modify to verify for RDS

Change-Id: Ifdbef6dffdf0172cd4891f27c68f7d135985bbca
Signed-off-by: cc1.yim <cc1.yim@samsung.com>

diff --git a/vcore/src/vcore/SignatureValidator.cpp b/vcore/src/vcore/SignatureValidator.cpp
index 366ea5921b042ff24d57303cadfe3a9978cd2ca2..5a800210d2fd857e963004bb341f2a72c70751cc 100644 (file)
--- a/vcore/src/vcore/SignatureValidator.cpp
+++ b/vcore/src/vcore/SignatureValidator.cpp
@@ -49,6 +49,12 @@ public:
         SignatureData &data,
         const std::string &widgetContentPath) = 0;
 
+    virtual SignatureValidator::Result checkList(
+        SignatureData &data,
+        const std::string &widgetContentPath,
+        const std::list<std::string>& uriList,
+        bool  exceptionUriHash = false) = 0;
+
     explicit ImplSignatureValidator(bool ocspEnable,
                   bool crlEnable,
                   bool complianceMode)
@@ -57,7 +63,7 @@ public:
       , m_complianceModeEnabled(complianceMode)
     {}
 
-    virtual ~ImplSignatureValidator(){}
+    virtual ~ImplSignatureValidator(){ }
 
     bool checkRoleURI(const SignatureData &data) {
         std::string roleURI = data.getRoleURI();
@@ -115,6 +121,11 @@ class ImplTizenSignatureValidator : public SignatureValidator::ImplSignatureVali
     SignatureValidator::Result check(SignatureData &data,
             const std::string &widgetContentPath);
 
+    SignatureValidator::Result checkList(SignatureData &data,
+            const std::string &widgetContentPath,
+            const std::list<std::string>& uriList,
+            bool  exceptionUriHash = false);
+
     explicit ImplTizenSignatureValidator(bool ocspEnable,
                        bool crlEnable,
                        bool complianceMode)
@@ -182,36 +193,36 @@ SignatureValidator::Result ImplTizenSignatureValidator::check(
         << storeIdSet.contains(CertStoreId::VIS_PUBLIC));
     LogDebug("Visibility level is partner :  "
         << storeIdSet.contains(CertStoreId::VIS_PARTNER));
-       LogDebug("Visibility level is platform :  "
-               << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
+    LogDebug("Visibility level is platform :  "
+      << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
 
-       if (data.isAuthorSignature())
-       {
-               if (!storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER))
-               {
+    if (data.isAuthorSignature())
+    {
+     if (!storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER))
+     {
             LogWarning("author-signature.xml has got unrecognized Root CA "
                        "certificate. Signature will be disregarded.");
             disregard = true;
-               }
+     }
         LogDebug("Root CA for author signature is correct.");
-       }
-       else
-       {
-               LogDebug("signaturefile name = " <<  data.getSignatureFileName().c_str());
-               if (data.getSignatureNumber() == 1)
-               {
-                       if (storeIdSet.contains(CertStoreId::VIS_PUBLIC) || storeIdSet.contains(CertStoreId::VIS_PARTNER) || storeIdSet.contains(CertStoreId::VIS_PLATFORM))
-                       {
-                               LogDebug("Root CA for signature1.xml is correct.");
-                       }
-                       else
-                       {
-                               LogWarning("author-signature.xml has got unrecognized Root CA "
-                                       "certificate. Signature will be disregarded.");
-                               disregard = true;
-                       }
-               }
-       }
+   }
+   else
+   {
+      LogDebug("signaturefile name = " <<  data.getSignatureFileName().c_str());
+      if (data.getSignatureNumber() == 1)
+      {
+         if (storeIdSet.contains(CertStoreId::VIS_PUBLIC) || storeIdSet.contains(CertStoreId::VIS_PARTNER) || storeIdSet.contains(CertStoreId::VIS_PLATFORM))
+         {
+            LogDebug("Root CA for signature1.xml is correct.");
+         }
+         else
+         {
+            LogWarning("author-signature.xml has got unrecognized Root CA "
+                       "certificate. Signature will be disregarded.");
+            disregard = true;
+         }
+      }
+   }
 
