Home   Package List   Routine Alphabetical List   Global Alphabetical List   FileMan Files List   FileMan Sub-Files List   Package Component Lists   Package-Namespace Mapping  
Routine: XUCERT1

XUCERT1.m

Go to the documentation of this file. 
  1. XUCERT1 ;ISD/HGW Kernel PKI Certificate Utilities (cont) ;09/17/2019  15:25
  1.  ;;8.0;KERNEL;**659,701**;Jul 10, 1995;Build 0
  1.  ;Per VA Directive 6402, this routine should not be modified.
  1.  ;
  1.  Q
  1. VAL1(DOC,SIG) ;Function. Validate Document (Cache 2015.2 or greater)
  1.  ;ZEXCEPT: Document,ValidateDocument ;Object Script
  1.  N XUDOC,XUSTATUS
  1.  S XUDOC=DOC.Document ;Create the OREF
  1.  I $G(XUDOC)="" Q "-1^Failed to import XML document"
  1.  D XUDOC.AddIDs() ; p701
  1.  S XUSTATUS=SIG.ValidateDocument(XUDOC)
  1.  I $G(XUSTATUS)["Failed" Q "-1^Failed data integrity or signature validation check"
  1.  Q 1
  1.  ;
  1. VAL2(DOC,SIG,ERR) ;Function. Validate Document (Less than Cache 2015.2)
  1.  N ERROR,STATUS
  1.  S STATUS=1
  1.  S ERROR=""
  1.  I '$$CHKDATA(DOC,SIG) S ERR("DIGEST")="" S STATUS=0 ; check integrity
  1.  I '$$CHKSIGN(DOC,SIG,.ERR) S STATUS=0 ; check signature is valid
  1.  Q STATUS=1
  1.  ;
  1. READER(DOC) ;Function. Reads XML Document
  1.  ;ZEXCEPT: %New,%XML,OpenFile,OpenStream,Reader,class ;Object Script
  1.  N XUIN,XUREAD,XUSC
  1.  S XUREAD=##class(%XML.Reader).%New() ;Create OREF instance in memory
  1.  I $E(DOC)="^" D
  1.  . S XUIN=$$LOADSTRM(DOC) ;Extract stream from global
  1.  . S XUSC=XUREAD.OpenStream(XUIN) ;Import from stream
  1.  E  D
  1.  . S XUSC=XUREAD.OpenFile(DOC) ;Import from file
  1.  I $G(XUSC)'=1 Q "-1^"_$G(XUSC)
  1.  Q XUREAD
  1.  ;
  1. SGNTR(READER) ;Function. Finds digital signature
  1.  N SIGNATURE,STATUS
  1.  D READER.Correlate("Signature","%XML.Security.Signature")
  1.  D READER.Next(.SIGNATURE,.STATUS)
  1.  I $G(SIGNATURE)="" Q "-1^NO-SIGNATURE"
  1.  Q SIGNATURE
  1.  ;
  1. CHKDATA(READER,SIG) ;Function. Check integrity of signed data
  1.  ; by comparing computed digest with incoming digest value
  1.  N COMPUTED
  1.  S COMPUTED=$$DIGESTCP(READER,SIG)
  1.  Q COMPUTED=$$DIGEST(SIG)
  1.  ;
  1. DIGESTCP(READER,SIG) ;Function. Compute SHA digest value
  1.  ;ZEXCEPT: %New,%XML,ComputeSha1Digest,Document,GetNode,NodeId,Writer,class
  1.  N NODE,WRITER,BITLENGT,ISSTR,MIME,SIGNNODE,PREFIXL,CANONTXT
  1.  S NODE=READER.Document.GetNode("")
  1.  S NODE.NodeId=$$REFNODE(READER)
  1.  S SIGNNODE=SIG.NodeId
  1.  S WRITER=##class(%XML.Writer).%New()
  1.  ; p701
  1.  S PREFIXL="" ; explicit, xml-exc-c14n#
  1.  ;S BITLENGT=160
  1.  S BITLENGT=256 ;
  1.  ; end p701
  1.  S ISSTR=0
  1.  S MIME=""
  1.  Q SIG.ComputeSha1Digest(NODE,SIGNNODE,WRITER,.PREFIXL,BITLENGT,ISSTR,.CANONTXT,MIME)
  1.  ;
  1. REFNODE(READER) ;Function. Get reference node which is Assertion node since GetNodeById can't find "ID"
  1.  ;ZEXCEPT: NodeId,STATUS
  1.  N ASSERTION
  1.  D READER.Rewind()
  1.  D READER.Correlate("Assertion","%SAML.Assertion")
  1.  D READER.Next(.ASSERTION,.STATUS)
  1.  Q ASSERTION.NodeId
  1.  ;
  1. DIGEST(SIGNATURE) ;Function. Find incoming digest value
  1.  ;ZEXCEPT: DigestValue,GetAt,Reference,SignedInfo
  1.  N REF
  1.  S REF=SIGNATURE.SignedInfo.Reference.GetAt(1)
  1.  Q REF.DigestValue
  1.  ;
  1. CHKSIGN(READER,SIGNATURE,ERR) ;Function. Validate digital signature
  1.  ; Return value: 1 if the signature was successfully verified, 0 otherwise.
