| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <stdio.h> |
| #include <rampart_encryption.h> |
| #include <rampart_constants.h> |
| #include <rampart_sec_header_processor.h> |
| #include <rampart_username_token.h> |
| #include <rampart_timestamp_token.h> |
| #include <rampart_util.h> |
| #include <rampart_sec_processed_result.h> |
| #include <rampart_handler_util.h> |
| #include <oxs_ctx.h> |
| #include <oxs_error.h> |
| #include <oxs_utility.h> |
| #include <oxs_key.h> |
| #include <oxs_axiom.h> |
| #include <oxs_asym_ctx.h> |
| #include <oxs_tokens.h> |
| #include <axutil_utils.h> |
| #include <axutil_array_list.h> |
| #include <axis2_key_type.h> |
| #include <rampart_token_processor.h> |
| #include <oxs_sign_ctx.h> |
| #include <oxs_xml_signature.h> |
| #include <oxs_key_mgr.h> |
| |
| /*Private functions*/ |
| static axis2_bool_t |
| rampart_shp_validate_qnames(const axutil_env_t *env, |
| axiom_node_t *node) |
| |
| { |
| axiom_element_t *node_ele = NULL; |
| axutil_qname_t *qname = NULL; |
| axutil_qname_t *node_qname = NULL; |
| axis2_char_t *local_name = NULL; |
| |
| AXIS2_ENV_CHECK(env,AXIS2_FALSE); |
| |
| node_ele = axiom_node_get_data_element(node, env); |
| if(!node_ele) |
| return AXIS2_FALSE; |
| |
| local_name = axiom_element_get_localname(node_ele,env); |
| if(!local_name){ |
| return AXIS2_FALSE; |
| } |
| if(axutil_strcmp(local_name, RAMPART_SECURITY_TIMESTAMP) == 0) |
| { |
| qname = axutil_qname_create(env, local_name, RAMPART_WSU_XMLNS, NULL/*RAMPART_WSU*/); |
| } |
| else if(axutil_strcmp(local_name, RAMPART_SECURITY_USERNAMETOKEN) ==0) |
| { |
| qname = axutil_qname_create(env, local_name, RAMPART_WSSE_XMLNS, NULL/*RAMPART_WSSE*/); |
| } |
| else if(axutil_strcmp(local_name,OXS_NODE_ENCRYPTED_KEY)==0) |
| { |
| qname = axutil_qname_create(env, local_name, OXS_ENC_NS, NULL/*OXS_XENC*/); |
| } |
| else if(axutil_strcmp(local_name, OXS_NODE_ENCRYPTED_DATA)==0) |
| { |
| qname = axutil_qname_create(env, local_name, OXS_ENC_NS, NULL/*OXS_XENC*/); |
| } |
| else if(axutil_strcmp(local_name, OXS_NODE_SIGNATURE)==0) |
| { |
| qname = axutil_qname_create(env, local_name, OXS_DSIG_NS, NULL/*OXS_DS*/); |
| } |
| else if(axutil_strcmp(local_name, OXS_NODE_BINARY_SECURITY_TOKEN) == 0) |
| { |
| return AXIS2_FALSE; |
| } |
| else if(axutil_strcmp(local_name, OXS_NODE_REFERENCE_LIST)==0) |
| { |
| return AXIS2_FALSE; |
| } |
| else |
| { |
| return AXIS2_FALSE; |
| } |
| |
| if(!qname) |
| { |
| return AXIS2_FALSE; |
| } |
| node_qname = axiom_element_get_qname(node_ele, env, node); |
| |
| if(!node_qname) |
| { |
| axutil_qname_free(qname, env); |
| qname = NULL; |
| return AXIS2_FALSE; |
| } |
| |
| if(axutil_qname_equals(qname, env, node_qname)) |
| { |
| axutil_qname_free(qname, env); |
| qname = NULL; |
| return AXIS2_TRUE; |
| } |
| return AXIS2_FALSE; |
| } |
| |
| static oxs_x509_cert_t *get_receiver_x509_cert( |
| const axutil_env_t *env, |
| rampart_context_t *rampart_context) |
| { |
| |
| axis2_char_t *file_name = NULL; |
| axis2_char_t *pem_buf = NULL; |
| |
| pem_buf = (axis2_char_t *)rampart_context_get_receiver_certificate( |
| rampart_context, env); |
| if(pem_buf) |
| { |
| return oxs_key_mgr_load_x509_cert_from_string(env, pem_buf); |
| } |
| else |
| { |
| file_name = rampart_context_get_receiver_certificate_file(rampart_context, env); |
| if(!file_name) |
| { |
| return NULL; |
| } |
| else |
| { |
| return oxs_key_mgr_load_x509_cert_from_pem_file(env, file_name); |
| } |
| } |
| } |
| |
| |
| static axis2_status_t |
| rampart_shp_process_timestamptoken(const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_node_t *sec_node) |
| { |
| axis2_status_t valid_ts = AXIS2_FAILURE; |
| axiom_node_t *ts_node = NULL; |
| |
| ts_node = oxs_axiom_get_node_by_local_name(env, |
| sec_node, RAMPART_SECURITY_TIMESTAMP); |
| if(!ts_node) |
| { |
| if(rampart_context_is_include_timestamp(rampart_context, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Timestamp is not in the message"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_SECURITY_TOKEN_UNAVAILABLE, |
| "Timestamp is not in the message ", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| else |
| { |
| return AXIS2_SUCCESS; |
| } |
| } |
| else if(!rampart_context_is_include_timestamp(rampart_context, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Timestamp should not be in the message."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Timestamp should not be in the message ", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| else |
| { |
| if(!rampart_shp_validate_qnames(env, ts_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in the Timestamp element."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Error in the Timestamp Element. ", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| |
| valid_ts = rampart_timestamp_token_validate(env, msg_ctx, ts_node); |
| |
| if (valid_ts) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][scp] Succesfully validated the timestamp "); |
| return AXIS2_SUCCESS; |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][scp] Timestamp is not valid"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Timestamp is not valid", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| |
| static axis2_status_t |
| rampart_shp_process_usernametoken(const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_node_t *sec_node) |
