File: xmlenc.h

package info (click to toggle)
virtuoso-opensource 6.1.6+dfsg2-4
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, buster, sid, stretch
  • size: 260,992 kB
  • ctags: 125,220
  • sloc: ansic: 652,748; sql: 458,419; xml: 282,834; java: 61,031; sh: 40,031; cpp: 36,890; cs: 25,240; php: 12,692; yacc: 9,523; lex: 7,018; makefile: 6,157; jsp: 4,484; awk: 1,643; perl: 1,013; ruby: 1,003; python: 326
file content (812 lines) | stat: -rw-r--r-- 22,960 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
/*
 *  xmlenc.h
 *
 *  $Id$
 *
 *  This file is part of the OpenLink Software Virtuoso Open-Source (VOS)
 *  project.
 *
 *  Copyright (C) 1998-2012 OpenLink Software
 *
 *  This project is free software; you can redistribute it and/or modify it
 *  under the terms of the GNU General Public License as published by the
 *  Free Software Foundation; only version 2 of the License, dated June 1991.
 *
 *  This program is distributed in the hope that it will be useful, but
 *  WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 *  General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License along
 *  with this program; if not, write to the Free Software Foundation, Inc.,
 *  51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
 *
 */

#ifndef XMLENC_ALGO_H
#define XMLENC_ALGO_H
#include <openssl/opensslv.h>
#if (OPENSSL_VERSION_NUMBER < 0x00907000L)
/*#warning aes is not supported*/
#else
#define AES_ENC_ENABLE
#endif

#include <openssl/evp.h>
#include <openssl/dsa.h>
#include <openssl/rsa.h>
#include <openssl/des.h>
#include <openssl/hmac.h>

#ifdef AES_ENC_ENABLE
#include <openssl/aes.h>
#endif

#include <openssl/x509.h>
#include <openssl/rand.h>

#if defined (SHA256_DIGEST_LENGTH)
#define SHA256_ENABLE
#endif


#include "libutil.h"
#include "soap.h"

#ifdef _KERBEROS
#include <krb5.h>
#include <gssapi/gssapi.h>
#include <gssapi/gssapi_generic.h>
#include <gssapi/gssapi_krb5.h>
#endif


/* uris */
/* from Web Services Security Addendum */
#if 0
#define WSS_SOAP_URI	"http://www.w3.org/2001/12/soap-envelope"
#else
#define WSS_SOAP_URI	SOAP_URI (11)
#endif
#define WSS_DSIG_URI	  "http://www.w3.org/2000/09/xmldsig#"
#define WSS_XENC_URI	  "http://www.w3.org/2001/04/xmlenc#"
#define WSS_M_URI	  "http://schemas.xmlsoap.org/rp"

/* security extensions for SOAP variants */
#define WSS_WSS_URI	  "http://schemas.xmlsoap.org/ws/2002/12/secext"
#define WSS_WSS_URI_0204  "http://schemas.xmlsoap.org/ws/2002/04/secext"
#define WSS_WSS_URI_0207  "http://schemas.xmlsoap.org/ws/2002/07/secext"
#define WSS_WSS_URI_OASIS "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"

/* utilities variants */
#define WSS_WSU_URI	  "http://schemas.xmlsoap.org/ws/2002/07/utility"
#define WSS_WSU_URI_OASIS "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"

/* XML Schema */
#define WSS_XSD_URI	  "http://www.w3.org/2001/XMLSchema"

#define XENC_URI WSS_XENC_URI
#define DSIG_URI WSS_DSIG_URI

/* aliases */
#define WSSE_URI(sctx) (sctx ? wsse_uris[(sctx)->wsc_wsse] : WSS_WSS_URI)
#define WSU_URI(sctx)  (sctx ? wsu_uris[(sctx)->wsc_wsu] : WSS_WSU_URI)

extern char * wsse_uris[]; /* defined in xmlenc.c */
extern char * wsu_uris[];

typedef enum {
  WSS0212 = 0,
  WSS0204,
  WSS0207,
  WSOASIS
} WSSE_TYPE_T;

typedef enum {
  WSU0207 = 0,
  WSUOASIS
} WSU_TYPE_T;


