Author: mmusaji Date: 2013-06-04 12:11:17 -0400 (Tue, 04 Jun 2013) New Revision: 17649 Added: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/operation/ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionAlgorithms.java Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/core/jaxws/spi/ProviderImpl.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireEncryptionOperation.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireSignatureOperation.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireTargetableOperation.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/SecurityDecoder.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/SecurityHeader.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/RequireEncryption.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/resources/schema/jboss-ws-security_1_0.xsd stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/META-INF/jboss-wsse-client.xml stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/WEB-INF/jboss-wsse-server.xml Log: [JBPAPP-10768] Initial commit of CVE-2012-5575 (JBPAPP-10455) backport Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/core/jaxws/spi/ProviderImpl.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/core/jaxws/spi/ProviderImpl.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/core/jaxws/spi/ProviderImpl.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -116,19 +116,19 @@ return bindingId; } - @Override + public <T extends EndpointReference> T createEndpointReference(Class<T> clazz, QName serviceName, QName portName, Source wsdlDocumentLocation, Element... referenceParameters) { throw new NotImplementedException(); } - @Override + public W3CEndpointReference createW3CEndpointReference(String address, QName serviceName, QName portName, List<Element> metadata, String wsdlDocumentLocation, List<Element> referenceParameters) { throw new NotImplementedException(); } - @Override + public <T> T getPort(EndpointReference endpointReference, Class<T> serviceEndpointInterface, WebServiceFeature... features) { throw new NotImplementedException(); @@ -139,4 +139,4 @@ { throw new NotImplementedException(); } -} \ No newline at end of file +} Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/DecryptionOperation.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -23,6 +23,8 @@ import java.util.Collection; import java.util.HashSet; +import java.util.Iterator; +import java.util.List; import javax.crypto.SecretKey; @@ -32,6 +34,7 @@ import org.jboss.ws.extensions.security.element.ReferenceList; import org.jboss.ws.extensions.security.element.SecurityHeader; import org.jboss.ws.extensions.security.element.SecurityProcess; +import org.jboss.ws.extensions.security.operation.EncryptionAlgorithms; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -41,11 +44,14 @@ private SecurityHeader header; private SecurityStore store; + + private List<String> allowedEncAlgorithms; - public DecryptionOperation(SecurityHeader header, SecurityStore store) throws WSSecurityException + public DecryptionOperation(SecurityHeader header, SecurityStore store, List<String> allowedEncAlgorithms) throws WSSecurityException { this.header = header; this.store = store; + this.allowedEncAlgorithms = allowedEncAlgorithms; } private boolean isContent(Element element) @@ -93,6 +99,15 @@ } String alg = getEncryptionAlgorithm(element); + if (allowedEncAlgorithms != null && !allowedEncAlgorithms.isEmpty()) { + boolean found = false; + for (Iterator<String> it = allowedEncAlgorithms.iterator(); it.hasNext() && !found; ) { + found = alg.equals(EncryptionAlgorithms.getAlgorithm(it.next())); + } + if (!found) { + throw new WSSecurityException("Unexpected encryption algorithm in received message: " + alg); + } + } try { XMLCipher cipher = XMLCipher.getInstance(alg); Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/EncryptionOperation.