diff options
Diffstat (limited to 'spss')
15 files changed, 429 insertions, 195 deletions
diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component index 8d9b0c1c1..0929e364c 100644 --- a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component +++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component @@ -1,8 +1,8 @@ <?xml version="1.0" encoding="UTF-8"?>
-<project-modules id="moduleCoreId" project-version="1.5.0">
+<project-modules id="moduleCoreId" project-version="2.0">
<wb-module deploy-name="moa-spss-handbook-referencedData">
<property name="context-root" value="moa-spss-handbook-referencedData"/>
<wb-resource deploy-path="/" source-path="src/main/webapp"/>
<property name="java-output-path" value="/target/classes"/>
</wb-module>
-</project-modules>
+</project-modules>
\ No newline at end of file diff --git a/spss/server/serverlib/.settings/org.eclipse.wst.common.component b/spss/server/serverlib/.settings/org.eclipse.wst.common.component index feb12899a..ee24ef8ba 100644 --- a/spss/server/serverlib/.settings/org.eclipse.wst.common.component +++ b/spss/server/serverlib/.settings/org.eclipse.wst.common.component @@ -1,10 +1,6 @@ -<?xml version="1.0" encoding="UTF-8"?>
-<project-modules id="moduleCoreId" project-version="1.5.0">
+<?xml version="1.0" encoding="UTF-8"?><project-modules id="moduleCoreId" project-version="1.5.0">
<wb-module deploy-name="moa-spss-lib">
<wb-resource deploy-path="/" source-path="src/main/java"/>
<wb-resource deploy-path="/" source-path="src/main/resources"/>
- <wb-resource deploy-path="/" source-path="/src/test/java"/>
- <wb-resource deploy-path="/" source-path="/src/main/java"/>
- <wb-resource deploy-path="/" source-path="/src/main/resources"/>
</wb-module>
</project-modules>
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index 09f496c74..e335139aa 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -101,6 +101,10 @@ public class ConfigurationPartsBuilder { ROOT + CONF + "SignatureCreation/" + CONF + "XMLDSig/" + CONF + "DigestMethodAlgorithm"; + private static final String XADES_VERSION_XPATH = + ROOT + CONF + "SignatureCreation/" + + CONF + "XAdES/" + + CONF + "Version"; private static final String C14N_ALGORITHM_XPATH = ROOT + CONF + "SignatureCreation/" + CONF + "XMLDSig/" @@ -115,6 +119,13 @@ public class ConfigurationPartsBuilder { ROOT + CONF + "Common/" + CONF + "PermitExternalUris/" + CONF + "BlackListUri"; + private static final String FORBID_EXTERNAL_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "ForbidExternalUris"; + private static final String WHITE_LIST_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "ForbidExternalUris/" + + CONF + "WhiteListUri"; private static final String HARDWARE_KEY_XPATH = ROOT + CONF + "SignatureCreation/" @@ -263,15 +274,19 @@ public class ConfigurationPartsBuilder { /** The accepted digest method algorithm URIs, as an array */ private static final String[] ACCEPTED_DIGEST_ALGORITHMS_ARRAY = - { Constants.SHA1_URI }; + { Constants.SHA1_URI, + Constants.SHA256_URI, + Constants.SHA384_URI, + Constants.SHA512_URI}; /** The accepted digest method algorithm URIs, as a Set */ private static final Set ACCEPTED_DIGEST_ALGORITHMS = new HashSet(Arrays.asList(ACCEPTED_DIGEST_ALGORITHMS_ARRAY)); - + + /** Default digest algorithm URI, if none/illegal has been configured */ private static final String DIGEST_ALGORITHM_DEFAULT = Constants.SHA1_URI; - + /** The root element of the MOA configuration */ private Element configElem; @@ -333,7 +348,7 @@ public class ConfigurationPartsBuilder { public String getDigestMethodAlgorithmName() { String digestMethod = getElementValue(getConfigElem(), DIGEST_METHOD_XPATH, null); - + if (digestMethod == null || !ACCEPTED_DIGEST_ALGORITHMS.contains(digestMethod)) { info( @@ -344,7 +359,20 @@ public class ConfigurationPartsBuilder { return digestMethod; } - + + /** + * Returns the digest method algorithm name. + * + * @return The digest method algorithm name from the configuration. + */ + public String getXAdESVersion() + { + String xadesVersion = getElementValue(getConfigElem(), XADES_VERSION_XPATH, null); + + return xadesVersion; + } + + /** * Returns the canonicalization algorithm name. * @@ -409,6 +437,7 @@ public class ConfigurationPartsBuilder { } } + /** * * @return @@ -448,10 +477,12 @@ public class ConfigurationPartsBuilder { array[1] = port; blacklist.add(array); - } + } + // set blacklist for iaik-moa ExternalReferenceChecker.setBlacklist(blackListIaikMoa); + if(blacklist.isEmpty()) // no blacklisted uris given info("config.36", null); @@ -459,7 +490,64 @@ public class ConfigurationPartsBuilder { return blacklist; } + + /** + * + * @return + */ + public List buildForbidExternalUris() { + + //info("config.47", null); + + List whitelist = new ArrayList(); + List whiteListIaikMoa = new ArrayList(); + + NodeIterator forbidExtIter = XPathUtils.selectNodeIterator( + getConfigElem(), + WHITE_LIST_URIS_XPATH); + + Element permitExtElem = null; + while ((permitExtElem = (Element) forbidExtIter.nextNode()) != null) { + String host = getElementValue(permitExtElem, CONF + "IP", null); + String port = getElementValue(permitExtElem, CONF + "Port", null); + + // TODO WhiteListeEntry +// WhiteListEntry entry =null; + if (port == null) { +// entry = new WhiteListEntry(host, -1); + info("config.49", new Object[]{host}); + } + else { +// entry = new WhiteListEntry(host, new Integer(port).intValue()); + info("config.49", new Object[]{host + ":" + port}); + } +// +// // add entry to iaik-moa whitelist +// whiteListIaikMoa.add(entry); + + + String array[] = new String[2]; + array[0] = host; + array[1] = port; + whitelist.add(array); + + } + + + // set whitelist for iaik-moa + // TODO +// ExternalReferenceChecker.setWhitelist(whiteListIaikMoa); + + + if(whitelist.isEmpty()) // no whitelisted uris given + info("config.48", null); + + + return whitelist; + } + + /** * Build the configured hardware keys. * @@ -573,9 +661,10 @@ public class ConfigurationPartsBuilder { while ((keyGroupElem = (Element) kgIter.nextNode()) != null) { String keyGroupId = getElementValue(keyGroupElem, CONF + "Id", null); + String keyGroupDigestMethodAlgorithm = getElementValue(keyGroupElem, CONF + "DigestMethodAlgorithm", null); Set keyGroupEntries = buildKeyGroupEntries(keyGroupId, keyModuleIds, keyGroupElem); - KeyGroup keyGroup = new KeyGroup(keyGroupId, keyGroupEntries); + KeyGroup keyGroup = new KeyGroup(keyGroupId, keyGroupEntries, keyGroupDigestMethodAlgorithm); if (keyGroups.containsKey(keyGroupId)) { diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java index 25fa0d6ad..b40a6bfa5 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java @@ -99,7 +99,10 @@ public class ConfigurationProvider /** The default canonicalization algorithm name */ private String canonicalizationAlgorithmName; - + + /** The XAdES version used for signature creation */ + private String xadesVersion; + /** * A <code>List</code> of <code>HardwareCryptoModule</code> objects for * configuring hardware modules. @@ -252,6 +255,11 @@ public class ConfigurationProvider private List blackListedUris_; /** + * A <code>List</code> of white listed URIs (host and port) + */ + private List whiteListedUris_; + + /** * A <code>TSLConfiguration</code> that represents the global TSL configuration */ private TSLConfiguration tslconfiguration_; @@ -351,6 +359,8 @@ public class ConfigurationProvider keyGroups = builder.buildKeyGroups(allKeyModules); keyGroupMappings = builder.buildKeyGroupMappings(keyGroups, ANONYMOUS_ISSUER_SERIAL); + + xadesVersion = builder.getXAdESVersion(); defaultChainingMode = builder.getDefaultChainingMode(); chainingModes = builder.buildChainingModes(); useAuthorityInfoAccess_ = builder.getUseAuthorityInfoAccess(); @@ -382,11 +392,14 @@ public class ConfigurationProvider allowExternalUris_= builder.allowExternalUris(); - if (allowExternalUris_) + if (allowExternalUris_) { blackListedUris_ = builder.buildPermitExternalUris(); + whiteListedUris_ = null; + } else { info("config.35", null); blackListedUris_ = null; + whiteListedUris_ = builder.buildForbidExternalUris(); } @@ -457,6 +470,16 @@ public class ConfigurationProvider return digestMethodAlgorithmName; } + /** + * Return the XAdES version used for signature creation. + * + * @return The XAdES version used for signature creation, or an empty <code>String</code>, + * if none has been configured. + */ + public