2:48 p.m.
Author: mmusaji
Date: 2013-07-05 08:48:02 -0400 (Fri, 05 Jul 2013)
New Revision: 17763
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/FailedCheckException.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityException.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java
Log:
[JBPAPP-10807] Merged CVE-2011-2487 from JBPAPP-10421
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -116,7 +116,7 @@
}
catch (XMLEncryptionException e)
{
- throw new FailedCheckException("Decryption was invalid.");
+ throw new FailedCheckException(e);
}
catch (Exception e)
{
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -23,6 +23,7 @@
import java.security.NoSuchAlgorithmException;
import java.security.cert.X509Certificate;
+import java.util.HashMap;
import java.util.List;
import javax.crypto.KeyGenerator;
@@ -46,6 +47,43 @@
private SecurityHeader header;
private SecurityStore store;
+
+ private static class Algorithm
+ {
+ Algorithm(String jceName, String xmlName, int size)
+ {
+ this.jceName = jceName;
+ this.xmlName = xmlName;
+ this.size = size;
+ }
+
+ public String jceName;
+ public String xmlName;
+ public int size;
+ }
+
+ private static HashMap<String, Algorithm> algorithms;
+ private static HashMap<String, String> algorithmsID;
+
+ private static final String DEFAULT_ALGORITHM = "aes-128";
+
+ static
+ {
+ algorithms = new HashMap<String, Algorithm>(4);
+ algorithms.put("aes-128", new Algorithm("AES",
XMLCipher.AES_128, 128));
+ algorithms.put("aes-192", new Algorithm("AES",
XMLCipher.AES_192, 192));
+ algorithms.put("aes-256", new Algorithm("AES",
XMLCipher.AES_256, 256));
+ algorithms.put("aes-128-gcm", new Algorithm("AES",
XMLCipher.AES_128_GCM, 128));
+ algorithms.put("aes-192-gcm", new Algorithm("AES",
XMLCipher.AES_192_GCM, 192));
+ algorithms.put("aes-256-gcm", new Algorithm("AES",
XMLCipher.AES_256_GCM, 256));
+ algorithms.put("tripledes", new Algorithm("TripleDes",
XMLCipher.TRIPLEDES, 168));
+
+ algorithmsID = new HashMap<String, String>(4);
+ algorithmsID.put(XMLCipher.AES_128, "aes-128");
+ algorithmsID.put(XMLCipher.AES_192, "aes-192");
+ algorithmsID.put(XMLCipher.AES_256, "aes-256");
+ algorithmsID.put(XMLCipher.TRIPLEDES, "tripledes");
+ }
public EncryptionOperation(SecurityHeader header, SecurityStore store) throws
WSSecurityException
{
@@ -89,6 +127,7 @@
public static SecretKey getSecretKey(String algorithm) throws WSSecurityException
{
+ Algorithm alg = algorithms.get(algorithm);
try
{
KeyGenerator kgen =
KeyGenerator.getInstance(EncryptionAlgorithms.getAlgorithmJceName(algorithm));
@@ -103,8 +142,8 @@
public void process(Document message, List<Target> targets, String alias, String
credential, String algorithm, boolean digest, boolean useNonce, boolean useTimestamp)
throws WSSecurityException
{
- if (! EncryptionAlgorithms.hasAlgorithm(algorithm)) {
- algorithm = EncryptionAlgorithms.DEFAULT_ALGORITHM;
+ if (! algorithms.containsKey(algorithm)) {
+ algorithm = DEFAULT_ALGORITHM;
}
SecretKey secretKey = getSecretKey(algorithm);
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/FailedCheckException.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/FailedCheckException.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/FailedCheckException.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -32,7 +32,7 @@
{
public static final QName faultCode = new QName(Constants.WSSE_NS,
"FailedCheck", Constants.WSSE_PREFIX);
- public static final String faultString = "The signature or decryption was
invlaid.";
+ public static final String faultString = "The signature or decryption was
invalid.";
public FailedCheckException()
{
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -69,6 +69,8 @@
{
// provide logging
private static Logger log = Logger.getLogger(WSSecurityDispatcher.class);
+
+ private static boolean VERBOSE_EXCEPTION_REPORTING =
Boolean.getBoolean("org.jboss.ws.native.security.verbose_exception_reporting");
private static List<Target>