     data.setStorageType(storeIdSet);
     data.setSortedCertificateList(sortedCertificateList);
@@ -235,65 +246,293 @@ SignatureValidator::Result ImplTizenSignatureValidator::check(
     time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
     time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-       time_t nowTime = time(NULL);
-       struct tm *t;
-
-       if (data.isAuthorSignature())
-       {
-               // time_t 2038 year bug exist. So, notAtter() cann't check...
-               /*
-               if (notAfter < nowTime)
-               {
-                       context.validationTime = notAfter - TIMET_DAY;
-                       LogWarning("Author certificate is expired. notAfter...");
-               }
-               */
-
-               if (notBefore > nowTime)
-               {
-                       LogWarning("Author certificate is expired. notBefore time is greater than system-time.");
-
-                       t = localtime(&nowTime);
-                       LogDebug("System's current Year : " << t->tm_year + 1900);
-                       LogDebug("System's current month : " << t->tm_mon + 1);
-                       LogDebug("System's current day : " << t->tm_mday);
-
-                       t = localtime(&notBefore);
-                       LogDebug("Author certificate's notBefore Year : " << t->tm_year + 1900);
-                       LogDebug("Author certificate's notBefore month : " << t->tm_mon + 1);
-                       LogDebug("Author certificate's notBefore day : " << t->tm_mday);
-
-                       context.validationTime = notBefore + TIMET_DAY;
-
-                       t = localtime(&context.validationTime);
-                       LogDebug("Modified current Year : " << t->tm_year + 1900);
-                       LogDebug("Modified current notBefore month : " << t->tm_mon + 1);
-                       LogDebug("Modified current notBefore day : " << t->tm_mday);
-               }
-       }
-       
+    time_t nowTime = time(NULL);
+    struct tm *t;
+
+    if (data.isAuthorSignature())
+    {
+       // time_t 2038 year bug exist. So, notAtter() cann't check...
+       /*
+       if (notAfter < nowTime)
+       {
+          context.validationTime = notAfter - TIMET_DAY;
+          LogWarning("Author certificate is expired. notAfter...");
+       }
+       */
+
+       if (notBefore > nowTime)
+       {
+          LogWarning("Author certificate is expired. notBefore time is greater than system-time.");
+
+          t = localtime(&nowTime);
+          LogDebug("System's current Year : " << t->tm_year + 1900);
+          LogDebug("System's current month : " << t->tm_mon + 1);
+          LogDebug("System's current day : " << t->tm_mday);
+
+          t = localtime(&notBefore);
+          LogDebug("Author certificate's notBefore Year : " << t->tm_year + 1900);
+          LogDebug("Author certificate's notBefore month : " << t->tm_mon + 1);
+          LogDebug("Author certificate's notBefore day : " << t->tm_mday);
+
+          context.validationTime = notBefore + TIMET_DAY;
+
+          t = localtime(&context.validationTime);
+          LogDebug("Modified current Year : " << t->tm_year + 1900);
+          LogDebug("Modified current notBefore month : " << t->tm_mon + 1);
+          LogDebug("Modified current notBefore day : " << t->tm_mday);
+      }
+    }
+
     // WAC 2.0 SP-2066 The wrt must not block widget installation
-       //context.allowBrokenChain = true;
+    //context.allowBrokenChain = true;
 
-       // end
-    if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validate(&context)) {
-        LogWarning("Installation break - invalid package!");
+    // end
+
+   if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validate(&context)) {
+         LogWarning("Installation break - invalid package! >> validate");
+         return SignatureValidator::SIGNATURE_INVALID;
+   }
+
+   data.setReference(context.referenceSet);
+   if (!checkObjectReferences(data)) {
+       return SignatureValidator::SIGNATURE_INVALID;
+   }
+
+  /*
+    ReferenceValidator fileValidator(widgetContentPath);
+    if (ReferenceValidator::NO_ERROR != fileValidator.checkReferences(data)) {
+        LogWarning("Invalid package - file references broken");
         return SignatureValidator::SIGNATURE_INVALID;
     }
+ */
 