| { |
| axis2_status_t valid_user = AXIS2_FAILURE; |
| axiom_node_t *ut_node = NULL; |
| |
| ut_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, RAMPART_SECURITY_USERNAMETOKEN); |
| if(!ut_node) |
| { |
| if(rampart_context_is_include_username_token(rampart_context, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Username token is not in the message"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_AUTHENTICATION, |
| "Username Token not found", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| else |
| { |
| return AXIS2_SUCCESS; |
| } |
| } |
| else if(!rampart_context_is_include_username_token(rampart_context, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Username token should not be in the message."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Username Token not expected", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| } |
| else |
| { |
| if(!rampart_shp_validate_qnames(env, ut_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in validating qnames for the username token"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Error in the Username token.", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Validating UsernameToken"); |
| valid_user = rampart_username_token_validate(env, |
| msg_ctx, ut_node, rampart_context); |
| } |
| if (valid_user) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Validating UsernameToken SUCCESS"); |
| return AXIS2_SUCCESS; |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Validating UsernameToken FAILED"); |
| |
| if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_AUTHENTICATION, |
| "UsernameToken validation failed.", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx); |
| } |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| static axis2_status_t |
| rampart_shp_process_encrypted_key(const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node, |
| axiom_node_t *encrypted_key_node) |
| { |
| axiom_node_t *ref_list_node = NULL; |
| axiom_node_t *enc_mtd_node = NULL; |
| axutil_array_list_t *reference_list = NULL; |
| axis2_char_t *enc_asym_algo = NULL; |
| axis2_char_t *prv_key_file = NULL; |
| axis2_char_t *password = NULL; |
| axis2_char_t *enc_user = NULL; |
| rampart_callback_t *password_callback = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| oxs_asym_ctx_t *asym_ctx = NULL; |
| oxs_key_t *decrypted_sym_key = NULL; |
| axis2_char_t *enc_asym_algo_in_pol = NULL; |
| axis2_char_t *enc_sym_algo_in_pol = NULL; |
| password_callback_fn password_function = NULL; |
| void *param = NULL; |
| int i = 0; |
| void *key_buf = NULL; |
| |
| /*Get EncryptedData references */ |
| ref_list_node = oxs_axiom_get_first_child_node_by_name( |
| env, encrypted_key_node, OXS_NODE_REFERENCE_LIST, OXS_ENC_NS, NULL); |
| reference_list = oxs_token_get_reference_list_data(env, ref_list_node); |
| |
| /*If there are no references. Nothing to do. Return success*/ |
| if((!reference_list) || (0 == axutil_array_list_size(reference_list, env))) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Reference List is empty"); |
| return AXIS2_SUCCESS; |
| } |
| AXIS2_LOG_INFO(env->log, |
| "[rampart][shp] Reference List has %d node reference(s)", |
| axutil_array_list_size(reference_list, env)); |
| |
| /*Get the algorithm to decrypt the sesison key*/ |
| |
| enc_mtd_node = oxs_axiom_get_first_child_node_by_name( |
| env, encrypted_key_node, OXS_NODE_ENCRYPTION_METHOD, OXS_ENC_NS, NULL); |
| enc_asym_algo = oxs_token_get_encryption_method(env, enc_mtd_node); |
| |
| /*If the reference list > 0 then We have nodes to decrypt. Next step is to get the encrypted key*/ |
| /*Obtain the session key which is encrypted*/ |
| /*Create an asym_ctx*/ |
| /*We should verify the algorithm with policy*/ |
| |
| enc_asym_algo_in_pol = rampart_context_get_enc_asym_algo(rampart_context, env); |
| if(!enc_asym_algo_in_pol) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the policy. No asym algo", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Assymetric enc algorithm not specified in policy."); |
| return AXIS2_FAILURE; |
| } |
| if(axutil_strcmp(enc_asym_algo_in_pol, enc_asym_algo) != 0) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "The key is encrypted with the wrong algorithm"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "The key is encrypted with the wrong algorithm", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| asym_ctx = oxs_asym_ctx_create(env); |
| |
| oxs_asym_ctx_set_algorithm(asym_ctx, env, enc_asym_algo); |
| |
| key_buf = rampart_context_get_prv_key(rampart_context, env); |
| if(key_buf) |
| { |
| axis2_key_type_t type = 0; |
| type = rampart_context_get_prv_key_type(rampart_context, env); |
| if(type == AXIS2_KEY_TYPE_PEM) |
| { |
| oxs_asym_ctx_set_pem_buf(asym_ctx, env, (axis2_char_t *)key_buf); |
| oxs_asym_ctx_set_format(asym_ctx, env, OXS_ASYM_CTX_FORMAT_PEM); |
| } |
| } |
| else |
| { |
| prv_key_file = rampart_context_get_private_key_file(rampart_context, env); |
| if(!prv_key_file) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the policy. No private key", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Private Key is not specified."); |
| return AXIS2_FAILURE; |
| } |
| oxs_asym_ctx_set_file_name(asym_ctx, env, prv_key_file); |
| oxs_asym_ctx_set_format(asym_ctx, env, |
