Produits Entr'ouvert » Lasso

/* $Id$

 *

 * Lasso - A free implementation of the Liberty Alliance specifications.

 *

 * Copyright (C) 2004-2007 Entr'ouvert

 * http://lasso.entrouvert.org

 *

 * Authors: See AUTHORS file in top-level directory.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, see <http://www.gnu.org/licenses/>.

 */

/**

 * SECTION:node

 * @short_description: Base class for all Lasso objects

 *

 * #LassoNode is the base class for Lasso objects; just a step over GObject as

 * defined in glib.

 *

 */

#include "private.h"

#include <ctype.h>

#include <errno.h>

#include <string.h>

#include <xmlsec/base64.h>

#include <xmlsec/xmltree.h>

#include <xmlsec/xmldsig.h>

#include <xmlsec/templates.h>

#include <xmlsec/crypto.h>

#include <xmlsec/xmlenc.h>

#include <xmlsec/openssl/crypto.h>

#include <xmlsec/openssl/x509.h>

#include "xml.h"

#include "xml_enc.h"

#include "saml_name_identifier.h"

#include "../utils.h"

#include "../registry.h"

#include "../debug.h"

#include "soap-1.1/soap_envelope.h"

#include "soap-1.1/soap_body.h"

#include "misc_text_node.h"

#include "../lasso_config.h"

#ifdef LASSO_WSF_ENABLED

#include "idwsf_strings.h"

#include "id-wsf-2.0/idwsf2_strings.h"

#endif

/* Needed for ECP */

#include "saml-2.0/samlp2_idp_list.h"

#include "paos_request.h"

#include "ecp/ecp_request.h"

#include "ecp/ecp_response.h"

#include "ecp/ecp_relaystate.h"

#include "../key.h"

#define LOG_LEVEL_XML_DEBUG G_LOG_LEVEL_DEBUG /* change to G_LOG_LEVEL_WARNING so it shows in Apache log */

static void lasso_node_build_xmlNode_from_snippets(LassoNode *node, LassoNodeClass *class, xmlNode *xmlnode,

		struct XmlSnippet *snippets, gboolean lasso_dump);

static struct XmlSnippet* find_xml_snippet_by_name(LassoNode *node, char *name, LassoNodeClass **class_p);

static gboolean set_value_at_path(LassoNode *node, char *path, char *query_value);

static char* get_value_by_path(LassoNode *node, char *path, struct XmlSnippet *xml_snippet);

static gboolean find_path(LassoNode *node, char *path, LassoNode **value_node,

		LassoNodeClass **class_p, struct XmlSnippet **snippet);

static void lasso_node_add_signature_template(LassoNode *node, xmlNode *xmlnode,

		struct XmlSnippet *snippet_signature);

static void lasso_node_traversal(LassoNode *node, void (*do_to_node)(LassoNode *node, SnippetType type), SnippetType type);

static LassoNode* lasso_node_new_from_xmlNode_with_type(xmlNode *xmlnode, char *typename);

static void lasso_node_remove_original_xmlnode(LassoNode *node, SnippetType type);

GHashTable *dst_services_by_href = NULL; /* ID-WSF 1 extra DST services, indexed on href */

GHashTable *dst_services_by_prefix = NULL; /* ID-WSF 1 extra DST services, indexed on prefix */

GHashTable *idwsf2_dst_services_by_href = NULL; /* ID-WSF 2 DST services, indexed on href */

GHashTable *idwsf2_dst_services_by_prefix = NULL; /* ID-WSF 2 DST services, indexed on prefix */

/*****************************************************************************/

/* global methods                                                            */

/*****************************************************************************/

/**

 * lasso_register_dst_service:

 * @prefix: prefix of DST service

 * @href: href of DST service

 *

 * Registers prefix and href of a custom data service template service.

