Author: coheigea
Date: Mon Nov 25 15:34:41 2013
New Revision: 1545323
URL: http://svn.apache.org/r1545323
Log:
[WSS-430] - SecurityPolicy validation support for encrypted/signed attachments
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcer.java
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcerFactory.java
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/EncryptedPartsAssertionState.java
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/OnlySignEntireHeadersAndBodyAssertionState.java
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignedPartsAssertionState.java
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/VulnerabliltyVectorsTest.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/DecryptInputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/WSSSignatureReferenceVerifyInputProcessor.java
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcer.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcer.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcer.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcer.java
Mon Nov 25 15:34:41 2013
@@ -126,12 +126,14 @@ public class PolicyEnforcer implements S
private boolean operationSecurityEventOccured = false;
private boolean initiator;
private String actorOrRole;
+ private int attachmentCount;
public PolicyEnforcer(List<OperationPolicy> operationPolicies, String
soapAction, boolean initiator,
- String actorOrRole) throws WSSPolicyException {
+ String actorOrRole, int attachmentCount) throws
WSSPolicyException {
this.operationPolicies = operationPolicies;
this.initiator = initiator;
this.actorOrRole = actorOrRole;
+ this.attachmentCount = attachmentCount;
assertionStateMap = new LinkedList<Map<SecurityEventConstants.Event,
Map<Assertion, List<Assertable>>>>();
failedAssertionStateMap = new
LinkedList<Map<SecurityEventConstants.Event, Map<Assertion,
List<Assertable>>>>();
@@ -260,14 +262,14 @@ public class PolicyEnforcer implements S
assertableList.add(new
ContentEncryptedElementsAssertionState(abstractSecurityAssertion, true));
} else if (abstractSecurityAssertion instanceof EncryptedParts) {
//initialized with asserted=true with the same reason as by the
EncryptedParts above
- assertableList.add(new
EncryptedPartsAssertionState(abstractSecurityAssertion, true));
+ assertableList.add(new
EncryptedPartsAssertionState(abstractSecurityAssertion, true, attachmentCount));
} else if (abstractSecurityAssertion instanceof EncryptedElements) {
//initialized with asserted=true with the same reason as by the
EncryptedParts above
assertableList.add(new
EncryptedElementsAssertionState(abstractSecurityAssertion, true));
} else if (abstractSecurityAssertion instanceof SignedParts) {
//initialized with asserted=true because it could be that parent
elements are signed and therefore these element are also signed
//the test if it is really signed is done via the
PolicyInputProcessor which emits SignedElementEvents for unsigned elements with
the unsigned flag
- assertableList.add(new
SignedPartsAssertionState(abstractSecurityAssertion, true));
+ assertableList.add(new
SignedPartsAssertionState(abstractSecurityAssertion, true, attachmentCount));
} else if (abstractSecurityAssertion instanceof SignedElements) {
//initialized with asserted=true with the same reason as by the
SignedParts above
assertableList.add(new
SignedElementsAssertionState(abstractSecurityAssertion, true));
@@ -514,7 +516,7 @@ public class PolicyEnforcer implements S
doAssert = true;
}
- if (!assertable.isAsserted() && (doAssert ||
assertable.isHardFailure())) {
+ if ((doAssert || assertable.isHardFailure()) &&
!assertable.isAsserted()) {
assertionMessage = assertable.getErrorMessage();
failedAssertionStateMap.add(map);
assertionStateMapIterator.remove();
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcerFactory.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcerFactory.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcerFactory.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/PolicyEnforcerFactory.java
Mon Nov 25 15:34:41 2013
@@ -421,10 +421,12 @@ public class PolicyEnforcerFactory {
* @param soapAction The requested soapAction of the actual request
* @param initiator Boolean flag to tell the engine if it is running in
client or server mode
* @param roleOrActor The actor or role of the security processing. Must
be set to the same value as WSSSecurityProperties#setActor()
+ * @param attachmentCount The number of Attachments received in the message
* @return the newly created PolicyEnforcer instance
* @throws WSSPolicyException
*/
- public PolicyEnforcer newPolicyEnforcer(String soapAction, boolean
initiator, String roleOrActor) throws WSSPolicyException {
- return new PolicyEnforcer(this.operationPolicies, soapAction,
initiator, roleOrActor);
+ public PolicyEnforcer newPolicyEnforcer(String soapAction, boolean
initiator,
+ String roleOrActor, int
attachmentCount) throws WSSPolicyException {
+ return new PolicyEnforcer(this.operationPolicies, soapAction,
initiator, roleOrActor, attachmentCount);
}
}