#define XENC_NS			XENC_URI
#define XENC_NAMESPACE_STR	"xmlns:xenc=\"" XENC_NS "\""
#define DSIG_NS			DSIG_URI
#define DSIG_PRX		"ds"
#define DS_NAMESPACE_STR	"xmlns:" DSIG_PRX "=\"" DSIG_NS "\""

#define XENC_ELEMENT_NS		XENC_NS "Element"


/* algos */
#define DSIG_RSA_URI	"http://www.w3.org/2000/09/xmldsig#rsa"
#define XML_CANON_EXC_ALGO	"http://www.w3.org/2001/10/xml-exc-c14n#"
#define XML_CANON_EXC_20010315_ALGO	"http://www.w3.org/TR/2001/REC-xml-c14n-20010315"

#define XENC_BASE64_ALGO	"http://www.w3.org/2001/04/xmlenc#base64"
#define XENC_TRIPLEDES_ALGO	"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
#define XENC_DES3_ALGO		"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
/* key transport */
#define XENC_RSA_ALGO		"http://www.w3.org/2001/04/xmlenc#rsa-1_5"
#define XENC_DSA_ALGO		"http://www.w3.org/2001/04/xmlenc#dsa"
#define XENC_DH_ALGO		"http://www.w3.org/2001/04/xmlenc#dh"

/* block encryption */
#define XENC_3DES_ALGO		"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
#define XENC_AES128_ALGO	"http://www.w3.org/2001/04/xmlenc#aes128-cbc"
#define XENC_AES192_ALGO	"http://www.w3.org/2001/04/xmlenc#aes192-cbc"
#define XENC_AES256_ALGO	"http://www.w3.org/2001/04/xmlenc#aes256-cbc"

#define DSIG_RSA_URI		"http://www.w3.org/2000/09/xmldsig#rsa"
#define XENC_TRIPLEDES_ALGO	"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
#define DSIG_SHA1_ALGO		"http://www.w3.org/2000/09/xmldsig#sha1"
#define DSIG_SHA256_ALGO	"http://www.w3.org/2000/09/xmldsig#sha256"

#define DSIG_RSA_SHA1_ALGO	"http://www.w3.org/2000/09/xmldsig#rsa-sha1"
#define DSIG_RSA_SHA256_ALGO	"http://www.w3.org/2000/09/xmldsig#rsa-sha256"
#define DSIG_DSA_SHA1_ALGO	"http://www.w3.org/2000/09/xmldsig#dsa-sha1"
#define DSIG_DH_SHA1_ALGO	"http://www.w3.org/2000/09/xmldsig#dh-sha1"
#define DSIG_DH_SHA256_ALGO	"http://www.w3.org/2000/09/xmldsig#dh-sha256"

#define DSIG_HMAC_SHA1_ALGO  	"http://www.w3.org/2000/09/xmldsig#hmac-sha1"
#define DSIG_HMAC_SHA256_ALGO  	"http://www.w3.org/2000/09/xmldsig#hmac-sha256"

/* transforms */
#define DSIG_ENVELOPED_SIGNATURE_ALGO	"http://www.w3.org/2000/09/xmldsig#enveloped-signature"
/* only for internal purposes */
#define DSIG_FAKE_URI_TRANSFORM_ALGO	"fake://www.openlinksw.com/xmldsig#uri"

#define DSIG_XPATH_TRANSFORM_NS	"http://www.w3.org/TR/1999/REC-xpath-19991116"

#define DSIG_TEST_ALGO		"http://localhost/xmldsig#test"

/* fake declaration, only for internal usage */
#define DSIG_KEY_UNSET_URI	"http://www.openlinksw.com/dsig#unset"