 **/

void

lasso_register_dst_service(const gchar *prefix, const gchar *href)

{

	if (dst_services_by_href == NULL) {

		dst_services_by_href = g_hash_table_new_full(

				g_str_hash, g_str_equal, g_free, g_free);

		dst_services_by_prefix = g_hash_table_new_full(

				g_str_hash, g_str_equal, g_free, g_free);

	}

	g_hash_table_insert(dst_services_by_prefix, g_strdup(prefix), g_strdup(href));

	g_hash_table_insert(dst_services_by_href, g_strdup(href), g_strdup(prefix));

}

void

lasso_register_idwsf2_dst_service(const gchar *prefix, const gchar *href)

{

	if (idwsf2_dst_services_by_href == NULL) {

		idwsf2_dst_services_by_href = g_hash_table_new_full(

				g_str_hash, g_str_equal, g_free, g_free);

		idwsf2_dst_services_by_prefix = g_hash_table_new_full(

				g_str_hash, g_str_equal, g_free, g_free);

	}

	g_hash_table_insert(idwsf2_dst_services_by_prefix, g_strdup(prefix), g_strdup(href));

	g_hash_table_insert(idwsf2_dst_services_by_href, g_strdup(href), g_strdup(prefix));

}

gchar*

lasso_get_prefix_for_dst_service_href(const gchar *href)

{

	if (dst_services_by_href == NULL)

		return NULL;

	return g_strdup(g_hash_table_lookup(dst_services_by_href, href));

}

gchar*

lasso_get_prefix_for_idwsf2_dst_service_href(const gchar *href)

{

	if (idwsf2_dst_services_by_href == NULL)

		return NULL;

	return g_strdup(g_hash_table_lookup(idwsf2_dst_services_by_href, href));

}

/*****************************************************************************/

/* virtual public methods                                                    */

/*****************************************************************************/

static char*

_lasso_node_export_to_xml(LassoNode *node, gboolean format, gboolean dump, int level)

{

	xmlNode *xmlnode;

	char *ret;

	g_return_val_if_fail (LASSO_IS_NODE(node), NULL);

	xmlnode = lasso_node_get_xmlNode(node, dump);

	if (xmlnode == NULL) {

		return NULL;

	}

	ret = lasso_xmlnode_to_string(xmlnode, format, level);

	xmlFreeNode(xmlnode);

	return ret;

}

/**

 * lasso_node_dump:

 * @node: a #LassoNode

 *

 * Dumps @node.  All datas in object are dumped in an XML format.

 *

 * Return value:(transfer full): a full XML dump of @node.  The string must be freed by the

 *     caller.

 **/

char*

lasso_node_dump(LassoNode *node)

{

	return _lasso_node_export_to_xml(node, FALSE, TRUE, 0);

}

/**

 * lasso_node_debug:

 * @node: a #LassoNode

 * @level:(default 10): the indentation depth, i.e. the depth of the last nodes to be indented.

 *

 * Create a debug dump for @node, it is pretty printed so any contained signature will be

 * uncheckable.

 *

 * Return value:(transfer full): a full indented and so human readable dump of @node. The string must be freed by

 * the caller.

 */

char*

lasso_node_debug(LassoNode *node, int level)

{

	return _lasso_node_export_to_xml(node, TRUE, TRUE, level);

}

/**

 * lasso_node_destroy:

 * @node: a #LassoNode

 *

 * Destroys the #LassoNode.

 **/

void

lasso_node_destroy(LassoNode *node)

{

	if (node == NULL) {

		return;

	}

	if (LASSO_IS_NODE(node)) {

		LassoNodeClass *class = LASSO_NODE_GET_CLASS(node);

		class->destroy(node);

	}

}

/**

 * lasso_node_export_to_base64:

 * @node: a #LassoNode

 *

 * Exports @node to a base64-encoded message.

 *

 * Return value: a base64-encoded export of @node.  The string must be freed by

 *      the caller.

 **/

char*

lasso_node_export_to_base64(LassoNode *node)

{

	char *str;

	char *ret;

	g_return_val_if_fail(LASSO_IS_NODE(node), NULL);

	str = lasso_node_export_to_xml(node);

	if (str == NULL)

		return NULL;

	ret = (char*)xmlSecBase64Encode(BAD_CAST str, strlen(str), 0);

	lasso_release_string(str);

	return ret;

}

/**

 * lasso_node_export_to_ecp_soap_response:

 * @node: a #LassoNode

 *

 * Exports @node to a ECP SOAP message.

 *

 * Return value: a ECP SOAP export of @node.  The string must be freed by the

 *      caller.

