/*
- Copyright (C) 2013-2016 Carl Hetherington <cth@carlh.net>
+ Copyright (C) 2013-2018 Carl Hetherington <cth@carlh.net>
- This program is free software; you can redistribute it and/or modify
+ This file is part of libdcp.
+
+ libdcp is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
- This program is distributed in the hope that it will be useful,
+ libdcp is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
+ along with libdcp. If not, see <http://www.gnu.org/licenses/>.
+
+ In addition, as a special exception, the copyright holders give
+ permission to link the code of portions of this program with the
+ OpenSSL library under certain conditions as described in each
+ individual source file, and distribute linked combinations
+ including the two.
+
+ You must obey the GNU General Public License in all respects
+ for all of the code used other than OpenSSL. If you modify
+ file(s) with this exception, you may extend this exception to your
+ version of the file(s), but you are not obligated to do so. If you
+ do not wish to do so, delete this exception statement from your
+ version. If you delete this exception statement from all source
+ files in the program, then also delete it here.
*/
#include "encrypted_kdm.h"
#include "util.h"
#include "certificate_chain.h"
+#include "exceptions.h"
+#include "compose.hpp"
#include <libcxml/cxml.h>
#include <libxml++/document.h>
#include <libxml++/nodes/element.h>
#include <libxml/parser.h>
+#include <boost/algorithm/string.hpp>
#include <boost/date_time/posix_time/posix_time.hpp>
#include <boost/foreach.hpp>
+#include <boost/format.hpp>
using std::list;
using std::vector;
using std::pair;
using boost::shared_ptr;
using boost::optional;
+using boost::starts_with;
using namespace dcp;
namespace dcp {
public:
Signer () {}
- Signer (shared_ptr<const cxml::Node> node)
+ explicit Signer (shared_ptr<const cxml::Node> node)
: x509_issuer_name (node->string_child ("X509IssuerName"))
, x509_serial_number (node->string_child ("X509SerialNumber"))
{
public:
X509Data () {}
- X509Data (boost::shared_ptr<const cxml::Node> node)
+ explicit X509Data (boost::shared_ptr<const cxml::Node> node)
: x509_issuer_serial (Signer (node->node_child ("X509IssuerSerial")))
, x509_certificate (node->string_child ("X509Certificate"))
{
public:
Reference () {}
- Reference (string u)
+ explicit Reference (string u)
: uri (u)
{}
- Reference (shared_ptr<const cxml::Node> node)
+ explicit Reference (shared_ptr<const cxml::Node> node)
: uri (node->string_attribute ("URI"))
, digest_value (node->string_child ("DigestValue"))
{
, authenticated_private ("#ID_AuthenticatedPrivate")
{}
- SignedInfo (shared_ptr<const cxml::Node> node)
+ explicit SignedInfo (shared_ptr<const cxml::Node> node)
{
list<shared_ptr<cxml::Node> > references = node->node_children ("Reference");
for (list<shared_ptr<cxml::Node> >::const_iterator i = references.begin(); i != references.end(); ++i) {
public:
Signature () {}
- Signature (shared_ptr<const cxml::Node> node)
+ explicit Signature (shared_ptr<const cxml::Node> node)
: signed_info (node->node_child ("SignedInfo"))
, signature_value (node->string_child ("SignatureValue"))
{
public:
AuthenticatedPrivate () {}
- AuthenticatedPrivate (shared_ptr<const cxml::Node> node)
+ explicit AuthenticatedPrivate (shared_ptr<const cxml::Node> node)
{
list<shared_ptr<cxml::Node> > encrypted_key_nodes = node->node_children ("EncryptedKey");
for (list<shared_ptr<cxml::Node> >::const_iterator i = encrypted_key_nodes.begin(); i != encrypted_key_nodes.end(); ++i) {
public:
TypedKeyId () {}
- TypedKeyId (shared_ptr<const cxml::Node> node)
+ explicit TypedKeyId (shared_ptr<const cxml::Node> node)
: key_type (node->string_child ("KeyType"))
, key_id (remove_urn_uuid (node->string_child ("KeyId")))
{
/* XXX: this feels like a bit of a hack */
if (key_type == "MDEK") {
type->set_attribute ("scope", "http://www.dolby.com/cp850/2012/KDM#kdm-key-type");
+ } else {
+ type->set_attribute ("scope", "http://www.smpte-ra.org/430-1/2006/KDM#kdm-key-type");
}
}
public:
KeyIdList () {}
- KeyIdList (shared_ptr<const cxml::Node> node)
+ explicit KeyIdList (shared_ptr<const cxml::Node> node)
{
