e5a0209d4b
Sign a document with macros (via file -> digital signatures -> digital signatures), realize that you still get a warning on file open, sign the macros in the document (via tools -> macros -> digital signature), realize that you did this in the wrong order, so now you have to re-sign the doc content. The reason for this is that the macro signature only signs the macro parts of the document (so you can still edit the document and the signature is valid, as long as you don't touch macros), while the doc content signature signs everything, including the macro signature, so the order of the two matters. Solve this trouble by adding a new setting that allows doing the two signatures in one step. Do this by extending the doc content signing code with an optional pre-step that first signs the document macros. This is a bit tricky to do, since xmlsecurity/ gets an RW signature stream and a RO document storage from sfx2/, but transferring one more signature stream can solve this trouble. Other tricky parts of the change: 1) The crypto signing is always done by libxmlsec, so DigitalSignaturesDialog::SetScriptingSignatureStream() has to update the storage of the sign manager's sign helper, otherwise, the hashes in the macro signature will be empty. 2) Signing reads the RO storage, so normally the macro signature would not be part of the doc signature when creating both signatures inside a single dialog. (The storage is only committed after the dialog ends.) Fix this problem by extending DocumentSignatureManager::add() and UriBindingHelper::OpenInputStream() to provide kind of an overlay when xmlsecurity/ gets a script signature stream: this way the macro signature will be part of the doc signature while the dialog is in progress. No overlay is needed later, once both streams are committed to the storage on dialog end. Change-Id: Ic2728689997165595991d5ec59c7a2683286e22d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/173263 Reviewed-by: Miklos Vajna <vmiklos@collabora.com> Tested-by: Jenkins
145 lines
6 KiB
C++
145 lines
6 KiB
C++
/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
|
|
/*
|
|
* This file is part of the LibreOffice project.
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
*
|
|
* This file incorporates work covered by the following license notice:
|
|
*
|
|
* Licensed to the Apache Software Foundation (ASF) under one or more
|
|
* contributor license agreements. See the NOTICE file distributed
|
|
* with this work for additional information regarding copyright
|
|
* ownership. The ASF licenses this file to you under the Apache
|
|
* License, Version 2.0 (the "License"); you may not use this file
|
|
* except in compliance with the License. You may obtain a copy of
|
|
* the License at http://www.apache.org/licenses/LICENSE-2.0 .
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "xmlsecuritydllapi.h"
|
|
|
|
#include <memory>
|
|
|
|
#include <svl/sigstruct.hxx>
|
|
#include "xmlsignaturehelper.hxx"
|
|
#include "documentsignaturehelper.hxx"
|
|
|
|
#include <com/sun/star/xml/crypto/XSEInitializer.hpp>
|
|
#include <unotools/tempfile.hxx>
|
|
|
|
namespace com::sun::star
|
|
{
|
|
namespace beans
|
|
{
|
|
struct PropertyValue;
|
|
}
|
|
namespace embed
|
|
{
|
|
class XStorage;
|
|
}
|
|
namespace frame
|
|
{
|
|
class XModel;
|
|
}
|
|
namespace graphic
|
|
{
|
|
class XGraphic;
|
|
}
|
|
namespace uno
|
|
{
|
|
class XComponentContext;
|
|
}
|
|
}
|
|
class PDFSignatureHelper;
|
|
class Xmlsec;
|
|
|
|
/// Manages signatures (addition, removal), used by DigitalSignaturesDialog.
|
|
class XMLSECURITY_DLLPUBLIC DocumentSignatureManager
|
|
{
|
|
private:
|
|
css::uno::Reference<css::uno::XComponentContext> mxContext;
|
|
css::uno::Reference<css::embed::XStorage> mxStore;
|
|
XMLSignatureHelper maSignatureHelper;
|
|
std::unique_ptr<PDFSignatureHelper> mpPDFSignatureHelper;
|
|
SignatureInformations maCurrentSignatureInformations;
|
|
DocumentSignatureMode const meSignatureMode;
|
|
css::uno::Sequence<css::uno::Sequence<css::beans::PropertyValue>> m_manifest;
|
|
css::uno::Reference<css::io::XStream> mxSignatureStream;
|
|
css::uno::Reference<css::io::XStream> mxScriptingSignatureStream;
|
|
css::uno::Reference<css::frame::XModel> mxModel;
|
|
rtl::Reference<utl::TempFileFastService> mxTempSignatureStream;
|
|
/// Storage containing all OOXML signatures, unused for ODF.