 **/

char*

lasso_node_export_to_ecp_soap_response(LassoNode *node, const char *assertionConsumerURL)

{

	char *ret = NULL;

	LassoNode *ecp_response = NULL;

	GList *headers = NULL;

	lasso_return_null_if_fail(LASSO_IS_NODE(node));

	lasso_return_null_if_fail(assertionConsumerURL);

	/* Build the soap header elements */

	ecp_response = lasso_ecp_response_new(assertionConsumerURL);

	goto_cleanup_if_fail(ecp_response);

	lasso_list_add_new_gobject(headers, ecp_response);

	/* Create soap envelope and serialize into an xml document */

	ret = lasso_node_export_to_soap_with_headers(node, headers);

 cleanup:

	lasso_release_list_of_gobjects(headers);

	return ret;

}

/**

 * lasso_node_export_to_paos_request:

 * @node: a #LassoNode

 *

 * Exports @node to a PAOS message.

 *

 * Deprecated, use lasso_node_export_to_paos_request_full() instead

 *

 * Return value: a PAOS export of @node.  The string must be freed by the

 *      caller.

 **/

char *

lasso_node_export_to_paos_request(LassoNode *node, const char *issuer,

		const char *responseConsumerURL, const char *relay_state)

{

	return lasso_node_export_to_paos_request_full(node, issuer, responseConsumerURL,

												  NULL, relay_state, TRUE, NULL, NULL);

}

/**

 * lasso_node_export_to_paos_request_full:

 * @node:

 * @issuer:

 * @responseConsumerURL:

 * @message_id: (allow-none):

 * @relay_state: (allow-none):

 * @is_passive:

 * @provider_name: (allow-none):

 * @idp_list: (allow-none):

 *

 * Creates a new SOAP message. The SOAP headers include a PaosRequst,

 * a EcpRequest and optionally a EcpRelayState. The SOAP body contains

 * the @node parameters.

 *

 * Returns: string containing a PAOS request. The string must be freed

 * by the caller.

 **/

char *

lasso_node_export_to_paos_request_full(LassoNode *node, const char *issuer,

									   const char *responseConsumerURL, const char *message_id,

									   const char *relay_state, gboolean is_passive, gchar *provider_name,

									   LassoSamlp2IDPList *idp_list)

{

	char *ret = NULL;

	LassoNode *paos_request = NULL;

	LassoNode *ecp_request = NULL;

	LassoNode *ecp_relaystate = NULL;

	GList *headers = NULL;

	lasso_return_null_if_fail(LASSO_IS_NODE(node));

	lasso_return_null_if_fail(issuer);

	lasso_return_null_if_fail(responseConsumerURL);

	/* Build the soap header elements */

	paos_request = lasso_paos_request_new(responseConsumerURL, message_id);

	goto_cleanup_if_fail(paos_request);

	lasso_list_add_new_gobject(headers, paos_request);

	ecp_request = lasso_ecp_request_new(issuer, is_passive, provider_name, idp_list);

	goto_cleanup_if_fail(ecp_request);

	lasso_list_add_new_gobject(headers, ecp_request);

	if (relay_state) {

		ecp_relaystate = lasso_ecp_relay_state_new(relay_state);

		goto_cleanup_if_fail(ecp_relaystate);

		lasso_list_add_new_gobject(headers, ecp_relaystate);

	}

	/* Create soap envelope and serialize into an xml document */

	ret = lasso_node_export_to_soap_with_headers(node, headers);

 cleanup:

	lasso_release_list_of_gobjects(headers);

	return ret;

}

/**

 * lasso_node_export_to_query:

 * @node: a #LassoNode

 * @sign_method:(default 1): the Signature transform method

 * @private_key_file:(allow-none): the path to the private key (may be NULL)

 *

 * Exports @node to a HTTP query string.  If @private_key_file is NULL,

 * query won't be signed.

 *

 * Return value: a HTTP query export of @node.  The string must be freed by the

 *      caller.