#define WSSE_X509_VALUE_TYPE	"wsse:X509v3"
#define WSSE_KERBTGT_VALUE_TYPE	"wsse:Kerberosv5TGT"
#define WSSE_KERBTGS_VALUE_TYPE	"wsse:Kerberosv5ST"

/* OASIS attributes */
#define OASIS_BASE_URI "http://docs.oasis-open.org/wss/2004/01/"
#define WSSE_OASIS_X509_VALUE_TYPE 		OASIS_BASE_URI "oasis-200401-wss-x509-token-profile-1.0#X509v3"
#define WSSE_OASIS_X509_SUBJECT_KEYIDENTIFIER   OASIS_BASE_URI "oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier"
#define WSSE_OASIS_X509_REFERENCE OASIS_BASE_URI "oasis-200401-wss-x509-token-profile-1.0#X509v3"
#define WSSE_OASIS_BASE64_ENCODING_TYPE OASIS_BASE_URI "oasis-200401-wss-soap-message-security-1.0#Base64Binary"
#define WSSE_OASIS_UTOKEN_PROFILE OASIS_BASE_URI "oasis-200401-wss-username-token-profile-1.0"


#define TA_XENC_ERR_BUFFER	1098
#define TA_XENC_ERR_CODE	1099

/* xenc_err_code_t codes */
#define DSIG_CHECK_ERR		200
#define DSIG_TEMPL_ERR		201

#define XENC_UNKNOWN_ALGO_ERR	300
#define XENC_WRITE_ERR		301
#define XENC_ALGO_ERR		302
#define XENC_WRONG_XML_DOC	303
#define XENC_DIFF_KEYS_ALGO_ERR	304
#define XENC_UNKNOWN_SUPER_KEY_ERR	305
#define XENC_UNKNOWN_ID_ERR	306
#define XENC_ENCKEY_ERR		307
#define XENC_PURE_KEY_ERR	308
#define XENC_ID_ERR		309
#define XENC_ENC_ERR		310
#define XENC_REF_EMPTY_ERR	311
#define XENC_UNKNOWN_KEY_ERR	312

#define WSSE_ERR		400

#define xenc_keys _xenc_keys()
#define xenc_certificates _xenc_certificates()
#define xenc_temp_keys _xenc_temp_keys()
id_hash_t * _xenc_certificates (void);

typedef struct {
  int  seed_len;
  int  secret_len;
  char A[20];
  /* Pseudo-elements:
     char seed[seed_len];
     char secret[secret_len];
     The algorithm requires that seed immediately follows A */
} P_SHA1_CTX;


struct xenc_key_s;
typedef struct xenc_key_s xenc_key_t;
typedef ptrlong xenc_err_code_t;

typedef struct xenc_try_block_s
{
  jmp_buf_splice	xtb_buf;
  xenc_err_code_t	xtb_err_code;
  char *		xtb_err_buffer;
} xenc_try_block_t;

typedef int (*xenc_encryptor_f) (dk_session_t * ses_in, long len, dk_session_t * ses_out,
				 xenc_key_t * key, xenc_try_block_t * tb);

typedef int (*xenc_decryptor_f) (dk_session_t * ses_in, long len, dk_session_t * ses_out,
				 xenc_key_t * key, xenc_try_block_t * tb);

typedef int (*dsig_digest_f) (dk_session_t * ses_in, long len, caddr_t * digest_out);

typedef int (*dsig_sign_f) (dk_session_t * ses_in, long len, xenc_key_t * key, caddr_t * sign_out);
typedef int (*dsig_verify_f) (dk_session_t * ses_in, long len, xenc_key_t * key, caddr_t digest);

typedef int (*dsig_transform_f) (query_instance_t * qi, dk_session_t * ses_in, long len,
				 dk_session_t * ses_out, caddr_t transform_data);

typedef int (*dsig_canon_f) (dk_session_t * ses_in, long len, dk_session_t * ses_out);

typedef int (*dsig_canon_2_f) (query_instance_t * qi, caddr_t *  doc_tree, caddr_t * siginfo_tree,
			       id_hash_t * nss, dk_session_t * ses_out);