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/EncryptedPartsAssertionState.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/EncryptedPartsAssertionState.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/EncryptedPartsAssertionState.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/EncryptedPartsAssertionState.java
Mon Nov 25 15:34:41 2013
@@ -32,6 +32,7 @@ import org.apache.wss4j.stax.securityEve
import org.apache.wss4j.stax.securityEvent.WSSecurityEventConstants;
import javax.xml.namespace.QName;
+
import java.util.LinkedList;
import java.util.List;
@@ -39,9 +40,15 @@ import java.util.List;
* WSP1.3, 4.2.1 EncryptedParts Assertion
*/
public class EncryptedPartsAssertionState extends AssertionState implements
Assertable {
+
+ private int attachmentCount;
+ private int encryptedAttachmentCount;
+ private boolean encryptedAttachmentRequired;
- public EncryptedPartsAssertionState(AbstractSecurityAssertion assertion,
boolean asserted) {
+ public EncryptedPartsAssertionState(
+ AbstractSecurityAssertion assertion, boolean asserted, int
attachmentCount) {
super(assertion, asserted);
+ this.attachmentCount = attachmentCount;
}
@Override
@@ -54,10 +61,17 @@ public class EncryptedPartsAssertionStat
@Override
public boolean assertEvent(SecurityEvent securityEvent) throws
WSSPolicyException {
- //todo attachments
-
EncryptedPartSecurityEvent encryptedPartSecurityEvent =
(EncryptedPartSecurityEvent) securityEvent;
EncryptedParts encryptedParts = (EncryptedParts) getAssertion();
+
+ if (encryptedParts.getAttachments() != null) {
+ encryptedAttachmentRequired = true;
+ if (encryptedPartSecurityEvent.isAttachment()) {
+ encryptedAttachmentCount++;
+ setAsserted(true);
+ return true;
+ }
+ }
//we'll never get events with the exact body path but child elements
so we can just check if we are in the body
if (encryptedParts.isBody() &&
WSSUtils.isInSOAPBody(encryptedPartSecurityEvent.getElementPath())) {
@@ -94,4 +108,12 @@ public class EncryptedPartsAssertionStat
//if we return false here other encrypted elements will trigger a
PolicyViolationException
return true;
}
+
+ @Override
+ public boolean isAsserted() {
+ if (encryptedAttachmentRequired && encryptedAttachmentCount <
attachmentCount) {
+ return false;
+ }
+ return super.isAsserted();
+ }
}
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/OnlySignEntireHeadersAndBodyAssertionState.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/OnlySignEntireHeadersAndBodyAssertionState.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/OnlySignEntireHeadersAndBodyAssertionState.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/OnlySignEntireHeadersAndBodyAssertionState.java
Mon Nov 25 15:34:41 2013
@@ -54,7 +54,7 @@ public class OnlySignEntireHeadersAndBod
@Override
public boolean assertEvent(SecurityEvent securityEvent) throws
WSSPolicyException {
AbstractSecuredElementSecurityEvent
abstractSecuredElementSecurityEvent = (AbstractSecuredElementSecurityEvent)
securityEvent;
- if (abstractSecuredElementSecurityEvent.isSigned()) {
+ if (abstractSecuredElementSecurityEvent.isSigned() &&
!abstractSecuredElementSecurityEvent.isAttachment()) {
List<QName> elementPath =
abstractSecuredElementSecurityEvent.getElementPath();
if (elementPath.size() == 4 &&
WSSUtils.isInSecurityHeader(abstractSecuredElementSecurityEvent.getXmlSecEvent(),
elementPath, roleOrActor)) {
setAsserted(true);
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignedPartsAssertionState.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignedPartsAssertionState.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignedPartsAssertionState.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignedPartsAssertionState.java
Mon Nov 25 15:34:41 2013
@@ -32,6 +32,7 @@ import org.apache.wss4j.stax.securityEve
import org.apache.wss4j.stax.securityEvent.WSSecurityEventConstants;
import javax.xml.namespace.QName;
+
import java.util.LinkedList;
import java.util.List;
@@ -39,9 +40,16 @@ import java.util.List;
* WSP1.3, 4.1.1 SignedParts Assertion
*/
public class SignedPartsAssertionState extends AssertionState implements
Assertable {
-
- public SignedPartsAssertionState(AbstractSecurityAssertion assertion,
boolean asserted) {
+
+ private int attachmentCount;
+ private int signedAttachmentCount;
+ private boolean signedAttachmentRequired;
+
+ public SignedPartsAssertionState(
+ AbstractSecurityAssertion assertion, boolean asserted, int
attachmentCount
+ ) {
super(assertion, asserted);
+ this.attachmentCount = attachmentCount;
}
@Override
@@ -54,10 +62,17 @@ public class SignedPartsAssertionState e
@Override
public boolean assertEvent(SecurityEvent securityEvent) throws
WSSPolicyException {
- //todo attachments
-
SignedPartSecurityEvent signedPartSecurityEvent =
(SignedPartSecurityEvent) securityEvent;
SignedParts signedParts = (SignedParts) getAssertion();
+
+ if (signedParts.getAttachments() != null) {
+ signedAttachmentRequired = true;
+ if (signedPartSecurityEvent.isAttachment()) {
+ signedAttachmentCount++;
+ setAsserted(true);
+ return true;