 **/

char*

lasso_node_export_to_query(LassoNode *node, LassoSignatureMethod sign_method,

		const char *private_key_file)

{

	return lasso_node_export_to_query_with_password(node, sign_method, private_key_file, NULL);

}

/**

 * lasso_node_export_to_query_with_password:

 * @node: a #LassoNode

 * @sign_method:(default 1): the Signature transform method

 * @private_key_file:(allow-none): the path to the private key (may be NULL)

 * @private_key_file_password:(allow-none): the password needed to decrypt the private key

 *

 * Exports @node to a HTTP query string.  If @private_key_file is NULL,

 * query won't be signed.

 *

 * Return value: a HTTP query export of @node.  The string must be freed by the

 *      caller.

 **/

char*

lasso_node_export_to_query_with_password(LassoNode *node,

		LassoSignatureMethod sign_method, const char *private_key_file,

		const char *private_key_file_password)

{

	char *unsigned_query, *query = NULL;

	LassoSignatureContext context = LASSO_SIGNATURE_CONTEXT_NONE;

	g_return_val_if_fail(LASSO_IS_NODE(node), NULL);

	context.signature_method = sign_method;

	context.signature_key = lasso_xmlsec_load_private_key(private_key_file,

			private_key_file_password, sign_method, NULL);

	if (! context.signature_key) {

		return NULL;

	}

	unsigned_query = lasso_node_build_query(node);

	if (unsigned_query){

		query = lasso_query_sign(unsigned_query, context);

		if (query) {

			lasso_release(unsigned_query);

			unsigned_query = query;

		}

	}

	lasso_release_sec_key(context.signature_key);

	return unsigned_query;

}

/**

 * lasso_node_export_to_xml:

 * @node: a #LassoNode

 *

 * Exports @node to an xml message.

 *

 * Return value: an xml export of @node.  The string must be freed by the

 *      caller.

 **/

gchar*

lasso_node_export_to_xml(LassoNode *node)

{

	return _lasso_node_export_to_xml(node, FALSE, FALSE, 0);

}

/**

 * lasso_node_export_to_soap:

 * @node: a #LassoNode

 *

 * Exports @node to a SOAP message.

 *

 * Return value: a SOAP export of @node.  The string must be freed by the

 *      caller.

 **/

char*

lasso_node_export_to_soap(LassoNode *node)

{

	LassoSoapEnvelope *envelope;

	LassoSoapBody *body;

	char *ret;

	g_return_val_if_fail(LASSO_IS_NODE(node), NULL);

	body = lasso_soap_body_new();

	envelope = lasso_soap_envelope_new(body);

	lasso_list_add_gobject(body->any, node);

	ret = lasso_node_export_to_xml((LassoNode*)envelope);

	lasso_release_gobject(envelope);

	lasso_release_gobject(body);

	return ret;

}

/**

 * lasso_node_export_to_soap_with_headers:

 * @node: a #LassoNode, becomes the SOAP body

 * @headers: (allow-none): #GList of #LassNode

 *

 * Exports @node to a SOAP message. The @node becomes the SOAP body.

 * each header in the #headers list is added to the SOAP header if non-NULL.

 * @headers is permitted to be an empty list (e.g. NULL).

 *

 * <example>

 * <title>Create SOAP envelope with variable number of header nodes</title>

 *

 * <para>You need to form a SOAP message with authn_request as the body and

 * paos_request, ecp_request and ecp_relaystate as SOAP header elements.

 * It is possible one or more of these may be NULL and should be skipped.</para>

 * <programlisting>

 * char *text = NULL;

 * LassoNode *paos_request = NULL;

 * LassoNode *ecp_request = NULL;

 * LassoNode *ecp_relaystate = NULL;

 * GList *headers = NULL;

 *

 * paos_request = lasso_paos_request_new(responseConsumerURL, message_id);

 * ecp_request = lasso_ecp_request_new(issuer, is_passive, provider_name, idp_list);

 *

 * lasso_list_add_new_gobject(headers, paos_request);

 * lasso_list_add_new_gobject(headers, ecp_request);

 * lasso_list_add_new_gobject(headers, ecp_relaystate);

 *

 * text = lasso_node_export_to_soap_with_headers(node, headers);

 *

 * lasso_release_list_of_gobjects(headers);

 * </programlisting>

 * </example>

 *

 * Return value: a SOAP export of @node.  The string must be freed by the

 *      caller.