-    data.setReference(context.referenceSet);
+    // It is good time to do OCSP check
+    // ocspCheck will throw an exception on any error.
+    // TODO Probably we should catch this exception and add
+    // some information to SignatureData.
+    if (!m_complianceModeEnabled && !data.isAuthorSignature()) {
+        CertificateCollection coll;
+        coll.load(sortedCertificateList);
 
-    if (!checkObjectReferences(data)) {
+        if (!coll.sort()) {
+            LogDebug("Collection does not contain chain!");
+            return SignatureValidator::SIGNATURE_INVALID;
+        }
+
+        CertificateVerifier verificator(m_ocspEnable, m_crlEnable);
+        VerificationStatus result = verificator.check(coll);
+
+        if (result == VERIFICATION_STATUS_REVOKED) {
+            return SignatureValidator::SIGNATURE_REVOKED;
+        }
+
+        if (result == VERIFICATION_STATUS_UNKNOWN ||
+            result == VERIFICATION_STATUS_ERROR)
+        {
+            disregard = true;
+        }
+    }
+
+    if (disregard) {
+        LogWarning("Signature is disregard. RootCA is not a member of Tizen.");
+        return SignatureValidator::SIGNATURE_DISREGARD;
+    }
+    return SignatureValidator::SIGNATURE_VERIFIED;
+}
+
+SignatureValidator::Result ImplTizenSignatureValidator::checkList(SignatureData &data,
+            const std::string &widgetContentPath,
+            const std::list<std::string>& uriList,
+            bool  exceptionUriHash)
+{
+    if(exceptionUriHash == true && uriList.size() != 0 )
+    {
+      LogWarning("Installation break >> invalid input parameter");
+      return SignatureValidator::SIGNATURE_INVALID;
+    }
+
+    bool disregard = false;
+    bool partialHash;
+
+    if (!checkRoleURI(data)) {
         return SignatureValidator::SIGNATURE_INVALID;
     }
 
