mirror of
https://github.com/netzbegruenung/user_saml.git
synced 2024-05-03 17:43:41 +02:00
511 lines
19 KiB
PHP
511 lines
19 KiB
PHP
<?php
|
|
namespace RobRichards\XMLSecLibs;
|
|
|
|
use DOMDocument;
|
|
use DOMNode;
|
|
use DOMXPath;
|
|
use Exception;
|
|
use RobRichards\XMLSecLibs\Utils\XPath as XPath;
|
|
|
|
/**
|
|
* xmlseclibs.php
|
|
*
|
|
* Copyright (c) 2007-2018, Robert Richards <rrichards@cdatazone.org>.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* * Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* * Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
*
|
|
* * Neither the name of Robert Richards nor the names of his
|
|
* contributors may be used to endorse or promote products derived
|
|
* from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
|
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
|
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* @author Robert Richards <rrichards@cdatazone.org>
|
|
* @copyright 2007-2018 Robert Richards <rrichards@cdatazone.org>
|
|
* @license http://www.opensource.org/licenses/bsd-license.php BSD License
|
|
*/
|
|
|
|
class XMLSecEnc
|
|
{
|
|
const template = "<xenc:EncryptedData xmlns:xenc='http://www.w3.org/2001/04/xmlenc#'>
|
|
<xenc:CipherData>
|
|
<xenc:CipherValue></xenc:CipherValue>
|
|
</xenc:CipherData>
|
|
</xenc:EncryptedData>";
|
|
|
|
const Element = 'http://www.w3.org/2001/04/xmlenc#Element';
|
|
const Content = 'http://www.w3.org/2001/04/xmlenc#Content';
|
|
const URI = 3;
|
|
const XMLENCNS = 'http://www.w3.org/2001/04/xmlenc#';
|
|
|
|
/** @var null|DOMDocument */
|
|
private $encdoc = null;
|
|
|
|
/** @var null|DOMNode */
|
|
private $rawNode = null;
|
|
|
|
/** @var null|string */
|
|
public $type = null;
|
|
|
|
/** @var null|DOMElement */
|
|
public $encKey = null;
|
|
|
|
/** @var array */
|
|
private $references = array();
|
|
|
|
public function __construct()
|
|
{
|
|
$this->_resetTemplate();
|
|
}
|
|
|
|
private function _resetTemplate()
|
|
{
|
|
$this->encdoc = new DOMDocument();
|
|
$this->encdoc->loadXML(self::template);
|
|
}
|
|
|
|
/**
|
|
* @param string $name
|
|
* @param DOMNode $node
|
|
* @param string $type
|
|
* @throws Exception
|
|
*/
|
|
public function addReference($name, $node, $type)
|
|
{
|
|
if (! $node instanceOf DOMNode) {
|
|
throw new Exception('$node is not of type DOMNode');
|
|
}
|
|
$curencdoc = $this->encdoc;
|
|
$this->_resetTemplate();
|
|
$encdoc = $this->encdoc;
|
|
$this->encdoc = $curencdoc;
|
|
$refuri = XMLSecurityDSig::generateGUID();
|
|
$element = $encdoc->documentElement;
|
|
$element->setAttribute("Id", $refuri);
|
|
$this->references[$name] = array("node" => $node, "type" => $type, "encnode" => $encdoc, "refuri" => $refuri);
|
|
}
|
|
|
|
/**
|
|
* @param DOMNode $node
|
|
*/
|
|
public function setNode($node)
|
|
{
|
|
$this->rawNode = $node;
|
|
}
|
|
|
|
/**
|
|
* Encrypt the selected node with the given key.
|
|
*
|
|
* @param XMLSecurityKey $objKey The encryption key and algorithm.
|
|
* @param bool $replace Whether the encrypted node should be replaced in the original tree. Default is true.
|
|
* @throws Exception
|
|
*
|
|
* @return DOMElement The <xenc:EncryptedData>-element.