| oxs_util_get_format_by_file_extension(env, prv_key_file)); |
| |
| /*Get the password to retrieve the key from key store*/ |
| /* password = rampart_callback_encuser_password(env, actions, msg_ctx);*/ |
| |
| password = rampart_context_get_prv_key_password(rampart_context, env); |
| |
| if(!password) |
| { |
| enc_user = rampart_context_get_encryption_user(rampart_context, env); |
| |
| if(!enc_user) |
| { |
| enc_user = rampart_context_get_user(rampart_context, env); |
| } |
| |
| if(enc_user) |
| { |
| password_function = rampart_context_get_pwcb_function(rampart_context, env); |
| if(password_function) |
| { |
| password = (*password_function)(env, enc_user, param); |
| } |
| |
| else |
| { |
| password_callback = rampart_context_get_password_callback(rampart_context, env); |
| if(!password_callback) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the policy. No password callback", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Password call back module is not specified."); |
| |
| return AXIS2_FAILURE; |
| } |
| password = rampart_callback_password(env, password_callback, enc_user); |
| } |
| } |
| } |
| oxs_asym_ctx_set_password(asym_ctx, env, password); |
| } |
| oxs_asym_ctx_set_operation(asym_ctx, env, OXS_ASYM_CTX_OPERATION_PRV_DECRYPT); |
| |
| /*oxs_asym_ctx_set_format(asym_ctx, env, OXS_ASYM_CTX_FORMAT_PKCS12);*/ |
| |
| /*Create an empty key*/ |
| |
| decrypted_sym_key = oxs_key_create(env); |
| |
| /*Call decrypt for the EncryptedKey*/ |
| status = oxs_xml_enc_decrypt_key(env, asym_ctx, |
| sec_node, encrypted_key_node, decrypted_sym_key); |
| |
| if(AXIS2_FAILURE == status) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Cannot decrypt the EncryptedKey"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Key decryption failed", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| /*Alright now we have the key used to encrypt the elements in the reference_list*/ |
| /*Go thru each and every node in the list and decrypt them*/ |
| |
| /*Before decrypt we should get the symmetric algo from policy. |
| So for each encrypted element we can compare the algo. */ |
| |
| enc_sym_algo_in_pol = rampart_context_get_enc_sym_algo(rampart_context, env); |
| if(!enc_sym_algo_in_pol) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the policy. No summetric algo", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Symetric enc algorithm not specified in policy."); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| for(i=0 ; i < axutil_array_list_size(reference_list, env); i++ ) |
| { |
| axis2_char_t *id = NULL; |
| axis2_char_t *id2 = NULL; |
| axiom_node_t *enc_data_node = NULL; |
| axiom_node_t *envelope_node = NULL; |
| oxs_ctx_t *ctx = NULL; |
| axiom_node_t *decrypted_node = NULL; |
| axiom_node_t *mtd_node = NULL; |
| axis2_char_t *sym_algo = NULL; |
| axiom_soap_body_t *soap_body = NULL; |
| |
| /*This need to be done in order to build the soap body.Do not remove.*/ |
| |
| soap_body = axiom_soap_envelope_get_body(soap_envelope, env); |
| |
| /*Get the i-th element and decrypt it */ |
| |
| id = (axis2_char_t*)axutil_array_list_get(reference_list, env, i); |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Decrypting node, ID=%s", id); |
| |
| /*Need to remove # sign from the ID*/ |
| |
| id2 = axutil_string_substring_starting_at(id, 1); |
| envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env); |
| |
| /*Search for the node by its ID*/ |
| |
| enc_data_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, id2, NULL); |
| if(!enc_data_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Node with ID=%s cannot be found", id); |
| |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Cannot find EncryptedData element", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| } |
| /*Create an enc_ctx*/ |
| mtd_node = oxs_axiom_get_first_child_node_by_name( |
| env, enc_data_node, OXS_NODE_ENCRYPTION_METHOD, OXS_ENC_NS, NULL); |
| |
| if(!mtd_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "Cannot find EncryptionMethod Element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Cannot find EncryptionMethod Element", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| sym_algo = oxs_token_get_encryption_method(env, mtd_node); |
| if(!sym_algo) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "Cannot get the Symmetric Algorithm from Soap message."); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Cannot find EncryptionMethod Element", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| |
| return AXIS2_FAILURE; |
| } |
| |
| if(axutil_strcmp(sym_algo, enc_sym_algo_in_pol)!=0) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "The content is encrypted with the wrong algorithm"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "The content is encrypted with the wrong algorithm", |
| RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| |
| } |
| |
| ctx = oxs_ctx_create(env); |
| oxs_ctx_set_key(ctx, env, decrypted_sym_key); |
| |
| status = oxs_xml_enc_decrypt_node(env, ctx, enc_data_node, &decrypted_node); |
| |
| if(AXIS2_FAILURE == status) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Data decryption failed", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| /*Free*/ |
| oxs_ctx_free(ctx, env); |
| ctx = NULL; |
| |
| /*AXIS2_FREE(env->allocator, id); |