-       /*
+    if (!checkProfileURI(data)) {
+        return SignatureValidator::SIGNATURE_INVALID;
+    }
+
+    //  CertificateList sortedCertificateList = data.getCertList();
+
+    CertificateCollection collection;
+    collection.load(data.getCertList());
+
+    // First step - sort certificate
+    if (!collection.sort()) {
+        LogWarning("Certificates do not form valid chain.");
+        return SignatureValidator::SIGNATURE_INVALID;
+    }
+
+    // Check for error
+    if (collection.empty()) {
+        LogWarning("Certificate list in signature is empty.");
+        return SignatureValidator::SIGNATURE_INVALID;
+    }
+
+    CertificateList sortedCertificateList = collection.getChain();
+
+    // TODO move it to CertificateCollection
+    // Add root CA and CA certificates (if chain is incomplete)
+    sortedCertificateList =
+        OCSPCertMgrUtil::completeCertificateChain(sortedCertificateList);
+
+    CertificatePtr root = sortedCertificateList.back();
+
+    // Is Root CA certificate trusted?
+    CertStoreId::Set storeIdSet = createCertificateIdentifier().find(root);
+
+    LogDebug("Is root certificate from TIZEN_DEVELOPER domain:  "
+        << storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER));
+    LogDebug("Is root certificate from TIZEN_TEST domain:  "
+        << storeIdSet.contains(CertStoreId::TIZEN_TEST));
+    LogDebug("Is root certificate from TIZEN_PUBLIC domain:  "
+        << storeIdSet.contains(CertStoreId::VIS_PUBLIC));
+    LogDebug("Is root certificate from TIZEN_PARTNER domain:  "
+        << storeIdSet.contains(CertStoreId::VIS_PARTNER));
+    LogDebug("Is root certificate from TIZEN_PLATFORM domain:  "
+        << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
+
+    LogDebug("Visibility level is public :  "
+        << storeIdSet.contains(CertStoreId::VIS_PUBLIC));
+    LogDebug("Visibility level is partner :  "
+        << storeIdSet.contains(CertStoreId::VIS_PARTNER));
+    LogDebug("Visibility level is platform :  "
+      << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
+
+    if (data.isAuthorSignature())
+    {
+     if (!storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER))
+     {
+            LogWarning("author-signature.xml has got unrecognized Root CA "
+                       "certificate. Signature will be disregarded.");
+            disregard = true;
+     }
+        LogDebug("Root CA for author signature is correct.");
+   }
+   else
+   {
+      LogDebug("signaturefile name = " <<  data.getSignatureFileName().c_str());
+      if (data.getSignatureNumber() == 1)
+      {
+         if (storeIdSet.contains(CertStoreId::VIS_PUBLIC) || storeIdSet.contains(CertStoreId::VIS_PARTNER) || storeIdSet.contains(CertStoreId::VIS_PLATFORM))
+         {
+            LogDebug("Root CA for signature1.xml is correct.");
+         }
+         else
+         {
+            LogWarning("author-signature.xml has got unrecognized Root CA "
+                       "certificate. Signature will be disregarded.");
+            disregard = true;
+         }
+      }
+   }
+
+    data.setStorageType(storeIdSet);
+    data.setSortedCertificateList(sortedCertificateList);
+
+    // We add only Root CA certificate because WAC ensure that the rest
+    // of certificates are present in signature files ;-)
+    XmlSec::XmlSecContext context;
+    context.signatureFile = data.getSignatureFileName();
+    context.certificatePtr = root;
+
+    // Now we should have full certificate chain.
+    // If the end certificate is not ROOT CA we should disregard signature
+    // but still signature must be valid... Aaaaaa it's so stupid...
+    if (!(root->isSignedBy(root))) {
+        LogWarning("Root CA certificate not found. Chain is incomplete.");
+    //  context.allowBrokenChain = true;
+    }
+
+    // WAC 2.0 SP-2066 The wrt must not block widget installation
+    // due to expiration of the author certificate.
+    time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
+    time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
+
+    time_t nowTime = time(NULL);
+    struct tm *t;
+
+    if (data.isAuthorSignature())
+    {
+       // time_t 2038 year bug exist. So, notAtter() cann't check...
+       /*
+       if (notAfter < nowTime)
+       {
+          context.validationTime = notAfter - TIMET_DAY;
+          LogWarning("Author certificate is expired. notAfter...");
+       }
+       */
+
+       if (notBefore > nowTime)
+       {
+          LogWarning("Author certificate is expired. notBefore time is greater than system-time.");
+
+          t = localtime(&nowTime);
+          LogDebug("System's current Year : " << t->tm_year + 1900);
+          LogDebug("System's current month : " << t->tm_mon + 1);
+          LogDebug("System's current day : " << t->tm_mday);
+
+          t = localtime(&notBefore);
+          LogDebug("Author certificate's notBefore Year : " << t->tm_year + 1900);
+          LogDebug("Author certificate's notBefore month : " << t->tm_mon + 1);
+          LogDebug("Author certificate's notBefore day : " << t->tm_mday);
+
+          context.validationTime = notBefore + TIMET_DAY;
+
+          t = localtime(&context.validationTime);
+          LogDebug("Modified current Year : " << t->tm_year + 1900);
+          LogDebug("Modified current notBefore month : " << t->tm_mon + 1);
+          LogDebug("Modified current notBefore day : " << t->tm_mday);
+      }
+    }
+
+    // WAC 2.0 SP-2066 The wrt must not block widget installation
+    //context.allowBrokenChain = true;
+
+    // end
+   if(exceptionUriHash == true || uriList.size() == 0)
+   {
+     if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validateNoHash(&context)) {
+        LogWarning("Installation break - invalid package! >> validateNoHash");
+        return SignatureValidator::SIGNATURE_INVALID;
+     }
+   }
+  else if(uriList.size() != 0)
+  {
+    partialHash = true;
+    XmlSecSingleton::Instance().setPartialHashList(uriList);
+    if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validatePartialHash(&context)) {
+        LogWarning("Installation break - invalid package! >> validatePartialHash");
+        return SignatureValidator::SIGNATURE_INVALID;
+    }
+  }
+
+   if(exceptionUriHash != true && partialHash != true)
+   {
+      data.setReference(context.referenceSet);
+
+      if (!checkObjectReferences(data)) {
+         return SignatureValidator::SIGNATURE_INVALID;
+      }
+   }
+
+  /*
     ReferenceValidator fileValidator(widgetContentPath);
     if (ReferenceValidator::NO_ERROR != fileValidator.checkReferences(data)) {
         LogWarning("Invalid package - file references broken");
         return SignatureValidator::SIGNATURE_INVALID;
     }
-       */
+ */
 
