[
https://issues.apache.org/jira/browse/RAMPART-461?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130825#comment-18130825
]
Andreas Martens commented on RAMPART-461:
-----------------------------------------
[https://github.com/apache/axis-axis2-java-rampart/pull/27] opened.
Built cleanly on my machine, but I needed to make some changes to the base
master first because I'm using Semeru Java:
* Update WS-WSS4J to latest, to get Kerberos fixes
* {*}{{RampartTest.java}}{*}: Added {{serviceClient.cleanupTransport()}} after
each invocation in the {{sc-}} Secure Conversation loop to cleanly reset TLS
connections and avoid broken pipe socket errors.
* {*}{{SymmetricBindingBuilder.java}}{*}: In {{{}setupEncryptedKey{}}},
generated symmetric keys dynamically using the algorithm from the policy's
configured algorithm suite (e.g. 256-bit for {{{}Basic256{}}}) rather than
hardcoding {{{}AES_128{}}}, resolving the decryption {{BadPaddingException}} in
Sample 09.
I'll submit a separate PR for these
> Can't validate cert used for encryption that's not present in
> keystore/truststore
> ---------------------------------------------------------------------------------
>
> Key: RAMPART-461
> URL: https://issues.apache.org/jira/browse/RAMPART-461
> Project: Rampart
> Issue Type: Bug
> Components: rampart-core
> Affects Versions: 2.0.0
> Reporter: Andreas Martens
> Priority: Major
>
> When the client performs encryption and places its cert in the message, WSS4J
> accepts it because the cert is signed by a CA in the truststore, but Rampart
> isn't.
> AI writeup:
>
> {{org.apache.rampart.PolicyBasedResultsValidator.isCertificateInKeyStore(Crypto,
> X509Certificate)}} assumes {{Crypto.getX509Certificates(CryptoType)}}
> returns {{null}} when no certificate matches:
> {{X509Certificate[] foundCerts = new X509Certificate[0];try { foundCerts =
> crypto.getX509Certificates(cryptoType); // ISSUER_SERIAL lookup} catch
> (WSSecurityException e) \{ ... }if (foundCerts != null && foundCerts[0] !=
> null && foundCerts[0].equals(cert)) { ... return true;}return false;}}
>
> WSS4J 2.x and later return an empty array, never {{{}null{}}}, when nothing
> matches. For example, {{Merlin.getX509Certificates(String issuer, BigInteger
> serial)}} ends with {{{}return new X509Certificate[0]{}}}. The check
> {{foundCerts != null}} passes, then {{foundCerts[0]}} throws
> {{{}ArrayIndexOutOfBoundsException{}}}.
> The method is documented as "directly copied from WSS4J
> (SignatureTrustValidator)". WSS4J's own versions of this check include the
> length guard: {{{}foundCerts != null && foundCerts.length > 0 &&
> foundCerts[0] != null && foundCerts[0].equals(...){}}}, for example in
> {{Merlin}} and {{{}CertificateStore{}}}.
> *Impact:* The failure only happens when the message signer's certificate is
> trusted through its issuing CA and is not itself in the keystore or
> truststore. That is the normal PKI deployment. Any inbound message signed by
> such a certificate fails with an AIOOBE, whereas the expected behaviour is to
> fall through to the issuer-chain check in {{isCertificateTrusted}} (steps 2
> and 3). This hides the bug from deployments that pin the client certificate.
> *Steps to reproduce:*
> # Truststore contains only the CA certificates (root and intermediate). The
> signer's end-entity certificate is in neither the keystore nor the truststore.
> # Client signs the request with {{AsymmetricBinding}} and an {{X509Token}}
> whose {{IncludeToken}} includes the cert as a {{{}BinarySecurityToken{}}}.
> The client's certificate is issued by the intermediate CA.
> # The server runs {{RampartReceiver}} with the default
> {{{}PolicyBasedResultsValidator{}}}.
> # WSS4J's {{SignatureTrustValidator}} accepts the signature, because the
> certificate path verifies to the intermediate CA.
> # Rampart's {{PolicyBasedResultsValidator.validate}} then calls
> {{{}verifyTrust{}}}, which calls {{{}isCertificateTrusted{}}}, which calls
> {{{}isCertificateInKeyStore{}}}.
> *Actual:*
> {{java.lang.ArrayIndexOutOfBoundsException: Array index out of range: 0 at
> org.apache.rampart.PolicyBasedResultsValidator.isCertificateInKeyStore(PolicyBasedResultsValidator.java:934)
> at
> org.apache.rampart.PolicyBasedResultsValidator.isCertificateTrusted(PolicyBasedResultsValidator.java:833)
> at
> org.apache.rampart.PolicyBasedResultsValidator.verifyTrust(PolicyBasedResultsValidator.java:791)
> at
> org.apache.rampart.PolicyBasedResultsValidator.validate(PolicyBasedResultsValidator.java:196)
> at org.apache.rampart.RampartEngine.process(RampartEngine.java:408)}}
>
> *Expected:* {{isCertificateInKeyStore}} returns {{false}} when no certificate
> matches, and {{isCertificateTrusted}} continues to the issuer lookup and path
> validation.
> *Proposed fix:* add {{foundCerts.length > 0 &&}} to the condition.
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