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -23,7 +23,6 @@ import java.security.NoSuchAlgorithmException; import java.security.cert.X509Certificate; -import java.util.HashMap; import java.util.List; import javax.crypto.KeyGenerator; @@ -38,6 +37,7 @@ import org.jboss.ws.extensions.security.element.ReferenceList; import org.jboss.ws.extensions.security.element.SecurityHeader; import org.jboss.ws.extensions.security.element.X509Token; +import org.jboss.ws.extensions.security.operation.EncryptionAlgorithms; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -47,36 +47,6 @@ private SecurityStore store; - private static class Algorithm - { - Algorithm(String jceName, String xmlName, int size) - { - this.jceName = jceName; - this.xmlName = xmlName; - this.size = size; - } - - public String jceName; - public String xmlName; - public int size; - } - - private static HashMap<String, Algorithm> algorithms; - - private static final String DEFAULT_ALGORITHM = "aes-128"; - - static - { - algorithms = new HashMap<String, Algorithm>(4); - algorithms.put("aes-128", new Algorithm("AES", XMLCipher.AES_128, 128)); - algorithms.put("aes-192", new Algorithm("AES", XMLCipher.AES_192, 192)); - algorithms.put("aes-256", new Algorithm("AES", XMLCipher.AES_256, 256)); - algorithms.put("aes-128-gcm", new Algorithm("AES", XMLCipher.AES_128_GCM, 128)); - algorithms.put("aes-192-gcm", new Algorithm("AES", XMLCipher.AES_192_GCM, 192)); - algorithms.put("aes-256-gcm", new Algorithm("AES", XMLCipher.AES_256_GCM, 256)); - algorithms.put("tripledes", new Algorithm("TripleDes", XMLCipher.TRIPLEDES, 168)); - } - public EncryptionOperation(SecurityHeader header, SecurityStore store) throws WSSecurityException { this.header = header; @@ -112,14 +82,17 @@ } } - public SecretKey getSecretKey(String algorithm) throws WSSecurityException + public static SecretKey generateSecretKey(String alg) throws WSSecurityException { - Algorithm alg = algorithms.get(algorithm); + return getSecretKey(EncryptionAlgorithms.getAlgorithmID(alg)); + } + public static SecretKey getSecretKey(String algorithm) throws WSSecurityException + { try { - KeyGenerator kgen = KeyGenerator.getInstance(alg.jceName); - kgen.init(alg.size); + KeyGenerator kgen = KeyGenerator.getInstance(EncryptionAlgorithms.getAlgorithmJceName(algorithm)); + kgen.init(EncryptionAlgorithms.getAlgorithmSize(algorithm)); return kgen.generateKey(); } catch (NoSuchAlgorithmException e) @@ -130,14 +103,15 @@ public void process(Document message, List<Target> targets, String alias, String credential, String algorithm, boolean digest, boolean useNonce, boolean useTimestamp) throws WSSecurityException { - if (! algorithms.containsKey(algorithm)) - algorithm = DEFAULT_ALGORITHM; + if (! EncryptionAlgorithms.hasAlgorithm(algorithm)) { + algorithm = EncryptionAlgorithms.DEFAULT_ALGORITHM; + } SecretKey secretKey = getSecretKey(algorithm); XMLCipher cipher; try { - cipher = XMLCipher.getInstance(algorithms.get(algorithm).xmlName); + cipher = XMLCipher.getInstance(EncryptionAlgorithms.getAlgorithm(algorithm)); cipher.init(XMLCipher.ENCRYPT_MODE, secretKey); } catch (XMLSecurityException e) Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireEncryptionOperation.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireEncryptionOperation.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireEncryptionOperation.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -21,13 +21,52 @@ */ package org.jboss.ws.extensions.security; +import java.util.LinkedList; +import java.util.List; +import java.util.StringTokenizer; + +import org.jboss.logging.Logger; import org.jboss.ws.extensions.security.element.SecurityHeader; +import org.jboss.ws.extensions.security.SecurityDecoder; +import org.jboss.ws.extensions.security.Target; - public class RequireEncryptionOperation extends RequireTargetableOperation -{ - public RequireEncryptionOperation(SecurityHeader header, SecurityStore store) throws WSSecurityException - { - super(header, store); + { + private List<String> allowedKeyWrapAlgorithms; + + private List<String> allowedEncAlgorithms; + + public RequireEncryptionOperation(List<Target> targets) { + super(targets); } -} + + public RequireEncryptionOperation(List<Target> targets, String keyWrapAlgorithms, String algorithms) + { + super(targets); + this.allowedEncAlgorithms = parseStringList(algorithms); + this.allowedKeyWrapAlgorithms = parseStringList(keyWrapAlgorithms); + } + + public void setupDecoder(SecurityDecoder decoder) { + if (allowedEncAlgorithms == null) { + Logger.getLogger(RequireEncryptionOperation.class).warn("No 'algorithms' provided for 'encryption' configuration requirement!"); + } + decoder.setAllowedEncAlgorithms(allowedEncAlgorithms); + if (allowedKeyWrapAlgorithms == null) { + Logger.getLogger(RequireEncryptionOperation.class).warn("No 'keyWrapAlgorithms' provided for 'encryption' configuration requirement!"); + } + decoder.setAllowedKeyWrapAlgorithms(allowedKeyWrapAlgorithms); + } + + private List<String> parseStringList(String s) { + List<String> result = null; + if (s != null && s.trim().length() > 0) { + StringTokenizer st = new StringTokenizer(s, ", ", false); + result = new LinkedList<String>(); + while (st.hasMoreTokens()) { + result.add(st.nextToken()); + } + } + return result; + } + } Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireSignatureOperation.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireSignatureOperation.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireSignatureOperation.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -22,12 +22,14 @@ package org.jboss.ws.extensions.security; import org.jboss.ws.extensions.security.element.SecurityHeader; +import org.jboss.ws.extensions.security.SecurityStore; +import java.util.List; public class RequireSignatureOperation extends RequireTargetableOperation { - public RequireSignatureOperation(SecurityHeader header, SecurityStore store) throws WSSecurityException + public RequireSignatureOperation(List<Target> targets) throws WSSecurityException { - super(header, store); + super(targets); } } Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireTargetableOperation.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireTargetableOperation.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/RequireTargetableOperation.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -33,8 +33,11 @@ public class RequireTargetableOperation implements RequireOperation { - public RequireTargetableOperation(SecurityHeader header, SecurityStore store) throws WSSecurityException + private List<Target> targets; + + public RequireTargetableOperation(List<Target> targets) { + this.targets = targets; } private Collection<String> resolveTarget(Document message, Target target) throws WSSecurityException Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/SecurityDecoder.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/SecurityDecoder.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/SecurityDecoder.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -34,6 +34,7 @@ import org.jboss.ws.extensions.security.element.Timestamp; import org.jboss.ws.extensions.security.element.Token; import org.jboss.ws.extensions.security.element.UsernameToken; +import org.jboss.ws.extensions.security.RequireEncryptionOperation; import org.jboss.ws.extensions.security.nonce.NonceFactory; import org.jboss.ws.metadata.wsse.Authenticate; import org.jboss.ws.metadata.wsse.TimestampVerification; @@ -67,6 +68,10 @@ private HashSet<String> signedIds = new HashSet<String>(); private HashSet<String> encryptedIds = new HashSet<String>(); + + private List<String> allowedKeyWrapAlgorithms; + + private List<String> allowedEncAlgorithms; public SecurityDecoder(SecurityStore store, NonceFactory nonceFactory, TimestampVerification