xmlsecurity/source/gpg/SecurityEnvironment.cxx

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /*
   3  * This file is part of the LibreOffice project.
   4  *
   5  * This Source Code Form is subject to the terms of the Mozilla Public
   6  * License, v. 2.0. If a copy of the MPL was not distributed with this
   7  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8  */
   9
  10 #include <config_gpgme.h>
  11
  12 #include "SecurityEnvironment.hxx"
  13 #include "CertificateImpl.hxx"
  14
  15 #include <cppuhelper/supportsservice.hxx>
  16 #include <comphelper/servicehelper.hxx>
  17 #include <list>
  18
  19 #ifdef _WIN32
  20 #include <config_folders.h>
  21 #include <osl/file.hxx>
  22 #include <osl/process.h>
  23 #include <rtl/bootstrap.hxx>
  24 #include <tools/urlobj.hxx>
  25 #endif
  26
  27 #include <key.h>
  28 #include <keylistresult.h>
  29 #include <xmlsec-wrapper.h>
  30
  31 using namespace css;
  32 using namespace css::security;
  33 using namespace css::uno;
  34 using namespace css::lang;
  35
  36 SecurityEnvironmentGpg::SecurityEnvironmentGpg()
  37 {
  38 #ifdef _WIN32
  39     // On Windows, gpgme expects gpgme-w32spawn.exe to be in the same directory as the current
  40     // process executable. This assumption might be wrong, e.g., for bundled python, which is
  41     // in instdir/program/python-core-x.y.z/bin, while gpgme-w32spawn.exe is in instdir/program.
  42     // If we can't find gpgme-w32spawn.exe in the current executable location, then try to find
  43     // the spawn executable, and inform gpgme about actual location using gpgme_set_global_flag.
  44     static bool bSpawnPathInitialized = [] {
  45         auto accessUrl = [](const INetURLObject& url) {
  46             osl::File file(url.GetMainURL(INetURLObject::DecodeMechanism::NONE));
  47             return file.open(osl_File_OpenFlag_Read) == osl::FileBase::E_None;
  48         };
  49         OUString sPath;
  50         osl_getExecutableFile(&sPath.pData);
  51         INetURLObject aPathUrl(sPath);
  52         aPathUrl.setName("gpgme-w32spawn.exe");
  53         if (!accessUrl(aPathUrl))
  54         {
  55             sPath = "$BRAND_BASE_DIR/" LIBO_LIBEXEC_FOLDER "/gpgme-w32spawn.exe";
  56             rtl::Bootstrap::expandMacros(sPath);
  57             aPathUrl.SetURL(sPath);
  58             if (accessUrl(aPathUrl))
  59             {
  60                 aPathUrl.removeSegment();
  61                 GpgME::setGlobalFlag("w32-inst-dir",
  62                                      aPathUrl.getFSysPath(FSysStyle::Dos).toUtf8().getStr());
  63             }
  64         }
  65         return true;
  66     }();
  67 #endif
  68     GpgME::Error err = GpgME::checkEngine(GpgME::OpenPGP);
  69     if (err)
  70         throw RuntimeException("The GpgME library failed to initialize for the OpenPGP protocol.");
  71
  72     m_ctx.reset( GpgME::Context::createForProtocol(GpgME::OpenPGP) );
  73     if (m_ctx == nullptr)
  74         throw RuntimeException("The GpgME library failed to initialize for the OpenPGP protocol.");
  75     m_ctx->setArmor(false);
  76 }
  77
  78 SecurityEnvironmentGpg::~SecurityEnvironmentGpg()
  79 {
  80 }
  81
  82 /* XUnoTunnel */
  83 sal_Int64 SAL_CALL SecurityEnvironmentGpg::getSomething( const Sequence< sal_Int8 >& aIdentifier )
  84 {
  85     if( aIdentifier.getLength() == 16 && 0 == memcmp( getUnoTunnelId().getConstArray(), aIdentifier.getConstArray(), 16 ) ) {
  86         return sal::static_int_cast<sal_Int64>(reinterpret_cast<sal_uIntPtr>(this));
  87     }
  88     return 0 ;
  89 }
  90
  91 /* XUnoTunnel extension */
  92
  93 namespace
  94 {
  95     class theSecurityEnvironmentUnoTunnelId  : public rtl::Static< UnoTunnelIdInit, theSecurityEnvironmentUnoTunnelId > {};
  96 }
  97
  98 const Sequence< sal_Int8>& SecurityEnvironmentGpg::getUnoTunnelId() {
  99     return theSecurityEnvironmentUnoTunnelId::get().getSeq();
 100 }
 101
 102 OUString SecurityEnvironmentGpg::getSecurityEnvironmentInformation()
 103 {
 104     return OUString();
 105 }
 106
 107 Sequence< Reference < XCertificate > > SecurityEnvironmentGpg::getCertificatesImpl( bool bPrivateOnly )
 108 {
 109     CertificateImpl* xCert;
 110     std::list< GpgME::Key > keyList;
 111     std::list< CertificateImpl* > certsList;
 112
 113     m_ctx->setKeyListMode(GPGME_KEYLIST_MODE_LOCAL);
 114     GpgME::Error err = m_ctx->startKeyListing("", bPrivateOnly );
 115     while (!err) {
 116         GpgME::Key k = m_ctx->nextKey(err);
 117         if (err)
 118             break;
