[jbossws-commits] JBossWS SVN: r17664 - in stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules: core/src/main/java/org/jboss/ws/extensions/security/element and 3 other directories.

Author: mmusaji Date: 2013-06-07 09:49:34 -0400 (Fri, 07 Jun 2013) New Revision: 17664 Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/FailedCheckException.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/WSSecurityException.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/DecryptionOperation.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java Log: [JBPAPP-10758] Merged changes for CVE-2012-2487 Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -76,6 +76,8 @@ { // provide logging private static Logger log = Logger.getLogger(WSSecurityDispatcher.class); + + private static boolean VERBOSE_EXCEPTION_REPORTING = Boolean.getBoolean("org.jboss.ws.native.security.verbose_exception_reporting"); public void decodeMessage(WSSecurityConfiguration configuration, SOAPMessage message, Config operationConfig) throws SOAPException { @@ -88,7 +90,7 @@ if (secHeaderElement == null) { if (hasRequirements(config, fault)) - throw convertToFault(new InvalidSecurityHeaderException("This service requires <wsse:Security>, which is missing.")); + throw convertToFault(new InvalidSecurityHeaderException("This service requires <wsse:Security>, which is missing."), true); } try @@ -263,8 +265,18 @@ private CommonSOAPFaultException convertToFault(WSSecurityException e) { - return new CommonSOAPFaultException(e.getFaultCode(), e.getFaultString()); + return convertToFault(e, VERBOSE_EXCEPTION_REPORTING); } + + private CommonSOAPFaultException convertToFault(WSSecurityException e, boolean verbose) + { + if (verbose) { + return new CommonSOAPFaultException(e.getFaultCode(), e.getFaultString()); + } else { + QName faultCode = new QName(Constants.JBOSS_WSSE_NS, "GenericError", Constants.JBOSS_WSSE_PREFIX); + return new CommonSOAPFaultException(faultCode, "A WS-Security error occurred."); + } + } private List<RequireOperation> buildRequireOperations(Config operationConfig, boolean fault) { Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -32,8 +32,10 @@ import org.jboss.ws.extensions.security.Constants; import org.jboss.ws.extensions.security.KeyResolver; import org.jboss.ws.extensions.security.Util; +import org.jboss.ws.extensions.security.exception.FailedCheckException; import org.jboss.ws.extensions.security.exception.InvalidSecurityHeaderException; import org.jboss.ws.extensions.security.exception.WSSecurityException; +import org.jboss.ws.extensions.security.operation.EncryptionOperation; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -128,7 +130,16 @@ } catch (XMLSecurityException e) { - throw new WSSecurityException("Could not parse encrypted key: " + e.getMessage(), e); + try + { + this.secretKey = EncryptionOperation.generateSecretKey(alg); + } + catch (Exception ex) + { + WSSecurityException exception = new FailedCheckException(e); + exception.setInternal(true); + throw exception; + } } this.document = element.getOwnerDocument(); Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/FailedCheckException.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/FailedCheckException.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/FailedCheckException.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -32,7 +32,7 @@ { public static final QName faultCode = new QName(Constants.WSSE_NS, "FailedCheck", Constants.WSSE_PREFIX); - public static final String faultString = "The signature or decryption was invlaid."; + public static final String faultString = "The signature or decryption was invalid."; public FailedCheckException() { Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/WSSecurityException.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/WSSecurityException.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/exception/WSSecurityException.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -72,4 +72,9 @@ { return faultString; } + + public void setInternal(boolean internal) + { + this.internal = internal; + } } Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/DecryptionOperation.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/DecryptionOperation.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/DecryptionOperation.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -107,7 +107,7 @@ } catch (XMLEncryptionException e) { - throw new FailedCheckException("Decryption was invalid."); + throw new FailedCheckException(e); } catch (Exception e) { Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -75,6 +75,7 @@ } private static HashMap<String, Algorithm> algorithms; + private static HashMap<String, String> algorithmsID; private static final String DEFAULT_ALGORITHM = "aes-128"; @@ -88,6 +89,12 @@ algorithms.put("aes-192-gcm", new Algorithm("AES", XMLCipher.AES_192_GCM, 192)); algorithms.put("aes-256-gcm", new Algorithm("AES", XMLCipher.AES_256_GCM, 256)); algorithms.put("tripledes", new Algorithm("TripleDes", XMLCipher.TRIPLEDES, 168)); + + algorithmsID = new HashMap<String, String>(4); + algorithmsID.put(XMLCipher.AES_128, "aes-128"); + algorithmsID.put(XMLCipher.AES_192, "aes-192"); + algorithmsID.put(XMLCipher.AES_256, "aes-256"); + algorithmsID.put(XMLCipher.TRIPLEDES, "tripledes"); } public EncryptionOperation(List<Target> targets, String alias, String algorithm, String wrap, String tokenRefType, String securityDomainAliasLabel) @@ -130,7 +137,7 @@ } } - public SecretKey getSecretKey(String algorithm) throws WSSecurityException + private static SecretKey getSecretKey(String algorithm) throws WSSecurityException { Algorithm alg = algorithms.get(algorithm); @@ -146,6 +153,11 @@ } } + public static SecretKey generateSecretKey(String alg) throws WSSecurityException + { + return getSecretKey(algorithmsID.get(alg)); + } + public void process(Document message, SecurityHeader header, SecurityStore store) throws WSSecurityException { if (! algorithms.containsKey(algorithm)) Modified: stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java =================================================================== --- stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java 2013-06-07 13:21:36 UTC (rev 17663) +++ stack/native/branches/jbossws-native-3.1.2.SP11_JBPAPP-10758/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java 2013-06-07 13:49:34 UTC (rev 17664) @@ -33,7 +33,6 @@ import junit.framework.Test; import org.jboss.ws.core.StubExt; -import org.jboss.ws.extensions.security.exception.FailedAuthenticationException; import org.jboss.wsf.test.JBossWSTest; import org.jboss.wsf.test.JBossWSTestSetup; @@ -50,10 +49,8 @@ private final String TARGET_ENDPOINT_ADDRESS = "http://" + getServerHost() + ":8080/jaxws-jbws1999"; - private static final String FAULT_CODE = "wsse:FailedAuthentication"; + private static final String FAULT_CODE = "jboss-wsse:GenericError"; - private static final String FAULT_STRING = FailedAuthenticationException.faultString; - public static Test suite() throws Exception { return new JBossWSTestSetup(JBWS1999TestCase.class, "jaxws-jbws1999.war"); @@ -111,8 +108,6 @@ SOAPFault fault = sfe.getFault(); String faultCode = fault.getFaultCode(); assertEquals("Fault Code", FAULT_CODE, faultCode); - String faultString = fault.getFaultString(); - assertEquals("Fault String", FAULT_STRING, faultString); } } @@ -149,8 +144,6 @@ SOAPFault fault = sfe.getFault(); String faultCode = fault.getFaultCode(); assertEquals("Fault Code", FAULT_CODE, faultCode); - String faultString = fault.getFaultString(); - assertEquals("Fault Message", FAULT_STRING, faultString); } } @@ -173,8 +166,6 @@ SOAPFault fault = sfe.getFault(); String faultCode = fault.getFaultCode(); assertEquals("Fault Code", FAULT_CODE, faultCode); - String faultString = fault.getFaultString(); - assertEquals("Fault Message", FAULT_STRING, faultString); } }