 **/

char*

lasso_node_export_to_soap_with_headers(LassoNode *node, GList *headers)

{

	GList *i;

	LassoSoapEnvelope *envelope = NULL;

	LassoNode *header = NULL;

	char *ret = NULL;

	g_return_val_if_fail(LASSO_IS_NODE(node), NULL);

	envelope = lasso_soap_envelope_new_full();

	lasso_list_add_gobject(envelope->Body->any, node);

	lasso_foreach(i, headers) {

		header = i->data;

		if (!header) continue;

		goto_cleanup_if_fail(LASSO_IS_NODE(header));

		lasso_list_add_gobject(envelope->Header->Other, header); /* adds ref */

	}

	ret = lasso_node_export_to_xml((LassoNode*)envelope);

 cleanup:

	lasso_release_gobject(envelope);

	return ret;

}

/**

 * lasso_node_encrypt:

 * @lasso_node: a #LassoNode to encrypt

 * @encryption_public_key : RSA public key the node will be encrypted with

 *

 * Generate a DES key and encrypt it with the RSA key.

 * Then encrypt @lasso_node with the DES key.

 *

 * Return value: an xmlNode which is the @node in an encrypted fashion.

 * It must be freed by the caller.

 **/

LassoSaml2EncryptedElement*

lasso_node_encrypt(LassoNode *lasso_node, xmlSecKey *encryption_public_key,

		LassoEncryptionSymKeyType encryption_sym_key_type, const char *recipient)

{

	xmlDocPtr doc = NULL;

	xmlNodePtr orig_node = NULL;

	LassoSaml2EncryptedElement *encrypted_element = NULL, *ret = NULL;

	xmlSecKeysMngrPtr key_manager = NULL;

	xmlNodePtr key_info_node = NULL;

	xmlNodePtr encrypted_key_node = NULL;

	xmlNodePtr encrypted_data = NULL;

	xmlNodePtr key_info_node2 = NULL;

	xmlSecEncCtxPtr enc_ctx = NULL;

	xmlSecTransformId xmlsec_encryption_sym_key_type;

	xmlSecKey *duplicate = NULL;

	if (encryption_public_key == NULL || !xmlSecKeyIsValid(encryption_public_key)) {

		message(G_LOG_LEVEL_WARNING, "Invalid encryption key");

		goto cleanup;

	}

	/* Create a document to contain the node to encrypt */

	doc = xmlNewDoc((xmlChar*)"1.0");

	orig_node = lasso_node_get_xmlNode(lasso_node, FALSE);

	xmlDocSetRootElement(doc, orig_node);

	/* Get the symetric key type */

	switch (encryption_sym_key_type) {

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_AES_256:

			xmlsec_encryption_sym_key_type = xmlSecTransformAes256CbcId;

			break;

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_3DES:

			xmlsec_encryption_sym_key_type = xmlSecTransformDes3CbcId;

			break;

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_AES_128:

		default:

			xmlsec_encryption_sym_key_type = xmlSecTransformAes128CbcId;

			break;

	}

	/* Create encryption template for a specific symetric key type */

	/* saml-core 2.2.4 line 498:

	 * The Type attribute SHOULD be present and, if present, MUST contain a value of

	 * http://www.w3.org/2001/04/xmlenc#Element. */

	encrypted_data = xmlSecTmplEncDataCreate(doc,

			xmlsec_encryption_sym_key_type,	NULL, xmlSecTypeEncElement, NULL, NULL);

	if (encrypted_data == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to create encryption template");

		goto cleanup;

	}

	if (xmlSecTmplEncDataEnsureCipherValue(encrypted_data) == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to add CipherValue node");

		goto cleanup;

	}

	/* create and initialize keys manager, we use a simple list based

	 * keys manager, implement your own xmlSecKeysStore klass if you need

	 * something more sophisticated

	 */

	key_manager = xmlSecKeysMngrCreate();

	if (key_manager == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to create keys manager");

		goto cleanup;

	}

	if (xmlSecCryptoAppDefaultKeysMngrInit(key_manager) < 0) {

		message(G_LOG_LEVEL_WARNING, "Failed to initialize keys manager");

		goto cleanup;