typedef xenc_key_t * (*xenc_generator_f) (void);

typedef enum {
  DSIG_KEY_RSA = 1,
  DSIG_KEY_DSA = 2,
  DSIG_KEY_3DES = 3,
  DSIG_KEY_AES = 4,
  DSIG_KEY_KERBEROS = 5,
  DSIG_KEY_DH = 6,
  DSIG_KEY_RAW = 15 /* base64 encoded */
} DSIG_KEY_TYPE;

typedef struct xenc_algo_s
{
  char *		xea_ns;
  char *		xea_name;
  DSIG_KEY_TYPE		xea_key_type;
  xenc_encryptor_f	xea_enc;
  xenc_decryptor_f	xea_dect;
  xenc_generator_f	xea_gen;
} xenc_algo_t;

typedef enum {
  UTOK_PASSWORD_TEXT = 0,
  UTOK_PASSWORD_DIGEST,
  UTOK_PASSWORD_NONE
} XENC_UTOK_TYPE;

typedef struct u_tok_s
{
  caddr_t 	uname;
  caddr_t 	pass;
  caddr_t 	nonce;
  caddr_t	ts;
  XENC_UTOK_TYPE type;
} u_tok_t;

typedef uuid_t * xenc_id_t;

#define xek_rsa ki.rsa.rsa_st
#define xek_private_rsa ki.rsa.private_rsa_st
#define xek_dsa ki.dsa.dsa_st
#define xek_private_dsa ki.dsa.private_dsa_st
#define xek_kerberos_tgs ki.kerb.tkt
#define xek_dh ki.dh.dh_st
#define xek_private_dh ki.dh.private_dh_st

struct xenc_key_s
{
  char *	xek_name;
  xenc_algo_t *	xek_enc_algo;
  xenc_algo_t * xek_sign_algo;

  DSIG_KEY_TYPE	xek_type;
  union {
    struct dsig_rsa_keyinfo_s
    {
      RSA*	rsa_st;
      RSA*	private_rsa_st;
      unsigned  char pad;
    } rsa;
    struct dsig_dsa_keyinfo_s
    {
      DSA*	dsa_st;
      DSA*	private_dsa_st;
    } dsa;
    struct dsig_des3_keyinfo_s
    {
      DES_cblock k1;
      DES_cblock k2;
      DES_cblock k3;

      DES_key_schedule ks1;/* key schedule */
      DES_key_schedule ks2;/* key schedule (for ede) */
      DES_key_schedule ks3;/* key schedule (for ede3) */

      DES_cblock iv;
#define PKCS5_SALT_LEN			8
      unsigned char salt[PKCS5_SALT_LEN];
    } triple_des;
#ifdef AES_ENC_ENABLE
    struct dsig_aes_keyinfo_s
    {
      /* key */
      unsigned char *	k;
      int		bits;
      unsigned char	iv[16];
    } aes;
#endif
#ifdef _KERBEROS
    struct dsig_kerberos_s
    {
      char *		service_name;
      gss_ctx_id_t	context;
      caddr_t		tkt;
    } kerb;
#endif
    struct dsig_dh_keyinfo_s
    {
      DH*	dh_st;
      DH*	private_dh_st;
    } dh;
    struct  dsig_raw_keyinfo_s
    {
      unsigned char *   k;
      int               bits;
    } raw;
  } ki; /* union is select by xek_type */
  EVP_PKEY *	xek_evp_key;
  EVP_PKEY *	xek_evp_private_key;
  X509 *	xek_x509;
  xenc_id_t	xek_x509_ref;
  caddr_t	xek_x509_ref_str;
  caddr_t	xek_x509_KI; /* subject key identifier, optional */
  caddr_t	xek_kerb_KI; /* ? ? ? kerberos key identifier, optional */
  u_tok_t *	xek_utok;
  int 		xek_is_temp;
};

