| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <stdio.h> |
| #include <axutil_utils.h> |
| #include <oxs_ctx.h> |
| #include <oxs_error.h> |
| #include <oxs_utility.h> |
| #include <rampart_encryption.h> |
| #include <oxs_key.h> |
| #include <rampart_constants.h> |
| #include <rampart_handler_util.h> |
| #include <oxs_tokens.h> |
| #include <axutil_array_list.h> |
| #include <oxs_axiom.h> |
| #include <oxs_asym_ctx.h> |
| #include <oxs_xml_encryption.h> |
| #include <oxs_derivation.h> |
| #include <axis2_key_type.h> |
| #include <oxs_derivation.h> |
| #include <rampart_sct_provider_utility.h> |
| #include <axiom_util.h> |
| |
| static axis2_status_t AXIS2_CALL |
| rampart_enc_get_nodes_to_encrypt( |
| rampart_context_t *rampart_context, |
| const axutil_env_t *env, |
| axiom_soap_envelope_t *soap_envelope, |
| axutil_array_list_t *nodes_to_encrypt) |
| { |
| axis2_status_t status1 = AXIS2_SUCCESS; |
| axis2_status_t status2 = AXIS2_SUCCESS; |
| |
| status1 = rampart_context_get_nodes_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| |
| status2 = rampart_context_get_elements_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| |
| if(status1 == AXIS2_SUCCESS || status2 == AXIS2_SUCCESS) |
| { |
| return AXIS2_SUCCESS; |
| } |
| else |
| { |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| /** |
| * Encrypts the session key using assymmetric encription |
| * @param env pointer to environment struct |
| * @param session_key the session key to be encrypted |
| * @param msg_ctx message context |
| * @param rampart_context the rampart context |
| * @param sec_node The security element |
| * @return AXIS2_SUCCESS on success, else AXIS2_FAILURE |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_enc_encrypt_session_key( |
| const axutil_env_t *env, |
| oxs_key_t *session_key, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_node_t *sec_node, |
| axutil_array_list_t *id_list) |
| { |
| oxs_asym_ctx_t *asym_ctx = NULL; |
| axis2_char_t *enc_asym_algo = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| axis2_bool_t server_side = AXIS2_FALSE; |
| rp_property_t *token = NULL; |
| rp_property_type_t token_type; |
| axis2_char_t *eki = NULL; |
| oxs_x509_cert_t *certificate = NULL; |
| |
| server_side = axis2_msg_ctx_get_server_side(msg_ctx, env); |
| token = rampart_context_get_token(rampart_context, env, AXIS2_TRUE, server_side, AXIS2_FALSE); |
| token_type = rp_property_get_type(token, env); |
| |
| if(!rampart_context_is_token_type_supported(token_type, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Specified token type not supported."); |
| return AXIS2_FAILURE; |
| } |
| |
| /* Get the asymmetric key encryption algorithm */ |
| enc_asym_algo = rampart_context_get_enc_asym_algo(rampart_context, env); |
| |
| /* Get encryption key identifier. This identifier depends on whether we include the token in |
| * the message. */ |
| if(rampart_context_is_token_include( |
| rampart_context, token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| eki = RAMPART_STR_DIRECT_REFERENCE; |
| } |
| else |
| { |
| eki = rampart_context_get_key_identifier(rampart_context, token, env); |
| } |
| |
| if(!eki) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart] No mechanism for attaching the certificate information."); |
| return AXIS2_FAILURE; |
| } |
| |
| /* Receiver certificate can be in the received message. In that case, we should use it. |
| If it is not there, then can get from key manager */ |
| if(rampart_context_get_found_cert_in_shp(rampart_context, env)) |
| { |
| certificate = rampart_context_get_receiver_cert_found_in_shp(rampart_context, env); |
| } |
| else |
| { |
| oxs_key_mgr_t *key_mgr = NULL; |
| key_mgr = rampart_context_get_key_mgr(rampart_context, env); |
| certificate = oxs_key_mgr_get_receiver_certificate(key_mgr, env); |
| } |
| |
| if (!certificate) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart] Receiver certificate cannot be loaded."); |
| return AXIS2_FAILURE; |
| } |
| |
| /* Create asymmetric encryption context and populate algorithm, certificate etc. */ |
| asym_ctx = oxs_asym_ctx_create(env); |
| oxs_asym_ctx_set_algorithm(asym_ctx, env, enc_asym_algo); |
| oxs_asym_ctx_set_certificate(asym_ctx, env, certificate); |
| oxs_asym_ctx_set_operation(asym_ctx, env,OXS_ASYM_CTX_OPERATION_PUB_ENCRYPT); |
| oxs_asym_ctx_set_st_ref_pattern(asym_ctx, env, eki); |
| |
| /* Encrypt the session key */ |
| status = oxs_xml_enc_encrypt_key(env, asym_ctx, sec_node, session_key, id_list); |
| oxs_asym_ctx_free(asym_ctx, env); |
| asym_ctx = NULL; |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart] Session key encryption failed."); |
| return AXIS2_FAILURE; |
| } |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * Encrypt the message using derived keys. Uses symmetric encryption |
| * @param env pointer to environment struct |
| * @param msg_ctx message context |
| * @param rampart_context rampart context |
| * @param soap_envelope the SOAP envelope |
| * @param sec_node The security element |
| * @return AXIS2_SUCCESS on success, else AXIS2_FAILURE |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_enc_dk_encrypt_message( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node) |
| { |
| axis2_status_t status = AXIS2_FAILURE; |
| oxs_key_t *session_key = NULL; |