|
|
*/
|
|
public function encryptNode($objKey, $replace = true)
|
|
{
|
|
$data = '';
|
|
if (empty($this->rawNode)) {
|
|
throw new Exception('Node to encrypt has not been set');
|
|
}
|
|
if (! $objKey instanceof XMLSecurityKey) {
|
|
throw new Exception('Invalid Key');
|
|
}
|
|
$doc = $this->rawNode->ownerDocument;
|
|
$xPath = new DOMXPath($this->encdoc);
|
|
$objList = $xPath->query('/xenc:EncryptedData/xenc:CipherData/xenc:CipherValue');
|
|
$cipherValue = $objList->item(0);
|
|
if ($cipherValue == null) {
|
|
throw new Exception('Error locating CipherValue element within template');
|
|
}
|
|
switch ($this->type) {
|
|
case (self::Element):
|
|
$data = $doc->saveXML($this->rawNode);
|
|
$this->encdoc->documentElement->setAttribute('Type', self::Element);
|
|
break;
|
|
case (self::Content):
|
|
$children = $this->rawNode->childNodes;
|
|
foreach ($children AS $child) {
|
|
$data .= $doc->saveXML($child);
|
|
}
|
|
$this->encdoc->documentElement->setAttribute('Type', self::Content);
|
|
break;
|
|
default:
|
|
throw new Exception('Type is currently not supported');
|
|
}
|
|
|
|
$encMethod = $this->encdoc->documentElement->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:EncryptionMethod'));
|
|
$encMethod->setAttribute('Algorithm', $objKey->getAlgorithm());
|
|
$cipherValue->parentNode->parentNode->insertBefore($encMethod, $cipherValue->parentNode->parentNode->firstChild);
|
|
|
|
$strEncrypt = base64_encode($objKey->encryptData($data));
|
|
$value = $this->encdoc->createTextNode($strEncrypt);
|
|
$cipherValue->appendChild($value);
|
|
|
|
if ($replace) {
|
|
switch ($this->type) {
|
|
case (self::Element):
|
|
if ($this->rawNode->nodeType == XML_DOCUMENT_NODE) {
|
|
return $this->encdoc;
|
|
}
|
|
$importEnc = $this->rawNode->ownerDocument->importNode($this->encdoc->documentElement, true);
|
|
$this->rawNode->parentNode->replaceChild($importEnc, $this->rawNode);
|
|
return $importEnc;
|
|
case (self::Content):
|
|
$importEnc = $this->rawNode->ownerDocument->importNode($this->encdoc->documentElement, true);
|
|
while ($this->rawNode->firstChild) {
|
|
$this->rawNode->removeChild($this->rawNode->firstChild);
|
|
}
|
|
$this->rawNode->appendChild($importEnc);
|
|
return $importEnc;
|
|
}
|
|
} else {
|
|
return $this->encdoc->documentElement;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @param XMLSecurityKey $objKey
|
|
* @throws Exception
|
|
*/
|
|
public function encryptReferences($objKey)
|
|
{
|
|
$curRawNode = $this->rawNode;
|
|
$curType = $this->type;
|
|
foreach ($this->references AS $name => $reference) {
|
|
$this->encdoc = $reference["encnode"];
|
|
$this->rawNode = $reference["node"];
|
|
$this->type = $reference["type"];
|
|
try {
|
|
$encNode = $this->encryptNode($objKey);
|
|
$this->references[$name]["encnode"] = $encNode;
|
|
} catch (Exception $e) {
|
|
$this->rawNode = $curRawNode;
|
|
$this->type = $curType;
|
|
throw $e;
|
|
}
|
|
}
|
|
$this->rawNode = $curRawNode;
|
|
$this->type = $curType;
|
|
}
|
|
|
|
/**
|
|
* Retrieve the CipherValue text from this encrypted node.
|
|
*
|
|
* @throws Exception
|
|
* @return string|null The Ciphervalue text, or null if no CipherValue is found.
