<div dir="ltr">Hi Aleksey<div><br></div><div>I am new to xmlsec and have a few questions. I tried to do my home first and went through the documentation and old emails but still have a few question. I will be very grateful if you can find the time to look into this please.</div>
<div style>I am using x509 certs and I am using the .18 prebuilt windows version</div><div><br></div><div><br></div><div>FIRST</div><div>---------</div><div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">My first question is very similar to the one posted here </span><a href="http://www.aleksey.com/pipermail/xmlsec/2002/004466.html" target="_blank" style="font-family:arial,sans-serif;font-size:13px">http://www.aleksey.com/pipermail/<span class="" style="background-color:rgb(255,255,204);color:rgb(34,34,34)">xmlsec</span>/2002/004466.html</a></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">I basically want to look at the certificate or the chain that actually validated the </span><span class="" style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,204)">xml</span><span style="font-family:arial,sans-serif;font-size:13px"> to check the Subject, Issuer, etc. I can’t find the structures mentioned in that thread, I am guessing the code must have changed since then or may be I am looking in the wrong place. Can you please confirm?</span></div>
<div><font face="arial, sans-serif">So then I looked at the command line tool code since it prints out the info that I need. I followed through the code but I cant find any accessible function to pull out the subject/issuer for the certs. I found the xmlSecKeyDataGetIdentifier function but it didnt print anythng for me. It was late and may be I am doing something wrong but I thought I will check with you if I am on the right track</font></div>
<div><font face="arial, sans-serif"><br></font></div><div><span style="font-family:'courier new',monospace">/////////////////////////////////////////////////////////////</span><br></div><div><div><font face="courier new, monospace">//key is the signKey from the context</font></div>
<div><font face="courier new, monospace">if (!xmlSecPtrListIsValid(key->dataList))</font></div><div><font face="courier new, monospace">{</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>info = "SignKey dataList is not valid";</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>return false;</font></div><div><font face="courier new, monospace">}</font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace">// key->dataList->id is the pointer to the xmlSecKeyDataListKlass struct</font></div><div><font face="courier new, monospace">if (!xmlSecPtrListCheckId(key->dataList, xmlSecKeyDataListId))</font></div>
<div><font face="courier new, monospace">{</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>info = "SignKey dataList kind is not xmlSecKeyDataListId";</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>return false;</font></div><div><font face="courier new, monospace">}</font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace">// "key-data-list"</font></div><div><font face="courier new, monospace">InfoLog << " DATALIST kind [" << (char*)key->dataList->id->name << "] size [" << key->dataList->use << "]" << endl;</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">xmlSecSize pos;</font></div><div><font face="courier new, monospace">for (pos = 0; pos < key->dataList->use; ++pos)</font></div>
<div><font face="courier new, monospace">{</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>ostringstream ss; ss << pos;</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>xmlSecKeyDataPtr value = (xmlSecKeyDataPtr)key->dataList->data[pos];</font></div>
<div><span class="" style="white-space:pre"><font face="courier new, monospace"> </font></span></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>if (value == NULL) </font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>{</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>info = "SignKey dataList data[" + ss.str() + "] is not valid";</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>return false;</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>}</font></div><div>
<font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>//key->dataList->id->debugDumpItem(key->dataList->data[pos], stdout);</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>if (!xmlSecKeyDataCheckId(value, xmlSecMSCryptoKeyDataX509Id))</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>{</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>info = "SignKey dataList data[" + ss.str() + "] kind is not xmlSecMSCryptoKeyDataX509Id";</font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>return false;</font></div>
<div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>}</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>InfoLog << "SignKey dataList data[" << ss.str().c_str() << "] kind [" << (char*)value->id->name << "]" << endl;</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>string identifier = (char*)xmlSecKeyDataGetIdentifier(value) ;</font></div>
<div style><span style="font-family:'courier new',monospace;white-space:pre"> // this did not print anything</span><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="" style="white-space:pre"> </span>InfoLog << "SignKey dataList data[" << ss.str().c_str() << "] identifier [" << identifier.c_str() << "]" << endl;</font></div>