| axutil_array_list_t *nodes_to_encrypt = NULL; |
| axutil_array_list_t *id_list = NULL; |
| axutil_array_list_t *dk_list = NULL; |
| axis2_char_t *enc_sym_algo = NULL; |
| axis2_char_t *asym_key_id = NULL; |
| axis2_bool_t free_asym_key_id = AXIS2_FALSE; |
| axiom_node_t *encrypted_key_node = NULL; |
| axiom_node_t *key_reference_node = NULL; |
| axiom_node_t *sig_node = NULL; |
| axiom_node_t *data_ref_list_node = NULL; |
| axis2_bool_t use_derived_keys = AXIS2_TRUE; |
| axis2_char_t *derived_key_version = NULL; |
| axis2_bool_t server_side = AXIS2_FALSE; |
| rp_property_t *token = NULL; |
| rp_property_type_t token_type; |
| rampart_saml_token_t *saml = NULL; |
| oxs_key_t *derived_key = NULL; |
| axiom_soap_body_t *body = NULL; |
| axiom_node_t *body_node = NULL; |
| axiom_node_t *body_child_node = NULL; |
| |
| axis2_bool_t signature_protection = AXIS2_FALSE; |
| int i = 0; |
| int j = 0; |
| |
| body = axiom_soap_envelope_get_body(soap_envelope, env); |
| body_node = axiom_soap_body_get_base_node(body, env); |
| body_child_node = axiom_node_get_first_element(body_node, env); |
| |
| /* Get nodes to be encrypted */ |
| nodes_to_encrypt = axutil_array_list_create(env, 0); |
| status = rampart_enc_get_nodes_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Error occured in Adding Encrypted parts."); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| /* If the sp:EncryptSignature is ON && We sign before the encryption, |
| * we need to add signature node too. */ |
| signature_protection = rampart_context_is_encrypt_signature(rampart_context, env); |
| |
| /* if nothing to encrypt, then we can return successfully */ |
| if((axutil_array_list_size(nodes_to_encrypt, env)==0)) |
| { |
| if(!signature_protection) |
| { |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, |
| "[rampart]No parts specified or specified parts can't be found for encryprion."); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_SUCCESS; |
| } |
| } |
| |
| if(signature_protection) |
| { |
| if(!(rampart_context_is_encrypt_before_sign(rampart_context, env))) |
| { |
| /*Sign->Encrypt. Easy. just add the signature node to the list*/ |
| sig_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE); |
| if(!sig_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Sigature Not found"); |
| return AXIS2_FAILURE; |
| } |
| axutil_array_list_add(nodes_to_encrypt, env, sig_node); |
| |
| if(rampart_context_is_sig_confirmation_reqd(rampart_context, env)) |
| { |
| axiom_node_t* cur_node = NULL; |
| cur_node = axiom_node_get_first_child(sec_node, env); |
| while(cur_node) |
| { |
| axis2_char_t *cur_local_name = NULL; |
| cur_local_name = axiom_util_get_localname(cur_node, env); |
| |
| if(0 == axutil_strcmp(cur_local_name, OXS_NODE_SIGNATURE_CONFIRMATION)) |
| { |
| axutil_array_list_add(nodes_to_encrypt, env, cur_node); |
| } |
| cur_node = axiom_node_get_next_sibling(cur_node, env); |
| } |
| } |
| } |
| } |
| |
| |
| /*Get the symmetric encryption algorithm*/ |
| enc_sym_algo = rampart_context_get_enc_sym_algo(rampart_context, env); |
| |
| /*If not specified set the default*/ |
| if(!enc_sym_algo || (0 == axutil_strcmp(enc_sym_algo, ""))) |
| { |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] No symmetric algorithm is specified for encryption. Using the default"); |
| enc_sym_algo = OXS_DEFAULT_SYM_ALGO; |
| } |
| |
| /*We need to take the decision whether to use derived keys or not*/ |
| server_side = axis2_msg_ctx_get_server_side(msg_ctx, env); |
| token = rampart_context_get_token(rampart_context, env, AXIS2_TRUE, server_side, AXIS2_FALSE); |
| token_type = rp_property_get_type(token, env); |
| use_derived_keys = rampart_context_check_is_derived_keys (env, token); |
| derived_key_version = rampart_context_get_derived_key_version(env, token); |
| |
| if(token_type == RP_PROPERTY_SAML_TOKEN) |
| { |
| /* We need to obtain the saml here because it is used in many parts of the code*/ |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_ENCRYPTION_TOKEN); |
| if (!saml) |
| { |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_PROTECTION_TOKEN); |
| } |
| if (!saml) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] SAML not set."); |
| return AXIS2_FAILURE; |
| } |
| } |
| session_key = rampart_context_get_encryption_session_key(rampart_context, env); |
| if(!session_key) |
| { |
| /*Generate the session key. if security context token, get the |
| shared secret and create the session key.*/ |
| if(token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) |
| { |
| oxs_buffer_t *key_buf = NULL; |
| session_key = oxs_key_create(env); |
| key_buf = sct_provider_get_secret(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| if(!key_buf) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Cannot get shared secret of security context token"); |
| oxs_key_free(session_key, env); |
| return AXIS2_FAILURE; |
| } |
| oxs_key_populate(session_key, env, |
| oxs_buffer_get_data(key_buf, env), "for-algo", |
| oxs_buffer_get_size(key_buf, env), OXS_KEY_USAGE_NONE); |
| rampart_context_set_encryption_session_key(rampart_context, env, session_key); |
| } |
| else if(token_type == RP_PROPERTY_SAML_TOKEN) |
| { |
| session_key = rampart_saml_token_get_session_key(saml, env); |
| if (!session_key) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] SAML session key not specified."); |