struct xenc_key_inst_s;
typedef struct xenc_key_inst_s xenc_key_inst_t;


struct xenc_key_inst_s
{
  char *		xeki_key_name;
  xenc_key_inst_t *	xeki_super_key_inst;/* Indicates that this key
					       instance (this*) must be
					       encrypted also by super key */
  xenc_id_t *		xeki_ids;
};

typedef char * xenc_reference_t;

typedef struct xenc_enc_key_s
{
  char *		xeke_name;
  char *		xeke_enc_method;
  char *		xeke_super_key;

  char *		xeke_carried_key_name;
  caddr_t		xeke_cipher_value;
  dk_set_t		xeke_refs; /* xenc_reference_t */

  xenc_key_t *		xeke_encrypted_key;
  int			xeke_is_raw;
} xenc_enc_key_t;


typedef struct xenc_doc_s
{
  id_hash_t		xed_keys; /* key instances */
  xml_tree_ent_t *	xed_doc;
} xenc_doc_t ;

typedef struct xpath_keyinst_s xpath_keyinst_t;

typedef struct xenc_enc_s
{
  dk_set_t		xed_keis; /* key instances */
} xenc_enc_t;

typedef struct xenc_dec_s
{
  dk_set_t		xed_keys; /* xenc_enc_key_t */
  dk_set_t		xed_cert_ids; /* char*s */
} xenc_dec_t;

/* Signature declarations */
typedef struct dsig_transform_s
{
  char *		dst_name;
  caddr_t		dst_data; /* additional data for transform */
} dsig_transform_t;

typedef struct dsig_reference_s
{
  dk_set_t	 	dsr_transforms; /* type dsig_transform_f */
  char *		dsr_digest_method;
  char *		dsr_uri;
  char *		dsr_type;
  char *		dsr_id;
  char *		dsr_digest; /* computed by method below */
  char *		dsr_text; /* result of reference */
} dsig_reference_t;

typedef enum {
  XENC_T_DEFAULT = 0,
  XENC_T_X509_CERT = 1
} XENC_VALUE_TYPE_T;

typedef struct dsig_signature_s
{
  char *	dss_canon_method;
  char *	dss_signature_method;
  dk_set_t	dss_refs; /* type dsig_reference_t */
  char *	dss_signature; /* computed by dss_signature_method */
  char *	dss_signature_1;

  xenc_key_t *	dss_key;
  XENC_VALUE_TYPE_T dss_key_value_type;
} dsig_signature_t;

typedef struct dsig_compare_s
{
  char *	dsc_obj;
  char *	dsc_value1;
  char *	dsc_value2;
} dsig_compare_t;

/* WSSE declarations */

typedef char* wsse_error_t;

/* where KeyInfo can appear */
typedef enum {
  XENC_T_ENCKEY = 1,
  XENC_T_DSIG = 2,
  XENC_T_ENCCTX = 3,
  XENC_T_SECURITY = 4
} XENC_TYPE_T;

typedef struct wsse_ser_ctx_s
{
  WSSE_TYPE_T		wsc_wsse;
  WSU_TYPE_T		wsc_wsu;
} wsse_ser_ctx_t;


typedef struct wsse_ctx_s
{
  dsig_signature_t *	wc_dsig;
  dsig_reference_t *	wc_curr_ref;
  dsig_transform_t *	wc_curr_transform;

  xenc_dec_t *		wc_dec;
  xenc_enc_key_t *	wc_curr_enckey;

  xenc_key_t *		wc_key;

