2 Copyright (C) 2013-2014 Carl Hetherington <cth@carlh.net>
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 2 of the License, or
7 (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program; if not, write to the Free Software
16 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 #include "encrypted_kdm.h"
23 #include <libcxml/cxml.h>
24 #include <libxml++/document.h>
25 #include <libxml++/nodes/element.h>
26 #include <libxml/parser.h>
27 #include <boost/date_time/posix_time/posix_time.hpp>
33 using boost::shared_ptr;
38 /** Namespace for classes used to hold our data; they are internal to this .cc file */
46 Signer (shared_ptr<const cxml::Node> node)
47 : x509_issuer_name (node->string_child ("X509IssuerName"))
48 , x509_serial_number (node->string_child ("X509SerialNumber"))
53 void as_xml (xmlpp::Element* node) const
55 node->add_child("X509IssuerName", "ds")->add_child_text (x509_issuer_name);
56 node->add_child("X509SerialNumber", "ds")->add_child_text (x509_serial_number);
59 string x509_issuer_name;
60 string x509_serial_number;
68 X509Data (boost::shared_ptr<const cxml::Node> node)
69 : x509_issuer_serial (Signer (node->node_child ("X509IssuerSerial")))
70 , x509_certificate (node->string_child ("X509Certificate"))
75 void as_xml (xmlpp::Element* node) const
77 x509_issuer_serial.as_xml (node->add_child ("X509IssuerSerial", "ds"));
78 node->add_child("X509Certificate", "ds")->add_child_text (x509_certificate);
81 Signer x509_issuer_serial;
82 std::string x509_certificate;
94 Reference (shared_ptr<const cxml::Node> node)
95 : uri (node->string_attribute ("URI"))
96 , digest_value (node->string_child ("DigestValue"))
101 void as_xml (xmlpp::Element* node) const
103 node->set_attribute ("URI", uri);
104 node->add_child("DigestMethod", "ds")->set_attribute ("Algorithm", "http://www.w3.org/2001/04/xmlenc#sha256");
105 node->add_child("DigestValue", "ds")->add_child_text (digest_value);
116 : authenticated_public ("#ID_AuthenticatedPublic")
117 , authenticated_private ("#ID_AuthenticatedPrivate")
120 SignedInfo (shared_ptr<const cxml::Node> node)
122 list<shared_ptr<cxml::Node> > references = node->node_children ("Reference");
123 for (list<shared_ptr<cxml::Node> >::const_iterator i = references.begin(); i != references.end(); ++i) {
124 if ((*i)->string_attribute ("URI") == "#ID_AuthenticatedPublic") {
125 authenticated_public = Reference (*i);
126 } else if ((*i)->string_attribute ("URI") == "#ID_AuthenticatedPrivate") {
127 authenticated_private = Reference (*i);
130 /* XXX: do something if we don't recognise the node */
134 void as_xml (xmlpp::Element* node) const
136 node->add_child ("CanonicalizationMethod", "ds")->set_attribute (
137 "Algorithm", "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"
140 node->add_child ("SignatureMethod", "ds")->set_attribute (
141 "Algorithm", "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
144 authenticated_public.as_xml (node->add_child ("Reference", "ds"));
145 authenticated_private.as_xml (node->add_child ("Reference", "ds"));
149 Reference authenticated_public;
150 Reference authenticated_private;
158 Signature (shared_ptr<const cxml::Node> node)
159 : signed_info (node->node_child ("SignedInfo"))
160 , signature_value (node->string_child ("SignatureValue"))
162 list<shared_ptr<cxml::Node> > x509_data_nodes = node->node_child("KeyInfo")->node_children ("X509Data");