| return AXIS2_FAILURE; |
| } |
| rampart_context_set_encryption_session_key(rampart_context, env, session_key); |
| } |
| else |
| { |
| axis2_char_t *token_id = NULL; |
| token_id = rampart_context_get_encryption_token_id(rampart_context, env, msg_ctx); |
| if(token_id) |
| { |
| session_key = rampart_context_get_key(rampart_context, env, token_id); |
| oxs_key_set_usage(session_key, env, OXS_KEY_USAGE_SESSION); |
| } |
| else |
| { |
| session_key = oxs_key_create(env); |
| status = oxs_key_for_algo(session_key, env, rampart_context_get_algorithmsuite(rampart_context, env)); |
| rampart_context_set_encryption_session_key(rampart_context, env, session_key); |
| } |
| } |
| } |
| |
| id_list = axutil_array_list_create(env, 5); |
| dk_list = axutil_array_list_create(env, 5); |
| /* For each and every encryption part. |
| 1. Derive a new key if key derivation is enabled. Or else use the same session key |
| 2. Encrypt using that key |
| */ |
| |
| /*Add ReferenceList element to the Security header. Note that we pass the sec_node. Not the EncryptedKey*/ |
| data_ref_list_node = oxs_token_build_reference_list_element(env, sec_node); |
| |
| /*create derived key. */ |
| if(AXIS2_TRUE == use_derived_keys) |
| { |
| /*Derive a new key*/ |
| derived_key = oxs_key_create(env); |
| oxs_key_set_length(derived_key, env, rampart_context_get_encryption_derived_key_len(rampart_context, env)); |
| status = oxs_derivation_derive_key(env, session_key, derived_key, AXIS2_TRUE); |
| |
| /*Add derived key to the list. We will create tokens*/ |
| axutil_array_list_add(dk_list, env, derived_key); |
| key_reference_node = NULL; |
| } |
| |
| /*Repeat until all encryption parts are encrypted*/ |
| for(i=0 ; i < axutil_array_list_size(nodes_to_encrypt, env); i++) |
| { |
| axiom_node_t *node_to_enc = NULL; |
| oxs_ctx_t *enc_ctx = NULL; |
| #if 0 |
| oxs_key_t *derived_key = NULL; |
| #endif |
| axis2_char_t *enc_data_id = NULL; |
| axiom_node_t *parent_of_node_to_enc = NULL; |
| axiom_node_t *enc_data_node = NULL; |
| |
| /*Get the node to be encrypted*/ |
| node_to_enc = (axiom_node_t *)axutil_array_list_get |
| (nodes_to_encrypt, env, i); |
| |
| /*Create the encryption context for OMXMLSEC*/ |
| enc_ctx = oxs_ctx_create(env); |
| |
| if(AXIS2_TRUE == use_derived_keys) |
| { |
| #if 0 |
| /*Derive a new key*/ |
| derived_key = oxs_key_create(env); |
| oxs_key_set_length(derived_key, env, rampart_context_get_encryption_derived_key_len(rampart_context, env)); |
| status = oxs_derivation_derive_key(env, session_key, derived_key, AXIS2_TRUE); |
| #endif |
| /*Set the derived key for the encryption*/ |
| oxs_ctx_set_key(enc_ctx, env, derived_key); |
| |
| /*Set the ref key name to build KeyInfo element. Here the key name is the derived key id*/ |
| oxs_ctx_set_ref_key_name(enc_ctx, env, oxs_key_get_name(derived_key, env)); |
| #if 0 |
| /*Add derived key to the list. We will create tokens*/ |
| axutil_array_list_add(dk_list, env, derived_key); |
| key_reference_node = NULL; |
| #endif |
| } |
| else |
| { |
| /*No key derivation. We use the same session key*/ |
| oxs_ctx_set_key(enc_ctx, env, session_key); |
| oxs_ctx_set_ref_key_name(enc_ctx, env, oxs_key_get_name(session_key, env)); |
| |
| if (token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| /*set the AttachedReference to key_reference_node*/ |
| key_reference_node = sct_provider_get_attached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| else |
| { |
| /*get the unattachedReference and set to key_reference_node*/ |
| key_reference_node = sct_provider_get_unattached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| } |
| else if (token_type == RP_PROPERTY_SAML_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| axiom_node_t *assertion = NULL; |
| /*set the AttachedReference to key_reference_node*/ |
| key_reference_node = rampart_saml_token_get_str(saml, env); |
| if (!key_reference_node) |
| { |
| assertion = rampart_saml_token_get_assertion(saml, env); |
| key_reference_node = oxs_saml_token_build_key_identifier_reference_local(env, NULL, assertion); |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] SAML session key not specified."); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| if(server_side) |
| { |
| axis2_char_t *encrypted_key_hash = NULL; |
| axiom_node_t *identifier_token = NULL; |
| encrypted_key_hash = oxs_key_get_key_sha(session_key, env); |
| key_reference_node = oxs_token_build_security_token_reference_element(env, NULL); |
| identifier_token = oxs_token_build_key_identifier_element(env, key_reference_node, |
| OXS_ENCODING_BASE64BINARY, OXS_X509_ENCRYPTED_KEY_SHA1, encrypted_key_hash); |
| } |
| else |
| { |
| key_reference_node = NULL; |
| } |
| } |
| } |
| |
| /*Set the algorithm*/ |
| oxs_ctx_set_enc_mtd_algorithm(enc_ctx, env, enc_sym_algo); |
| |
| /*Generate ID for the encrypted data ielement*/ |
| parent_of_node_to_enc = axiom_node_get_parent(node_to_enc, env); |
| enc_data_id = oxs_util_generate_id(env, (axis2_char_t*)OXS_ENCDATA_ID); |
| |
| if(parent_of_node_to_enc || enc_data_id) |
| { |
| axis2_char_t *enc_type = OXS_TYPE_ENC_ELEMENT; |
| |
| if(body_child_node == node_to_enc) |
| { |
| /* we have to use #Content for body encryption */ |
| enc_type = OXS_TYPE_ENC_CONTENT; |
| } |
| |