     // It is good time to do OCSP check
     // ocspCheck will throw an exception on any error.
@@ -335,6 +574,11 @@ class ImplWacSignatureValidator : public SignatureValidator::ImplSignatureValida
     SignatureValidator::Result check(SignatureData &data,
             const std::string &widgetContentPath);
 
+    SignatureValidator::Result checkList(SignatureData &data,
+            const std::string &widgetContentPath,
+            const std::list<std::string>& uriList,
+            bool  exceptionUriHash = false);
+
     explicit ImplWacSignatureValidator(bool ocspEnable,
                      bool crlEnable,
                      bool complianceMode)
@@ -344,6 +588,17 @@ class ImplWacSignatureValidator : public SignatureValidator::ImplSignatureValida
     virtual ~ImplWacSignatureValidator() {}
 };
 
+
+SignatureValidator::Result ImplWacSignatureValidator::checkList(
+        SignatureData &data,
+        const std::string &widgetContentPath,
+        const std::list<std::string>& uriList,
+        bool  exceptionUriHash)
+{
+    return SignatureValidator::SIGNATURE_INVALID;
+}
+
+
 SignatureValidator::Result ImplWacSignatureValidator::check(
     SignatureData &data,
     const std::string &widgetContentPath)
@@ -402,36 +657,34 @@ SignatureValidator::Result ImplWacSignatureValidator::check(
         << storeIdSet.contains(CertStoreId::VIS_PUBLIC));
     LogDebug("Visibility level is partner :  "
         << storeIdSet.contains(CertStoreId::VIS_PARTNER));
-       LogDebug("Visibility level is platform :  "
-               << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
+    LogDebug("Visibility level is platform :  "
+        << storeIdSet.contains(CertStoreId::VIS_PLATFORM));
 
-       if (data.isAuthorSignature())
-       {
-               if (!storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER))
-               {
-            LogWarning("author-signature.xml has got unrecognized Root CA "
-                       "certificate. Signature will be disregarded.");
-            disregard = true;
-               }
+    if (data.isAuthorSignature())
+    {
+     if (!storeIdSet.contains(CertStoreId::TIZEN_DEVELOPER))
+     {
+        LogWarning("author-signature.xml has got unrecognized Root CA "
+                   "certificate. Signature will be disregarded.");
+        disregard = true;
+     }
         LogDebug("Root CA for author signature is correct.");
-       }
-       else
-       {
-               LogDebug("signaturefile name = " <<  data.getSignatureFileName().c_str());
-               if (data.getSignatureNumber() == 1)
-               {
-                       if (storeIdSet.contains(CertStoreId::VIS_PUBLIC) || storeIdSet.contains(CertStoreId::VIS_PARTNER) || storeIdSet.contains(CertStoreId::VIS_PLATFORM))
-                       {
-                               LogDebug("Root CA for signature1.xml is correct.");
-                       }
-                       else
-                       {
-                               LogWarning("author-signature.xml has got unrecognized Root CA "
-                                       "certificate. Signature will be disregarded.");
-                               disregard = true;
-                       }
-               }
-       }
+    } else {
+        LogDebug("signaturefile name = " <<  data.getSignatureFileName().c_str());
+       if (data.getSignatureNumber() == 1)
+       {
+          if (storeIdSet.contains(CertStoreId::VIS_PUBLIC) || storeIdSet.contains(CertStoreId::VIS_PARTNER) || storeIdSet.contains(CertStoreId::VIS_PLATFORM))
+          {
+             LogDebug("Root CA for signature1.xml is correct.");
+          }
+          else
+          {
+             LogWarning("author-signature.xml has got unrecognized Root CA "
+                        "certificate. Signature will be disregarded.");
+             disregard = true;
+          }
+       }
+    }
 
     data.setStorageType(storeIdSet);
     data.setSortedCertificateList(sortedCertificateList);
@@ -451,46 +704,46 @@ SignatureValidator::Result ImplWacSignatureValidator::check(
     }
 