+ }
+ }
if (signedParts.isBody()
&& WSSUtils.pathMatches(WSSConstants.SOAP_11_BODY_PATH,
signedPartSecurityEvent.getElementPath(), true, false)) {
@@ -105,4 +120,12 @@ public class SignedPartsAssertionState e
//if we return false here other signed elements will trigger a
PolicyViolationException
return true;
}
+
+ @Override
+ public boolean isAsserted() {
+ if (signedAttachmentRequired && signedAttachmentCount <
attachmentCount) {
+ return false;
+ }
+ return super.isAsserted();
+ }
}
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
Mon Nov 25 15:34:41 2013
@@ -99,7 +99,7 @@ public class AbstractPolicyTestBase exte
element.appendChild(policyNode);
}
PolicyEnforcerFactory policyEnforcerFactory =
PolicyEnforcerFactory.newInstance(document, customAssertionBuilders);
- PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("", false, null);
+ PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("", false, null, 0);
return policyEnforcer;
}
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/VulnerabliltyVectorsTest.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/VulnerabliltyVectorsTest.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/VulnerabliltyVectorsTest.java
(original)
+++
webservices/wss4j/trunk/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/VulnerabliltyVectorsTest.java
Mon Nov 25 15:34:41 2013
@@ -75,7 +75,7 @@ public class VulnerabliltyVectorsTest ex
inSecurityProperties.loadDecryptionKeystore(this.getClass().getClassLoader().getResource("receiver.jks"),
"default".toCharArray());
PolicyEnforcerFactory policyEnforcerFactory =
PolicyEnforcerFactory.newInstance(this.getClass().getClassLoader().getResource("testdata/wsdl/actionSpoofing.wsdl"));
- PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("emptyPolicy", false, null);
+ PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("emptyPolicy", false, null, 0);
inSecurityProperties.addInputProcessor(new
PolicyInputProcessor(policyEnforcer, inSecurityProperties));
try {
@@ -127,7 +127,7 @@ public class VulnerabliltyVectorsTest ex
inSecurityProperties.loadDecryptionKeystore(this.getClass().getClassLoader().getResource("receiver.jks"),
"default".toCharArray());
PolicyEnforcerFactory policyEnforcerFactory =
PolicyEnforcerFactory.newInstance(this.getClass().getClassLoader().getResource("testdata/wsdl/actionSpoofing.wsdl"));
- PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("goodPolicy", false, null);
+ PolicyEnforcer policyEnforcer =
policyEnforcerFactory.newPolicyEnforcer("goodPolicy", false, null, 0);
inSecurityProperties.addInputProcessor(new
PolicyInputProcessor(policyEnforcer, inSecurityProperties));
try {
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/DecryptInputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/DecryptInputProcessor.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/DecryptInputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/DecryptInputProcessor.java
Mon Nov 25 15:34:41 2013
@@ -339,6 +339,14 @@ public class DecryptInputProcessor exten
} catch (Exception e) {
throw new
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY, e);
}
+
+ // Create a security event for this encrypted Attachment
+ final DocumentContext documentContext =
inputProcessorChain.getDocumentContext();
+ EncryptedPartSecurityEvent encryptedPartSecurityEvent =
+ new EncryptedPartSecurityEvent(inboundSecurityToken, true,
documentContext.getProtectionOrder());
+ encryptedPartSecurityEvent.setAttachment(true);
+
encryptedPartSecurityEvent.setCorrelationID(encryptedDataType.getId());
+
inputProcessorChain.getSecurityContext().registerSecurityEvent(encryptedPartSecurityEvent);
}
}
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/WSSSignatureReferenceVerifyInputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/WSSSignatureReferenceVerifyInputProcessor.java?rev=1545323&r1=1545322&r2=1545323&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/WSSSignatureReferenceVerifyInputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/WSSSignatureReferenceVerifyInputProcessor.java
Mon Nov 25 15:34:41 2013
@@ -89,7 +89,7 @@ public class WSSSignatureReferenceVerify
}
String attachmentId = referenceType.getURI().substring(4);
-
+
AttachmentRequestCallback attachmentRequestCallback = new
AttachmentRequestCallback();
attachmentRequestCallback.setAttachmentId(attachmentId);
try {
@@ -168,6 +168,13 @@ public class WSSSignatureReferenceVerify
WSSecurityException.ErrorCode.INVALID_SECURITY, e);
}
+ // Create a security event for this signed Attachment
+ final DocumentContext documentContext =
inputProcessorChain.getDocumentContext();
+ SignedPartSecurityEvent signedPartSecurityEvent =
+ new SignedPartSecurityEvent(getInboundSecurityToken(), true,
documentContext.getProtectionOrder());
+ signedPartSecurityEvent.setAttachment(true);
+ signedPartSecurityEvent.setCorrelationID(referenceType.getId());
+
inputProcessorChain.getSecurityContext().registerSecurityEvent(signedPartSecurityEvent);
} else {
super.verifyExternalReference(
inputProcessorChain, inputStream, referenceType);