| enc_data_node = oxs_token_build_encrypted_data_element(env, |
| parent_of_node_to_enc, enc_type, enc_data_id ); |
| status = oxs_xml_enc_encrypt_node(env, enc_ctx, |
| node_to_enc, &enc_data_node, key_reference_node); |
| /*Add Ids to the list. We will create reference list*/ |
| axutil_array_list_add(id_list, env, enc_data_id); |
| |
| if(AXIS2_FAILURE == status) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot encrypt the node " ); |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| |
| return AXIS2_FAILURE; |
| } |
| |
| } |
| oxs_ctx_free(enc_ctx, env); |
| enc_ctx = NULL; |
| |
| }/*End of for loop. Iterating nodes_to_encrypt list*/ |
| |
| /*Free node list*/ |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| |
| if (token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| axiom_node_t *security_context_token_node = NULL; |
| /*include the security context token*/ |
| security_context_token_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SECURITY_CONTEXT_TOKEN); |
| if((!security_context_token_node) || (rampart_context_is_different_session_key_for_enc_and_sign(env, rampart_context))) |
| { |
| security_context_token_node = sct_provider_get_token(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| if(!security_context_token_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot get security context token"); |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| return AXIS2_FAILURE; |
| } |
| axiom_node_add_child(sec_node, env, security_context_token_node); |
| } |
| } |
| } |
| else if (token_type == RP_PROPERTY_SAML_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| axiom_node_t *assertion = NULL; |
| /*include the security context token*/ |
| if (!rampart_saml_token_is_added_to_header(saml, env)) |
| assertion = rampart_saml_token_get_assertion(saml, env); |
| if(!assertion) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot get SAML token"); |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| return AXIS2_FAILURE; |
| } |
| axiom_node_add_child(sec_node, env, assertion); |
| } |
| } |
| else |
| { |
| /* If not done already, Encrypt the session key using the Public Key of the recipient*/ |
| /* Note: Here we do not send the id_list to create a ReferenceList inside the encrypted key. Instead we create the |
| * ReferenceList as a child of Security element */ |
| if(!server_side) |
| { |
| encrypted_key_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(!encrypted_key_node) |
| { |
| /*Create EncryptedKey element*/ |
| status = rampart_enc_encrypt_session_key(env, session_key, msg_ctx, rampart_context, sec_node, NULL ); |
| if(AXIS2_FAILURE == status) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot encrypt the session key " ); |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| return AXIS2_FAILURE; |
| } |
| /*Now we have en EncryptedKey Node*/ |
| encrypted_key_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| |
| /*Get the asym key Id*/ |
| if(!encrypted_key_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, EncryptedKey Not found"); |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| return AXIS2_FAILURE; |
| } |
| asym_key_id = oxs_util_generate_id(env, (axis2_char_t*)OXS_ENCKEY_ID); |
| free_asym_key_id = AXIS2_TRUE; |
| if(asym_key_id) |
| { |
| oxs_axiom_add_attribute(env, encrypted_key_node, NULL, |
| NULL, OXS_ATTR_ID, asym_key_id); |
| } |
| } |
| else |
| { |
| /*OK Buddy we have already created EncryptedKey node. Get the Id */ |
| asym_key_id = oxs_axiom_get_attribute_value_of_node_by_name(env, encrypted_key_node, OXS_ATTR_ID, NULL); |
| } |
| } |
| } |
| |
| /*Add used <wsc:DerivedKeyToken> elements to the header*/ |
| for(j=0 ; j < axutil_array_list_size(dk_list, env); j++){ |
| oxs_key_t *dk = NULL; |
| |
| dk = (oxs_key_t *)axutil_array_list_get(dk_list, env, j); |
| |
| /*Build the <wsc:DerivedKeyToken> element*/ |
| if(dk) |
| { |
| axiom_node_t *dk_node = NULL; |
| if (token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| /*set the AttachedReference to key_reference_node*/ |
| key_reference_node = sct_provider_get_attached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| else |
| { |
| /*get the unattachedReference and set to key_reference_node*/ |
| key_reference_node = sct_provider_get_unattached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| dk_node = oxs_derivation_build_derived_key_token_with_stre(env, dk, sec_node, key_reference_node, derived_key_version); |
| } |
| else |
| { |
| if(server_side) |
| { |
| axis2_char_t *encrypted_key_hash = NULL; |
| axiom_node_t *identifier_token = NULL; |
| encrypted_key_hash = oxs_key_get_key_sha(session_key, env); |
| key_reference_node = oxs_token_build_security_token_reference_element(env, NULL); |
| identifier_token = oxs_token_build_key_identifier_element(env, key_reference_node, |
| OXS_ENCODING_BASE64BINARY, OXS_X509_ENCRYPTED_KEY_SHA1, encrypted_key_hash); |
| dk_node = oxs_derivation_build_derived_key_token_with_stre(env, dk, sec_node, key_reference_node, derived_key_version); |
| } |
| else |
| { |
| dk_node = oxs_derivation_build_derived_key_token(env, dk, sec_node, asym_key_id, OXS_WSS_11_VALUE_TYPE_ENCRYPTED_KEY, derived_key_version); |
| } |
| } |
| |
| /*derived key should appear before ReferenceList*/ |
| oxs_axiom_interchange_nodes(env, dk_node, data_ref_list_node); |
| } |
