Электронная подпись ГОСТ Р 34.10 документов формата PDF в офисном пакете LibreOffice

--- pdfwriter_impl_ORIG.cxx	2017-10-25 17:25:39.000000000 +0300
+++ pdfwriter_impl.cxx	2018-10-31 19:48:32.078482227 +0300
@@ -6698,6 +6698,9 @@
                                 CERTCertificate *cert,
                                 SECItem *digest)
 {
+    SECKEYPublicKey *pubk = NULL;
+    SECOidTag hashAlgTag;
+
     NSSCMSMessage *result = NSS_CMSMessage_Create(nullptr);
     if (!result)
     {
@@ -6732,8 +6735,31 @@
         NSS_CMSMessage_Destroy(result);
         return nullptr;
     }
-
+    pubk = CERT_ExtractPublicKey(cert);
+    if (pubk == NULL)
+	return NULL;
+    switch(pubk->keyType){
+	case gost3410Key:
+	    hashAlgTag = SEC_OID_GOSTHASH;
+fprintf(stderr, "CreateCMSMessage: gost3410Key Use HASH_AlgGOSTHASH_=%d\n", hashAlgTag);
+	    break;
+	case gost3410Key_256:
+	    hashAlgTag = SEC_OID_GOST3411_2012_256;
+fprintf(stderr, "CreateCMSMessage: gost3410Key_256 Use HASH_AlgGOSTHASH_=%d\n", hashAlgTag);
+	    break;
+	case gost3410Key_512:
+	    hashAlgTag = SEC_OID_GOST3411_2012_512;
+fprintf(stderr, "CreateCMSMessage: gost3410Key_512  Use HASH_AlgGOSTHASH_=%d\n", hashAlgTag);
+	    break;
+	default:
+	    hashAlgTag = SEC_OID_SHA256;
+	    break;
+    }
+/*
     *cms_signer = NSS_CMSSignerInfo_Create(result, cert, SEC_OID_SHA256);
+*/
+    *cms_signer = NSS_CMSSignerInfo_Create(result, cert, hashAlgTag);
+
     if (!*cms_signer)
     {
         SAL_WARN("vcl.pdfwriter", "NSS_CMSSignerInfo_Create failed");
@@ -6773,8 +6799,8 @@
         NSS_CMSMessage_Destroy(result);
         return nullptr;
     }
+    if (NSS_CMSSignedData_SetDigestValue(*cms_sd, hashAlgTag, digest) != SECSuccess)
 
-    if (NSS_CMSSignedData_SetDigestValue(*cms_sd, SEC_OID_SHA256, digest) != SECSuccess)
     {
         SAL_WARN("vcl.pdfwriter", "NSS_CMSSignedData_SetDigestValue failed");
         NSS_CMSSignedData_Destroy(*cms_sd);
@@ -6982,6 +7008,10 @@
 bool PDFWriter::Sign(PDFSignContext& rContext)
 {
 #ifndef _WIN32
+    SECKEYPublicKey *pubk = NULL;
+    SECOidTag hashAlgTag;
+    HASH_HashType hashType;
+    int hashLen;
 
     CERTCertificate *cert = CERT_DecodeCertFromPackage(reinterpret_cast<char *>(rContext.m_pDerEncoded), rContext.m_nDerEncoded);
 
@@ -6990,8 +7020,33 @@
         SAL_WARN("vcl.pdfwriter", "CERT_DecodeCertFromPackage failed");
         return false;
     }
+    pubk = CERT_ExtractPublicKey(cert);
+    if (pubk == NULL)
+	return NULL;
+    switch(pubk->keyType){
+	case gost3410Key:
+	    hashAlgTag = SEC_OID_GOSTHASH;
+	    hashType = HASH_AlgGOSTHASH;
+	    hashLen = SHA256_LENGTH;
+	    break;
+	case gost3410Key_256:
+	    hashAlgTag = SEC_OID_GOST3411_2012_256;
+	    hashType = HASH_AlgGOSTHASH_12_256;
+	    hashLen = SHA256_LENGTH;
+	    break;
+	case gost3410Key_512:
+	    hashAlgTag = SEC_OID_GOST3411_2012_512;
+	    hashLen = SHA256_LENGTH * 2;
+	    hashType = HASH_AlgGOSTHASH_12_512;
+	    break;
+	default:
+	    hashAlgTag = SEC_OID_SHA256;
+	    hashType = HASH_AlgSHA256;
+	    hashLen = SHA256_LENGTH;
+	    break;
+    }
+    HashContextScope hc(HASH_Create(hashType));
 
-    HashContextScope hc(HASH_Create(HASH_AlgSHA256));
     if (!hc.get())
     {
         SAL_WARN("vcl.pdfwriter", "HASH_Create failed");
@@ -7005,15 +7060,18 @@
     HASH_Update(hc.get(), static_cast<const unsigned char*>(rContext.m_pByteRange2), rContext.m_nByteRange2);
 
     SECItem digest;
-    unsigned char hash[SHA256_LENGTH];
+    unsigned char hash[SHA256_LENGTH * 2];
+
     digest.data = hash;
-    HASH_End(hc.get(), digest.data, &digest.len, SHA256_LENGTH);
+    HASH_End(hc.get(), digest.data, &digest.len, hashLen);
+
     hc.clear();
 