list<shared_ptr<cxml::Node> > typed_key_id_nodes = node->node_children ("TypedKeyId");
for (list<shared_ptr<cxml::Node> >::const_iterator i = typed_key_id_nodes.begin(); i != typed_key_id_nodes.end(); ++i) {
public:
AuthorizedDeviceInfo () {}
- AuthorizedDeviceInfo (shared_ptr<const cxml::Node> node)
+ explicit AuthorizedDeviceInfo (shared_ptr<const cxml::Node> node)
: device_list_identifier (remove_urn_uuid (node->string_child ("DeviceListIdentifier")))
, device_list_description (node->optional_string_child ("DeviceListDescription"))
{
public:
X509IssuerSerial () {}
- X509IssuerSerial (shared_ptr<const cxml::Node> node)
+ explicit X509IssuerSerial (shared_ptr<const cxml::Node> node)
: x509_issuer_name (node->string_child ("X509IssuerName"))
, x509_serial_number (node->string_child ("X509SerialNumber"))
{
public:
Recipient () {}
- Recipient (shared_ptr<const cxml::Node> node)
+ explicit Recipient (shared_ptr<const cxml::Node> node)
: x509_issuer_serial (node->node_child ("X509IssuerSerial"))
, x509_subject_name (node->string_child ("X509SubjectName"))
{
public:
KDMRequiredExtensions () {}
- KDMRequiredExtensions (shared_ptr<const cxml::Node> node)
+ explicit KDMRequiredExtensions (shared_ptr<const cxml::Node> node)
: recipient (node->node_child ("Recipient"))
, composition_playlist_id (remove_urn_uuid (node->string_child ("CompositionPlaylistId")))
, content_title_text (node->string_child ("ContentTitleText"))
, authorized_device_info (node->node_child ("AuthorizedDeviceInfo"))
, key_id_list (node->node_child ("KeyIdList"))
{
-
+ disable_forensic_marking_picture = false;
+ disable_forensic_marking_audio = optional<int>();
+ if (node->optional_node_child("ForensicMarkFlagList")) {
+ BOOST_FOREACH (cxml::ConstNodePtr i, node->node_child("ForensicMarkFlagList")->node_children("ForensicMarkFlag")) {
+ if (i->content() == picture_disable) {
+ disable_forensic_marking_picture = true;
+ } else if (starts_with(i->content(), audio_disable)) {
+ disable_forensic_marking_audio = 0;
+ string const above = audio_disable + "-above-channel-";
+ if (starts_with(i->content(), above)) {
+ string above_number = i->content().substr(above.length());
+ if (above_number == "") {
+ throw KDMFormatError("Badly-formatted ForensicMarkFlag");
+ }
+ disable_forensic_marking_audio = atoi(above_number.c_str());
+ }
+ }
+ }
+ }
}
void as_xml (xmlpp::Element* node) const
}
node->add_child("ContentKeysNotValidBefore")->add_child_text (not_valid_before.as_string ());
node->add_child("ContentKeysNotValidAfter")->add_child_text (not_valid_after.as_string ());
- authorized_device_info.as_xml (node->add_child ("AuthorizedDeviceInfo"));
+ if (authorized_device_info) {
+ authorized_device_info->as_xml (node->add_child ("AuthorizedDeviceInfo"));
+ }
key_id_list.as_xml (node->add_child ("KeyIdList"));
- xmlpp::Element* forensic_mark_flag_list = node->add_child ("ForensicMarkFlagList");
- forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text ("http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-picture-disable");
- forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text ("http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-audio-disable");
+ if (disable_forensic_marking_picture || disable_forensic_marking_audio) {
+ xmlpp::Element* forensic_mark_flag_list = node->add_child ("ForensicMarkFlagList");
+ if (disable_forensic_marking_picture) {
+ forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text(picture_disable);
+ }
+ if (disable_forensic_marking_audio) {
+ string mrkflg = audio_disable;
+ if (*disable_forensic_marking_audio > 0) {
+ mrkflg += String::compose ("-above-channel-%1", *disable_forensic_marking_audio);
+ }
+ forensic_mark_flag_list->add_child("ForensicMarkFlag")->add_child_text (mrkflg);
+ }
+ }
}
Recipient recipient;
string content_title_text;
LocalTime not_valid_before;
LocalTime not_valid_after;
- AuthorizedDeviceInfo authorized_device_info;
+ bool disable_forensic_marking_picture;
+ optional<int> disable_forensic_marking_audio;
+ boost::optional<AuthorizedDeviceInfo> authorized_device_info;
KeyIdList key_id_list;
+
+private:
+ static const string picture_disable;
+ static const string audio_disable;
};