| |
| /*We will free DK here*/ |
| oxs_key_free(dk, env); |
| dk = NULL; |
| |
| }/*End of For loop of dk_list iteration*/ |
| |
| /*Free derrived key list*/ |
| axutil_array_list_free(dk_list, env); |
| dk_list = NULL; |
| |
| /*Free derrived Id list*/ |
| for(j=0 ; j < axutil_array_list_size(id_list, env); j++) |
| { |
| axis2_char_t *id = NULL; |
| axis2_char_t* mod_id = NULL; |
| id = (axis2_char_t *)axutil_array_list_get(id_list, env, j); |
| mod_id = axutil_stracat(env, OXS_LOCAL_REFERENCE_PREFIX,id); |
| oxs_token_build_data_reference_element(env, data_ref_list_node, mod_id); |
| /*if x509 is used and no-derived keys, then we have to modify security token reference*/ |
| if((token_type == RP_PROPERTY_X509_TOKEN) && (!use_derived_keys) && (asym_key_id)) |
| { |
| axiom_node_t *enc_data_node = NULL; |
| axiom_node_t *envelope_node = NULL; |
| axiom_node_t *str_node = NULL; |
| axiom_node_t *reference_node = NULL; |
| axis2_char_t *id_ref = NULL; |
| |
| envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env); |
| enc_data_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, id, NULL); |
| str_node = oxs_axiom_get_node_by_local_name(env, enc_data_node, OXS_NODE_SECURITY_TOKEN_REFRENCE); |
| reference_node = oxs_axiom_get_node_by_local_name(env, str_node, OXS_NODE_REFERENCE); |
| reference_node = axiom_node_detach(reference_node, env); |
| axiom_node_free_tree(reference_node, env); |
| |
| id_ref = axutil_stracat(env, OXS_LOCAL_REFERENCE_PREFIX,asym_key_id); |
| reference_node = oxs_token_build_reference_element(env, str_node, |
| id_ref, OXS_WSS_11_VALUE_TYPE_ENCRYPTED_KEY); |
| |
| AXIS2_FREE(env->allocator, id_ref); |
| } |
| |
| AXIS2_FREE(env->allocator, id); |
| AXIS2_FREE(env->allocator, mod_id); |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| |
| if(free_asym_key_id && asym_key_id) |
| { |
| AXIS2_FREE(env->allocator, asym_key_id); |
| } |
| |
| return status; |
| } |
| |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_enc_encrypt_message( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node) |
| { |
| |
| axutil_array_list_t *nodes_to_encrypt = NULL; |
| axutil_array_list_t *id_list = NULL; |
| axis2_status_t status = AXIS2_FAILURE; |
| axis2_char_t *enc_sym_algo = NULL; |
| oxs_key_t *session_key = NULL; |
| axis2_bool_t server_side = AXIS2_FALSE; |
| rp_property_type_t token_type; |
| rp_property_t *token = NULL; |
| int i = 0; |
| axis2_bool_t signature_protection = AXIS2_FALSE; |
| axiom_node_t *sig_node = NULL; |
| axiom_soap_body_t *body = NULL; |
| axiom_node_t *body_node = NULL; |
| axiom_node_t *body_child_node = NULL; |
| |
| body = axiom_soap_envelope_get_body(soap_envelope, env); |
| body_node = axiom_soap_body_get_base_node(body, env); |
| body_child_node = axiom_node_get_first_element(body_node, env); |
| |
| |
| /*Get nodes to be encrypted*/ |
| |
| server_side = axis2_msg_ctx_get_server_side(msg_ctx, env); |
| nodes_to_encrypt = axutil_array_list_create(env, 0); |
| |
| signature_protection = rampart_context_is_encrypt_signature( |
| rampart_context, env); |
| |
| status = rampart_enc_get_nodes_to_encrypt( |
| rampart_context, env, soap_envelope, nodes_to_encrypt); |
| |
| if(status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_signature]Error occured in Adding Encrypted parts.."); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| if((axutil_array_list_size(nodes_to_encrypt, env)==0)) |
| { |
| if(!signature_protection) |
| { |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] No parts specified or specified parts can't be found for encryprion."); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_SUCCESS; |
| } |
| } |
| |
| if(signature_protection) |
| { |
| if(!(rampart_context_is_encrypt_before_sign(rampart_context, env))) |
| { |
| sig_node = oxs_axiom_get_node_by_local_name(env, sec_node, OXS_NODE_SIGNATURE); |
| if(!sig_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Sigature Not found"); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| axutil_array_list_add(nodes_to_encrypt, env, sig_node); |
| } |
| } |
| |
| /*Now we have to check whether a token is specified.*/ |
| token = rampart_context_get_token(rampart_context, env, |
| AXIS2_TRUE, server_side, AXIS2_FALSE); |
| if(!token) |
| { |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encryption Token is not specified"); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_SUCCESS; |
| } |
| token_type = rp_property_get_type(token, env); |
| |
| if(!rampart_context_is_token_type_supported(token_type, env)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Specified token type not supported."); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| if(rampart_context_check_is_derived_keys(env,token)) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]We still do not support derived keys"); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| /*Get the symmetric encryption algorithm*/ |
| enc_sym_algo = rampart_context_get_enc_sym_algo(rampart_context, env); |
| |
| /*If not specified set the default*/ |
| if(!enc_sym_algo || (0 == axutil_strcmp(enc_sym_algo, ""))) |
| { |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]No symmetric algorithm is specified for encryption. Using the default"); |
| enc_sym_algo = OXS_DEFAULT_SYM_ALGO; |
| } |
| |