	}

	/* add key to keys manager, from now on keys manager is responsible

	 * for destroying key

	 */

	duplicate = xmlSecKeyDuplicate(encryption_public_key);

	if (xmlSecCryptoAppDefaultKeysMngrAdoptKey(key_manager, duplicate) < 0) {

		lasso_release_sec_key(duplicate);

		goto cleanup;

	}

	/* add <dsig:KeyInfo/> */

	key_info_node = xmlSecTmplEncDataEnsureKeyInfo(encrypted_data, NULL);

	if (key_info_node == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to add key info");

		goto cleanup;

	}

	/* add <enc:EncryptedKey/> to store the encrypted session key */

	encrypted_key_node = xmlSecTmplKeyInfoAddEncryptedKey(key_info_node,

			xmlSecTransformRsaPkcs1Id, NULL, NULL, (xmlChar*)recipient);

	if (encrypted_key_node == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to add encrypted key");

		goto cleanup;

	}

	/* we want to put encrypted key in the <enc:CipherValue/> node */

	if (xmlSecTmplEncDataEnsureCipherValue(encrypted_key_node) == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to add CipherValue node");

		goto cleanup;

	}

	/* add <dsig:KeyInfo/> and <dsig:KeyName/> nodes to <enc:EncryptedKey/> */

	key_info_node2 = xmlSecTmplEncDataEnsureKeyInfo(encrypted_key_node, NULL);

	if (key_info_node2 == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to add key info");

		goto cleanup;

	}

	/* check id of the key */

	if (xmlSecKeyGetData(encryption_public_key, xmlSecOpenSSLKeyDataRsaId) != 0) {

		xmlNode *key_value = xmlSecTmplKeyInfoAddKeyValue(key_info_node2);

		if (key_value == NULL) {

			message(G_LOG_LEVEL_WARNING, "Failed to add key value");

			goto cleanup;

		}

	} else { /* it must be a certificate */

		xmlNodePtr x509_data;

		x509_data = xmlSecTmplKeyInfoAddX509Data(key_info_node2);

		if (x509_data == NULL) {

			message(G_LOG_LEVEL_WARNING, "Failed to add X509 data");

			goto cleanup;

		}

	}

	/* create encryption context */

	enc_ctx = (xmlSecEncCtxPtr)xmlSecEncCtxCreate(key_manager);

	if (enc_ctx == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to create encryption context");

		goto cleanup;

	}

	/* generate a symetric key */

	switch (encryption_sym_key_type) {

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_AES_256:

			enc_ctx->encKey = xmlSecKeyGenerate(xmlSecKeyDataAesId, 256,

					xmlSecKeyDataTypeSession);

			break;

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_3DES:

			enc_ctx->encKey = xmlSecKeyGenerate(xmlSecKeyDataDesId, 192,

					xmlSecKeyDataTypeSession);

			break;

		case LASSO_ENCRYPTION_SYM_KEY_TYPE_AES_128:

		default:

			enc_ctx->encKey = xmlSecKeyGenerate(xmlSecKeyDataAesId, 128,

					xmlSecKeyDataTypeSession);

			break;

	}

	if (enc_ctx->encKey == NULL) {

		message(G_LOG_LEVEL_WARNING, "Failed to generate session des key");

		goto cleanup;

	}

	/* encrypt the data */

	if (xmlSecEncCtxXmlEncrypt(enc_ctx, encrypted_data, orig_node) < 0) {

		message(G_LOG_LEVEL_WARNING, "Encryption failed");

		goto cleanup;

	}

	/* Create a new EncryptedElement */

	encrypted_element = LASSO_SAML2_ENCRYPTED_ELEMENT(lasso_saml2_encrypted_element_new());

	lasso_assign_gobject(encrypted_element->original_data, lasso_node);

	lasso_assign_xml_node(encrypted_element->EncryptedData, xmlDocGetRootElement(doc));

	lasso_transfer_gobject(ret, encrypted_element);

cleanup:

	lasso_release_key_manager(key_manager);

	lasso_release_gobject(encrypted_element);

	lasso_release_encrypt_context(enc_ctx);

	lasso_release_doc(doc);

	return ret;

}

/**

 * lasso_node_init_from_query:

 * @node: a #LassoNode (or derived class)

 * @query: the query string

 *

 * Initialiazes @node fields with data from @query string.

