import javax.xml.crypto.*;
import javax.xml.crypto.dsig.*;
import javax.xml.crypto.dsig.dom.DOMValidateContext;
import javax.xml.crypto.dsig.keyinfo.*;

import java.io.FileInputStream;
import java.security.*;
import java.security.cert.X509Certificate;
import java.util.Iterator;
import java.util.List;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;
import ru.CryptoPro.JCPxml.Consts;

/**
 * This is a simple example of validating an XML 
 * Signature using the JSR 105 API. It assumes the key needed to
 * validate the signature is contained in a KeyValue KeyInfo. 
 */
public class ValidateByCert {

    //
    // Synopsis: java ValidateByCert [document]
    //
    //	  where "document" is the name of a file containing the XML document
    //	  to be validated.
    //
    public static void main(String[] args) throws Exception {

    System.out.println("###### Test ValidateByCert is begun ######");
    	
	// Instantiate the document to be validated
	DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
	dbf.setNamespaceAware(true);
	Document doc =
            dbf.newDocumentBuilder().parse(new FileInputStream("...\\singed-4481167995637542322.xml"));

	// Find Signature element
	NodeList nl = 
	    doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
	if (nl.getLength() == 0) {
	    throw new Exception("Cannot find Signature element");
	}
	
	com.sun.org.apache.xml.internal.security.Init.init();
	
    Provider pxml = new ru.CryptoPro.JCPxml.dsig.internal.dom.XMLDSigRI();

	// Create a DOM XMLSignatureFactory that will be used to unmarshal the 
	// document containing the XMLSignature 
	XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM", pxml);

	// Create a DOMValidateContext and specify a KeyValue KeySelector
        // and document context
	DOMValidateContext valContext = new DOMValidateContext
	    (new X509CertificateSelector(), nl.item(0));
	
	// unmarshal the XMLSignature
	XMLSignature signature = fac.unmarshalXMLSignature(valContext);

	// Validate the XMLSignature (generated above)
	boolean coreValidity = signature.validate(valContext); 

	// Check core validation status
	if (coreValidity == false) {
    	    System.err.println("Signature failed core validation"); 
	    boolean sv = signature.getSignatureValue().validate(valContext);
	    System.out.println("signature validation status: " + sv);
	    // check the validation status of each Reference
	    Iterator i = signature.getSignedInfo().getReferences().iterator();
	    for (int j = 0; i.hasNext(); j++) {
		boolean refValid = 
		    ((Reference) i.next()).validate(valContext);
		System.out.println("ref[" + j + "] validity status: " + refValid);
	    }
	} else {
    	    System.out.println("Signature passed core validation");
	}
	
	System.out.println("###### Test ValidateByCert is finished ######");
	
    }
    
    /**
     * X509CertificateSelector which retrieves the public key out of the
     * X509Certificate(X509Data) element and returns it.
     * NOTE: If the key algorithm doesn't match signature algorithm,
     * then the public key will be ignored.
     */
    private static class X509CertificateSelector extends KeySelector {
	public KeySelectorResult select(KeyInfo keyInfo,
                                        KeySelector.Purpose purpose,
                                        AlgorithmMethod method,
                                        XMLCryptoContext context)
            throws KeySelectorException {
            if (keyInfo == null) {
		throw new KeySelectorException("Null KeyInfo object!");
            }
            SignatureMethod sm = (SignatureMethod) method;
            List list = keyInfo.getContent();

            for (int i = 0; i < list.size(); i++) {
            	XMLStructure xmlStructure = (XMLStructure) list.get(i);
            	if (xmlStructure instanceof X509Data) {
                    X509Data data = (X509Data)xmlStructure;
                    X509Certificate cert = (X509Certificate) data.getContent().get(0);
            		PublicKey pk = cert.getPublicKey();
                    // make sure algorithm is compatible with method
                    if (algEquals(sm.getAlgorithm(), pk.getAlgorithm())) {
                        return new SimpleKeySelectorResult(pk);
                    }
            	}
            }
            throw new KeySelectorException("No KeyValue element found!");
	}

        //@@@FIXME: this should also work for key types other than GOST3410
	static boolean algEquals(String algURI, String algName) {
            if (algName.equalsIgnoreCase("DSA") &&
            		algURI.equalsIgnoreCase(SignatureMethod.DSA_SHA1)) {
            	return true;
            } else if (algName.equalsIgnoreCase("RSA") &&
                       algURI.equalsIgnoreCase(SignatureMethod.RSA_SHA1)) {
            	return true;
            } 
            else if (algName.equalsIgnoreCase("GOST3410") &&
                    (algURI.equalsIgnoreCase(ru.CryptoPro.JCPxml.Consts.URI_GOST_SIGN) ||
                     algURI.equalsIgnoreCase(ru.CryptoPro.JCPxml.Consts.URN_GOST_SIGN)
                    )) {
            	return true;
            }
            else {
            	return false;
            }
		}
    }

    private static class SimpleKeySelectorResult implements KeySelectorResult {
    	private PublicKey pk;
    	
    	SimpleKeySelectorResult(PublicKey pk) {
    		this.pk = pk;
    	}

    	public Key getKey() { 
    		return pk; 
    	}
    }
}