163 for (list<shared_ptr<cxml::Node> >::const_iterator i = x509_data_nodes.begin(); i != x509_data_nodes.end(); ++i) {
164 x509_data.push_back (X509Data (*i));
168 void as_xml (xmlpp::Node* node) const
170 signed_info.as_xml (node->add_child ("SignedInfo", "ds"));
171 node->add_child("SignatureValue", "ds")->add_child_text (signature_value);
173 xmlpp::Element* key_info_node = node->add_child ("KeyInfo", "ds");
174 for (std::list<X509Data>::const_iterator i = x509_data.begin(); i != x509_data.end(); ++i) {
175 i->as_xml (key_info_node->add_child ("X509Data", "ds"));
179 SignedInfo signed_info;
180 string signature_value;
181 list<X509Data> x509_data;
184 class AuthenticatedPrivate
187 AuthenticatedPrivate () {}
189 AuthenticatedPrivate (shared_ptr<const cxml::Node> node)
191 list<shared_ptr<cxml::Node> > encrypted_key_nodes = node->node_children ("EncryptedKey");
192 for (list<shared_ptr<cxml::Node> >::const_iterator i = encrypted_key_nodes.begin(); i != encrypted_key_nodes.end(); ++i) {
193 encrypted_key.push_back ((*i)->node_child("CipherData")->string_child ("CipherValue"));
197 void as_xml (xmlpp::Element* node, map<string, xmlpp::Attribute *>& references) const
199 references["ID_AuthenticatedPrivate"] = node->set_attribute ("Id", "ID_AuthenticatedPrivate");
201 for (list<string>::const_iterator i = encrypted_key.begin(); i != encrypted_key.end(); ++i) {
202 xmlpp::Element* encrypted_key = node->add_child ("EncryptedKey", "enc");
203 xmlpp::Element* encryption_method = encrypted_key->add_child ("EncryptionMethod", "enc");
204 encryption_method->set_attribute ("Algorithm", "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
205 xmlpp::Element* digest_method = encryption_method->add_child ("DigestMethod", "ds");
206 digest_method->set_attribute ("Algorithm", "http://www.w3.org/2000/09/xmldsig#sha1");
207 xmlpp::Element* cipher_data = encrypted_key->add_child ("CipherData", "enc");
208 cipher_data->add_child("CipherValue", "enc")->add_child_text (*i);
212 list<string> encrypted_key;
220 TypedKeyId (shared_ptr<const cxml::Node> node)
221 : key_type (node->string_child ("KeyType"))
222 , key_id (node->string_child ("KeyId").substr (9))
227 TypedKeyId (string type, string id)
232 void as_xml (xmlpp::Element* node) const
234 node->add_child("KeyType")->add_child_text (key_type);
235 node->add_child("KeyId")->add_child_text ("urn:uuid:" + key_id);
247 KeyIdList (shared_ptr<const cxml::Node> node)
249 list<shared_ptr<cxml::Node> > typed_key_id_nodes = node->node_children ("TypedKeyId");
250 for (list<shared_ptr<cxml::Node> >::const_iterator i = typed_key_id_nodes.begin(); i != typed_key_id_nodes.end(); ++i) {
251 typed_key_id.push_back (TypedKeyId (*i));
255 void as_xml (xmlpp::Element* node) const
257 for (list<TypedKeyId>::const_iterator i = typed_key_id.begin(); i != typed_key_id.end(); ++i) {
258 i->as_xml (node->add_child("TypedKeyId"));
262 list<TypedKeyId> typed_key_id;
265 class AuthorizedDeviceInfo
268 AuthorizedDeviceInfo () {}
270 AuthorizedDeviceInfo (shared_ptr<const cxml::Node> node)
271 : device_list_identifier (node->string_child ("DeviceListIdentifier").substr (9))
272 , device_list_description (node->string_child ("DeviceListDescription"))
273 , certificate_thumbprint (node->node_child("DeviceList")->string_child ("CertificateThumbprint"))
278 void as_xml (xmlpp::Element* node) const
280 node->add_child ("DeviceListIdentifier")->add_child_text ("urn:uuid:" + device_list_identifier);
281 node->add_child ("DeviceListDescription")->add_child_text (device_list_description);