timestampVerification, Authenticate authenticate) @@ -129,7 +134,7 @@ encryptedIds.clear(); SignatureVerificationOperation signatureVerifier = new SignatureVerificationOperation(header, store); - DecryptionOperation decrypter = new DecryptionOperation(header, store); + DecryptionOperation decrypter = new DecryptionOperation(header, store, allowedEncAlgorithms); for (SecurityProcess process : header.getSecurityProcesses()) { @@ -153,6 +158,18 @@ } + + public void init(List<OperationDescription<RequireOperation>> requireOperations) { + if (requireOperations != null) { + for (OperationDescription<RequireOperation> operation : requireOperations) { + if (operation.equals(RequireEncryptionOperation.class)) { + RequireEncryptionOperation op = new RequireEncryptionOperation(operation.getTargets()); + op.setupDecoder(this); + break; + } + } + } + } public void verify(List<OperationDescription<RequireOperation>> requireOperations) throws WSSecurityException { @@ -167,12 +184,12 @@ if (operation.equals(RequireSignatureOperation.class)) { - op = new RequireSignatureOperation(header, store); + op = new RequireSignatureOperation(o.getTargets()); processedIds = signedIds; } else if (operation.equals(RequireEncryptionOperation.class)) { - op = new RequireEncryptionOperation(header, store); + op = new RequireEncryptionOperation(o.getTargets()); processedIds = encryptedIds; } else @@ -200,7 +217,7 @@ public void decode(Document message, Element headerElement) throws WSSecurityException { this.headerElement = headerElement; - this.header = new SecurityHeader(this.headerElement, store); + this.header = new SecurityHeader(this.headerElement, store, allowedKeyWrapAlgorithms, allowedEncAlgorithms); this.message = message; decode(); @@ -212,4 +229,15 @@ // message (required by the specification) detachHeader(); } + + public void setAllowedKeyWrapAlgorithms(List<String> allowedKeyWrapAlgorithms) + { + this.allowedKeyWrapAlgorithms = allowedKeyWrapAlgorithms; + } + + public void setAllowedEncAlgorithms(List<String> allowedEncAlgorithms) + { + this.allowedEncAlgorithms = allowedEncAlgorithms; + } + } Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -31,6 +31,7 @@ import javax.xml.rpc.soap.SOAPFaultException; import javax.xml.soap.SOAPException; import javax.xml.soap.SOAPHeader; +import javax.xml.soap.SOAPMessage; import javax.xml.ws.BindingProvider; import javax.xml.ws.WebServiceException; @@ -44,6 +45,7 @@ import org.jboss.ws.extensions.security.nonce.DefaultNonceFactory; import org.jboss.ws.extensions.security.nonce.NonceFactory; import org.jboss.ws.extensions.security.nonce.NonceGenerator; +import org.jboss.ws.extensions.security.RequireEncryptionOperation; import org.jboss.ws.metadata.umdm.EndpointMetaData; import org.jboss.ws.metadata.umdm.OperationMetaData; import org.jboss.ws.metadata.wsse.Authenticate; @@ -123,6 +125,7 @@ QName secQName = new QName(Constants.WSSE_NS, "Security"); Element secHeaderElement = (soapHeader != null) ? Util.findElement(soapHeader, secQName) : null; + boolean fault = soapMessage.getSOAPBody().getFault() != null; if (secHeaderElement == null) { @@ -158,7 +161,7 @@ Config operationConfig = getConfig(ctx, config, soapMessage); if (secHeaderElement != null) { - decodeHeader(ctx, config, operationConfig, soapMessage, secHeaderElement); + decodeHeader(config, actualConfig, soapMessage, secHeaderElement, fault); } authorize(operationConfig); @@ -174,8 +177,7 @@ } } - private static void decodeHeader(CommonMessageContext ctx, WSSecurityConfiguration configuration, Config operationConfig, SOAPMessageImpl message, - Element secHeaderElement) throws WSSecurityException, SOAPException + private static void decodeHeader(WSSecurityConfiguration configuration, Config config, SOAPMessage message, Element secHeaderElement, boolean fault) throws WSSecurityException, SOAPException { SecurityStore securityStore = new