     // WAC 2.0 SP-2066 The wrt must not block widget installation
-       // due to expiration of the author certificate.
-       time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
-       time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
-
-       time_t nowTime = time(NULL);
-       struct tm *t;
-
-       if (data.isAuthorSignature())
-       {
-               // time_t 2038 year bug exist. So, notAtter() cann't check...
-               /*
-               if (notAfter < nowTime)
-               {
-                       context.validationTime = notAfter - TIMET_DAY;
-                       LogWarning("Author certificate is expired. notAfter...");
-                }
-                */
-
-               if (notBefore > nowTime)
-               {
-                       LogWarning("Author certificate is expired. notBefore time is greater than system-time.");
-
-                       t = localtime(&nowTime);
-                       LogDebug("System's current Year : " << t->tm_year + 1900);
-                       LogDebug("System's current month : " << t->tm_mon + 1);
-                       LogDebug("System's current day : " << t->tm_mday);
-
-                       t = localtime(&notBefore);
-                       LogDebug("Author certificate's notBefore Year : " << t->tm_year + 1900);
-                       LogDebug("Author certificate's notBefore month : " << t->tm_mon + 1);
-                       LogDebug("Author certificate's notBefore day : " << t->tm_mday);
-
-                       context.validationTime = notBefore + TIMET_DAY;
-
-                       t = localtime(&context.validationTime);
-                       LogDebug("Modified current Year : " << t->tm_year + 1900);
-                       LogDebug("Modified current notBefore month : " << t->tm_mon + 1);
-                       LogDebug("Modified current notBefore day : " << t->tm_mday);
-               }
-       }
+    // due to expiration of the author certificate.
+    time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
+    time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
+
+    time_t nowTime = time(NULL);
+    struct tm *t;
+
+    if (data.isAuthorSignature())
+    {
+      // time_t 2038 year bug exist. So, notAtter() cann't check...
+      /*
+      if (notAfter < nowTime)
+      {
+         context.validationTime = notAfter - TIMET_DAY;
+         LogWarning("Author certificate is expired. notAfter...");
+      }
+      */
+
+    if (notBefore > nowTime)
+    {
+       LogWarning("Author certificate is expired. notBefore time is greater than system-time.");
+
+       t = localtime(&nowTime);
+       LogDebug("System's current Year : " << t->tm_year + 1900);
+       LogDebug("System's current month : " << t->tm_mon + 1);
+       LogDebug("System's current day : " << t->tm_mday);
+
+       t = localtime(&notBefore);
+       LogDebug("Author certificate's notBefore Year : " << t->tm_year + 1900);
+       LogDebug("Author certificate's notBefore month : " << t->tm_mon + 1);
+       LogDebug("Author certificate's notBefore day : " << t->tm_mday);
+
+       context.validationTime = notBefore + TIMET_DAY;
+
+       t = localtime(&context.validationTime);
+       LogDebug("Modified current Year : " << t->tm_year + 1900);
+       LogDebug("Modified current notBefore month : " << t->tm_mon + 1);
+       LogDebug("Modified current notBefore day : " << t->tm_mday);
+    }
+   }
 
     if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validate(&context)) {
         LogWarning("Installation break - invalid package!");
@@ -537,7 +790,7 @@ SignatureValidator::Result ImplWacSignatureValidator::check(
     }
 
     if (disregard) {
-               LogWarning("Signature is disregard. RootCA is not a member of Tizen.");
+        LogWarning("Signature is disregard. RootCA is not a member of Tizen.");
         return SignatureValidator::SIGNATURE_DISREGARD;
     }
     return SignatureValidator::SIGNATURE_VERIFIED;
@@ -552,10 +805,16 @@ SignatureValidator::SignatureValidator(
     bool complianceMode)
   : m_impl(0)
 {
-    if (appType == TIZEN)
-        m_impl = new ImplTizenSignatureValidator(ocspEnable,crlEnable,complianceMode);
-    else
-        m_impl = new ImplWacSignatureValidator(ocspEnable,crlEnable,complianceMode);
+    LogDebug( "appType :" << appType );
+
+    if(appType == TIZEN)
+    {
+     m_impl = new ImplTizenSignatureValidator(ocspEnable,crlEnable,complianceMode);
+    }
+    else if(appType == WAC20)
+    {
+     m_impl = new ImplWacSignatureValidator(ocspEnable,crlEnable,complianceMode);
+    }
 }
 