| session_key = rampart_context_get_encryption_session_key(rampart_context, env); |
| if(!session_key){ |
| /*Generate the session key*/ |
| session_key = oxs_key_create(env); |
| status = oxs_key_for_algo(session_key, env, rampart_context_get_algorithmsuite(rampart_context, env)); |
| rampart_context_set_encryption_session_key(rampart_context, env, session_key); |
| } |
| if(AXIS2_FAILURE == status) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot generate the key for the algorithm %s, ", enc_sym_algo); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| |
| /*Key will be duplicated inside the function. So no worries freeing it here*/ |
| /*if(rampart_context_is_encrypt_before_sign(rampart_context, env) |
| && signature_protection) |
| { |
| rampart_context_set_session_key(rampart_context, env, session_key); |
| }*/ |
| |
| /*Create a list to store EncDataIds. This will be used in building the ReferenceList*/ |
| |
| id_list = axutil_array_list_create(env, 5); |
| |
| /*Repeat until all encryption parts are encrypted*/ |
| for(i=0 ; i < axutil_array_list_size(nodes_to_encrypt, env); i++) |
| { |
| axiom_node_t *node_to_enc = NULL; |
| axiom_node_t *parent_of_node_to_enc = NULL; |
| axiom_node_t *enc_data_node = NULL; |
| oxs_ctx_t *enc_ctx = NULL; |
| axis2_char_t *id = NULL; |
| axis2_status_t enc_status = AXIS2_FAILURE; |
| |
| /*Get the node to be encrypted*/ |
| node_to_enc = (axiom_node_t *)axutil_array_list_get |
| (nodes_to_encrypt, env, i); |
| if(!node_to_enc) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot get the node from the list to encrypt"); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| /*Create the encryption context for OMXMLSEC*/ |
| enc_ctx = oxs_ctx_create(env); |
| /*Set the key*/ |
| oxs_ctx_set_key(enc_ctx, env, session_key); |
| /*Set the algorithm*/ |
| oxs_ctx_set_enc_mtd_algorithm(enc_ctx, env, enc_sym_algo); |
| /*Create an empty EncryptedDataNode*/ |
| parent_of_node_to_enc = axiom_node_get_parent(node_to_enc, env); |
| id = oxs_util_generate_id(env, (axis2_char_t*)OXS_ENCDATA_ID); |
| |
| if(parent_of_node_to_enc || id) |
| { |
| axis2_char_t *enc_type = OXS_TYPE_ENC_ELEMENT; |
| |
| if(body_child_node == node_to_enc) |
| { |
| /* we have to use #Content for body encryption */ |
| enc_type = OXS_TYPE_ENC_CONTENT; |
| } |
| |
| enc_data_node = oxs_token_build_encrypted_data_element(env, |
| parent_of_node_to_enc, enc_type, id ); |
| enc_status = oxs_xml_enc_encrypt_node(env, enc_ctx, |
| node_to_enc, &enc_data_node, NULL); |
| axutil_array_list_add(id_list, env, id); |
| if(AXIS2_FAILURE == enc_status) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Cannot encrypt the node " ); |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| return AXIS2_FAILURE; |
| } |
| } |
| oxs_ctx_free(enc_ctx, env); |
| enc_ctx = NULL; |
| |
| }/*Eof For loop*/ |
| |
| /*free nodes_to_encrypt list*/ |
| axutil_array_list_free(nodes_to_encrypt, env); |
| nodes_to_encrypt = NULL; |
| |
| /*We need to encrypt the session key.*/ |
| status = rampart_enc_encrypt_session_key(env, session_key, msg_ctx, rampart_context, sec_node, id_list); |
| if(AXIS2_FAILURE == status){ |
| return AXIS2_FAILURE; |
| } |
| /*Free id_list*/ |
| if(id_list) |
| { |
| int size = 0; |
| int j = 0; |
| size = axutil_array_list_size(id_list, env); |
| for (j = 0; j < size; j++) |
| { |
| axis2_char_t *id = NULL; |
| |
| id = axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id); |
| id = NULL; |
| } |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| } |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_enc_add_key_info( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node) |
| { |
| |
| axis2_char_t *key_id = NULL; |
| axiom_node_t *key_info_node = NULL; |
| axiom_node_t *str_node = NULL; |
| axiom_node_t *reference_node = NULL; |
| |
| axiom_node_t *encrypted_data_node = NULL; |
| axiom_node_t *encrypted_key_node = NULL; |
| axiom_node_t *body_node = NULL; |
| axiom_soap_body_t *body = NULL; |
| |
| axiom_element_t *body_ele = NULL; |
| axiom_element_t *encrypted_data_ele = NULL; |
| |
| encrypted_key_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(!encrypted_key_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, EncryptedKey Not found"); |
| return AXIS2_FAILURE; |
| } |
| |
| key_id = oxs_util_generate_id(env, (axis2_char_t*)OXS_ENCKEY_ID); |
| |
| if(key_id) |
| { |
| oxs_axiom_add_attribute(env, encrypted_key_node, NULL/*OXS_WSU*/, |
| NULL/*RAMPART_WSU_XMLNS*/, OXS_ATTR_ID, key_id); |
| } |
| |
| body = axiom_soap_envelope_get_body(soap_envelope, env); |
| body_node = axiom_soap_body_get_base_node(body, env); |
| |
| body_ele = (axiom_element_t *) |
| axiom_node_get_data_element(body_node, env); |
| |
| encrypted_data_ele = axiom_util_get_first_child_element_with_localname( |
| body_ele, env, body_node, OXS_NODE_ENCRYPTED_DATA, &encrypted_data_node); |
| |
| if(encrypted_data_ele) |
| { |
| key_info_node = oxs_token_build_key_info_element( |
| env, encrypted_data_node); |
| if(key_info_node) |
| { |
| str_node = oxs_token_build_security_token_reference_element( |
| env, key_info_node); |
| if(str_node) |
| { |
| axis2_char_t *key_id_ref = NULL; |
| key_id_ref = axutil_stracat(env, OXS_LOCAL_REFERENCE_PREFIX,key_id); |
| reference_node = oxs_token_build_reference_element( |
| env, str_node, key_id_ref, NULL); |
| AXIS2_FREE(env->allocator, key_id_ref); |
| key_id_ref = NULL; |
| AXIS2_FREE(env->allocator, key_id); |
| key_id = NULL; |
| |
| if(!reference_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Reference Node build failed"); |
| return AXIS2_FAILURE; |
| } |
| else |
| { |
| return AXIS2_SUCCESS; |
| } |
| } |
| else{ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Cannot build the STR node"); |
| AXIS2_FREE(env->allocator, key_id); |
| key_id = NULL; |
| return AXIS2_FAILURE; |
| } |
| } |
| else{ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Encrypting signature, cannot build the key indfo node"); |
| AXIS2_FREE(env->allocator, key_id); |
| key_id = NULL; |
| return AXIS2_FAILURE; |
| } |
| } |
| else{ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Cannot get the encryption data element"); |
| AXIS2_FREE(env->allocator, key_id); |
| key_id = NULL; |
| return AXIS2_FAILURE; |
| } |
| } |
| |
| |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| rampart_enc_encrypt_signature( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx, |
| rampart_context_t *rampart_context, |
| axiom_soap_envelope_t *soap_envelope, |
| axiom_node_t *sec_node) |
| { |
| |
| oxs_key_t *session_key = NULL; |
| oxs_key_t *derived_key = NULL; |
| axiom_node_t *node_to_enc = NULL; |
| axiom_node_t *enc_data_node = NULL; |
| oxs_ctx_t *enc_ctx = NULL; |
| axis2_char_t *id = NULL; |
| axis2_status_t enc_status = AXIS2_FAILURE; |
| axis2_char_t *enc_sym_algo = NULL; |
| axutil_array_list_t *id_list = NULL; |
| axiom_node_t *encrypted_key_node = NULL; |
| axiom_node_t *temp_node = NULL; |
| axiom_node_t *node_to_move = NULL; |
| axis2_bool_t use_derived_keys = AXIS2_TRUE; |
| axis2_char_t *derived_key_version = NULL; |
| axis2_bool_t server_side = AXIS2_FALSE; |
| rp_property_t *token = NULL; |
| rp_property_type_t token_type; |
| axis2_status_t status = AXIS2_FAILURE; |
| axiom_node_t *key_reference_node = NULL; |
| axiom_node_t *key_reference_for_encrypted_data = NULL; |
| rampart_saml_token_t *saml = NULL; |
| |
| session_key = rampart_context_get_encryption_session_key(rampart_context, env); |
| |
| if(!session_key) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting Signature.Session key not found"); |
| return AXIS2_FAILURE; |
| } |
| /*Get <ds:Signature> node*/ |
| node_to_enc = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_SIGNATURE); |
| |
| if(!node_to_enc) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting Signature. Signature node not found"); |
| return AXIS2_FAILURE; |
| } |
| |
| server_side = axis2_msg_ctx_get_server_side(msg_ctx, env); |
| token = rampart_context_get_token(rampart_context, env, AXIS2_TRUE, server_side, AXIS2_FALSE); |
| token_type = rp_property_get_type(token, env); |
| |
| if(token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) |
| { |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| /*set the AttachedReference to key_reference_node*/ |
| key_reference_node = sct_provider_get_attached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| else |
| { |
| /*get the unattachedReference and set to key_reference_node*/ |
| key_reference_node = sct_provider_get_unattached_reference(env, token, AXIS2_TRUE, rampart_context, msg_ctx); |
| } |
| } |
| else if(token_type == RP_PROPERTY_SAML_TOKEN) |
| { |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_ENCRYPTION_TOKEN); |
| if (!saml) |
| { |
| saml = rampart_context_get_saml_token(rampart_context, env, RAMPART_ST_TYPE_PROTECTION_TOKEN); |
| } |
| if (!saml) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] SAML not set."); |
| return AXIS2_FAILURE; |
| } |
| if(rampart_context_is_token_include(rampart_context, |
| token, token_type, server_side, AXIS2_FALSE, env)) |
| { |
| /*set the AttachedReference to key_reference_node*/ |
| key_reference_node = rampart_saml_token_get_str(saml, env); |
| } |
| else |
| { |
| /*get the unattachedReference and set to key_reference_node*/ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] SAML not set."); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| if((server_side) && (rampart_context_get_binding_type(rampart_context,env) == RP_PROPERTY_SYMMETRIC_BINDING)) |
| { |
| axis2_char_t *encrypted_key_hash = NULL; |
| axiom_node_t *identifier_token = NULL; |
| encrypted_key_hash = oxs_key_get_key_sha(session_key, env); |
| key_reference_node = oxs_token_build_security_token_reference_element(env, NULL); |
| identifier_token = oxs_token_build_key_identifier_element(env, key_reference_node, |
| OXS_ENCODING_BASE64BINARY, OXS_X509_ENCRYPTED_KEY_SHA1, encrypted_key_hash); |
| } |
| else |
| { |
| encrypted_key_node = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_ENCRYPTED_KEY); |
| if(!encrypted_key_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, EncryptedKey Not found"); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| |
| enc_ctx = oxs_ctx_create(env); |
| |
| /*We need to take the decision whether to use derived keys or not*/ |
| use_derived_keys = rampart_context_check_is_derived_keys (env, token); |
| derived_key_version = rampart_context_get_derived_key_version(env, token); |
| if(AXIS2_TRUE == use_derived_keys) |
| { |
| /*Derive a new key*/ |
| derived_key = oxs_key_create(env); |
| oxs_key_set_length(derived_key, env, rampart_context_get_encryption_derived_key_len(rampart_context, env)); |