+const string KDMRequiredExtensions::picture_disable = "http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-picture-disable";
+const string KDMRequiredExtensions::audio_disable = "http://www.smpte-ra.org/430-1/2006/KDM#mrkflg-audio-disable";
+
class RequiredExtensions
{
public:
RequiredExtensions () {}
- RequiredExtensions (shared_ptr<const cxml::Node> node)
+ explicit RequiredExtensions (shared_ptr<const cxml::Node> node)
: kdm_required_extensions (node->node_child ("KDMRequiredExtensions"))
{
, issue_date (LocalTime().as_string ())
{}
- AuthenticatedPublic (shared_ptr<const cxml::Node> node)
+ explicit AuthenticatedPublic (shared_ptr<const cxml::Node> node)
: message_id (remove_urn_uuid (node->string_child ("MessageId")))
, annotation_text (node->optional_string_child ("AnnotationText"))
, issue_date (node->string_child ("IssueDate"))
}
- EncryptedKDMData (shared_ptr<const cxml::Node> node)
+ explicit EncryptedKDMData (shared_ptr<const cxml::Node> node)
: authenticated_public (node->node_child ("AuthenticatedPublic"))
, authenticated_private (node->node_child ("AuthenticatedPrivate"))
, signature (node->node_child ("Signature"))
xmlAddID (0, document->cobj(), (const xmlChar *) i->first.c_str(), i->second->cobj ());
}
+ indent (document->get_root_node(), 0);
return document;
}
EncryptedKDM::EncryptedKDM (string s)
{
- shared_ptr<cxml::Document> doc (new cxml::Document ("DCinemaSecurityMessage"));
- doc->read_string (s);
- _data = new data::EncryptedKDMData (doc);
+ try {
+ shared_ptr<cxml::Document> doc (new cxml::Document ("DCinemaSecurityMessage"));
+ doc->read_string (s);
+ _data = new data::EncryptedKDMData (doc);
+ } catch (xmlpp::parse_error& e) {
+ throw KDMFormatError (e.what ());
+ }
}
+/** @param trusted_devices Trusted device thumbprints */
EncryptedKDM::EncryptedKDM (
shared_ptr<const CertificateChain> signer,
Certificate recipient,
- vector<Certificate> trusted_devices,
- string device_list_description,
+ vector<string> trusted_devices,
string cpl_id,
string content_title_text,
optional<string> annotation_text,
LocalTime not_valid_before,
LocalTime not_valid_after,
Formulation formulation,
+ bool disable_forensic_marking_picture,
+ optional<int> disable_forensic_marking_audio,
list<pair<string, string> > key_ids,
list<string> keys
)
{
/* Fill our XML-ish description in with the juicy bits that the caller has given */
+ /* Our ideas, based on http://isdcf.com/papers/ISDCF-Doc5-kdm-certs.pdf, about the KDM types are:
+ *
+ * Type Trusted-device thumb ContentAuthenticator
+ * MODIFIED_TRANSITIONAL_1 assume-trust No
+ * MULTIPLE_MODIFIED_TRANSITIONAL_1 as specified No
+ * DCI_ANY assume-trust Yes
+ * DCI_SPECIFIC as specified Yes
+ */
+
data::AuthenticatedPublic& aup = _data->authenticated_public;
aup.signer.x509_issuer_name = signer->leaf().issuer ();
aup.signer.x509_serial_number = signer->leaf().serial ();
kre.recipient.x509_issuer_serial.x509_issuer_name = recipient.issuer ();
kre.recipient.x509_issuer_serial.x509_serial_number = recipient.serial ();
kre.recipient.x509_subject_name = recipient.subject ();
- kre.authorized_device_info.device_list_description = device_list_description;
kre.composition_playlist_id = cpl_id;
if (formulation == DCI_ANY || formulation == DCI_SPECIFIC) {
kre.content_authenticator = signer->leaf().thumbprint ();
kre.content_title_text = content_title_text;
kre.not_valid_before = not_valid_before;
kre.not_valid_after = not_valid_after;
- kre.authorized_device_info.device_list_identifier = make_uuid ();
- string n = recipient.subject_common_name ();
- if (n.find (".") != string::npos) {
- n = n.substr (n.find (".") + 1);
- }
- kre.authorized_device_info.device_list_description = n;
-
- if (formulation == MODIFIED_TRANSITIONAL_1 || formulation == DCI_ANY) {
- /* Use the "assume trust" thumbprint */
- kre.authorized_device_info.certificate_thumbprints.push_back ("2jmj7l5rSw0yVb/vlWAYkK/YBwk=");
- } else if (formulation == DCI_SPECIFIC) {
- /* As I read the standard we should use the recipient
- /and/ other trusted device thumbprints here. MJD
- reports that this doesn't work with his setup;
- a working KDM does not include the recipient's
- thumbprint (recipient.thumbprint()).
