| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <rampart_handler_util.h> |
| #include <rampart_constants.h> |
| #include <rampart_sec_processed_result.h> |
| #include <rampart_policy_validator.h> |
| #include <axiom_util.h> |
| |
| /** |
| * validates whether timestamp is added according to the policy |
| */ |
| static axis2_status_t |
| rampart_pv_validate_ts( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| if(rampart_context_is_include_timestamp(rampart_context, env)) |
| { |
| axis2_char_t *ts_found = NULL; |
| ts_found = (axis2_char_t*)rampart_get_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_TS_CHECKED); |
| if(axutil_strcmp(RAMPART_YES, ts_found)) |
| { |
| /* Timestamp is not send in the message, but needed by policy */ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart]Timestamp token required. Not found"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Timestamp token required. Cannot find in the security header", |
| RAMPART_FAULT_INVALID_SECURITY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * validates whether username token is added according to the policy. Needed by server side |
| */ |
| static axis2_status_t |
| rampart_pv_validate_ut( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| if(axis2_msg_ctx_get_server_side(msg_ctx,env)) |
| { |
| /* user name is verified only by server side. For client side, it is not needed */ |
| |
| if(rampart_context_is_include_username_token(rampart_context, env)) |
| { |
| axis2_char_t *ut_found = NULL; |
| ut_found = (axis2_char_t*)rampart_get_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_UT_CHECKED); |
| if(axutil_strcmp(RAMPART_YES, ut_found)) |
| { |
| /* UsernameToken is not send in the message, but needed by policy */ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]UsernameToken required. Not found"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Username token required. Cannot find in the security header", |
| RAMPART_FAULT_INVALID_SECURITY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * validates whether signature confirmation is added according to the policy. Needed by client side |
| */ |
| static axis2_status_t |
| rampart_pv_validate_signature_confirmation( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| if(!axis2_msg_ctx_get_server_side(msg_ctx,env)) |
| { |
| /* signature confirmation is verified only by client side. Not needed for server side */ |
| |
| axis2_bool_t sig_conf_reqd = AXIS2_FALSE; |
| sig_conf_reqd = rampart_context_is_sig_confirmation_reqd(rampart_context, env); |
| |
| if(sig_conf_reqd) |
| { |
| axis2_char_t* sig_conf_found = NULL; |
| sig_conf_found = (axis2_char_t*)rampart_get_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_SIG_CONFIRM_FOUND); |
| if(axutil_strcmp(RAMPART_YES, sig_conf_found)) |
| { |
| /* Signature confirmation is not send in the message, but needed by policy */ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart]Signature confirmation required."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "SignatureConfirmation is not found", RAMPART_FAULT_INVALID_SECURITY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * validates whether Signature is encrypted |
| */ |
| static axis2_status_t |
| rampart_pv_validate_signature_encryption( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| axis2_bool_t signature_protection = AXIS2_FALSE; |
| |
| signature_protection = rampart_context_is_encrypt_signature(rampart_context, env); |
| if(signature_protection) |
| { |
| axis2_char_t* sig_encrypted = NULL; |
| sig_encrypted = (axis2_char_t*)rampart_get_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_SIG_ENCRYPTED); |
| if(axutil_strcmp(RAMPART_YES, sig_encrypted)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart]Signature need to be encrypted."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Signature need to be encrypted", RAMPART_FAULT_INVALID_SECURITY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * validates whether body is encrypted |
| */ |
| static axis2_status_t |
| rampart_pv_validate_encryption( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| axis2_bool_t body_encryption = AXIS2_FALSE; |
| axis2_status_t status = AXIS2_SUCCESS; |
| axutil_array_list_t *nodes_to_encrypt = NULL; |
| axiom_soap_envelope_t *soap_envelope = NULL; |
| int i = 0; |
| |
| nodes_to_encrypt = axutil_array_list_create(env, 0); |
| soap_envelope = axis2_msg_ctx_get_soap_envelope(msg_ctx, env); |
| status = rampart_context_get_nodes_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| status = rampart_context_get_elements_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| |
| /* See if the body need to be encrypted */ |
| if(nodes_to_encrypt && (axutil_array_list_size(nodes_to_encrypt, env) > 0)) |
| { |
| for(i=0 ; i < axutil_array_list_size(nodes_to_encrypt, env); i++) |
| { |
| axiom_node_t *node_to_enc = NULL; |
| |
| /* Get the node to be encrypted */ |
| node_to_enc = (axiom_node_t *)axutil_array_list_get(nodes_to_encrypt, env, i); |
| if(node_to_enc) |
| { |
| if(!axutil_strcmp(OXS_NODE_BODY , |
| axiom_util_get_localname(axiom_node_get_parent(node_to_enc,env), env))) |
| { |
| body_encryption = AXIS2_TRUE; |
| break; |
| } |
| } |
| }/* Eof loop */ |
| } |
| else |
| { |
| axutil_array_list_free(nodes_to_encrypt, env); |
| return AXIS2_SUCCESS; |
| } |
| |
| axutil_array_list_free(nodes_to_encrypt, env); |
| |
| if(body_encryption) |
| { |
| axis2_char_t* body_encrypted = NULL; |
| body_encrypted = (axis2_char_t*)rampart_get_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_BODY_ENCRYPTED); |
| if(axutil_strcmp(RAMPART_YES, body_encrypted)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart]Body need to be encrypted."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Body need to be encrypted", RAMPART_FAULT_INVALID_SECURITY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * validates whether message is signed |
| */ |
| static axis2_status_t |
| rampart_pv_validate_signature( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| axis2_char_t* signature_verified = NULL; |
| |
| signature_verified = (axis2_char_t*)rampart_get_security_processed_result(env, msg_ctx, |
| RAMPART_SPR_SIG_VALUE); |
| if(!signature_verified) |
| { |
| axutil_array_list_t *nodes_to_sign = NULL; |
| axiom_soap_envelope_t *soap_envelope = NULL; |
| int nodes_to_sign_size = 0; |
| |
| nodes_to_sign = axutil_array_list_create(env, 0); |
| soap_envelope = axis2_msg_ctx_get_soap_envelope(msg_ctx, env); |
| rampart_context_get_nodes_to_sign(rampart_context, env, soap_envelope, nodes_to_sign); |
| rampart_context_get_elements_to_sign(rampart_context, env, soap_envelope, nodes_to_sign); |
| nodes_to_sign_size = axutil_array_list_size(nodes_to_sign, env); |
| axutil_array_list_free(nodes_to_sign, env); |
| |
| if(nodes_to_sign_size > 0) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Could not find signature."); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| /* if signature verified is not null, validation would have done when verifying the signature */ |
| return AXIS2_SUCCESS; |
| } |
| |
| static axis2_status_t |
| rampart_pv_validate_endorsing( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| if(axis2_msg_ctx_get_server_side(msg_ctx,env)) |
| { |
| /* Endorsing signature is verified only by server side. Not needed for client side */ |
| axis2_char_t* endorsing_verified = NULL; |
| endorsing_verified = (axis2_char_t*)rampart_get_security_processed_result(env, msg_ctx, |
| RAMPART_SPR_SIG_VALUE); |
| if(!endorsing_verified) |
| { |
| /* check whether we need endorsing signature*/ |
| rp_property_t *token = NULL; |
| token = rampart_context_get_endorsing_token(rampart_context, env); |
| if(token) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"Could not find endorsing signature."); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| |
| /* if endorsing verified is not null, validation would have done when verifying the signature */ |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * Validate security policies, those cannot be checked on the fly |
| * @param env pointer to environment struct |
| * @param rampart_context the Rampart Context |
| * @param sec_node The security element |
| * @param msg_ctx message context |
| * @return AXIS2_SUCCESS on success, else AXIS2_FAILURE |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_pv_validate_sec_header( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context, |
| axiom_node_t *sec_node, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| |
| /* Check if the signature needed to be encrypted */ |
| if(!rampart_pv_validate_signature_encryption(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* Check if the Signature Confirmation is set */ |
| if(!rampart_pv_validate_signature_confirmation(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* Check if Usernametoken found */ |
| if(!rampart_pv_validate_ut(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* Check if Timestamp found */ |
| if(!rampart_pv_validate_ts(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* If the binding is transport, we don't need to validate anything more */ |
| if(rampart_context_get_binding_type(rampart_context,env) == RP_PROPERTY_TRANSPORT_BINDING) |
| { |
| return AXIS2_SUCCESS; |
| } |
| |
| /* Check if encryption is valid found */ |
| if(!rampart_pv_validate_encryption(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* Check if signature is valid found */ |
| if(!rampart_pv_validate_signature(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* Check if endorsing signature is valid */ |
| if(!rampart_pv_validate_endorsing(env, rampart_context, msg_ctx)) |
| { |
| return AXIS2_FAILURE; |
| } |
| |
| /* All the policy reqmnts are met. We are good to go */ |
| return AXIS2_SUCCESS; |
| } |
| |
| |
| |