| id = NULL; |
| */ |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Node ID=%s decrypted successfuly", id); |
| }/*end of For loop*/ |
| |
| |
| /*Set the security processed result*/ |
| rampart_set_security_processed_result( |
| env, msg_ctx, RAMPART_SPR_ENC_CHECKED, RAMPART_YES); |
| |
| /*Free*/ |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| |
| if(decrypted_sym_key) |
| { |
| oxs_key_free(decrypted_sym_key, env); |
| decrypted_sym_key = NULL; |
| } |
| |
| axutil_array_list_free(reference_list, env); |
| reference_list = NULL; |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| |
| static axis2_status_t |
| rampart_shp_process_reference_list( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node, |
| axiom_node_t *ref_list_node) |
| { |
| |
| axutil_array_list_t *reference_list = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| int i = 0; |
| |
| reference_list = oxs_token_get_reference_list_data(env, |
| ref_list_node); |
| |
| if((!reference_list) || (0 == axutil_array_list_size(reference_list, env))) |
| { |
| if (reference_list) |
| { |
| axutil_array_list_free(reference_list, env); |
| reference_list = NULL; |
| } |
| |
| AXIS2_LOG_INFO(env->log, |
| "[rampart][shp] Nothing Encrypted Outside security header"); |
| return AXIS2_SUCCESS; |
| } |
| |
| for(i=0 ; i < axutil_array_list_size(reference_list, env); i++ ) |
| { |
| axis2_char_t *id = NULL; |
| axis2_char_t *id2 = NULL; |
| axiom_node_t *enc_data_node = NULL; |
| axiom_node_t *envelope_node = NULL; |
| axiom_soap_body_t *soap_body = NULL; |
| axiom_node_t *key_info_node = NULL; |
| axiom_node_t *str_node = NULL; |
| |
| soap_body = axiom_soap_envelope_get_body(soap_envelope, env); |
| |
| id = (axis2_char_t*)axutil_array_list_get(reference_list, env, i); |
| |
| id2 = axutil_string_substring_starting_at(axutil_strdup(env, id), 1); |
| |
| envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env); |
| |
| /*Search for the node by its ID*/ |
| enc_data_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, id2, NULL); |
| if(!enc_data_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Node with ID=%s cannot be found", id2); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Cannot find EncryptedData element", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx); |
| axutil_array_list_free(reference_list, env); |
| reference_list = NULL; |
| AXIS2_FREE(env->allocator, id2); |
| id2 = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_FREE(env->allocator, id2); |
| id2 = NULL; |
| |
| key_info_node = oxs_axiom_get_first_child_node_by_name(env, enc_data_node, |
| OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL); |
| |
| if(key_info_node) |
| { |
| str_node = oxs_axiom_get_first_child_node_by_name(env, key_info_node, |
| OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL); |
| |
| if(str_node) |
| { |
| axiom_node_t *str_child_node = NULL; |
| axis2_char_t *str_child_name = NULL; |
| |
| str_child_node = axiom_node_get_first_element(str_node, env); |
| str_child_name = axiom_util_get_localname(str_child_node, env); |
| if(str_child_name) |
| { |
| if(axutil_strcmp(str_child_name, OXS_NODE_REFERENCE) == 0) |
| { |
| axis2_char_t *ref = NULL; |
| axis2_char_t *ref_id = NULL; |
| axiom_node_t *encrypted_key_node = NULL; |
| |
| ref = oxs_token_get_reference(env, str_child_node); |
| ref_id = axutil_string_substring_starting_at(axutil_strdup(env, ref), 1); |
| |
| encrypted_key_node = oxs_axiom_get_node_by_id(env, sec_node, "Id", ref_id, NULL); |
| AXIS2_FREE(env->allocator, ref_id); |
| ref_id = NULL; |
| if(encrypted_key_node) |
| { |
| ref_list_node = axiom_node_detach(ref_list_node, env); |
| axiom_node_add_child(encrypted_key_node, env, ref_list_node); |
| |
| status = rampart_shp_process_encrypted_key(env, msg_ctx, rampart_context, |
| soap_envelope, sec_node, encrypted_key_node); |
| break; |
| } |
| } |
| } |
| } |
| } |
| } |
| |
| axutil_array_list_free(reference_list, env); |
| reference_list = NULL; |
| return status; |
| } |
| |
| |
| |
| |
| |
| static axis2_status_t |
| rampart_shp_process_signature( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node, |
| axiom_node_t *sig_node) |
| { |
| |
| oxs_sign_ctx_t *sign_ctx = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| axis2_char_t *digest_mtd_pol = NULL; |
| axis2_char_t *sig_mtd_pol = NULL; |
| axiom_node_t *sign_info_node = NULL; |
| axiom_node_t *cur_node = NULL; |
| rp_property_t *token = NULL; |
| axis2_bool_t server_side = AXIS2_FALSE; |
| axis2_char_t *eki = NULL; |
| rp_property_type_t token_type; |
| axiom_node_t *key_info_node = NULL; |
| axiom_node_t *str_node = NULL; |
| axiom_node_t *str_child_node = NULL; |
| axis2_char_t *str_child_name = NULL; |
| oxs_x509_cert_t *cert = NULL; |
| axiom_node_t *key_info_child_node = NULL; |
| axiom_node_t *envelope_node = NULL; |
| axis2_bool_t is_include_token = AXIS2_FALSE; |
| |
| server_side = axis2_msg_ctx_get_server_side(msg_ctx,env); |
| sig_mtd_pol = rampart_context_get_asym_sig_algo(rampart_context,env); |
| digest_mtd_pol = rampart_context_get_digest_mtd(rampart_context,env); |
| |
| if(!sig_mtd_pol || !digest_mtd_pol) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the policy. No signature algo", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in policy, Specifying signature algorithms."); |
| return AXIS2_FAILURE; |
| } |
| |
| sign_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node, |
| OXS_NODE_SIGNEDINFO, OXS_DSIG_NS, NULL); |
| |
| if(!sign_info_node) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Sign info node not found.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Sign info cannot be found.Verifycation failed"); |
| return AXIS2_FAILURE; |
| } |
| |
| cur_node = axiom_node_get_first_element(sign_info_node, env); |
| while(cur_node) |
| { |
| axis2_char_t *localname = NULL; |
| localname = axiom_util_get_localname(cur_node, env); |
| if(axutil_strcmp(localname, OXS_NODE_SIGNATURE_METHOD)==0) |
| { |
| /*Verify the signature method with policy*/ |
| axis2_char_t *sig_mtd = NULL; |
| sig_mtd = oxs_token_get_signature_method(env, cur_node); |
| if(sig_mtd) |
| { |
| if(axutil_strcmp(sig_mtd_pol, sig_mtd)!=0) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Signed with Invalid algorithm", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Signed with Invalid algorithm"); |
| |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| else |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Signature method element not found .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Signature method element not found"); |
| return AXIS2_FAILURE; |
| } |
| } |
| else if(axutil_strcmp(localname, OXS_NODE_REFERENCE)==0) |
| { |
| /*Verify each digest method with policy*/ |
| axiom_node_t *digest_mtd_node = NULL; |
| axis2_char_t *digest_mtd = NULL; |
| digest_mtd_node = oxs_axiom_get_first_child_node_by_name(env, cur_node, |
| OXS_NODE_DIGEST_METHOD, OXS_DSIG_NS, NULL); |
| if(digest_mtd_node) |
| { |
| digest_mtd = oxs_token_get_digest_method(env, digest_mtd_node); |
| if(digest_mtd) |
| { |
| if(axutil_strcmp(digest_mtd_pol, digest_mtd)!=0) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Digest created with Invalid algorithm", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Digest Created with Invalid algorithm"); |
| |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| /*we do not need to process at this moment*/ |
| } |
| cur_node = axiom_node_get_next_sibling(cur_node, env); |
| } |
| |
| /*Get the key identifiers and build the certificate*/ |
| /*First we should verify with policy*/ |
| |
| token = rampart_context_get_token(rampart_context, env, |
| AXIS2_FALSE, server_side, AXIS2_TRUE); |
| |
| if(!token) |
| { |
| AXIS2_LOG_INFO(env->log, |
| "[rampart][shp] Signature Token is not specified"); |
| return AXIS2_SUCCESS; |
| } |
| token_type = rp_property_get_type(token, env); |
| |
| if(!rampart_context_is_token_type_supported(token_type, env)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_UNSUPPORTED_SECURITY_TOKEN, |
| "The token type does not supported", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] The token type does not supported"); |
| |
| return AXIS2_FAILURE; |
| } |
| |
| if(rampart_context_check_is_derived_keys(env, token)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_UNSUPPORTED_SECURITY_TOKEN, |
| "Derived Keys are not supported.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Derived Keys are not supported."); |
| |
| return AXIS2_FAILURE; |
| } |
| is_include_token = rampart_context_is_token_include( |
| rampart_context, token, token_type, server_side, AXIS2_TRUE, env); |
| |
| key_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node, |
| OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL ); |
| |
| if(!key_info_node) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Key Info node is not in the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp]Verify failed. Key Info node is not in the message."); |
| return AXIS2_FAILURE; |
| } |
| str_node = oxs_axiom_get_first_child_node_by_name(env, key_info_node, |
| OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL); |
| |
| if(str_node) |
| { |
| str_child_node = axiom_node_get_first_element(str_node,env); |
| if(str_child_node) |
| { |
| str_child_name = axiom_util_get_localname(str_child_node, env); |
| if(str_child_name) |
| { |
| if(is_include_token) |
| { |
| if(axutil_strcmp(str_child_name, OXS_NODE_REFERENCE)!=0) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Token is not in the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Token is not included in the message "); |
| |
| return AXIS2_FAILURE; |
| } |
| cert = oxs_x509_cert_create(env); |
| status = rampart_token_process_direct_ref(env, str_child_node, sec_node, cert); |
| } |
| else |
| { |
| if(0 == axutil_strcmp(str_child_name, OXS_NODE_EMBEDDED)) |
| { |
| if(!rampart_context_is_key_identifier_type_supported( |
| rampart_context, token, RAMPART_STR_EMBEDDED, env)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_EMBEDDED); |
| return AXIS2_FAILURE; |
| } |
| cert = oxs_x509_cert_create(env); |
| status = rampart_token_process_embedded(env, str_child_node, cert); |
| } |
| else if(0 == axutil_strcmp(str_child_name, OXS_NODE_KEY_IDENTIFIER)) |
| { |
| if(!rampart_context_is_key_identifier_type_supported( |
| rampart_context, token, RAMPART_STR_KEY_IDENTIFIER, env)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_KEY_IDENTIFIER); |
| return AXIS2_FAILURE; |
| } |
| cert = get_receiver_x509_cert(env, rampart_context); |
| status = AXIS2_SUCCESS; |
| } |
| else if(0 == axutil_strcmp(str_child_name, OXS_NODE_X509_DATA)) |
| { |
| if(!rampart_context_is_key_identifier_type_supported( |
| rampart_context, token, RAMPART_STR_ISSUER_SERIAL, env)) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_X509_DATA); |
| return AXIS2_FAILURE; |
| } |
| cert = get_receiver_x509_cert(env,rampart_context); |
| status = AXIS2_SUCCESS; |
| } |
| else |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI , |
| "[Rampart][shp]Key Reference %s not supported ", str_child_name); |
| return AXIS2_FAILURE; |
| } |
| } |
| if(status != AXIS2_SUCCESS || !cert) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Cannot load the key to verify the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI , |
| "[Rampart][shp] Cannot load the key to verify the message"); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Cannot get the key Reference Type from the message."); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]No Child node in the Security Token Reference Element."); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| /*So there may be scenarios where there is no Security Token Reference Element.*/ |
| else |
| { |
| |
| /*In such case policy support only Isssuer Serial scenario.*/ |
| |
| if(axutil_strcmp(eki, RAMPART_STR_ISSUER_SERIAL)==0) |
| { |
| key_info_child_node = axiom_node_get_first_element(key_info_node, env); |
| if(key_info_child_node) |
| { |
| axis2_char_t *key_info_child_name = NULL; |
| key_info_child_name = axiom_util_get_localname(key_info_child_node, env); |
| if(key_info_child_name) |
| { |
| if(0 == axutil_strcmp(key_info_child_name, OXS_NODE_X509_DATA)) |
| { |
| status = rampart_token_process_x509_data(env, key_info_child_node, cert); |
| if(status != AXIS2_SUCCESS || !cert) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, |
| "Cannot load the key to verify the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI , |
| "[Rampart][shp] Cannot load the key to verify the message"); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Cannot get the key Reference Type from the message."); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Cannot get the key Reference Type from the message."); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Cannot get the key Reference Type from the message."); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Can't be used as a direct child of Key Info"); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| sign_ctx = oxs_sign_ctx_create(env); |
| |
| if(!sign_ctx) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Sign context creation failed. Out of Memeory."); |
| return AXIS2_FAILURE; |
| } |
| |
| /*Set the required values in sig_ctx*/ |
| |
| oxs_sign_ctx_set_operation(sign_ctx, env, OXS_SIGN_OPERATION_VERIFY); |
| oxs_sign_ctx_set_certificate(sign_ctx, env, cert); |
| |
| envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env); |
| if(!envelope_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Cannot get the Envelope node from envelope."); |
| return AXIS2_FAILURE; |
| } |
| |
| /*Verify the signature*/ |
| |
| status = oxs_xml_sig_verify(env, sign_ctx, sig_node,envelope_node); |
| if(status != AXIS2_SUCCESS) |
| { |
| if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env)) |
| { |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, |
| "Signature Verification failed.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| } |
| |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[Rampart][shp]Signature Verification failed."); |
| |
| return AXIS2_FAILURE; |
| } |
| |
| if(sign_ctx) |
| { |
| oxs_sign_ctx_free(sign_ctx, env); |
| sign_ctx = NULL; |
| } |
| |
| return status; |
| } |
| |
| |
| /*Public functions*/ |
| |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_shp_process_message(const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node) |
| { |
| axiom_node_t *cur_node = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| axis2_bool_t need_replay_detection = AXIS2_FALSE; |
| axis2_bool_t signature_protection = AXIS2_FALSE; |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Processing security header"); |
| |
| |
| |
| if((rampart_context_get_binding_type(rampart_context, env)) == |
| RP_PROPERTY_ASYMMETRIC_BINDING) |
| { |
| |
| signature_protection = rampart_context_is_encrypt_signature( |
| rampart_context, env); |
| |
| if(rampart_context_is_encrypt_before_sign(rampart_context, env)) |
| { |
| if(signature_protection) |
| { |
| axiom_node_t *ref_list_node = NULL; |
| |
| cur_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| |
| if(!cur_node) |
| { |
| |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] No Encrypted Key element."); |
| |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Signature is not encrypted.", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| return AXIS2_FAILURE; |
| |
| } |
| |
| if(!rampart_shp_validate_qnames(env, cur_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in the Encrypted key element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the Encrypted key element ", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Process EncryptedKey"); |
| |
| status = rampart_shp_process_encrypted_key( |
| env, msg_ctx, rampart_context, soap_envelope, sec_node, cur_node); |
| if(status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Encrypted key processing failed."); |
| return status; |
| } |
| ref_list_node = oxs_axiom_get_first_child_node_by_name( |
| env, cur_node, OXS_NODE_REFERENCE_LIST, OXS_ENC_NS, NULL); |
| |
| axiom_node_detach(ref_list_node, env); |
| |
| axiom_node_free_tree(ref_list_node, env); |
| ref_list_node = NULL; |
| |
| } |
| /*First we should verify signature.*/ |
| if(rampart_context_check_whether_to_sign(rampart_context, env)) |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE); |
| if(!cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] No Signature element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Message is not signed ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| } |
| |
| if(!rampart_shp_validate_qnames(env, cur_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in the Signature element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the Signature element ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Processing Signature element."); |
| |
| status = rampart_shp_process_signature( |
| env, msg_ctx, rampart_context, soap_envelope, sec_node, cur_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env)) |
| { |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, "Signature is not valid", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| return status; |
| } |
| else |
| { |
| return status; |
| } |
| } |
| } |
| else |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE); |
| if(cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] policy does not specify signature"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Policy does not specify signature ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| |
| } |
| else |
| { |
| status = AXIS2_SUCCESS; |
| } |
| } |
| |
| /*This verification is a quick hack.This should be cganged in the future |
| with a proper verification method before message processing |
| Because we need to compare the protected nodes in the message |
| with the nodes to protect in policy. */ |
| |
| if(rampart_context_check_whether_to_encrypt(rampart_context, env)) |
| { |
| if(!signature_protection) |
| { |
| cur_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| |
| if(!cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] No Encrypted Key element."); |
| |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Signature is not encrypted.", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| if(!rampart_shp_validate_qnames(env, cur_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in the Encrypted key element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the Encrypted key element ", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Process EncryptedKey"); |
| |
| status = rampart_shp_process_encrypted_key( |
| env, msg_ctx, rampart_context, soap_envelope, sec_node, cur_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env)) |
| { |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, "Encryption key processing failed.", |
| RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| } |
| return status; |
| } |
| } |
| else |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_REFERENCE_LIST); |
| if(!cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Protection order is wrong or Signature not encrypted."); |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, "Protection order is wrong or Signature is not encrypted. ", |
| RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| } |
| status = rampart_shp_process_reference_list(env, msg_ctx, |
| rampart_context, soap_envelope, sec_node, cur_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, "Error in decrypting the signature. ", |
| RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in decrypting the Signature."); |
| return status; |
| } |
| } |
| } |
| else |
| { |
| cur_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(cur_node) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] policy does not specify encryption."); |
| return AXIS2_FAILURE; |
| } |
| else |
| status = AXIS2_SUCCESS; |
| } |
| } |
| else |
| { |
| /*We should decrypt the message first*/ |
| if(rampart_context_check_whether_to_encrypt(rampart_context,env)) |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(!cur_node) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] No Encrypted Key element"); |
| return AXIS2_FAILURE; |
| } |
| if(!rampart_shp_validate_qnames(env,cur_node)) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Error in the security header"); |
| return AXIS2_FAILURE; |
| } |
| |
| if(signature_protection) |
| { |
| if(oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE)) |
| { |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Signature is not Encrypted."); |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Process EncryptedKey"); |
| status = rampart_shp_process_encrypted_key(env,msg_ctx, rampart_context, soap_envelope, sec_node, cur_node); |
| if(status!=AXIS2_SUCCESS) |
| return status; |
| } |
| else |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] policy does not specify Encryption"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Policy does not specify Encryption. ", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx); |
| } |
| else |
| { |
| status = AXIS2_SUCCESS;; |
| } |
| } |
| |
| /*After decrypting we may verify signature stuff.*/ |
| if(rampart_context_check_whether_to_sign(rampart_context, env)) |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE); |
| if(!cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] No Signature element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Message is not signed ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| |
| return AXIS2_FAILURE; |
| } |
| |
| if(!rampart_shp_validate_qnames(env, cur_node)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Error in the Signature element"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Error in the Signature element ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| return AXIS2_FAILURE; |
| } |
| |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Processing Signature element."); |
| |
| status = rampart_shp_process_signature(env, msg_ctx, |
| rampart_context, soap_envelope, sec_node, cur_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env)) |
| { |
| rampart_create_fault_envelope( |
| env, RAMPART_FAULT_INVALID_SECURITY, "Signature is not valid", |
| RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| return status; |
| } |
| else |
| { |
| return status; |
| } |
| } |
| } |
| |
| else |
| { |
| cur_node = oxs_axiom_get_node_by_local_name(env, sec_node,OXS_NODE_SIGNATURE); |
| if(cur_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] policy does not specify signature"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, |
| "Policy does not specify signature ", RAMPART_FAULT_IN_SIGNATURE, msg_ctx); |
| } |
| else |
| { |
| status = AXIS2_SUCCESS; |
| } |
| } |
| } |
| /*Now we can process timestamp*/ |
| |
| status = rampart_shp_process_timestamptoken( |
| env, msg_ctx, rampart_context, sec_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Timestamp Processing failed."); |
| return status; |
| } |
| |
| if(axis2_msg_ctx_get_server_side(msg_ctx, env)) |
| { |
| status = rampart_shp_process_usernametoken( |
| env, msg_ctx, rampart_context, sec_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| return status; |
| } |
| } |
| |
| if(NULL == rampart_context_get_rd_val(rampart_context, env)){ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Replay detection is not specified. Nothing to do"); |
| need_replay_detection = AXIS2_FALSE; |
| }else{ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Checking message for replay."); |
| need_replay_detection = AXIS2_TRUE; |
| } |
| if(AXIS2_TRUE == need_replay_detection){/*TODO Chk for the policy configuration*/ |
| rampart_is_replayed_fn rd_fn = NULL; |
| /*Is replayed*/ |
| rd_fn = rampart_context_get_replay_detect_function(rampart_context, env); |
| if(rd_fn){ |
| status = (*rd_fn)(env, msg_ctx, rampart_context); |
| if(status != AXIS2_SUCCESS){ |
| /*Scream .. replayed*/ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart][shp] Message can be replayed"); |
| rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, "Message is replayed", RAMPART_FAULT_MSG_REPLAYED, msg_ctx); |
| return AXIS2_FAILURE; |
| }else{ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Checked message for replays. Not a replay."); |
| } |
| }else{ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] No replay detection function specified. Nothing to do. "); |
| } |
| } |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Security header element processing, DONE "); |
| /*Do the action accordingly*/ |
| return AXIS2_SUCCESS; |
| } |
| |
| else if((rampart_context_get_binding_type(rampart_context, env)) |
| == RP_PROPERTY_SYMMETRIC_BINDING) |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Symmetric binding is not supported.", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "Symmetric binding is not supported"); |
| return AXIS2_FAILURE; |
| } |
| |
| else if((rampart_context_get_binding_type(rampart_context, env)) == |
| RP_PROPERTY_TRANSPORT_BINDING) |
| { |
| axis2_status_t status = AXIS2_FAILURE; |
| |
| status = rampart_shp_process_timestamptoken( |
| env, msg_ctx, rampart_context, sec_node); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| return status; |
| } |
| |
| if( axis2_msg_ctx_get_server_side(msg_ctx, env)) |
| { |
| status = rampart_shp_process_usernametoken( |
| env, msg_ctx, rampart_context, sec_node); |
| |
| if(status!=AXIS2_SUCCESS) |
| { |
| return status; |
| } |
| } |
| |
| if(AXIS2_TRUE == need_replay_detection){/*TODO Chk for the policy configuration*/ |
| rampart_is_replayed_fn rd_fn = NULL; |
| /*Is replayed*/ |
| rd_fn = rampart_context_get_replay_detect_function(rampart_context, env); |
| if(rd_fn){ |
| status = (*rd_fn)(env, msg_ctx, rampart_context); |
| if(status != AXIS2_SUCCESS){ |
| /*Scream .. replayed*/ |
| return AXIS2_FAILURE; |
| }else{ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Checked message for replays. Not a replay."); |
| } |
| }else{ |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] No replay detection function specified. Nothing to do. "); |
| } |
| } |
| AXIS2_LOG_INFO(env->log, "[rampart][shp] Security header element processing, DONE "); |
| /*Do the action accordingly*/ |
| return AXIS2_SUCCESS; |
| |
| } |
| else |
| { |
| rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, |
| "Unsupportive binding type.", RAMPART_FAULT_IN_POLICY, msg_ctx); |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][shp] Unsupportive binding type."); |
| return AXIS2_FAILURE; |
| } |
| |
| } |
| |
| |
| |
