using namespace libdcp;
KDM::KDM (boost::filesystem::path kdm, boost::filesystem::path private_key)
- : xml_kdm (new xml::DCinemaSecurityMessage (kdm))
+ : _xml_kdm (new xml::DCinemaSecurityMessage (kdm))
{
/* Read the private key */
/* Use it to decrypt the keys */
- list<string> encrypted_keys = xml_kdm->authenticated_private.encrypted_keys;
+ list<string> encrypted_keys = _xml_kdm->authenticated_private.encrypted_keys;
for (list<string>::iterator i = encrypted_keys.begin(); i != encrypted_keys.end(); ++i) {
KDM::KDM (
shared_ptr<const CPL> cpl, shared_ptr<const Signer> signer, shared_ptr<const Certificate> recipient_cert,
boost::posix_time::ptime not_valid_before, boost::posix_time::ptime not_valid_after,
- MXFMetadata mxf_metadata, XMLMetadata xml_metadata
+ string annotation_text, string issue_date
)
- : xml_kdm (new xml::DCinemaSecurityMessage)
+ : _xml_kdm (new xml::DCinemaSecurityMessage)
{
- xml::AuthenticatedPublic& apu = xml_kdm->authenticated_public;
+ xml::AuthenticatedPublic& apu = _xml_kdm->authenticated_public;
/* AuthenticatedPublic */
apu.message_id = "urn:uuid:" + make_uuid ();
apu.message_type = "http://www.smpte-ra.org/430-1/2006/KDM#kdm-key-type";
- apu.annotation_text = mxf_metadata.product_name;
- apu.issue_date = xml_metadata.issue_date;
+ apu.annotation_text = annotation_text;
+ apu.issue_date = issue_date;
apu.signer.x509_issuer_name = signer->certificates().leaf()->issuer ();
apu.signer.x509_serial_number = signer->certificates().leaf()->serial ();
apu.recipient.x509_issuer_serial.x509_issuer_name = recipient_cert->issuer ();
apu.recipient.x509_issuer_serial.x509_serial_number = recipient_cert->serial ();
apu.recipient.x509_subject_name = recipient_cert->subject ();
apu.composition_playlist_id = "urn:uuid:" + cpl->id ();
+// apu.content_authenticator = signer->certificates().leaf()->thumbprint ();
apu.content_title_text = cpl->name ();
apu.content_keys_not_valid_before = ptime_to_string (not_valid_before);
apu.content_keys_not_valid_after = ptime_to_string (not_valid_after);
apu.authorized_device_info.device_list_identifier = "urn:uuid:" + make_uuid ();
- apu.authorized_device_info.device_list_description = recipient_cert->subject ();
- apu.authorized_device_info.device_list.push_back (recipient_cert->thumbprint ());
-
+ string n = recipient_cert->common_name ();
+ if (n.find (".") != string::npos) {
+ n = n.substr (n.find (".") + 1);
+ }
+ apu.authorized_device_info.device_list_description = n;
+// apu.authorized_device_info.device_list.push_back (recipient_cert->thumbprint ());
+
+ /* Sometimes digital_cinema_tools uses this magic thumbprint instead of that from an actual
+ recipient certificate. KDMs delivered to City Screen appear to use the same thing.
+ */
+ apu.authorized_device_info.device_list.push_back ("2jmj7l5rSw0yVb/vlWAYkK/YBwk=");
+
list<shared_ptr<const Asset> > assets = cpl->assets ();
for (list<shared_ptr<const Asset> >::iterator i = assets.begin(); i != assets.end(); ++i) {
/* XXX: non-MXF assets? */
/* XXX: non-MXF assets? */
shared_ptr<const MXFAsset> mxf = boost::dynamic_pointer_cast<const MXFAsset> (*i);
if (mxf) {
- xml_kdm->authenticated_private.encrypted_keys.push_back (
- KDMKey (signer, cpl->id (), mxf->key_id (), not_valid_before, not_valid_after, mxf->key().get()).base64 ()
+ KDMKey kkey (
+ signer, cpl->id (), mxf->key_type (), mxf->key_id (),
+ not_valid_before, not_valid_after, mxf->key().get()
);
+
+ _keys.push_back (kkey);
+ _xml_kdm->authenticated_private.encrypted_keys.push_back (kkey.encrypted_base64 (recipient_cert));
}
}
/* Signature */
- shared_ptr<xmlpp::Document> doc = xml_kdm->as_xml ();
+ shared_ptr<xmlpp::Document> doc = _xml_kdm->as_xml ();
shared_ptr<cxml::Node> root (new cxml::Node (doc->get_root_node ()));
xmlpp::Node* signature = root->node_child("Signature")->node();
signer->add_signature_value (signature, "ds");
- xml_kdm->signature = xml::Signature (shared_ptr<cxml::Node> (new cxml::Node (signature)));
+ _xml_kdm->signature = xml::Signature (shared_ptr<cxml::Node> (new cxml::Node (signature)));
+}
+
+KDM::KDM (KDM const & other)
+ : _keys (other._keys)
+ , _xml_kdm (new xml::DCinemaSecurityMessage (*other._xml_kdm.get()))
+{
+
}
+KDM &
+KDM::operator= (KDM const & other)
+{
+ if (this == &other) {
+ return *this;
+ }
+
+ _keys = other._keys;
+ _xml_kdm.reset (new xml::DCinemaSecurityMessage (*other._xml_kdm.get ()));
+
+ return *this;
+}
+
void
KDM::as_xml (boost::filesystem::path path) const
{
- shared_ptr<xmlpp::Document> doc = xml_kdm->as_xml ();
- doc->write_to_file_formatted (path.string(), "UTF-8");
+ shared_ptr<xmlpp::Document> doc = _xml_kdm->as_xml ();
+ /* This must *not* be the _formatted version, otherwise the signature
+ will be wrong.