  XENC_TYPE_T		wc_object_type;
  int			wc_allow_empty_vals; /*!< allow some uninitialized values, which will be resolved later */

  id_hash_t *		wc_id_cache;

  caddr_t *		wc_opts;

  int			wc_is_try_block;
  xenc_try_block_t	wc_tb;
} wsse_ctx_t;

struct xpath_keyinst_s;
struct subst_item_s;

typedef struct xml_doc_subst_s
{
  xml_tree_ent_t *	xs_doc;
#if 0
  caddr_t *		xs_origs; /* tree elements */
  caddr_t *		xs_copies; /* texts */
#endif
  struct subst_item_s *	xs_subst_items;
  caddr_t *		xs_discard;
  caddr_t *		xs_envelope;
  caddr_t *		xs_new_child_tags;
  int			xs_soap_version;
  int			xs_sign;
  id_hash_t *		xs_namespaces;
  dk_set_t		xs_parent_link;
} xml_doc_subst_t;



void dsig_free (dsig_signature_t * dsig);
dsig_signature_t * dsig_copy_draft (dsig_signature_t * dsig);
/* pre: dsig must be empty. All algorithms must be valid.
   post: fills dsig object, only DigestValue remains untouched.

   exceptions: no
*/
xenc_err_code_t dsig_initialize (query_instance_t * qi, dk_session_t * doc, long xml_ses_len,
	dsig_signature_t * dsig, xenc_err_code_t * c, char ** err);


int dsig_compare (dsig_signature_t * d1, dsig_signature_t * d2, dsig_compare_t * cmp);

int dsig_digest_algo_create (const char* xmln, dsig_digest_f f);
int dsig_sign_algo_create (const char * xmln, dsig_sign_f f);
int dsig_verify_algo_create (const char * xmln, dsig_verify_f f);

dsig_canon_f dsig_canon_f_get (const char * name, xenc_try_block_t * t);
dsig_canon_2_f dsig_canon_2_f_get (const char * name, xenc_try_block_t * t);
dsig_sign_f dsig_sign_f_get (const char * name, xenc_try_block_t * t);
dsig_verify_f dsig_verify_f_get (const char * name, xenc_try_block_t * t);
dsig_digest_f dsig_digest_f_get (const char * name, xenc_try_block_t * t);
dsig_transform_f dsig_transform_f_get (const char * name, xenc_try_block_t * t);

#include "xmlenc_algos.h"

#define XENC_WAR	1
#define XENC_ERR	2
#define XENC_FATAL	3

#define XENC_TRY(tb) { (tb)->xtb_err_code = 0; (tb)->xtb_err_buffer = 0; if (0 == setjmp_splice (&(tb)->xtb_buf))
#define XENC_CATCH else
#define XENC_TRY_END(tb) dk_free_box ( (tb)->xtb_err_buffer ); (tb)->xtb_err_buffer = 0; }
#define XENC_SIGNAL(tb,type) longjmp_splice (&(tb)->xtb_buf, type)
#define XENC_SIGNAL_WAR(tb) XENC_SIGNAL(tb, XENC_WAR)
#define XENC_SIGNAL_ERR(tb) XENC_SIGNAL(tb, XENC_ERR)
#define XENC_SIGNAL_FATAL(tb) XENC_SIGNAL(tb, XENC_FATAL)


void algo_stores_init (void);

caddr_t * signature_serialize_1 (dsig_signature_t * dsig, wsse_ser_ctx_t * sctx);

void xenc_make_error (char * buf,long  maxlen, xenc_err_code_t c, const char * err);

void wsse_report_error (wsse_ctx_t * ctx, char * code, int buflen, ...);
void xenc_report_error (xenc_try_block_t * t, long buflen, xenc_err_code_t c, char * errbuf, ...);

xenc_err_code_t xenc_decrypt_xml (query_instance_t * qi, xenc_dec_t * enc, caddr_t in_xml, caddr_t encode,
				  lang_handler_t * lh,  dk_session_t * out_xml, xenc_err_code_t * c,
				  char ** err);

caddr_t * xenc_get_namespaces (caddr_t * curr, id_hash_t * namespaces);
caddr_t xml_doc_subst (xml_doc_subst_t * xs);
void xml_doc_subst_free(xml_doc_subst_t * xs);

