < files_size; ++i) {
185 assert(files[i]);
186
187 /* load trusted cert */
188 if(xmlSecCryptoAppKeysMngrCertLoad(mngr, files[i], xmlSecKeyDataFormatPem, xmlSecKeyDataTypeTrusted) < 0) {
189 fprintf(stderr,"Error: failed to load pem certificate from \"%s\"\n", files[i]);
190 xmlSecKeysMngrDestroy(mngr);
191 return(NULL);
192 }
193 }
194
195 return(mngr);
196 }
197
198 /**
199 * verify_file:
200 * @mngr: the pointer to keys manager.
201 * @xml_file: the signed XML file name.
202 *
203 * Verifies XML signature in #xml_file.
204 *
205 * Returns 0 on success or a negative value if an error occurs.
206 */
207 int
verify_file(xmlSecKeysMngrPtr mngr,const char * xml_file)208 verify_file(xmlSecKeysMngrPtr mngr, const char* xml_file) {
209 xmlDocPtr doc = NULL;
210 xmlNodePtr node = NULL;
211 xmlSecDSigCtxPtr dsigCtx = NULL;
212 int res = -1;
213
214 assert(mngr);
215 assert(xml_file);
216
217 /* load file */
218 doc = xmlParseFile(xml_file);
219 if ((doc == NULL) || (xmlDocGetRootElement(doc) == NULL)){
220 fprintf(stderr, "Error: unable to parse file \"%s\"\n", xml_file);
221 goto done;
222 }
223
224 /* find start node */
225 node = xmlSecFindNode(xmlDocGetRootElement(doc), xmlSecNodeSignature, xmlSecDSigNs);
226 if(node == NULL) {
227 fprintf(stderr, "Error: start node not found in \"%s\"\n", xml_file);
228 goto done;
229 }
230
231 /* create signature context */
232 dsigCtx = xmlSecDSigCtxCreate(mngr);
233 if(dsigCtx == NULL) {
234 fprintf(stderr,"Error: failed to create signature context\n");
235 goto done;
236 }
237
238 /* Verify signature */
239 if(xmlSecDSigCtxVerify(dsigCtx, node) < 0) {
240 fprintf(stderr,"Error: signature verify\n");
241 goto done;
242 }
243
244 /* print verification result to stdout */
245 if(dsigCtx->status == xmlSecDSigStatusSucceeded) {
246 fprintf(stdout, "Signature is OK\n");
247 } else {
248 fprintf(stdout, "Signature is INVALID\n");
249 }
250
251 /* success */
252 res = 0;
253
254 done:
255 /* cleanup */
256 if(dsigCtx != NULL) {
257 xmlSecDSigCtxDestroy(dsigCtx);
258 }
259
260 if(doc != NULL) {
261 xmlFreeDoc(doc);
262 }
263 return(res);
264 }
265
266
267