|
|
*/
|
|
public function getCipherValue()
|
|
{
|
|
if (empty($this->rawNode)) {
|
|
throw new Exception('Node to decrypt has not been set');
|
|
}
|
|
|
|
$doc = $this->rawNode->ownerDocument;
|
|
$xPath = new DOMXPath($doc);
|
|
$xPath->registerNamespace('xmlencr', self::XMLENCNS);
|
|
/* Only handles embedded content right now and not a reference */
|
|
$query = "./xmlencr:CipherData/xmlencr:CipherValue";
|
|
$nodeset = $xPath->query($query, $this->rawNode);
|
|
$node = $nodeset->item(0);
|
|
|
|
if (!$node) {
|
|
return null;
|
|
}
|
|
|
|
return base64_decode($node->nodeValue);
|
|
}
|
|
|
|
/**
|
|
* Decrypt this encrypted node.
|
|
*
|
|
* The behaviour of this function depends on the value of $replace.
|
|
* If $replace is false, we will return the decrypted data as a string.
|
|
* If $replace is true, we will insert the decrypted element(s) into the
|
|
* document, and return the decrypted element(s).
|
|
*
|
|
* @param XMLSecurityKey $objKey The decryption key that should be used when decrypting the node.
|
|
* @param boolean $replace Whether we should replace the encrypted node in the XML document with the decrypted data. The default is true.
|
|
*
|
|
* @return string|DOMElement The decrypted data.
|
|
*/
|
|
public function decryptNode($objKey, $replace=true)
|
|
{
|
|
if (! $objKey instanceof XMLSecurityKey) {
|
|
throw new Exception('Invalid Key');
|
|
}
|
|
|
|
$encryptedData = $this->getCipherValue();
|
|
if ($encryptedData) {
|
|
$decrypted = $objKey->decryptData($encryptedData);
|
|
if ($replace) {
|
|
switch ($this->type) {
|
|
case (self::Element):
|
|
$newdoc = new DOMDocument();
|
|
$newdoc->loadXML($decrypted);
|
|
if ($this->rawNode->nodeType == XML_DOCUMENT_NODE) {
|
|
return $newdoc;
|
|
}
|
|
$importEnc = $this->rawNode->ownerDocument->importNode($newdoc->documentElement, true);
|
|
$this->rawNode->parentNode->replaceChild($importEnc, $this->rawNode);
|
|
return $importEnc;
|
|
case (self::Content):
|
|
if ($this->rawNode->nodeType == XML_DOCUMENT_NODE) {
|
|
$doc = $this->rawNode;
|
|
} else {
|
|
$doc = $this->rawNode->ownerDocument;
|
|
}
|
|
$newFrag = $doc->createDocumentFragment();
|
|
$newFrag->appendXML($decrypted);
|
|
$parent = $this->rawNode->parentNode;
|
|
$parent->replaceChild($newFrag, $this->rawNode);
|
|
return $parent;
|
|
default:
|
|
return $decrypted;
|
|
}
|
|
} else {
|
|
return $decrypted;
|
|
}
|
|
} else {
|
|
throw new Exception("Cannot locate encrypted data");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Encrypt the XMLSecurityKey
|
|
*
|
|
* @param XMLSecurityKey $srcKey
|
|
* @param XMLSecurityKey $rawKey
|
|
* @param bool $append
|
|
* @throws Exception
|
|
*/
|
|
public function encryptKey($srcKey, $rawKey, $append=true)
|
|
{
|
|
if ((! $srcKey instanceof XMLSecurityKey) || (! $rawKey instanceof XMLSecurityKey)) {
|
|
throw new Exception('Invalid Key');
|
|
}
|
|
$strEncKey = base64_encode($srcKey->encryptData($rawKey->key));
|
|
$root = $this->encdoc->documentElement;
|
|
$encKey = $this->encdoc->createElementNS(self::XMLENCNS, 'xenc:EncryptedKey');
|
|
if ($append) {
|
|
