From 28ff6a737cf60612c777a02559f6f9cf1f51d015 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Tue, 13 Aug 2024 15:42:38 +0300 Subject: [PATCH] Validate TSL XSD schemas IB-8160 Signed-off-by: Raul Metsma --- .../ts_119612v020101_additionaltypes_xsd.xsd | 43 ++ ...119612v020101_additionaltypes_xsd.xsd.orig | 43 ++ etc/schema/ts_119612v020101_sie_xsd.xsd | 92 ++++ etc/schema/ts_119612v020101_sie_xsd.xsd.orig | 92 ++++ etc/schema/ts_119612v020201_201601xsd.xsd | 457 ++++++++++++++++++ .../ts_119612v020201_201601xsd.xsd.orig | 457 ++++++++++++++++++ etc/schema/xml.xsd | 117 +++++ libdigidocpp.dox | 14 + src/crypto/TSL.cpp | 7 +- 9 files changed, 1320 insertions(+), 2 deletions(-) create mode 100644 etc/schema/ts_119612v020101_additionaltypes_xsd.xsd create mode 100644 etc/schema/ts_119612v020101_additionaltypes_xsd.xsd.orig create mode 100644 etc/schema/ts_119612v020101_sie_xsd.xsd create mode 100644 etc/schema/ts_119612v020101_sie_xsd.xsd.orig create mode 100644 etc/schema/ts_119612v020201_201601xsd.xsd create mode 100644 etc/schema/ts_119612v020201_201601xsd.xsd.orig create mode 100644 etc/schema/xml.xsd diff --git a/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd b/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd new file mode 100644 index 000000000..5df405d70 --- /dev/null +++ b/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd @@ -0,0 +1,43 @@ + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs + +X509CertificateLocation element was specified in TS 102 231 v3.1.2 clause B.4.3 The ServiceDigitalIdentityType. It is now deprecated and is not used + +PublicKeyLocation element was specified in TS 102 231 v3.1.2 clause B.4.3 The ServiceDigitalIdentityType. It is now deprecated and is not used + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.3 OtherCriteria, bullet 1) ExtendedKeyUsage + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.3 TakenOverBy Extension + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.3 OtherCriteria, bullet 2) CertSubjectDNAttribute + + + + + + + diff --git a/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd.orig b/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd.orig new file mode 100644 index 000000000..fb323a033 --- /dev/null +++ b/etc/schema/ts_119612v020101_additionaltypes_xsd.xsd.orig @@ -0,0 +1,43 @@ + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs + +X509CertificateLocation element was specified in TS 102 231 v3.1.2 clause B.4.3 The ServiceDigitalIdentityType. It is now deprecated and is not used + +PublicKeyLocation element was specified in TS 102 231 v3.1.2 clause B.4.3 The ServiceDigitalIdentityType. It is now deprecated and is not used + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.3 OtherCriteria, bullet 1) ExtendedKeyUsage + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.3 TakenOverBy Extension + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.3 OtherCriteria, bullet 2) CertSubjectDNAttribute + + + + + + + diff --git a/etc/schema/ts_119612v020101_sie_xsd.xsd b/etc/schema/ts_119612v020101_sie_xsd.xsd new file mode 100644 index 000000000..440b006c6 --- /dev/null +++ b/etc/schema/ts_119612v020101_sie_xsd.xsd @@ -0,0 +1,92 @@ + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2 Qualifications Extension + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.1 QualificationElement + + + + + + + + + + Please first try to use the CriteriaList before doing the OtherCriteria extension point. + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2 CriteriaList + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.3 Qualifier + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.2 PolicySet + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.1 KeyUsage + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/etc/schema/ts_119612v020101_sie_xsd.xsd.orig b/etc/schema/ts_119612v020101_sie_xsd.xsd.orig new file mode 100644 index 000000000..2c06e3916 --- /dev/null +++ b/etc/schema/ts_119612v020101_sie_xsd.xsd.orig @@ -0,0 +1,92 @@ + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2 Qualifications Extension + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.1 QualificationElement + + + + + + + + + + Please first try to use the CriteriaList before doing the OtherCriteria extension point. + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2 CriteriaList + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.3 Qualifier + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.2 PolicySet + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.2.2.1 KeyUsage + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/etc/schema/ts_119612v020201_201601xsd.xsd b/etc/schema/ts_119612v020201_201601xsd.xsd new file mode 100644 index 000000000..ca8192b33 --- /dev/null +++ b/etc/schema/ts_119612v020201_201601xsd.xsd @@ -0,0 +1,457 @@ + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5 