| status = oxs_derivation_derive_key(env, session_key, derived_key, AXIS2_TRUE); |
| |
| /*Set the derived key for the encryption*/ |
| oxs_ctx_set_key(enc_ctx, env, derived_key); |
| |
| /*Set the ref key name to build KeyInfo element. Here the key name is the derived key id*/ |
| oxs_ctx_set_ref_key_name(enc_ctx, env, oxs_key_get_name(derived_key, env)); |
| } |
| else |
| { |
| /*No Key derivation is needed we will proceed with the same session key*/ |
| oxs_ctx_set_key(enc_ctx, env, session_key); |
| key_reference_for_encrypted_data = key_reference_node; |
| } |
| enc_sym_algo = rampart_context_get_enc_sym_algo(rampart_context, env); |
| oxs_ctx_set_enc_mtd_algorithm(enc_ctx, env, enc_sym_algo); |
| id = oxs_util_generate_id(env, (axis2_char_t*)OXS_ENCDATA_ID); |
| |
| /*Manage the reference list*/ |
| id_list = axutil_array_list_create(env, 0); |
| axutil_array_list_add(id_list, env, id); |
| if((rampart_context_get_binding_type(rampart_context,env)) == RP_PROPERTY_ASYMMETRIC_BINDING) |
| { |
| /*We append IDs to the EncryptedKey node*/ |
| axiom_node_t *ref_list_node = NULL; |
| ref_list_node = oxs_token_build_data_reference_list( |
| env, encrypted_key_node, id_list); |
| if(!ref_list_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][rampart_encryption]Asym Encrypting signature," |
| "Building reference list failed"); |
| return AXIS2_FAILURE; |
| } |
| } |
| else if((rampart_context_get_binding_type(rampart_context,env)) == RP_PROPERTY_SYMMETRIC_BINDING) |
| { |
| if((AXIS2_TRUE == use_derived_keys) || (token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) || (server_side) || |
| (token_type == RP_PROPERTY_SAML_TOKEN)) |
| { |
| /*We need to create a new reference list and then attach it before the EncryptedData(signature)*/ |
| axiom_node_t *ref_list_node = NULL; |
| |
| ref_list_node = oxs_token_build_data_reference_list(env, sec_node, id_list); |
| if(!ref_list_node) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][rampart_encryption]Sym Encrypting signature," |
| "Building reference list failed"); |
| return AXIS2_FAILURE; |
| } |
| } |
| else |
| { |
| /*The session key is in use. Add a ref to the EncryptedKey's ref list*/ |
| axiom_node_t *ref_list_node = NULL; |
| ref_list_node = oxs_axiom_get_first_child_node_by_name( |
| env, encrypted_key_node, OXS_NODE_REFERENCE_LIST, OXS_ENC_NS, NULL); |
| if(ref_list_node) |
| { |
| /*There is a ref list node in EncryptedKey. So append*/ |
| axiom_node_t *data_ref_node = NULL; |
| axis2_char_t *mod_id = NULL; |
| |
| /*We need to prepend # to the id in the list to create the reference*/ |
| mod_id = axutil_stracat(env, OXS_LOCAL_REFERENCE_PREFIX,id); |
| data_ref_node = oxs_token_build_data_reference_element(env, ref_list_node, mod_id); |
| |
| } |
| else |
| { |
| /*There is NO ref list node in EncryptedKey. So create a new one */ |
| ref_list_node = oxs_token_build_data_reference_list(env, encrypted_key_node, id_list); |
| } |
| } |
| } |
| else |
| { |
| /*Nothing to do*/ |
| } |
| |
| /*Encrypt the signature*/ |
| enc_data_node = oxs_token_build_encrypted_data_element( |
| env, sec_node, OXS_TYPE_ENC_ELEMENT, id ); |
| enc_status = oxs_xml_enc_encrypt_node( |
| env, enc_ctx, node_to_enc, &enc_data_node, key_reference_for_encrypted_data); |
| |
| /*FREE*/ |
| oxs_ctx_free(enc_ctx, env); |
| enc_ctx = NULL; |
| |
| if(enc_status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption] Encrypting node failed"); |
| return AXIS2_FAILURE; |
| } |
| /*If we have used a derrived key, we need to attach it to the Securuty Header*/ |
| if(AXIS2_TRUE == use_derived_keys) |
| { |
| if((token_type == RP_PROPERTY_SECURITY_CONTEXT_TOKEN) || token_type == RP_PROPERTY_SAML_TOKEN || |
| (server_side && (rampart_context_get_binding_type(rampart_context,env) == RP_PROPERTY_SYMMETRIC_BINDING))) |
| { |
| oxs_derivation_build_derived_key_token_with_stre(env, derived_key, sec_node, key_reference_node, derived_key_version); |
| } |
| else |
| { |
| axis2_char_t *asym_key_id = NULL; |
| asym_key_id = oxs_axiom_get_attribute_value_of_node_by_name(env, encrypted_key_node, OXS_ATTR_ID, NULL); |
| oxs_derivation_build_derived_key_token(env, derived_key, sec_node, asym_key_id, OXS_WSS_11_VALUE_TYPE_ENCRYPTED_KEY, derived_key_version); |
| } |
| /*now we can free the derived key*/ |
| oxs_key_free(derived_key, env); |
| derived_key = NULL; |
| } |
| |
| node_to_move = oxs_axiom_get_node_by_local_name( |
| env, sec_node, OXS_NODE_REFERENCE_LIST); |
| |
| if(node_to_move) |
| { |
| temp_node = axiom_node_detach(node_to_move, env); |
| if(temp_node) |
| { |
| enc_status = axiom_node_insert_sibling_after( |
| enc_data_node, env, temp_node); |
| if(enc_status != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart][rampart_encryption]Encrypting signature, Node moving failed."); |
| return AXIS2_FAILURE; |
| } |
| } |
| } |
| |
| |
| if(id_list) |
| { |
| /*Need to free data of the list*/ |
| int size = 0; |
| int j = 0; |
| size = axutil_array_list_size(id_list, env); |
| for (j = 0; j < size; j++) |
| { |
| axis2_char_t *id_temp = NULL; |
| id_temp = axutil_array_list_get(id_list, env, j); |
| AXIS2_FREE(env->allocator, id_temp); |
| id_temp = NULL; |
| } |
| |
| axutil_array_list_free(id_list, env); |
| id_list = NULL; |
| } |
| return AXIS2_SUCCESS; |
| } |