  1.  ;ZEXCEPT: %New,%XML,Canonicalize,Certificate,Document,Encryption,GetNode,GetXMLString,KeyInfo,NodeId,OutputToString,RSASHAVerify,SignatureValue,SignedInfo,ValidateTokenRef,Writer,X509Credentials,class
  1.  N BITLENGT,CAFILE,CERT,CRLFILE,ERROR,SIGNTXT,SIGNVAL,STATUS
  1.  S ERROR=""
  1.  S BITLENGT=256 ; (Integer) Length in bits of desired hash, where 256 is SHA-256
  1.  S SIGNTXT=$$SIGNTEXT(READER,SIGNATURE) ; (String) Data that was signed
  1.  S SIGNVAL=SIGNATURE.SignatureValue ; (String) Signature to be verified
  1.  S CERT=$$CERT(SIGNATURE) ; (String) X.509 certificate containing the RSA public key to validate the signature
  1.  ;P701
  1.  I +CERT=-1 S ERR("CERT")=""
  1.  S CAFILE=$System.Util.ManagerDirectory()_"cache.cer"
  1.  I '##class(%File).Exists(CAFILE) S ERR("CAFILE")=""
  1.  ;S CRLFILE=$zu(12)_"cache.crl"
  1.  ;I $zu(140,4,CRLFILE)'=0 Set CRLFILE=""
  1.  ;RSASHAVerify works with OpenSSL on Windows and Linux, but crashes with VMS.
  1.  I $$VERSION^%ZOSV(1)["OpenVMS" Q 1  ;Quit if VMS, skip signature validation
  1.  I $D(ERR("CAFILE")) D
  1.  . S STATUS=$System.Encryption.RSASHAVerify(BITLENGT,SIGNTXT,SIGNVAL,CERT)
  1.  E  S STATUS=$System.Encryption.RSASHAVerify(BITLENGT,SIGNTXT,SIGNVAL,CERT,CAFILE)
  1.  I 'STATUS S ERR("SIGNATURE")="" Q 0
  1.  Q 1
  1.  ;
  1. SIGNTEXT(READER,SIGNATURE) ;Function. Retrieves the SignedInfo text
  1.  ;ZEXCEPT: %New,%XML,Canonicalize,Document,GetNode,GetXMLString,NodeId,OutputToString,SignedInfo,Writer,class ;ObjectScript
  1.  N NODE,PREFARR,WRITER,SC
  1.  S NODE=READER.Document.GetNode("")
  1.  S NODE.NodeId=SIGNATURE.SignedInfo.NodeId
  1.  ; p701 explicit canonicalization, xml-exc-c14n#, make PREFARR undefined
  1.  ;S PREFARR="c14n" ; signing prefix array
  1.  S WRITER=##class(%XML.Writer).%New()
  1.  S SC=WRITER.OutputToString()
  1.  S SC=WRITER.Canonicalize(NODE,.PREFARR)
  1.  Q WRITER.GetXMLString(.SC) ; SignedInfo
  1.  ;
  1. CERT(SIG) ;Function. Retrieves a certificate
  1.  ;ZEXCEPT: Certificate,KeyInfo,ValidateTokenRef,X509Credentials ;ObjectScript
  1.  N KEYINFO,ERROR
  1.  S KEYINFO=SIG.KeyInfo
  1.  S ERROR=KEYINFO.ValidateTokenRef("")
  1.  I ERROR'="" Q "-1^Invalid KeyInfo"
  1.  Q KEYINFO.X509Credentials.Certificate
  1.  ;
  1. LOADSTRM(GLO) ;Intrinsic Function. Load global into stream
  1.  ;ZEXCEPT: %New,%Stream,GlobalCharacter,class ;ObjectScript
  1.  N GLOREF,I,X,XMLSTRM,XQ,Y
  1.  S Y=GLO
  1.  S XQ=$P(Y,")") ;or use $$OREF^DILF(closed_root) to convert closed root to open root?
  1.  S XMLSTRM=##class(%Stream.TmpCharacter).%New() ;Create OREF instance in memory. p701 instead of GlobalCharacter
  1.  ;Read XML from global, starting at the beginning, into XMLSTRM
  1.  F I=0:0 D  Q:Y'[XQ
  1.  . S Y=$Q(@Y) Q:Y'[XQ
  1.  . S X=$G(@Y)
  1.  . D XMLSTRM.Write(X)
  1.  Q XMLSTRM
  1.  ;
  1. ADDERR(RES,ERR) ;
  1.  S RES(ERR)=""
  1.  Q
  1.  ;