Scheme operator address + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5.1 Scheme operator postal address + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5.2 Scheme operator electronic address + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.17 Scheme extensions + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.18 Trust Service Provider List + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3 Scheme information + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.3 TSL type + + Specified in TS 119 612 v2.1.1 clause 5.3.4 Scheme operator name + + Specified in TS 119 612 v2.1.1 clause 5.3.6 Scheme name + + Specified in TS 119 612 v2.1.1 clause 5.3.7 Scheme information URI + + + + Specified in TS 119 612 v2.1.1 clause 5.3.9 Scheme type/community/rules + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.10 Scheme territory + + + Specified in TS 119 612 v2.1.1 clause 5.3.11 TSL policy/legal notice + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.15 Next update + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs + + + + + + + + + + + + + + + + + + pecified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs item b) from Format + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs item c) from Format + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.16 Distribution points + + + Specified in TS 119 612 v2.1.1 clause 5.3.18 Trust Service Provider List + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.4 TSP information + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.4.6 TSP Services (list of services) + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5 Service information + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.4 Service current status + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.7 Service supply points + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.1 Service type identifier + + + Specified in TS 119 612 v2.1.1 clause 5.5.3 Service digital identity + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.10 Service history + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.6 Service history instance + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.4 expiredCertsRevocationInfo Extension + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.1 additionalServiceInformation Extension + + + + + + + + + diff --git a/etc/schema/ts_119612v020201_201601xsd.xsd.orig b/etc/schema/ts_119612v020201_201601xsd.xsd.orig new file mode 100644 index 000000000..bd26829c7 --- /dev/null +++ b/etc/schema/ts_119612v020201_201601xsd.xsd.orig @@ -0,0 +1,457 @@ + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5 Scheme operator address + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5.1 Scheme operator postal address + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.5.2 Scheme operator electronic address + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.17 Scheme extensions + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.1.4 Language support + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.18 Trust Service Provider List + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3 Scheme information + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.3 TSL type + + Specified in TS 119 612 v2.1.1 clause 5.3.4 Scheme operator name + + Specified in TS 119 612 v2.1.1 clause 5.3.6 Scheme name + + Specified in TS 119 612 v2.1.1 clause 5.3.7 Scheme information URI + + + + Specified in TS 119 612 v2.1.1 clause 5.3.9 Scheme type/community/rules + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.10 Scheme territory + + + Specified in TS 119 612 v2.1.1 clause 5.3.11 TSL policy/legal notice + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.15 Next update + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs + + + + + + + + + + + + + + + + + + pecified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs item b) from Format + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.13 Pointers to other TSLs item c) from Format + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.3.16 Distribution points + + + Specified in TS 119 612 v2.1.1 clause 5.3.18 Trust Service Provider List + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.4 TSP information + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.4.6 TSP Services (list of services) + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5 Service information + + + + + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.4 Service current status + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.7 Service supply points + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.1 Service type identifier + + + Specified in TS 119 612 v2.1.1 clause 5.5.3 Service digital identity + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.10 Service history + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.6 Service history instance + + + + + + + + + + + + + + + + + + + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.4 expiredCertsRevocationInfo Extension + + + Specified in TS 119 612 v2.1.1 clause 5.5.9.1 additionalServiceInformation Extension + + + + + + + + + diff --git a/etc/schema/xml.xsd b/etc/schema/xml.xsd new file mode 100644 index 000000000..3f4e85417 --- /dev/null +++ b/etc/schema/xml.xsd @@ -0,0 +1,117 @@ + + + + + + + See http://www.w3.org/XML/1998/namespace.html and + http://www.w3.org/TR/REC-xml for information about this namespace. + + This schema document describes the XML namespace, in a form + suitable for import by other schema documents. + + Note that local names in this namespace are intended to be defined + only by the World Wide Web Consortium or its subgroups. The + following names are currently defined in this namespace and should + not be used with conflicting semantics by any Working Group, + specification, or document instance: + + base (as an attribute name): denotes an attribute whose value + provides a URI to be used as the base for interpreting any + relative URIs in the scope of the element on which it + appears; its value is inherited. This name is reserved + by virtue of its definition in the XML Base specification. + + lang (as an attribute name): denotes an attribute whose value + is a language code for the natural language of the content of + any element; its value is inherited. This name is reserved + by virtue of its definition in the XML specification. + + space (as an attribute name): denotes an attribute whose + value is a keyword indicating what whitespace processing + discipline is intended for the content of the element; its + value is inherited. This name is reserved by virtue of its + definition in the XML specification. + + Father (in any context at all): denotes Jon Bosak, the chair of + the original XML Working Group. This name is reserved by + the following decision of the W3C XML Plenary and + XML Coordination groups: + + In appreciation for his vision, leadership and dedication + the W3C XML Plenary on this 10th day of February, 2000 + reserves for Jon Bosak in perpetuity the XML name + xml:Father + + + + + This schema defines attributes and an attribute group + suitable for use by + schemas wishing to allow xml:base, xml:lang or xml:space attributes + on elements they define. + + To enable this, such a schema must import this schema + for the XML namespace, e.g. as follows: + <schema . . .> + . . . + <import namespace="http://www.w3.org/XML/1998/namespace" + schemaLocation="http://www.w3.org/2001/03/xml.xsd"/> + + Subsequently, qualified reference to any of the attributes + or the group defined below will have the desired effect, e.g. + + <type . . .> + . . . + <attributeGroup ref="xml:specialAttrs"/> + + will define a type which will schema-validate an instance + element with any of those attributes + + + + In keeping with the XML Schema WG's standard versioning + policy, this schema document will persist at + http://www.w3.org/2001/03/xml.xsd. + At the date of issue it can also be found at + http://www.w3.org/2001/xml.xsd. + The schema document at that URI may however change in the future, + in order to remain compatible with the latest version of XML Schema + itself. In other words, if the XML Schema namespace changes, the version + of this document at + http://www.w3.org/2001/xml.xsd will change + accordingly; the version at + http://www.w3.org/2001/03/xml.xsd will not change. + + + + + + In due course, we should install the relevant ISO 2- and 3-letter + codes as the enumerated possible values . . . + + + + + + + + + + + + + + + See http://www.w3.org/TR/xmlbase/ for + information about this attribute. + + + + + + + + + + diff --git a/libdigidocpp.dox b/libdigidocpp.dox index eea685f0f..d8c13aa50 100644 --- a/libdigidocpp.dox +++ b/libdigidocpp.dox @@ -516,7 +516,21 @@ Modifications are marked between xml comment tags. \endcode +Schema ts_119612v020101_sie_xsd.xsd +1) The schemas' locations have been modified so that the file is looked up from the local file system. +\code{.xml} + + +\endcode +Schema ts_119612v020101_additionaltypes_xsd.xsd +1) The schemas' locations have been modified so that the file is looked up from the local file system. +\code{.xml} + + + + +\endcode diff --git a/src/crypto/TSL.cpp b/src/crypto/TSL.cpp index 30b07154f..c91eb2786 100644 --- a/src/crypto/TSL.cpp +++ b/src/crypto/TSL.cpp @@ -109,8 +109,11 @@ TSL::TSL(string file) return; if(get()) { - static array ids { pcxmlChar("Id"), nullptr }; - xmlSecAddIDs(get(), nullptr, ids.data()); + try { + validateSchema(File::path(Conf::instance()->xsdPath(), "ts_119612v020201_201601xsd.xsd")); + } catch(const Exception &e) { + WARN("Failed to parse configuration: %s, %s", file.c_str(), e.msg().c_str()); + } } else WARN("Failed to parse configuration: %s", path.c_str());