+ */
+ doc->write_to_file (path.string(), "UTF-8");
}
-KDMKey::KDMKey (shared_ptr<const Signer> signer, string cpl_id, string key_id, boost::posix_time::ptime from, boost::posix_time::ptime until, Key key)
+string
+KDM::as_xml () const
+{
+ shared_ptr<xmlpp::Document> doc = _xml_kdm->as_xml ();
+ /* This must *not* be the _formatted version, otherwise the signature
+ will be wrong.
+ */
+ return doc->write_to_string ("UTF-8");
+}
+
+KDMKey::KDMKey (
+ shared_ptr<const Signer> signer, string cpl_id, string key_type, string key_id, boost::posix_time::ptime from, boost::posix_time::ptime until, Key key
+ )
: _cpl_id (cpl_id)
+ , _key_type (key_type)
, _key_id (key_id)
, _not_valid_before (ptime_to_string (from))
, _not_valid_after (ptime_to_string (until))
if (&other == this) {
return *this;
}
-
+
_cpl_id = other._cpl_id;
_key_type = other._key_type;
_key_id = other._key_id;
}
string
-KDMKey::base64 () const
+KDMKey::encrypted_base64 (shared_ptr<const Certificate> recipient_cert) const
{
+ assert (_key_type.length() == 4);
+ assert (_not_valid_before.length() == 25);
+ assert (_not_valid_after.length() == 25);
+
/* XXX: SMPTE only */
uint8_t block[138];
uint8_t* p = block;
put (&p, _not_valid_after);
put (&p, _key.value(), ASDCP::KeyLen);
+ /* Encrypt using the projector's public key */
+ RSA* rsa = recipient_cert->public_key ();
+ unsigned char encrypted[RSA_size(rsa)];
+ int const encrypted_len = RSA_public_encrypt (p - block, block, encrypted, rsa, RSA_PKCS1_OAEP_PADDING);
+ if (encrypted_len == -1) {
+ throw MiscError (String::compose ("Could not encrypt KDM (%1)", ERR_error_string (ERR_get_error(), 0)));
+ }
+
/* Lazy overallocation */
- char string[138 * 2];
- return Kumu::base64encode (block, 138, string, 138 * 2);
+ char out[encrypted_len * 2];
+ Kumu::base64encode (encrypted, encrypted_len, out, encrypted_len * 2);
+ int const N = strlen (out);
+ stringstream lines;
+ for (int i = 0; i < N; ++i) {
+ if (i > 0 && (i % 64) == 0) {
+ lines << "\n";
+ }
+ lines << out[i];
+ }
+
+ return lines.str ();
}
string
stringstream s;
s << id[i] << id[i + 1];
int h;
- s >> h;
+ s >> hex >> h;
**d = h;
(*d)++;
}
}
+
+bool
+libdcp::operator== (libdcp::KDMKey const & a, libdcp::KDMKey const & b)
+{
+ if (memcmp (a._signer_thumbprint, b._signer_thumbprint, 20) != 0) {
+ return false;
+ }
+
+ return (
+ a._cpl_id == b._cpl_id &&
+ a._key_type == b._key_type &&
+ a._key_id == b._key_id &&
+ a._not_valid_before == b._not_valid_before &&
+ a._not_valid_after == b._not_valid_after &&
+ a._key == b._key
+ );
+}
projects / libdcp.git / blobdiff