 *

 * Return value: %TRUE if success

 **/

gboolean

lasso_node_init_from_query(LassoNode *node, const char *query)

{

	LassoNodeClass *class;

	char **query_fields;

	int i;

	gboolean rc;

	g_return_val_if_fail(LASSO_IS_NODE(node), FALSE);

	class = LASSO_NODE_GET_CLASS(node);

	query_fields = urlencoded_to_strings(query);

	rc = class->init_from_query(node, query_fields);

	for (i = 0; query_fields[i]; i++) {

		xmlFree(query_fields[i]);

		query_fields[i] = NULL;

	}

	lasso_release(query_fields);

	return rc;

}

/**

 * lasso_node_init_from_xml:

 * @node: a #LassoNode (or derived class)

 * @xmlnode: the libxml2 node

 *

 * Initialiazes @node fields with data from @xmlnode XML node.

 *

 * Return value: 0 on success; or a negative value otherwise.

 **/

int

lasso_node_init_from_xml(LassoNode *node, xmlNode *xmlnode)

{

	LassoNodeClass *class;

	g_return_val_if_fail(LASSO_IS_NODE(node), LASSO_XML_ERROR_OBJECT_CONSTRUCTION_FAILED);

	class = LASSO_NODE_GET_CLASS(node);

	return class->init_from_xml(node, xmlnode);

}

/**

 * lasso_node_build_query:

 * @node: a #LassoNode

 *

 * Build an HTTP query from the given LassoNode, this is a pure virtual

 * function, you must overload it in subclass.

 *

 * Return value: a newly allocated string containing the query if it succeed,

 * or NULL otherwise.

 */

char*

lasso_node_build_query(LassoNode *node)

{

	LassoNodeClass *class;

	g_return_val_if_fail (LASSO_IS_NODE(node), NULL);

	class = LASSO_NODE_GET_CLASS(node);

	return class->build_query(node);

}

static LassoNodeClassData*

lasso_legacy_get_signature_node_data(LassoNode *node, LassoNodeClass **out_klass)

{

	LassoNodeClass *klass = NULL;

	LassoNodeClassData *node_data = NULL;

	klass = LASSO_NODE_GET_CLASS(node);

	/* find a klass defining a signature */

	while (klass && LASSO_IS_NODE_CLASS(klass)) {

		if (klass->node_data && klass->node_data->sign_type_offset) {

			if (out_klass) {

				*out_klass = klass;

			}

			node_data = klass->node_data;

			break;

		}

		klass = g_type_class_peek_parent(klass);

	}

	return node_data;

}

static gboolean

lasso_legacy_extract_and_copy_signature_parameters(LassoNode *node, LassoNodeClassData *node_data)

{

	LassoSignatureMethod signature_method = LASSO_SIGNATURE_METHOD_NONE;

	char *private_key_file = NULL;

	char *certificate_file = NULL;

	if (! node_data) {

		return FALSE;

	}

	signature_method = G_STRUCT_MEMBER(LassoSignatureMethod, node,

			node_data->sign_method_offset);

	private_key_file = G_STRUCT_MEMBER(char *, node, node_data->private_key_file_offset);

	certificate_file = G_STRUCT_MEMBER(char *, node, node_data->certificate_file_offset);

	if (! lasso_validate_signature_method(signature_method)) {

		return FALSE;

	}

	if (lasso_node_set_signature(node,

			lasso_make_signature_context_from_path_or_string(private_key_file, NULL,

				signature_method, certificate_file)) != 0) {

		return FALSE;

	}

	return TRUE;

}

/**

 * lasso_node_get_xmlNode:

 * @node: a #LassoNode

 * @lasso_dump: whether to include lasso-specific nodes

 *

 * Builds an XML representation of @node.

 *

 * Return value: a new xmlNode.  It must be freed by the caller.