 119         if (!k.isRevoked() && !k.isExpired() && !k.isDisabled() && !k.isInvalid()) {
 120             // We can't create CertificateImpl here as CertificateImpl::setCertificate uses GpgME API
 121             // which interrupts our key listing here. So first get the keys from GpgME, then create the CertificateImpls
 122             keyList.push_back(k);
 123         }
 124     }
 125     m_ctx->endKeyListing();
 126
 127     for (auto const& key : keyList) {
 128         xCert = new CertificateImpl();
 129         xCert->setCertificate(m_ctx.get(),key);
 130         certsList.push_back(xCert);
 131     }
 132
 133     Sequence< Reference< XCertificate > > xCertificateSequence(certsList.size());
 134     int i = 0;
 135     for (auto const& cert : certsList) {
 136         xCertificateSequence[i++] = cert;
 137     }
 138
 139     return xCertificateSequence;
 140 }
 141
 142 Sequence< Reference < XCertificate > > SecurityEnvironmentGpg::getPersonalCertificates()
 143 {
 144     return getCertificatesImpl( true );
 145 }
 146
 147 Sequence< Reference < XCertificate > > SecurityEnvironmentGpg::getAllCertificates()
 148 {
 149     return getCertificatesImpl( false );
 150 }
 151
 152 Reference< XCertificate > SecurityEnvironmentGpg::getCertificate( const OUString& keyId, const Sequence< sal_Int8 >& /*serialNumber*/ )
 153 {
 154     CertificateImpl* xCert=nullptr;
 155
 156     //xmlChar* pSignatureValue=xmlNodeGetContent(cur);
 157     OString ostr = OUStringToOString( keyId , RTL_TEXTENCODING_UTF8 );
 158     const xmlChar* strKeyId = reinterpret_cast<const xmlChar*>(ostr.getStr());
 159     if(xmlSecBase64Decode(strKeyId, const_cast<xmlSecByte*>(strKeyId), xmlStrlen(strKeyId)) < 0)
 160         throw RuntimeException("Base64 decode failed");
 161
 162     m_ctx->setKeyListMode(GPGME_KEYLIST_MODE_LOCAL);
 163     GpgME::Error err = m_ctx->startKeyListing("", false);
 164     while (!err) {
 165         GpgME::Key k = m_ctx->nextKey(err);
 166         if (err)
 167             break;
 168         if (!k.isInvalid() && strcmp(k.primaryFingerprint(), reinterpret_cast<const char*>(strKeyId)) == 0) {
 169             xCert = new CertificateImpl();
 170             xCert->setCertificate(m_ctx.get(), k);
 171             m_ctx->endKeyListing();
 172             return xCert;
 173         }
 174     }
 175     m_ctx->endKeyListing();
 176
 177     return nullptr;
 178 }
 179
 180 Sequence< Reference < XCertificate > > SecurityEnvironmentGpg::buildCertificatePath( const Reference< XCertificate >& /*begin*/ )
 181 {
 182     return Sequence< Reference < XCertificate > >();
 183 }
 184
 185 Reference< XCertificate > SecurityEnvironmentGpg::createCertificateFromRaw( const Sequence< sal_Int8 >& /*rawCertificate*/ )
 186 {
 187     return nullptr;
 188 }
 189
 190 Reference< XCertificate > SecurityEnvironmentGpg::createCertificateFromAscii( const OUString& /*asciiCertificate*/ )
 191 {
 192     return nullptr;
 193 }
 194
 195 sal_Int32 SecurityEnvironmentGpg::verifyCertificate( const Reference< XCertificate >& aCert,
 196                                                   const Sequence< Reference< XCertificate > >&  /*intermediateCerts*/ )
 197 {
 198     const CertificateImpl* xCert = dynamic_cast<CertificateImpl*>(aCert.get());
 199     if (xCert == nullptr) {
 200          // Can't find the key locally -> unknown owner
 201         return security::CertificateValidity::ISSUER_UNKNOWN;
 202     }
 203
 204     const GpgME::Key* key = xCert->getCertificate();
 205     if (key->ownerTrust() == GpgME::Key::OwnerTrust::Marginal ||
 206         key->ownerTrust() == GpgME::Key::OwnerTrust::Full ||
 207         key->ownerTrust() == GpgME::Key::OwnerTrust::Ultimate)
 208     {
 209         return security::CertificateValidity::VALID;
 210     }
 211
 212     return security::CertificateValidity::ISSUER_UNTRUSTED;
 213 }
 214
 215 sal_Int32 SecurityEnvironmentGpg::getCertificateCharacters(
 216     const Reference< XCertificate >& aCert)
 217 {
 218     const CertificateImpl* xCert;
 219     Reference< XUnoTunnel > xCertTunnel(aCert, UNO_QUERY_THROW) ;
 220     xCert = reinterpret_cast<CertificateImpl*>(sal::static_int_cast<sal_uIntPtr>(xCertTunnel->getSomething(CertificateImpl::getUnoTunnelId()))) ;
 221     if (xCert == nullptr)
 222         throw RuntimeException();
 223
 224     // we only listed private keys anyway, up in
 225     // SecurityEnvironmentGpg::getPersonalCertificates
 226     return CertificateCharacters::HAS_PRIVATE_KEY;
 227 }
 228
 229 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */