davsclaus commented on code in PR #28769:
URL: https://github.com/apache/camel/pull/28769#discussion_r4444565735
##########
components/camel-as2/camel-as2-api/src/main/java/org/apache/camel/component/as2/api/util/MicUtils.java:
##########
@@ -112,6 +122,91 @@ public static ReceivedContentMic createReceivedContentMic(
}
}
+ /**
+ * Finds the correct content to compute the MIC over, per RFC 5402.
+ * <p>
+ * For compress-before-sign, the MIC must cover the compressed entity
(what was signed). For sign-before-compress or
+ * no compression, the MIC covers the EDI payload. For a signed message
the content is the signed part exactly as
+ * received.
+ */
+ private static byte[] findMicContent(
+ ClassicHttpRequest request, Certificate[]
validateSigningCertificateChain, PrivateKey decryptingPrivateKey)
+ throws HttpException {
+
+ EntityParser.parseAS2MessageEntity(request);
+
+ String contentTypeString = HttpMessageUtils.getHeaderValue(request,
AS2Header.CONTENT_TYPE);
+ if (contentTypeString == null) {
+ throw new HttpException("Failed to create MIC: content type
missing from request");
+ }
+ ContentType contentType = ContentType.parse(contentTypeString);
+
+ // Navigate the message structure to find the multipart/signed entity
+ MultipartSignedEntity multipartSignedEntity =
findMultipartSignedEntity(request, contentType, decryptingPrivateKey);
+ if (multipartSignedEntity != null) {
+ try {
+ byte[] signedContent =
multipartSignedEntity.getSignedDataContent();
+ if (signedContent != null) {
+ return signedContent;
+ }
+ } catch (IOException e) {
+ throw new HttpException("Failed to create MIC: cannot read the
signed content", e);
+ }
+ }
+
+ // No multipart/signed found, fall back to extracting the EDI payload
+ return
EntityUtils.getContent(HttpMessageUtils.extractEdiPayload(request,
+ new
HttpMessageUtils.DecrpytingAndSigningInfo(validateSigningCertificateChain,
decryptingPrivateKey)));
+ }
+
+ /**
+ * Navigate the entity hierarchy to find the multipart/signed entity,
whose signed part (part 0, as received) is
+ * what the MIC is computed over. Returns null if no multipart/signed is
found.
+ */
+ private static MultipartSignedEntity findMultipartSignedEntity(
+ ClassicHttpRequest request, ContentType contentType, PrivateKey
decryptingPrivateKey)
+ throws HttpException {
+
+ String mimeType = contentType.getMimeType().toLowerCase();
+
+ if (AS2MimeType.MULTIPART_SIGNED.equals(mimeType)) {
+ // Top-level signed
+ return HttpMessageUtils.getEntity(request,
MultipartSignedEntity.class);
+ } else if (AS2MimeType.APPLICATION_PKCS7_MIME.equals(mimeType)) {
+ String smimeType = contentType.getParameter("smime-type");
+ if ("compressed-data".equals(smimeType)) {
+ // Sign-before-compress: decompress first, then find the
signed entity inside
Review Comment:
This branch is CAMEL-23065's sign-before-compress handling (fix version
4.19.0), not part of #28749. Before this PR, 4.18.x computed the MIC over
`extractEdiPayload(...)`. It looks correct to me, and `new
ZlibExpanderProvider()` without a bound matches what `HttpMessageUtils` already
does on 4.18.x (CAMEL-24431 is 4.23+ only). But it changes the MDN MIC for
compressed, signed messages on 4.18.6, so please mention it in the PR
description and the 4.18 upgrade note, and add 4.18.6 to CAMEL-23065's fix
versions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