 **/

xmlNode*

lasso_node_get_xmlNode(LassoNode *node, gboolean lasso_dump)

{

	xmlNode *xmlnode = NULL;

	LassoSignatureContext context;

	LassoNodeClassData *node_data;

	g_return_val_if_fail (LASSO_IS_NODE(node), NULL);

	xmlnode = LASSO_NODE_GET_CLASS(node)->get_xmlNode(node, lasso_dump);

	node_data = lasso_legacy_get_signature_node_data(node, NULL);

	context = lasso_node_get_signature(node);

	/* support for legacy way to put a signature on a node */

	if (! lasso_validate_signature_context(context)) {

		if (lasso_legacy_extract_and_copy_signature_parameters(node, node_data))

			context = lasso_node_get_signature(node);

	}

	if (! lasso_dump && node_data && xmlnode && lasso_validate_signature_context(context)) {

		int rc;

		char *id_attribute = G_STRUCT_MEMBER(char*, node,

				node_data->id_attribute_offset);

		rc = lasso_sign_node(xmlnode, context, node_data->id_attribute_name,

				id_attribute);

		if (rc != 0) {

			warning("Signing of %s:%s failed: %s", xmlnode->ns->prefix,

					xmlnode->name, lasso_strerror(rc));

			lasso_release_xml_node(xmlnode);

		}

	}

	return xmlnode;

}

/**

 * lasso_node_cleanup_original_xmlnodes:

 *

 * @node: a #LassoNode

 *

 * Traverse the #LassoNode tree starting at Node and remove keeped xmlNode if one is found.

 *

 * Return value: None

 */

void

lasso_node_cleanup_original_xmlnodes(LassoNode *node)

{

	lasso_node_traversal(node, lasso_node_remove_original_xmlnode, 0);

}

static GQuark original_xmlnode_quark;

static GQuark custom_element_quark;

/**

 * lasso_node_get_original_xmlnode:

 * @node: a #LassoNode

 *

 * Retrieve the original xmlNode eventually associated to this #LassoNode.

 *

 * Return value:(transfer none): an #xmlNodePtr or NULL.

 */

xmlNodePtr

lasso_node_get_original_xmlnode(LassoNode *node)

{

	return g_object_get_qdata(G_OBJECT(node), original_xmlnode_quark);

}

static void original_xmlnode_free(void *node) {

	xmlNode *xnode = (xmlNode*)node;

	if (node) {

		if (lasso_flag_memory_debug) {

			fprintf(stderr, "freeing original xmlnode %s (at %p)\n", xnode->name, xnode);

		}

		xmlFreeNode(xnode);

	}

}

/**

 * lasso_node_set_original_xmlnode:

 * @node: the #LassoNode object

 * @xmlnode: an #xmlNode

 *

 * Set the underlying XML representation of the object.

 *

 */

void

lasso_node_set_original_xmlnode(LassoNode *node, xmlNode* xmlnode)

{

	if (xmlnode) {

		xmlNode *copy = NULL;

		xmlNode *parent = xmlnode->parent;

		copy = xmlCopyNode(xmlnode, 1);

		/* excl-c14n can move some namespace declarations at the point where the document is

		 * cut, to simulate it we copy on the new node all namespaces from the parents of

		 * the node which are not shadowed by another declaration on this node or one of its

		 * parent. */

		while (parent && parent->type == XML_ELEMENT_NODE) {

			xmlNs *ns_def = parent->nsDef;

			xmlNs *local_ns_def;

			while (ns_def) {

				int ok = 1;

				local_ns_def = copy->nsDef;

				while (local_ns_def) {

					if (lasso_strisequal((char*)local_ns_def->prefix, (char*)ns_def->prefix)) {

						ok = 0;

						break;

					}

					local_ns_def = local_ns_def->next;

				}

				if (ok) {

					xmlNewNs(copy, ns_def->href, ns_def->prefix);

				}

				ns_def = ns_def->next;

			}

			parent = parent->parent;

		}

		if (lasso_flag_memory_debug) {

			fprintf(stderr, "setting original xmlnode (at %p) on node %s:%p\n", copy, G_OBJECT_TYPE_NAME (node), node);

		}

		g_object_set_qdata_full(G_OBJECT(node), original_xmlnode_quark, copy, (GDestroyNotify)original_xmlnode_free);

	} else {

		if (lasso_flag_memory_debug) {

			fprintf(stderr, "clearing original xmlnode on node %p\n", node);

		}

		g_object_set_qdata_full(G_OBJECT(node), original_xmlnode_quark, NULL, (GDestroyNotify)original_xmlnode_free);