$keyInfo = $root->insertBefore($this->encdoc->createElementNS('http://www.w3.org/2000/09/xmldsig#', 'dsig:KeyInfo'), $root->firstChild);
|
|
$keyInfo->appendChild($encKey);
|
|
} else {
|
|
$this->encKey = $encKey;
|
|
}
|
|
$encMethod = $encKey->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:EncryptionMethod'));
|
|
$encMethod->setAttribute('Algorithm', $srcKey->getAlgorith());
|
|
if (! empty($srcKey->name)) {
|
|
$keyInfo = $encKey->appendChild($this->encdoc->createElementNS('http://www.w3.org/2000/09/xmldsig#', 'dsig:KeyInfo'));
|
|
$keyInfo->appendChild($this->encdoc->createElementNS('http://www.w3.org/2000/09/xmldsig#', 'dsig:KeyName', $srcKey->name));
|
|
}
|
|
$cipherData = $encKey->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:CipherData'));
|
|
$cipherData->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:CipherValue', $strEncKey));
|
|
if (is_array($this->references) && count($this->references) > 0) {
|
|
$refList = $encKey->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:ReferenceList'));
|
|
foreach ($this->references AS $name => $reference) {
|
|
$refuri = $reference["refuri"];
|
|
$dataRef = $refList->appendChild($this->encdoc->createElementNS(self::XMLENCNS, 'xenc:DataReference'));
|
|
$dataRef->setAttribute("URI", '#' . $refuri);
|
|
}
|
|
}
|
|
return;
|
|
}
|
|
|
|
/**
|
|
* @param XMLSecurityKey $encKey
|
|
* @return DOMElement|string
|
|
* @throws Exception
|
|
*/
|
|
public function decryptKey($encKey)
|
|
{
|
|
if (! $encKey->isEncrypted) {
|
|
throw new Exception("Key is not Encrypted");
|
|
}
|
|
if (empty($encKey->key)) {
|
|
throw new Exception("Key is missing data to perform the decryption");
|
|
}
|
|
return $this->decryptNode($encKey, false);
|
|
}
|
|
|
|
/**
|
|
* @param DOMDocument $element
|
|
* @return DOMNode|null
|
|
*/
|
|
public function locateEncryptedData($element)
|
|
{
|
|
if ($element instanceof DOMDocument) {
|
|
$doc = $element;
|
|
} else {
|
|
$doc = $element->ownerDocument;
|
|
}
|
|
if ($doc) {
|
|
$xpath = new DOMXPath($doc);
|
|
$query = "//*[local-name()='EncryptedData' and namespace-uri()='".self::XMLENCNS."']";
|
|
$nodeset = $xpath->query($query);
|
|
return $nodeset->item(0);
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Returns the key from the DOM
|
|
* @param null|DOMNode $node
|
|
* @return null|XMLSecurityKey
|
|
*/
|
|
public function locateKey($node=null)
|
|
{
|
|
if (empty($node)) {
|
|
$node = $this->rawNode;
|
|
}
|
|
if (! $node instanceof DOMNode) {
|
|
return null;
|
|
}
|
|
if ($doc = $node->ownerDocument) {
|
|
$xpath = new DOMXPath($doc);
|
|
$xpath->registerNamespace('xmlsecenc', self::XMLENCNS);
|
|
$query = ".//xmlsecenc:EncryptionMethod";
|
|
$nodeset = $xpath->query($query, $node);
|
|
if ($encmeth = $nodeset->item(0)) {
|
|
$attrAlgorithm = $encmeth->getAttribute("Algorithm");
|
|
try {
|
|
$objKey = new XMLSecurityKey($attrAlgorithm, array('type' => 'private'));
|
|
} catch (Exception $e) {
|
|
return null;
|
|
}
|
|
return $objKey;
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* @param null|XMLSecurityKey $objBaseKey
|
|
* @param null|DOMNode $node
|
|
* @return null|XMLSecurityKey
|
|
* @throws Exception
|
|
*/
|
|