- */
- BOOST_FOREACH (Certificate const & i, trusted_devices) {
- kre.authorized_device_info.certificate_thumbprints.push_back (i.thumbprint ());
+ kre.disable_forensic_marking_picture = disable_forensic_marking_picture;
+ kre.disable_forensic_marking_audio = disable_forensic_marking_audio;
+
+ if (formulation != MODIFIED_TRANSITIONAL_TEST) {
+ kre.authorized_device_info = data::AuthorizedDeviceInfo ();
+ kre.authorized_device_info->device_list_identifier = make_uuid ();
+ string n = recipient.subject_common_name ();
+ if (n.find (".") != string::npos) {
+ n = n.substr (n.find (".") + 1);
+ }
+ kre.authorized_device_info->device_list_description = n;
+
+ if (formulation == MODIFIED_TRANSITIONAL_1 || formulation == DCI_ANY) {
+ /* Use the "assume trust" thumbprint */
+ kre.authorized_device_info->certificate_thumbprints.push_back ("2jmj7l5rSw0yVb/vlWAYkK/YBwk=");
+ } else if (formulation == MULTIPLE_MODIFIED_TRANSITIONAL_1 || formulation == DCI_SPECIFIC) {
+ if (trusted_devices.empty ()) {
+ /* Fall back on the "assume trust" thumbprint so we
+ can generate "modified-transitional-1" KDMs
+ together with "multiple-modified-transitional-1"
+ KDMs in one go, and similarly for "dci-any" etc.
+ */
+ kre.authorized_device_info->certificate_thumbprints.push_back ("2jmj7l5rSw0yVb/vlWAYkK/YBwk=");
+ } else {
+ /* As I read the standard we should use the
+ recipient /and/ other trusted device thumbprints
+ here. MJD reports that this doesn't work with
+ his setup; a working KDM does not include the
+ recipient's thumbprint (recipient.thumbprint()).
+ Waimea uses only the trusted devices here, too.
+ */
+ BOOST_FOREACH (string i, trusted_devices) {
+ kre.authorized_device_info->certificate_thumbprints.push_back (i);
+ }
+ }
}
}
xmlpp::Node::NodeList children = doc->get_root_node()->get_children ();
for (xmlpp::Node::NodeList::const_iterator i = children.begin(); i != children.end(); ++i) {
if ((*i)->get_name() == "Signature") {
- signer->add_signature_value (*i, "ds");
+ signer->add_signature_value (dynamic_cast<xmlpp::Element*>(*i), "ds", false);
}
}
return _data->authenticated_private.encrypted_key;
}
+string
+EncryptedKDM::id () const
+{
+ return _data->authenticated_public.message_id;
+}
+
optional<string>
EncryptedKDM::annotation_text () const
{
return _data->authenticated_public.issue_date;
}
+LocalTime
+EncryptedKDM::not_valid_before () const
+{
+ return _data->authenticated_public.required_extensions.kdm_required_extensions.not_valid_before;
+}
+
+LocalTime
+EncryptedKDM::not_valid_after () const
+{
+ return _data->authenticated_public.required_extensions.kdm_required_extensions.not_valid_after;
+}
+
+string
+EncryptedKDM::recipient_x509_subject_name () const
+{
+ return _data->authenticated_public.required_extensions.kdm_required_extensions.recipient.x509_subject_name;
+}
+
bool
dcp::operator== (EncryptedKDM const & a, EncryptedKDM const & b)
{
projects / libdcp.git / blobdiff