xenc_key_t * xenc_build_encrypted_key (const char * carried_name, dk_session_t * in,
				       const char * algo_name,  xenc_try_block_t * t);
xenc_key_t * xenc_key_create (const char * name,  const char * enc_type, const char * sign_type, int lock);
dsig_signature_t * dsig_template_ (query_instance_t * qi, caddr_t signature_xml_text, xenc_try_block_t * t, caddr_t * opts);
caddr_t dsig_sign_signature_ (query_instance_t * qi, dsig_signature_t * dsig, caddr_t dsig_template, xenc_err_code_t * c, char ** c_err);
xenc_algo_t * xenc_algorithms_get (const char* name);
#ifdef MALLOC_DEBUG
caddr_t dbg_wsse_get_content_val (DBG_PARAMS caddr_t * tag);
#define wsse_get_content_val(tag) dbg_wsse_get_content_val (__FILE__,__LINE__,tag)
#else
caddr_t wsse_get_content_val (caddr_t * curr);
#endif


xenc_key_t * xenc_key_aes_create (const char * name, int keylen, const char * pwd);
void xenc_key_remove (xenc_key_t * key, int lock);
int __xenc_key_dsa_init (char *name, int lock);
int __xenc_key_dh_init (char *name, int lock);

void xenc_key_3des_init (xenc_key_t * pkey, unsigned char * k1, unsigned char * k2, unsigned char * k3);
int xml_c_build_ancessor_ns_link (caddr_t * doc_tree, caddr_t * select_tree,
				  id_hash_t * nss, dk_set_t * parent_link);
xenc_key_t * xenc_get_key_by_name (const char * name, int protect);
void xenc_ids_hash_free (id_hash_t * ids);
void xenc_build_ids_hash (caddr_t * curr, id_hash_t ** id_hash, int only_encrypted_data);

caddr_t xmlenc_decrypt_soap (caddr_t * qst, char * xml_text, long soap_version, long validate_sign,
                     const char * enc, lang_handler_t *lh, caddr_t * err_ret, caddr_t * opts, caddr_t *rkeys);

xenc_key_t *certificate_decode (caddr_t encoded_cert, const char * value_type,
				 const char * encoding_type);
caddr_t xenc_x509_get_key_identifier (X509 * cert);
caddr_t xenc_x509_KI_base64 (X509 * cert);
caddr_t xenc_get_keyname_by_ki (caddr_t keyident);
xenc_key_t * xenc_get_key_by_keyidentifier (caddr_t keyident, int lock);
int xenc_algorithms_create (const char * ns0, const char * name,
			    xenc_encryptor_f enc,
			    xenc_decryptor_f dect,
			    DSIG_KEY_TYPE key_type);
caddr_t * xml_find_signedinfo (caddr_t * root, int is_wsse);
caddr_t * xml_find_signature (caddr_t * root, int is_wsse);
wsse_ctx_t * wsse_ctx_allocate (void);
void wsse_ctx_free (wsse_ctx_t * ctx);
caddr_t dsig_sign_signature (dsig_signature_t * dsig, xml_tree_ent_t * xte, id_hash_t * nss, wsse_ctx_t * ctx);
int xenc_encode_base64(char * input, char * output, size_t len);
int xenc_decode_base64(char * src, char * end);
xenc_key_t * xenc_key_create_from_utok (u_tok_t * utok, caddr_t seed, wsse_ctx_t * ctx);
void xenc_set_serialization_ctx (caddr_t try_ns_spec, wsse_ser_ctx_t * sctx);
caddr_t bif_xmlenc_decrypt_soap (caddr_t * qst, caddr_t * err_ret, state_slot_t ** args);
caddr_t bif_dsig_validate (caddr_t * qst, caddr_t * err_ret, state_slot_t ** args);
caddr_t xenc_get_option (caddr_t *options, const char * opt, char * def);
caddr_t certificate_encode (BIO * b, const char * encoding_type);
caddr_t * xml_find_any_child (caddr_t * curr, const char * name, const char * uri);

extern dk_mutex_t * xenc_keys_mtx;