 SignatureValidator::~SignatureValidator() {
@@ -569,5 +828,14 @@ SignatureValidator::Result SignatureValidator::check(
     return m_impl->check(data, widgetContentPath);
 }
 
+SignatureValidator::Result SignatureValidator::checkList(
+    SignatureData &data,
+    const std::string &widgetContentPath,
+    const std::list<std::string>& uriList,
+    bool  exceptionUriHash)
+{
+    return m_impl->checkList(data, widgetContentPath, uriList, exceptionUriHash );
+}
+
 } // namespace ValidationCore
 

diff --git a/vcore/src/vcore/SignatureValidator.h b/vcore/src/vcore/SignatureValidator.h
index 041366f09ddd890bdc3949a5d9efaf8ac0e56b8a..931de76f200beacab529375d99692c79e82351f9 100644 (file)
--- a/vcore/src/vcore/SignatureValidator.h
+++ b/vcore/src/vcore/SignatureValidator.h
@@ -61,8 +61,14 @@ public:
         SignatureData &data,
         const std::string &widgetContentPath);
 
+    Result checkList(
+        SignatureData &data,
+        const std::string &widgetContentPath,
+        const std::list<std::string>& uriList,
+        bool  exceptionUriHash = false);
+
 private:
-       ImplSignatureValidator *m_impl;
+     ImplSignatureValidator *m_impl;
 };
 
 } // namespace ValidationCore

diff --git a/vcore/src/vcore/XmlsecAdapter.cpp b/vcore/src/vcore/XmlsecAdapter.cpp
index 7297ec37f70cca2941d98f914ab5a1589df09894..5c14dca1d49d5c03efee14cd0ba1204baaa09cfb 100644 (file)
--- a/vcore/src/vcore/XmlsecAdapter.cpp
+++ b/vcore/src/vcore/XmlsecAdapter.cpp
@@ -77,6 +77,7 @@ int XmlSec::fileMatchCallback(const char *filename)
 void* XmlSec::fileOpenCallback(const char *filename)
 {
     std::string path = s_prefixPath + filename;
+
     LogDebug("Xmlsec opening: " << path);
     return new FileWrapper(xmlFileOpen(path.c_str()),false);
 }
@@ -99,6 +100,7 @@ int XmlSec::fileReadCallback(void *context,
 
 int XmlSec::fileCloseCallback(void *context)
 {
+  LogDebug("Xmlsec closing:  ");
     FileWrapper *fw = static_cast<FileWrapper*>(context);
     int output = 0;
     if (!(fw->released)) {
@@ -143,7 +145,10 @@ void LogDebugPrint(const char* file, int line, const char* func,
 }
 
 XmlSec::XmlSec() :
-    m_initialized(false)
+    m_initialized(false),
+    m_noHash(false),
+    m_partialHash(false),
+    m_pList(NULL)
 {
     LIBXML_TEST_VERSION
         xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS;
@@ -217,6 +222,8 @@ void XmlSec::deinitialize(void)
 
 XmlSec::~XmlSec()
 {
+   m_noHash= false;
+   m_partialHash = false;
     if (m_initialized) {
         deinitialize();
     }
@@ -273,16 +280,72 @@ XmlSec::Result XmlSec::validateFile(XmlSecContext *context,
         dsigCtx->keyInfoReadCtx.certsVerificationTime = context->validationTime;
     }
 