282 xmlpp::Element* device_list = node->add_child ("DeviceList");
283 device_list->add_child("CertificateThumbprint")->add_child_text (certificate_thumbprint);
286 /** DeviceListIdentifier without the urn:uuid: prefix */
287 string device_list_identifier;
288 string device_list_description;
289 string certificate_thumbprint;
292 class X509IssuerSerial
295 X509IssuerSerial () {}
297 X509IssuerSerial (shared_ptr<const cxml::Node> node)
298 : x509_issuer_name (node->string_child ("X509IssuerName"))
299 , x509_serial_number (node->string_child ("X509SerialNumber"))
304 void as_xml (xmlpp::Element* node) const
306 node->add_child("X509IssuerName", "ds")->add_child_text (x509_issuer_name);
307 node->add_child("X509SerialNumber", "ds")->add_child_text (x509_serial_number);
310 string x509_issuer_name;
311 string x509_serial_number;
319 Recipient (shared_ptr<const cxml::Node> node)
320 : x509_issuer_serial (node->node_child ("X509IssuerSerial"))
321 , x509_subject_name (node->string_child ("X509SubjectName"))
326 void as_xml (xmlpp::Element* node) const
328 x509_issuer_serial.as_xml (node->add_child ("X509IssuerSerial"));
329 node->add_child("X509SubjectName")->add_child_text (x509_subject_name);
332 X509IssuerSerial x509_issuer_serial;
333 string x509_subject_name;
336 class KDMRequiredExtensions
339 KDMRequiredExtensions () {}
341 KDMRequiredExtensions (shared_ptr<const cxml::Node> node)
342 : recipient (node->node_child ("Recipient"))
343 , composition_playlist_id (node->string_child ("CompositionPlaylistId").substr (9))
344 , content_title_text (node->string_child ("ContentTitleText"))
345 , not_valid_before (node->string_child ("ContentKeysNotValidBefore"))
346 , not_valid_after (node->string_child ("ContentKeysNotValidAfter"))
347 , authorized_device_info (node->node_child ("AuthorizedDeviceInfo"))
348 , key_id_list (node->node_child ("KeyIdList"))
353 void as_xml (xmlpp::Element* node) const
355 node->set_attribute ("xmlns", "http://www.smpte-ra.org/schemas/430-1/2006/KDM");
357 recipient.as_xml (node->add_child ("Recipient"));
358 node->add_child("CompositionPlaylistId")->add_child_text ("urn:uuid:" + composition_playlist_id);
359 if (content_authenticator) {
360 node->add_child("ContentAuthenticator")->add_child_text (content_authenticator.get ());
362 node->add_child("ContentTitleText")->add_child_text (content_title_text);
363 node->add_child("ContentKeysNotValidBefore")->add_child_text (not_valid_before.as_string ());
364 node->add_child("ContentKeysNotValidAfter")->add_child_text (not_valid_after.as_string ());
365 authorized_device_info.as_xml (node->add_child ("AuthorizedDeviceInfo"));
366 key_id_list.as_xml (node->add_child ("KeyIdList"));
368 xmlpp::Element* forensic_mark_flag_list = node->add_child ("ForensicMarkFlagList");
369 forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text ("http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-picture-disable");
370 forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text ("http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-audio-disable");
374 string composition_playlist_id;
375 boost::optional<string> content_authenticator;
376 string content_title_text;
377 LocalTime not_valid_before;
378 LocalTime not_valid_after;
379 AuthorizedDeviceInfo authorized_device_info;
380 KeyIdList key_id_list;
383 class RequiredExtensions
386 RequiredExtensions () {}