#if OPENSSL_VERSION_NUMBER < 0x10100000

static inline HMAC_CTX *HMAC_CTX_new(void)
{
	HMAC_CTX *p;

	p = calloc(1, sizeof(HMAC_CTX));
	if (!p)
		return p;
	HMAC_CTX_init(p);
	return p;
}

static inline void HMAC_CTX_free(HMAC_CTX *ctx)
{
	HMAC_CTX_cleanup(ctx);
	free(ctx);
}

static inline void RSA_get0_key(const RSA *r, const BIGNUM **n,
				const BIGNUM **e, const BIGNUM **d)
{
	if (n != NULL)
		*n = r->n;
	if (e != NULL)
		*e = r->e;
	if (d != NULL)
		*d = r->d;
}

static inline void RSA_get0_factors(const RSA *r, const BIGNUM **p,
				    const BIGNUM **q)
{
	if (p != NULL)
		*p = r->p;
	if (q != NULL)
		*q = r->q;
}

static inline RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
{
	if (pkey->type != EVP_PKEY_RSA)
		return NULL;
	return pkey->pkey.rsa;
}

static inline void DH_get0_key(const DH *dh, const BIGNUM **pub_key,
			       const BIGNUM **priv_key)
{
	if (pub_key != NULL)
		*pub_key = dh->pub_key;
	if (priv_key != NULL)
		*priv_key = dh->priv_key;
}


static inline void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q,
			       const BIGNUM **g)
{
	if (p != NULL)
		*p = dh->p;
	if (q != NULL)
		*q = dh->q;
	if (g != NULL)
		*g = dh->g;
}

static inline DSA *EVP_PKEY_get0_DSA(EVP_PKEY *pkey)
{
	if (pkey->type != EVP_PKEY_DSA)
		return NULL;
	return pkey->pkey.dsa;
}

static inline int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
{
	/* If the fields p and g in d are NULL, the corresponding input
	 * parameters MUST be non-NULL.  q may remain NULL.
	 */
	if ((dh->p == NULL && p == NULL)
	    || (dh->g == NULL && g == NULL))
		return 0;

	if (p != NULL) {
		BN_free(dh->p);
		dh->p = p;
	}
	if (q != NULL) {
		BN_free(dh->q);
		dh->q = q;
	}
	if (g != NULL) {
		BN_free(dh->g);
		dh->g = g;
	}

	if (q != NULL) {
		dh->length = BN_num_bits(q);
	}

	return 1;
}

static inline int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d)
{
	/* If the fields n and e in r are NULL, the corresponding input
	 * parameters MUST be non-NULL for n and e.  d may be
	 * left NULL (in case only the public key is used).
	 */
	if ((r->n == NULL && n == NULL)
	    || (r->e == NULL && e == NULL))
		return 0;

	if (n != NULL) {
		BN_free(r->n);
		r->n = n;
	}
	if (e != NULL) {
		BN_free(r->e);
		r->e = e;
	}
	if (d != NULL) {
		BN_free(r->d);
		r->d = d;
	}

	return 1;
}

static inline void DSA_get0_pqg(const DSA *d, const BIGNUM **p,
				const BIGNUM **q, const BIGNUM **g)
{
	if (p != NULL)
		*p = d->p;
	if (q != NULL)
		*q = d->q;
	if (g != NULL)
		*g = d->g;
}

static inline void DSA_get0_key(const DSA *d, const BIGNUM **pub_key,
				const BIGNUM **priv_key)
{
	if (pub_key != NULL)
		*pub_key = d->pub_key;
	if (priv_key != NULL)
		*priv_key = d->priv_key;
}

static inline const STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x)
{
	return x->cert_info->extensions;
}

static inline int X509_up_ref(X509 *x)
{
	return CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
}

static inline STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v)
{
	return v->objs;
}

static inline int X509_OBJECT_get_type(const X509_OBJECT *a)
{
	return a->type;
}

static inline X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a)
{
	if (a == NULL || a->type != X509_LU_X509)
		return NULL;
	return a->data.x509;
}

#endif

#endif