 #ifdef DBG_UTIL
     {
         FILE *out = fopen("PDFWRITER.hash.data", "wb");
-        fwrite(hash, SHA256_LENGTH, 1, out);
+        fwrite(hash, hashLen, 1, out);
+
         fclose(out);
     }
 #endif
@@ -7078,8 +7136,8 @@
             fclose(out);
         }
 #endif
+        HashContextScope ts_hc(HASH_Create(hashType));
 
-        HashContextScope ts_hc(HASH_Create(HASH_AlgSHA256));
         if (!ts_hc.get())
         {
             SAL_WARN("vcl.pdfwriter", "HASH_Create failed");
@@ -7090,16 +7148,19 @@
         HASH_Begin(ts_hc.get());
         HASH_Update(ts_hc.get(), ts_cms_signer->encDigest.data, ts_cms_signer->encDigest.len);
         SECItem ts_digest;
-        unsigned char ts_hash[SHA256_LENGTH];
+        unsigned char ts_hash[SHA256_LENGTH * 2];
+
         ts_digest.type = siBuffer;
         ts_digest.data = ts_hash;
-        HASH_End(ts_hc.get(), ts_digest.data, &ts_digest.len, SHA256_LENGTH);
+        HASH_End(ts_hc.get(), ts_digest.data, &ts_digest.len, hashLen);
+
         ts_hc.clear();
 
 #ifdef DBG_UTIL
         {
             FILE *out = fopen("PDFWRITER.ts_hash.data", "wb");
-            fwrite(ts_hash, SHA256_LENGTH, 1, out);
+            fwrite(ts_hash, hashLen, 1, out);
+
             fclose(out);
         }
 #endif
@@ -7111,7 +7172,8 @@
 
         src.messageImprint.hashAlgorithm.algorithm.data = nullptr;
         src.messageImprint.hashAlgorithm.parameters.data = nullptr;
-        SECOID_SetAlgorithmID(nullptr, &src.messageImprint.hashAlgorithm, SEC_OID_SHA256, nullptr);
+        SECOID_SetAlgorithmID(nullptr, &src.messageImprint.hashAlgorithm, hashAlgTag, nullptr);
+
         src.messageImprint.hashedMessage = ts_digest;
 
         src.reqPolicy.type = siBuffer;
@@ -7340,11 +7402,13 @@
     // Write ESSCertIDv2.hashAlgorithm.
     aCertID.hashAlgorithm.algorithm.data = nullptr;
     aCertID.hashAlgorithm.parameters.data = nullptr;
-    SECOID_SetAlgorithmID(nullptr, &aCertID.hashAlgorithm, SEC_OID_SHA256, nullptr);
+    SECOID_SetAlgorithmID(nullptr, &aCertID.hashAlgorithm, hashAlgTag, nullptr);
+
     // Write ESSCertIDv2.certHash.
     SECItem aCertHashItem;
-    unsigned char aCertHash[SHA256_LENGTH];
-    HashContextScope aCertHashContext(HASH_Create(HASH_AlgSHA256));
+    unsigned char aCertHash[SHA256_LENGTH*2];
+    HashContextScope aCertHashContext(HASH_Create(hashType));
+
     if (!aCertHashContext.get())
     {
         SAL_WARN("vcl.pdfwriter", "HASH_Create() failed");
@@ -7354,7 +7418,8 @@
     HASH_Update(aCertHashContext.get(), reinterpret_cast<const unsigned char *>(rContext.m_pDerEncoded), rContext.m_nDerEncoded);
     aCertHashItem.type = siBuffer;
     aCertHashItem.data = aCertHash;
-    HASH_End(aCertHashContext.get(), aCertHashItem.data, &aCertHashItem.len, SHA256_LENGTH);
+    HASH_End(aCertHashContext.get(), aCertHashItem.data, &aCertHashItem.len, hashLen);
+
     aCertID.certHash = aCertHashItem;
     // Write ESSCertIDv2.issuerSerial.
     IssuerSerial aSerial;

--- pdfdocument_ORIG.cxx	2017-10-25 17:25:39.000000000 +0300
+++ pdfdocument.cxx	2018-10-31 19:49:34.174485641 +0300
@@ -2400,6 +2400,19 @@
     case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:
         eOidTag = SEC_OID_SHA512;
         break;
+    case SEC_OID_GOST3410_SIGN_256:
+    case SEC_OID_GOST3411_2012_256:
+        eOidTag = SEC_OID_GOST3411_2012_256;
+	break;
+    case SEC_OID_GOST3410_SIGN_512:
+    case SEC_OID_GOST3411_2012_512:
+        eOidTag = SEC_OID_GOST3411_2012_512;
+	break;
+    case SEC_OID_GOST3410_SIGNATURE:
+    case SEC_OID_GOSTHASH:
+        eOidTag = SEC_OID_GOSTHASH;
+	break;
+
     default:
         break;
     }
@@ -2453,6 +2466,16 @@
     case SEC_OID_SHA512:
         nMaxResultLen = msfilter::SHA512_HASH_LENGTH;
         break;
+    case SEC_OID_GOST3411_2012_256:
+        nMaxResultLen = msfilter::SHA256_HASH_LENGTH;
+	break;
+    case SEC_OID_GOST3411_2012_512:
+        nMaxResultLen = msfilter::SHA512_HASH_LENGTH;
+	break;
+    case SEC_OID_GOSTHASH:
+        nMaxResultLen = msfilter::SHA256_HASH_LENGTH;
+	break;
+
     default:
         SAL_WARN("xmlsecurity.pdfio", "PDFDocument::ValidateSignature: unrecognized algorithm");
         return false;