public static function staticLocateKeyInfo($objBaseKey=null, $node=null)
|
|
{
|
|
if (empty($node) || (! $node instanceof DOMNode)) {
|
|
return null;
|
|
}
|
|
$doc = $node->ownerDocument;
|
|
if (!$doc) {
|
|
return null;
|
|
}
|
|
|
|
$xpath = new DOMXPath($doc);
|
|
$xpath->registerNamespace('xmlsecenc', self::XMLENCNS);
|
|
$xpath->registerNamespace('xmlsecdsig', XMLSecurityDSig::XMLDSIGNS);
|
|
$query = "./xmlsecdsig:KeyInfo";
|
|
$nodeset = $xpath->query($query, $node);
|
|
$encmeth = $nodeset->item(0);
|
|
if (!$encmeth) {
|
|
/* No KeyInfo in EncryptedData / EncryptedKey. */
|
|
return $objBaseKey;
|
|
}
|
|
|
|
foreach ($encmeth->childNodes AS $child) {
|
|
switch ($child->localName) {
|
|
case 'KeyName':
|
|
if (! empty($objBaseKey)) {
|
|
$objBaseKey->name = $child->nodeValue;
|
|
}
|
|
break;
|
|
case 'KeyValue':
|
|
foreach ($child->childNodes AS $keyval) {
|
|
switch ($keyval->localName) {
|
|
case 'DSAKeyValue':
|
|
throw new Exception("DSAKeyValue currently not supported");
|
|
case 'RSAKeyValue':
|
|
$modulus = null;
|
|
$exponent = null;
|
|
if ($modulusNode = $keyval->getElementsByTagName('Modulus')->item(0)) {
|
|
$modulus = base64_decode($modulusNode->nodeValue);
|
|
}
|
|
if ($exponentNode = $keyval->getElementsByTagName('Exponent')->item(0)) {
|
|
$exponent = base64_decode($exponentNode->nodeValue);
|
|
}
|
|
if (empty($modulus) || empty($exponent)) {
|
|
throw new Exception("Missing Modulus or Exponent");
|
|
}
|
|
$publicKey = XMLSecurityKey::convertRSA($modulus, $exponent);
|
|
$objBaseKey->loadKey($publicKey);
|
|
break;
|
|
}
|
|
}
|
|
break;
|
|
case 'RetrievalMethod':
|
|
$type = $child->getAttribute('Type');
|
|
if ($type !== 'http://www.w3.org/2001/04/xmlenc#EncryptedKey') {
|
|
/* Unsupported key type. */
|
|
break;
|
|
}
|
|
$uri = $child->getAttribute('URI');
|
|
if ($uri[0] !== '#') {
|
|
/* URI not a reference - unsupported. */
|
|
break;
|
|
}
|
|
$id = substr($uri, 1);
|
|
|
|
$query = '//xmlsecenc:EncryptedKey[@Id="'.XPath::filterAttrValue($id, XPath::DOUBLE_QUOTE).'"]';
|
|
$keyElement = $xpath->query($query)->item(0);
|
|
if (!$keyElement) {
|
|
throw new Exception("Unable to locate EncryptedKey with @Id='$id'.");
|
|
}
|
|
|
|
return XMLSecurityKey::fromEncryptedKeyElement($keyElement);
|
|
case 'EncryptedKey':
|
|
return XMLSecurityKey::fromEncryptedKeyElement($child);
|
|
case 'X509Data':
|
|
if ($x509certNodes = $child->getElementsByTagName('X509Certificate')) {
|
|
if ($x509certNodes->length > 0) {
|
|
$x509cert = $x509certNodes->item(0)->textContent;
|
|
$x509cert = str_replace(array("\r", "\n", " "), "", $x509cert);
|
|
$x509cert = "-----BEGIN CERTIFICATE-----\n".chunk_split($x509cert, 64, "\n")."-----END CERTIFICATE-----\n";
|
|
$objBaseKey->loadKey($x509cert, false, true);
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
return $objBaseKey;
|
|
}
|
|
|
|
/**
|
|
* @param null|XMLSecurityKey $objBaseKey
|
|
* @param null|DOMNode $node
|
|
* @return null|XMLSecurityKey
|
|
*/
|
|
public function locateKeyInfo($objBaseKey=null, $node=null)
|
|
{
|
|
if (empty($node)) {
|
|
$node = $this->rawNode;
|
|
}
|
|
return self::staticLocateKeyInfo($objBaseKey, $node);
|
|
}
|
|
}
|