388 RequiredExtensions (shared_ptr<const cxml::Node> node)
389 : kdm_required_extensions (node->node_child ("KDMRequiredExtensions"))
394 void as_xml (xmlpp::Element* node) const
396 kdm_required_extensions.as_xml (node->add_child ("KDMRequiredExtensions"));
399 KDMRequiredExtensions kdm_required_extensions;
402 class AuthenticatedPublic
405 AuthenticatedPublic ()
406 : message_id (make_uuid ())
407 , issue_date (LocalTime().as_string ())
410 AuthenticatedPublic (shared_ptr<const cxml::Node> node)
411 : message_id (node->string_child ("MessageId").substr (9))
412 , annotation_text (node->string_child ("AnnotationText"))
413 , issue_date (node->string_child ("IssueDate"))
414 , signer (node->node_child ("Signer"))
415 , required_extensions (node->node_child ("RequiredExtensions"))
420 void as_xml (xmlpp::Element* node, map<string, xmlpp::Attribute *>& references) const
422 references["ID_AuthenticatedPublic"] = node->set_attribute ("Id", "ID_AuthenticatedPublic");
424 node->add_child("MessageId")->add_child_text ("urn:uuid:" + message_id);
425 node->add_child("MessageType")->add_child_text ("http://www.smpte-ra.org/430-1/2006/KDM#kdm-key-type");
426 node->add_child("AnnotationText")->add_child_text (annotation_text);
427 node->add_child("IssueDate")->add_child_text (issue_date);
429 signer.as_xml (node->add_child ("Signer"));
430 required_extensions.as_xml (node->add_child ("RequiredExtensions"));
432 node->add_child ("NonCriticalExtensions");
436 string annotation_text;
439 RequiredExtensions required_extensions;
442 /** Class to describe our data. We use a class hierarchy as it's a bit nicer
443 * for XML data than a flat description.
445 class EncryptedKDMData
453 EncryptedKDMData (shared_ptr<const cxml::Node> node)
454 : authenticated_public (node->node_child ("AuthenticatedPublic"))
455 , authenticated_private (node->node_child ("AuthenticatedPrivate"))
456 , signature (node->node_child ("Signature"))
461 shared_ptr<xmlpp::Document> as_xml () const
463 shared_ptr<xmlpp::Document> document (new xmlpp::Document ());
464 xmlpp::Element* root = document->create_root_node ("DCinemaSecurityMessage", "http://www.smpte-ra.org/schemas/430-3/2006/ETM");
465 root->set_namespace_declaration ("http://www.w3.org/2000/09/xmldsig#", "ds");
466 root->set_namespace_declaration ("http://www.w3.org/2001/04/xmlenc#", "enc");
467 map<string, xmlpp::Attribute *> references;
468 authenticated_public.as_xml (root->add_child ("AuthenticatedPublic"), references);
469 authenticated_private.as_xml (root->add_child ("AuthenticatedPrivate"), references);
470 signature.as_xml (root->add_child ("Signature", "ds"));
472 for (map<string, xmlpp::Attribute*>::const_iterator i = references.begin(); i != references.end(); ++i) {
473 xmlAddID (0, document->cobj(), (const xmlChar *) i->first.c_str(), i->second->cobj ());
479 AuthenticatedPublic authenticated_public;
480 AuthenticatedPrivate authenticated_private;
487 EncryptedKDM::EncryptedKDM (boost::filesystem::path file)
488 : _data (new data::EncryptedKDMData (shared_ptr<cxml::Node> (new cxml::Document ("DCinemaSecurityMessage", file))))
493 EncryptedKDM::EncryptedKDM (
494 shared_ptr<const Signer> signer,
495 shared_ptr<const Certificate> recipient,
496 string device_list_description,
498 string content_title_text,
499 LocalTime not_valid_before,
500 LocalTime not_valid_after,
501 Formulation formulation,
502 list<pair<string, string> > key_ids,
505 : _data (new data::EncryptedKDMData)