convertTargets(List<org.jboss.ws.metadata.wsse.Target> targets)
{
@@ -112,8 +114,18 @@
private static CommonSOAPFaultException convertToFault(WSSecurityException e)
{
- return new CommonSOAPFaultException(e.getFaultCode(), e.getFaultString());
+ return convertToFault(e, VERBOSE_EXCEPTION_REPORTING);
}
+
+ private static CommonSOAPFaultException convertToFault(WSSecurityException e, boolean
verbose)
+ {
+ if (verbose) {
+ return new CommonSOAPFaultException(e.getFaultCode(), e.getFaultString());
+ } else {
+ QName faultCode = new QName(Constants.JBOSS_WSSE_NS, "GenericError",
Constants.JBOSS_WSSE_PREFIX);
+ return new CommonSOAPFaultException(faultCode, "A WS-Security error
occurred.");
+ }
+ }
public static void handleInbound(CommonMessageContext ctx) throws SOAPException,
SOAPFaultException
{
@@ -152,7 +164,7 @@
if (hasRequirements(config, operation, port))
- throw convertToFault(new InvalidSecurityHeaderException("This service
requires <wsse:Security>, which is missing."));
+ throw convertToFault(new InvalidSecurityHeaderException("This service
requires <wsse:Security>, which is missing."), true);
}
try
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityException.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityException.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/WSSecurityException.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -71,4 +71,9 @@
{
return faultString;
}
+
+ public void setInternal(boolean internal)
+ {
+ this.internal = internal;
+ }
}
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -36,6 +36,8 @@
import org.jboss.ws.extensions.security.KeyResolver;
import org.jboss.ws.extensions.security.Util;
import org.jboss.ws.extensions.security.WSSecurityException;
+import org.jboss.ws.extensions.security.EncryptionOperation;
+import org.jboss.ws.extensions.security.FailedCheckException;
import org.jboss.ws.extensions.security.operation.EncryptionAlgorithms;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
@@ -155,7 +157,16 @@
}
catch (XMLSecurityException e)
{
- throw new WSSecurityException("Could not parse encrypted key: " +
e.getMessage(), e);
+ try
+ {
+ this.secretKey = EncryptionOperation.generateSecretKey(alg);
+ }
+ catch (Exception ex)
+ {
+ WSSecurityException exception = new FailedCheckException(e);
+ exception.setInternal(true);
+ throw exception;
+ }
}
this.document = element.getOwnerDocument();
Modified:
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java
===================================================================
---
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java 2013-07-05
11:31:41 UTC (rev 17762)
+++
stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10807/src/test/java/org/jboss/test/ws/jaxws/jbws1999/JBWS1999TestCase.java 2013-07-05
12:48:02 UTC (rev 17763)
@@ -50,7 +50,7 @@
private final String TARGET_ENDPOINT_ADDRESS = "http://" + getServerHost() +
":8080/jaxws-jbws1999";
- private static final String FAULT_CODE = "wsse:FailedAuthentication";
+ private static final String FAULT_CODE = "jboss-wsse:GenericError";
private static final String FAULT_STRING = "The security token could not be
authenticated or authorized.";
@@ -111,8 +111,6 @@
SOAPFault fault = sfe.getFault();
String faultCode = fault.getFaultCode();
assertEquals("Fault Code", FAULT_CODE, faultCode);
- String faultString = fault.getFaultString();
- assertEquals("Fault String", FAULT_STRING, faultString);
}
}
@@ -149,8 +147,6 @@
SOAPFault fault = sfe.getFault();
String faultCode = fault.getFaultCode();
assertEquals("Fault Code", FAULT_CODE, faultCode);
- String faultString = fault.getFaultString();
- assertEquals("Fault Message", FAULT_STRING, faultString);
}
}
@@ -173,8 +169,6 @@
SOAPFault fault = sfe.getFault();
String faultCode = fault.getFaultCode();
assertEquals("Fault Code", FAULT_CODE, faultCode);
- String faultString = fault.getFaultString();
- assertEquals("Fault Message", FAULT_STRING, faultString);
}
}