<div><font face="courier new, monospace">}</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">/* THIS IS THE INFO I AM LOOKING FOR. Is it accessible from outside?</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> xmlSecMSCryptoKeyDataX509DebugDump(xmlSecKeyDataPtr data, FILE* output) {</font></div><div><font face="courier new, monospace"> PCCERT_CONTEXT cert;</font></div>
<div><font face="courier new, monospace"> xmlSecSize size, pos;</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> xmlSecAssert(xmlSecKeyDataCheckId(data, xmlSecMSCryptoKeyDataX509Id));</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> fprintf(output, "=== X509 Data:\n");</font></div><div><font face="courier new, monospace"><br></font></div><div>
<font face="courier new, monospace"> cert = xmlSecMSCryptoKeyDataX509GetKeyCert(data);</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> if(cert != NULL) {</font></div>
<div><font face="courier new, monospace"> fprintf(output, "==== Key Certificate:\n");</font></div><div><font face="courier new, monospace"> xmlSecMSCryptoX509CertDebugDump(cert, output);</font></div>
<div><font face="courier new, monospace"> }</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> size = xmlSecMSCryptoKeyDataX509GetCertsSize(data);</font></div>
<div><font face="courier new, monospace"> for(pos = 0; pos < size; ++pos) {</font></div><div><font face="courier new, monospace"> cert = xmlSecMSCryptoKeyDataX509GetCert(data, pos);</font></div><div><font face="courier new, monospace"> if(cert == NULL) {</font></div>
<div><font face="courier new, monospace"> xmlSecError(XMLSEC_ERRORS_HERE,</font></div><div><font face="courier new, monospace"> xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),</font></div>
<div><font face="courier new, monospace"> "xmlSecMSCryptoKeyDataX509GetCert",</font></div><div><font face="courier new, monospace"> XMLSEC_ERRORS_R_XMLSEC_FAILED,</font></div>
<div><font face="courier new, monospace"> "pos=%d", pos);</font></div><div><font face="courier new, monospace"> return;</font></div><div><font face="courier new, monospace"> }</font></div>
<div><font face="courier new, monospace"> fprintf(output, "==== Certificate:\n");</font></div><div><font face="courier new, monospace"> xmlSecMSCryptoX509CertDebugDump(cert, output);</font></div><div>
<font face="courier new, monospace"> }</font></div><div><font face="courier new, monospace">*/</font></div><div style="font-family:'courier new',monospace">/////////////////////////////////////////////////////////////<br>
</div></div><div><div style="font-size:13px"><span style="font-family:'courier new',monospace;font-size:small"><br></span></div><div style="font-size:13px"><span style="font-family:arial,sans-serif"><br></span></div>
<div style="font-size:13px"><span style="font-family:arial,sans-serif">SECOND</span><br></div></div><div><p class="" style="font-family:arial,sans-serif;font-size:13px">--------------</p><p class="" style="font-family:arial,sans-serif;font-size:13px">
In one of your replies (<a href="http://www.aleksey.com/pipermail/xmlsec/2011/009076.html" target="_blank">http://www.aleksey.com/pipermail/<span class="" style="background-color:rgb(255,255,204);color:rgb(34,34,34)">xmlsec</span>/2011/009076.html</a>) you said<u></u><u></u></p>
<p class="" style="font-family:arial,sans-serif;font-size:13px">“I think you can get what you want by using "--enabled-key-data" (and "--list-key-data") command line options for <span class="" style="background-color:rgb(255,255,204)">xmlsec</span> utility. Simply disable reading of certs from <span class="" style="background-color:rgb(255,255,204)">XML</span> file completely and provide the signature key (not necessarily in a cert) from the command line.”</p>
<p class="" style="font-family:arial,sans-serif;font-size:13px">How exactly do I do that? Because –enabled-key-data always expects a parameter. I guess I can just say “hmac” or some other option that doesn’t apply in my case to achieve that, is that right?</p>
<p class="" style="font-family:arial,sans-serif;font-size:13px"><u></u></p><p class="" style="font-family:arial,sans-serif;font-size:13px">Also the command to list them "<span class="" style="background-color:rgb(255,255,204)">xmlsec</span> list-key-data –crypto mscrypto", I didn’t see it documented in the command line help.</p>
<p class="" style="font-family:arial,sans-serif;font-size:13px">From verify4 example, I found the following. What is the corresponding equivalent for the code (to disable reading of certs from xml completely?</p><p class="">
<font face="courier new, monospace"> /* in addition, limit possible key data to valid X509 certificates only */</font></p><p class=""><font face="courier new, monospace"> if(xmlSecPtrListAdd(&(dsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecKeyDataX509Id) < 0) {</font></p>
<p class=""><font face="courier new, monospace"> fprintf(stderr,"Error: failed to limit allowed key data\n");</font></p><p class=""><font face="courier new, monospace"> goto done;</font></p><p class="">
<font face="courier new, monospace"> }</font></p><p class="" style="font-family:arial,sans-serif;font-size:13px"><br></p><p class="" style="font-family:arial,sans-serif;font-size:13px">Thanks a lot for your help</p><p class="" style="font-family:arial,sans-serif;font-size:13px">
<u></u></p><p class="" style="font-family:arial,sans-serif;font-size:13px"><u></u><br></p></div></div>