SecurityStore(configuration.getKeyStoreURL(), configuration.getKeyStoreType(), configuration.getKeyStorePassword(), configuration.getKeyPasswords(), configuration.getTrustStoreURL(), configuration.getTrustStoreType(), configuration.getTrustStorePassword()); @@ -183,25 +185,34 @@ Authenticate authenticate = null; - if (operationConfig != null) + if (config != null) { - authenticate = operationConfig.getAuthenticate(); + authenticate = config.getAuthenticate(); } - SecurityDecoder decoder = new SecurityDecoder(securityStore, factory, configuration.getTimestampVerification(), authenticate); - + SecurityDecoder decoder = new SecurityDecoder(securityStore, factory, configuration.getTimestampVerification(), authenticate); + List<OperationDescription<RequireOperation>> operations = buildRequireOperations(config, fault); + decoder.init(operations); decoder.decode(message.getSOAPPart(), secHeaderElement); if (log.isTraceEnabled()) log.trace("Decoded Message:\n" + DOMWriter.printNode(message.getSOAPPart(), true)); - OperationMetaData opMetaData = ctx.getOperationMetaData(); + CommonMessageContext ctx = MessageContextAssociation.peekMessageContext(); + OperationMetaData opMetaData = null; + if(ctx != null) { + opMetaData = ctx.getOperationMetaData(); + }else if (log.isTraceEnabled()) { + log.warn("No CommonMessageContext Found"); + } + if (opMetaData == null) { // Get the operation meta data from the soap message // for the server side inbound message. EndpointMetaData epMetaData = ctx.getEndpointMetaData(); - opMetaData = message.getOperationMetaData(epMetaData); + SOAPMessageImpl soapMessage = (SOAPMessageImpl)ctx.getSOAPMessage(); + opMetaData = soapMessage.getOperationMetaData(epMetaData); } String operation = null; @@ -212,8 +223,6 @@ port = opMetaData.getEndpointMetaData().getPortName().getLocalPart(); } - List<OperationDescription<RequireOperation>> operations = buildRequireOperations(configuration, operation, port); - decoder.verify(operations); if (log.isDebugEnabled()) log.debug("Verification is successful"); @@ -325,9 +334,9 @@ return (operationConfig != null && operationConfig.getRequires() != null); } - private static List<OperationDescription<RequireOperation>> buildRequireOperations(WSSecurityConfiguration config, String operation, String port) + private static List<OperationDescription<RequireOperation>> buildRequireOperations(Config operationConfig, boolean fault) { - Config operationConfig = getConfig(config, port, operation); + if (operationConfig == null) return null; @@ -348,7 +357,7 @@ } RequireEncryption requireEncryption = requires.getRequireEncryption(); - if (requireEncryption != null) + if (requireEncryption != null && (!fault || requireEncryption.isIncludeFaults())) { List<Target> targets = convertTargets(requireEncryption.getTargets()); operations.add(new OperationDescription<RequireOperation>(RequireEncryptionOperation.class, targets, null, null, null)); Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/EncryptedKey.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -22,6 +22,9 @@ package org.jboss.ws.extensions.security.element; import java.security.PrivateKey; +import java.util.HashMap; +import java.util.Iterator; +import java.util.List; import javax.crypto.SecretKey; @@ -33,9 +36,11 @@ import org.jboss.ws.extensions.security.KeyResolver; import org.jboss.ws.extensions.security.Util; import org.jboss.ws.extensions.security.WSSecurityException; +import org.jboss.ws.extensions.security.operation.EncryptionAlgorithms; import org.w3c.dom.Document; import org.w3c.dom.Element; + /** * <code>EncryptedKey</code> represents the am XMLSecurity encrypted key. * @@ -54,6 +59,15 @@ private Element cachedElement; + private static HashMap<String, String> keyWrapAlgorithms; + private static final String DEFAULT_ALGORITHM = "rsa_15"; + static + { + keyWrapAlgorithms = new