|
|
css::uno::Reference<css::embed::XStorage> mxTempSignatureStorage;
|
|
css::uno::Reference<css::xml::crypto::XSEInitializer> mxSEInitializer;
|
|
css::uno::Reference<css::xml::crypto::XXMLSecurityContext> mxSecurityContext;
|
|
css::uno::Reference<css::xml::crypto::XSEInitializer> mxGpgSEInitializer;
|
|
css::uno::Reference<css::xml::crypto::XXMLSecurityContext> mxGpgSecurityContext;
|
|
std::shared_ptr<Xmlsec> mpXmlsecLibrary;
|
|
|
|
public:
|
|
DocumentSignatureManager(const css::uno::Reference<css::uno::XComponentContext>& xContext,
|
|
DocumentSignatureMode eMode);
|
|
~DocumentSignatureManager();
|
|
|
|
/**
|
|
* Checks if a particular stream is a valid xml stream. Those are treated
|
|
* differently when they are signed (c14n transformation)
|
|
*/
|
|
bool isXML(std::u16string_view rURI);
|
|
bool readManifest();
|
|
|
|
SignatureStreamHelper ImplOpenSignatureStream(sal_Int32 nStreamOpenMode, bool bTempStream);
|
|
/// Add a new signature, using xCert as a signing certificate, and rDescription as description.
|
|
bool add(const css::uno::Reference<css::security::XCertificate>& xCert,
|
|
const css::uno::Reference<css::xml::crypto::XXMLSecurityContext>& xSecurityContext,
|
|
const OUString& rDescription, sal_Int32& nSecurityId, bool bAdESCompliant,
|
|
const OUString& rSignatureLineId = OUString(),
|
|
const css::uno::Reference<css::graphic::XGraphic>& xValidGraphic
|
|
= css::uno::Reference<css::graphic::XGraphic>(),
|
|
const css::uno::Reference<css::graphic::XGraphic>& xInvalidGraphic
|
|
= css::uno::Reference<css::graphic::XGraphic>());
|
|
/// Remove signature at nPosition.
|
|
void remove(sal_uInt16 nPosition);
|
|
/// Read signatures from either a temp stream or the real storage.
|
|
void read(bool bUseTempStream, bool bCacheLastSignature = true);
|
|
/// Write signatures back to the persistent storage.
|
|
void write(bool bXAdESCompliantIfODF);
|
|
/// Lazy creation of PDF helper.
|
|
PDFSignatureHelper& getPDFSignatureHelper();
|
|
#if 0
|
|
// Checks if the document is a kind where it is relevant to distinguish between using XAdES or not
|
|
bool IsXAdESRelevant();
|
|
#endif
|
|
/// Attempts to initialize the platform-specific crypto.
|
|
bool init();
|
|
/// Get the security environment.
|
|
css::uno::Reference<css::xml::crypto::XSecurityEnvironment> getSecurityEnvironment();
|
|
css::uno::Reference<css::xml::crypto::XSecurityEnvironment> getGpgSecurityEnvironment();
|
|
css::uno::Reference<css::xml::crypto::XXMLSecurityContext> const& getSecurityContext() const;
|
|
css::uno::Reference<css::xml::crypto::XXMLSecurityContext> const& getGpgSecurityContext() const;
|
|
void setStore(const css::uno::Reference<css::embed::XStorage>& xStore) { mxStore = xStore; }
|
|
XMLSignatureHelper& getSignatureHelper() { return maSignatureHelper; }
|
|
bool hasPDFSignatureHelper() const { return bool(mpPDFSignatureHelper); }
|
|
void setSignatureStream(const css::uno::Reference<css::io::XStream>& xSignatureStream)
|
|
{
|
|
mxSignatureStream = xSignatureStream;
|
|
}
|
|
css::uno::Reference<css::io::XStream> getSignatureStream() const { return mxSignatureStream; }
|
|
void setScriptingSignatureStream(
|
|
const css::uno::Reference<css::io::XStream>& xScriptingSignatureStream)
|
|
{
|
|
mxScriptingSignatureStream = xScriptingSignatureStream;
|
|
}
|
|
void setModel(const css::uno::Reference<css::frame::XModel>& xModel);
|
|
const css::uno::Reference<css::embed::XStorage>& getStore() const { return mxStore; }
|
|
DocumentSignatureMode getSignatureMode() const { return meSignatureMode; }
|
|
SignatureInformations& getCurrentSignatureInformations()
|
|
{
|
|
return maCurrentSignatureInformations;
|
|
}
|
|
};
|
|
|
|
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
|