-    /*   Verify signature */
-    if (xmlSecDSigCtxVerify(dsigCtx, node) < 0) {
+    if( m_noHash == true || m_partialHash == true ) {
+        LogDebug("SignatureEx start >> ");
+        if( m_pList == NULL ) {
+            LogWarning("## [validate]: uriList does not exist" );
+            fprintf(stderr, "## [validate]: uriList does not exist\n");
+            res = xmlSecDSigCtxVerifyEx(dsigCtx, node, 1, NULL);
+    } else {
+        int n = 0;
+        int i = 0;
+
+        if(m_pList == NULL)
+        {
+          LogWarning("## [validate]: uriList does not exist" );
+          fprintf(stderr, "## [validate]: uriList does not exist\n");
+          res = -1;
+          goto done;
+        }
+
+        n = m_pList->size();
+
+        char* pList[n+1];
+        std::list<std::string>::const_iterator itr = m_pList->begin();
+        std::string tmpString;
+        char* uri = NULL;
+        int len;
+
+        for(itr; itr != m_pList->end(); ++itr) {
+           tmpString = (*itr);
+           uri = (char*)tmpString.c_str();
+           len = strlen(uri);
+           pList[i] = (char*)malloc(len + 1);
+           memcpy(pList[i], uri, len);
+           pList[i][len] = '\0';
+           fprintf(stderr, "## [validate]: uriList[%d] = %s\n", i, pList[i]);
+           ++i;
+        }
+        pList[n] = '\0';
+
+        res = xmlSecDSigCtxVerifyEx(dsigCtx, node, 1, (void*)pList);
+        i = 0;
+        while(pList[i] != NULL) {
+          free(pList[i]);
+          ++i;
+        }
+     }
+
+     if(res < 0) {
+        LogError("SignatureEx verify error.");
+        fprintf(stderr, "## [validate error]: SignatureEx verify error\n");
+        res = -1;
+        goto done;
+     }
+    } else {
+       LogDebug("Signature start >> ");
+
+       /*  Verify signature */
+       if (xmlSecDSigCtxVerify(dsigCtx, node) < 0) {
          LogError("Signature verify error.");
          fprintf(stderr, "## [validate error]: Signature verify error\n");
          res = -1;
-        goto done;
+         goto done;
+      }
     }
 
     if (dsigCtx->keyInfoReadCtx.flags2 &
-        XMLSEC_KEYINFO_ERROR_FLAGS_BROKEN_CHAIN) {
+     XMLSEC_KEYINFO_ERROR_FLAGS_BROKEN_CHAIN) {
         LogWarning("XMLSEC_KEYINFO_FLAGS_ALLOW_BROKEN_CHAIN was set to true!");
         LogWarning("Signature contains broken chain!");
         context->errorBrokenChain = true;
@@ -423,4 +486,28 @@ XmlSec::Result XmlSec::validate(XmlSecContext *context)
 
     return validateFile(context, mngr.get());
 }
+
+XmlSec::Result XmlSec::validateNoHash(XmlSecContext *context)
+{
+    xmlSecErrorsSetCallback(LogDebugPrint);
+
+    m_noHash = true;
+    return validate(context);
+}
+
+XmlSec::Result XmlSec::validatePartialHash(XmlSecContext *context)
+{
+    xmlSecErrorsSetCallback(LogDebugPrint);
+
+    m_partialHash = true;
+    return validate(context);
+}
+
+XmlSec::Result XmlSec::setPartialHashList(const std::list<std::string>& targetUri)
+{
+  xmlSecErrorsSetCallback(LogDebugPrint);
+
+    m_pList = (std::list<std::string>*)&targetUri;
+    return NO_ERROR;
+}
 } // namespace ValidationCore

diff --git a/vcore/src/vcore/XmlsecAdapter.h b/vcore/src/vcore/XmlsecAdapter.h
index 4f3663645161a36216f19c95f3c6923776a7106b..3deba63927c93952e49669f9c7b1f8c2f02496e4 100644 (file)
--- a/vcore/src/vcore/XmlsecAdapter.h
+++ b/vcore/src/vcore/XmlsecAdapter.h
@@ -105,7 +105,11 @@ class XmlSec : public DPL::Noncopyable
      * Context - input/output param.
      */
     Result validate(XmlSecContext *context);
-  protected:
+    Result validateNoHash(XmlSecContext *context);
+    Result validatePartialHash(XmlSecContext *context);
+    Result setPartialHashList(const std::list<std::string>& targetUri);
+ 
+ protected:
     XmlSec();
     ~XmlSec();
   private:
@@ -119,6 +123,9 @@ class XmlSec : public DPL::Noncopyable
             xmlSecKeysMngrPtr mngr);
 
     bool m_initialized;
+    bool m_noHash;
+    bool m_partialHash;
+    std::list<std::string>* m_pList;
 
     static std::string s_prefixPath;
     static int fileMatchCallback(const char *filename);