HashMap<String, String>(4); + keyWrapAlgorithms.put("rsa_15", XMLCipher.RSA_v1dot5); + keyWrapAlgorithms.put("rsa_oaep", XMLCipher.RSA_OAEP); + } + public EncryptedKey(Document document, SecretKey secretKey, X509Token token) { this(document, secretKey, token, new ReferenceList()); @@ -67,7 +81,7 @@ this.list = list; } - public EncryptedKey(Element element, KeyResolver resolver) throws WSSecurityException + public EncryptedKey(Element element, KeyResolver resolver, List<String> allowedKeyWrapAlgorithms, List<String> allowedEncAlgorithms) throws WSSecurityException { org.apache.xml.security.encryption.EncryptedKey key; XMLCipher cipher; @@ -84,6 +98,27 @@ } KeyInfo info = key.getKeyInfo(); + boolean supportedKeyWrapAlg = false; + final String kwa = key.getEncryptionMethod().getAlgorithm(); + for (Iterator<String> it = keyWrapAlgorithms.values().iterator(); it.hasNext() && !supportedKeyWrapAlg; ) { + String s = it.next(); + if (s.equals(kwa)) { + supportedKeyWrapAlg = true; + } + } + if (!supportedKeyWrapAlg) { + throw new WSSecurityException("Unsupported key wrap algorithm in received message: " + kwa); + } + if (allowedKeyWrapAlgorithms != null && !allowedKeyWrapAlgorithms.isEmpty()) { + boolean found = false; + for (Iterator<String> it = allowedKeyWrapAlgorithms.iterator(); it.hasNext() && !found; ) { + found = kwa.equals(keyWrapAlgorithms.get(it.next())); + } + if (!found) { + throw new WSSecurityException("Unexpected key wrap algorithm in received message: " + kwa); + } + } + if (info == null) throw new WSSecurityException("EncryptedKey element did not contain KeyInfo"); @@ -103,6 +138,15 @@ String alg = getKeyAlgorithm(element); if (alg == null) throw new WSSecurityException("Could not determine encrypted key algorithm!"); + if (allowedEncAlgorithms != null && !allowedEncAlgorithms.isEmpty()) { + boolean found = false; + for (Iterator<String> it = allowedEncAlgorithms.iterator(); it.hasNext() && !found; ) { + found = alg.equals(EncryptionAlgorithms.getAlgorithm(it.next())); + } + if (!found) { + throw new WSSecurityException("Unexpected encryption algorithm in received message: " + alg); + } + } try { @@ -190,4 +234,4 @@ { return list; } -} \ No newline at end of file +} Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/SecurityHeader.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/SecurityHeader.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/element/SecurityHeader.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -23,6 +23,7 @@ import java.util.HashMap; import java.util.LinkedList; +import java.util.List; import org.jboss.ws.extensions.security.BinarySecurityTokenValidator; import org.jboss.ws.extensions.security.Constants; @@ -56,13 +57,13 @@ // Looks like this is only for embedded tokens private LinkedList<SecurityTokenReference> securityTokenReferences = new LinkedList<SecurityTokenReference>(); - + public SecurityHeader(Document document) { this.document = document; } - - public SecurityHeader(Element element, SecurityStore store) throws WSSecurityException + + public SecurityHeader(Element element, SecurityStore store, List<String> allowedKeyWrapAlgorithms, List<String> allowedEncAlgorithms) throws WSSecurityException { document = element.getOwnerDocument(); KeyResolver resolver = new KeyResolver(store); @@ -86,7 +87,7 @@ else if (tag.equals("Signature")) securityProcesses.add(new Signature(child, resolver)); else if (tag.equals("EncryptedKey")) - securityProcesses.add(new EncryptedKey(child, resolver)); + securityProcesses.add(new EncryptedKey(child, resolver, allowedKeyWrapAlgorithms, allowedEncAlgorithms)); else if (tag.equals("ReferenceList")) throw new UnsupportedSecurityTokenException("ReferenceLists outside of encrypted keys (shared secrets) are not supported."); Added: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionAlgorithms.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionAlgorithms.java (rev 0) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionAlgorithms.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -0,0 +1,94 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2013, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.ws.extensions.security.operation; + +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; + +import org.apache.xml.security.encryption.XMLCipher; + +public final class EncryptionAlgorithms +{ + /** --- Keep private for security reasons --- **/ + private static class Algorithm + { + Algorithm(String jceName, String xmlName, int size) + { + this.jceName = jceName; + this.xmlName = xmlName; + this.size = size; + } + + public String jceName; + public String xmlName; + public int size; + } + private static Map<String, Algorithm> algorithms; + private static Map<String, String> algorithmsID; + /** ----------------------------------------- **/ + + public static final String DEFAULT_ALGORITHM = "aes-128"; + + static + { + algorithms = new HashMap<String, Algorithm>(4); + algorithms.put("aes-128", new Algorithm("AES", XMLCipher.AES_128, 128)); + algorithms.put("aes-192", new Algorithm("AES", XMLCipher.AES_192, 192)); + algorithms.put("aes-256", new Algorithm("AES", XMLCipher.AES_256, 256)); + algorithms.put("aes-128-gcm", new Algorithm("AES", XMLCipher.AES_128_GCM, 128)); + algorithms.put("aes-192-gcm", new Algorithm("AES", XMLCipher.AES_192_GCM, 192)); + algorithms.put("aes-256-gcm", new Algorithm("AES", XMLCipher.AES_256_GCM, 256)); + algorithms.put("tripledes", new Algorithm("TripleDes", XMLCipher.TRIPLEDES, 168)); + algorithms = Collections.unmodifiableMap(algorithms); + + algorithmsID = new HashMap<String, String>(4); + algorithmsID.put(XMLCipher.AES_128, "aes-128"); + algorithmsID.put(XMLCipher.AES_192, "aes-192"); + algorithmsID.put(XMLCipher.AES_256, "aes-256"); + algorithmsID.put(XMLCipher.TRIPLEDES, "tripledes"); + algorithmsID = Collections.unmodifiableMap(algorithmsID); + } + + public static boolean hasAlgorithm(String id) { + return algorithms.containsKey(id); + } + + public static String getAlgorithm(String id) { + Algorithm alg = algorithms.get(id); + return alg == null ? null : alg.xmlName; + } + + public static String getAlgorithmJceName(String id) { + Algorithm alg = algorithms.get(id); + return alg == null ? null : alg.jceName; + } + + public static int getAlgorithmSize(String id) { + Algorithm alg = algorithms.get(id); + return alg == null ? null : alg.size; + } + + public static String getAlgorithmID(String xmlName) { + return algorithmsID.get(xmlName); + } +} Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/RequireEncryption.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/RequireEncryption.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/RequireEncryption.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -21,6 +21,7 @@ */ package org.jboss.ws.metadata.wsse; + /** * <code>Sign</code> represents the sign tag, which declares that a message * should be signed. @@ -30,5 +31,43 @@ */ public class RequireEncryption extends Targetable { - private static final long serialVersionUID = 3765798680988205647L; + private static final long serialVersionUID = 3765798680988205648L; + + private boolean includeFaults; + + private String keyWrapAlgorithms; + + private String algorithms; + + public RequireEncryption(boolean includeFaults, String keyWrapAlgorithms, String algorithms) + { + this.includeFaults = includeFaults; + this.algorithms = algorithms; + this.keyWrapAlgorithms = keyWrapAlgorithms; + } + + public boolean isIncludeFaults() + { + return includeFaults; + } + + public String getdKeyWrapAlgorithms() + { + return keyWrapAlgorithms; + } + + public void setKeyWrapAlgorithms(String keyWrapAlgorithms) + { + this.keyWrapAlgorithms = keyWrapAlgorithms; + } + + public String getAlgorithms() + { + return algorithms; + } + + public void setAlgorithms(String algorithms) + { + this.algorithms = algorithms; + } } Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2013-06-04 16:11:17 UTC (rev 17649) @@ -452,13 +452,19 @@ public Object newChild(Requires requires, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) { log.trace("newChild: " + localName); + if ("signature".equals(localName)) { return new RequireSignature(); } else if ("encryption".equals(localName)) { - return new RequireEncryption(); + boolean includeFaults = false; + String value = attrs.getValue("", "includeFaults"); + if (value != null) + includeFaults = (Boolean) SimpleTypeBindings.unmarshal(SimpleTypeBindings.XS_BOOLEAN_NAME, value, null); + + return new RequireEncryption(includeFaults, attrs.getValue("", "keyWrapAlgorithms"), attrs.getValue("", "algorithms")); } else if ("timestamp".equals(localName)) { Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/resources/schema/jboss-ws-security_1_0.xsd =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/resources/schema/jboss-ws-security_1_0.xsd 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/main/resources/schema/jboss-ws-security_1_0.xsd 2013-06-04 16:11:17 UTC (rev 17649) @@ -164,6 +164,16 @@ <xs:sequence> <xs:element name="targets" type="targetsType" minOccurs="0"/> </xs:sequence> + <xs:attribute name="algorithm" type="xs:string"> + <xs:annotation> + <xs:documentation>A blank space or comma separated list of algorithm ids that are allowed for the encrypted incoming message</xs:documentation> + </xs:annotation> + </xs:attribute> + <xs:attribute name="keyWrapAlgorithm" type="xs:string"> + <xs:annotation> + <xs:documentation>A blank space or comma separated list of algorithm ids that are allowed for the key wrapping in incoming message</xs:documentation> + </xs:annotation> + </xs:attribute> </xs:complexType> <xs:complexType name="requiresType"> <xs:all> @@ -240,6 +250,9 @@ <xs:enumeration value="aes-128"/> <xs:enumeration value="aes-192"/> <xs:enumeration value="aes-256"/> + <xs:enumeration value="aes-128-gcm"/> + <xs:enumeration value="aes-192-gcm"/> + <xs:enumeration value="aes-256-gcm"/> <xs:enumeration value="tripledes"/> </xs:restriction> </xs:simpleType> Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/META-INF/jboss-wsse-client.xml =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/META-INF/jboss-wsse-client.xml 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/META-INF/jboss-wsse-client.xml 2013-06-04 16:11:17 UTC (rev 17649) @@ -3,9 +3,9 @@ <jboss-ws-security xmlns="http://www.jboss.com/ws-security/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.jboss.com/ws-security/config http://www.jboss.com/ws-security/schema/jboss-ws-security_1_0.xsd"> <config> - <encrypt type="x509v3" algorithm="aes-128-gcm" alias="wsse"/> + <encrypt type="x509v3" algorithm="aes-192-gcm" keyWrapAlgorithm="rsa_oaep" alias="wsse"/> <requires> <encryption/> </requires> </config> -</jboss-ws-security> \ No newline at end of file +</jboss-ws-security> Modified: stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/WEB-INF/jboss-wsse-server.xml =================================================================== --- stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/WEB-INF/jboss-wsse-server.xml 2013-06-04 09:53:35 UTC (rev 17648) +++ stack/native/branches/jbossws-native-2.0.1.SP2_CP11_JBPAPP-10768/src/test/resources/jaxws/samples/wssecurity/simple-encrypt/WEB-INF/jboss-wsse-server.xml 2013-06-04 16:11:17 UTC (rev 17649) @@ -7,9 +7,9 @@ <trust-store-file>WEB-INF/wsse.truststore</trust-store-file> <trust-store-password>jbossws</trust-store-password> <config> - <encrypt type="x509v3" algorithm="aes-128-gcm" alias="wsse"/> + <encrypt type="x509v3" algorithm="aes-192-gcm" keyWrapAlgorithm="rsa_oaep" alias="wsse"/> <requires> - <encryption/> + <encryption algorithms="aes-192-gcm aes-256-gcm" keyWrapAlgorithms="rsa_oaep"/> </requires> </config> -</jboss-ws-security> \ No newline at end of file +</jboss-ws-security>