507 /* Fill our XML-ish description in with the juicy bits that the caller has given */
509 data::AuthenticatedPublic& aup = _data->authenticated_public;
510 aup.signer.x509_issuer_name = signer->certificates().leaf()->issuer ();
511 aup.signer.x509_serial_number = signer->certificates().leaf()->serial ();
513 data::KDMRequiredExtensions& kre = _data->authenticated_public.required_extensions.kdm_required_extensions;
514 kre.recipient.x509_issuer_serial.x509_issuer_name = recipient->issuer ();
515 kre.recipient.x509_issuer_serial.x509_serial_number = recipient->serial ();
516 kre.recipient.x509_subject_name = recipient->subject ();
517 kre.authorized_device_info.device_list_description = device_list_description;
518 kre.composition_playlist_id = cpl_id;
519 if (formulation == DCI_ANY || formulation == DCI_SPECIFIC) {
520 kre.content_authenticator = signer->certificates().leaf()->thumbprint ();
522 kre.content_title_text = content_title_text;
523 kre.not_valid_before = not_valid_before;
524 kre.not_valid_after = not_valid_after;
525 kre.authorized_device_info.device_list_identifier = make_uuid ();
526 string n = recipient->common_name ();
527 if (n.find (".") != string::npos) {
528 n = n.substr (n.find (".") + 1);
530 kre.authorized_device_info.device_list_description = n;
532 if (formulation == MODIFIED_TRANSITIONAL_1 || formulation == DCI_ANY) {
533 /* Use the "assume trust" thumbprint */
534 kre.authorized_device_info.certificate_thumbprint = "2jmj7l5rSw0yVb/vlWAYkK/YBwk=";
535 } else if (formulation == DCI_SPECIFIC) {
536 /* Use the recipient thumbprint */
537 kre.authorized_device_info.certificate_thumbprint = recipient->thumbprint ();
540 for (list<pair<string, string> >::const_iterator i = key_ids.begin(); i != key_ids.end(); ++i) {
541 kre.key_id_list.typed_key_id.push_back (data::TypedKeyId (i->first, i->second));
544 _data->authenticated_private.encrypted_key = keys;
546 /* Read the XML so far and sign it */
547 shared_ptr<xmlpp::Document> doc = _data->as_xml ();
548 xmlpp::Node::NodeList children = doc->get_root_node()->get_children ();
549 for (xmlpp::Node::NodeList::const_iterator i = children.begin(); i != children.end(); ++i) {
550 if ((*i)->get_name() == "Signature") {
551 signer->add_signature_value (*i, "ds");
555 /* Read the bits that add_signature_value did back into our variables */
556 shared_ptr<cxml::Node> signed_doc (new cxml::Node (doc->get_root_node ()));
557 _data->signature = data::Signature (signed_doc->node_child ("Signature"));
560 EncryptedKDM::EncryptedKDM (EncryptedKDM const & other)
561 : _data (new data::EncryptedKDMData (*other._data))
567 EncryptedKDM::operator= (EncryptedKDM const & other)
569 if (this == &other) {
574 _data = new data::EncryptedKDMData (*other._data);
578 EncryptedKDM::~EncryptedKDM ()
584 EncryptedKDM::as_xml (boost::filesystem::path path) const
586 FILE* f = fopen_boost (path, "w");
587 string const x = as_xml ();
588 fwrite (x.c_str(), 1, x.length(), f);
593 EncryptedKDM::as_xml () const
595 xmlpp::Document document;
596 xmlpp::Element* root = document.create_root_node ("DCinemaSecurityMessage", "http://www.smpte-ra.org/schemas/430-3/2006/ETM");
597 root->set_namespace_declaration ("http://www.w3.org/2000/09/xmldsig#", "ds");
598 root->set_namespace_declaration ("http://www.w3.org/2001/04/xmlenc#", "enc");
600 return _data->as_xml()->write_to_string ("UTF-8");
604 EncryptedKDM::keys () const
606 return _data->authenticated_private.encrypted_key;