String getXAdESVersion() { + return xadesVersion; + } + public boolean getAllowExternalUris() { return this.allowExternalUris_; } @@ -464,6 +487,9 @@ public class ConfigurationProvider public List getBlackListedUris() { return this.blackListedUris_; } + public List getWhiteListedUris() { + return this.whiteListedUris_; + } /** * Return the name of the canonicalization algorithm used during signature @@ -515,6 +541,11 @@ public class ConfigurationProvider public Map getKeyGroups() { return keyGroups; } + + public KeyGroup getKeyGroup(String keyGroupId) { + KeyGroup keyGroup = (KeyGroup) keyGroups.get(keyGroupId); + return keyGroup; + } /** * Return the set of <code>KeyGroupEntry</code>s of a given key group, which a diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java index 22ed8ae83..c2490f9a3 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java @@ -40,16 +40,20 @@ public class KeyGroup { private Set keyGroupEntries; /** The key group ID. */ private String id; + /** The digest method algorithm for the key group */ + private String digestMethodAlgorithm; /** * Create a <code>KeyGroup</code>. * * @param id The ID of this <code>KeyGroup</code>. * @param keyGroupEntries The keys belonging to this <code>KeyGroup</code>. + * @param digestMethodAlgorithm The signature algorithm used for this key group */ - public KeyGroup(String id, Set keyGroupEntries) { + public KeyGroup(String id, Set keyGroupEntries, String digestMethodAlgorithm) { this.id = id; this.keyGroupEntries = keyGroupEntries; + this.digestMethodAlgorithm = digestMethodAlgorithm; } /** @@ -60,6 +64,14 @@ public class KeyGroup { public Set getKeyGroupEntries() { return keyGroupEntries; } + + /** + * Returnd the digest method algorithm used for this key group + * @return The digest method signature algorithm used for this key group + */ + public String getDigestMethodAlgorithm() { + return digestMethodAlgorithm; + } /** * Return the ID of this <code>KeyGroup</code>. @@ -87,7 +99,7 @@ public class KeyGroup { sb.append(" " + i.next()); } } - return "(KeyGroup - ID:" + id + " " + sb.toString() + ")"; + return "(KeyGroup - ID:" + id + " " + sb.toString() + ")" + "DigestMethodAlgorithm: " + digestMethodAlgorithm; } } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java index 9b5dce883..479f0aac9 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java @@ -24,9 +24,6 @@ package at.gv.egovernment.moa.spss.server.iaik.xmlsign; -import java.util.List; -import java.util.Set; - import iaik.server.modules.algorithms.SignatureAlgorithms; import iaik.server.modules.keys.AlgorithmUnavailableException; import iaik.server.modules.keys.KeyEntryID; @@ -37,6 +34,10 @@ import iaik.server.modules.xml.Canonicalization; import iaik.server.modules.xmlsign.XMLSignatureCreationProfile; import iaik.server.modules.xmlsign.XMLSignatureInsertionLocation; +import java.util.List; +import java.util.Set; + +import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.server.transaction.TransactionContext; import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager; @@ -75,7 +76,10 @@ public class XMLSignatureCreationProfileImpl private IdGenerator dsigManifestIDGenerator; /** The ID generator for signed property IDs. */ private IdGenerator propertyIDGenerator; - + /** The selected digest method algorithm if XAdES 1.4.2 is used */ + private String digestMethodXAdES142; + + /** * Create a new <code>XMLSignatureCreationProfileImpl</code>. * @@ -86,7 +90,8 @@ public class XMLSignatureCreationProfileImpl */ public XMLSignatureCreationProfileImpl( int createProfileCount, - Set reservedIDs) { + Set reservedIDs, + String digestMethodXAdES142) { signatureIDGenerator = new IdGenerator("signature-" + createProfileCount, reservedIDs); manifestIDGenerator = @@ -95,6 +100,7 @@ public class XMLSignatureCreationProfileImpl new IdGenerator("dsig-manifest-" + createProfileCount, reservedIDs); propertyIDGenerator = new IdGenerator("etsi-signed-" + createProfileCount, reservedIDs); + this.digestMethodXAdES142 = digestMethodXAdES142; } /** @@ -168,27 +174,127 @@ public class XMLSignatureCreationProfileImpl e, null); } - - if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) // TODO retournierten Algorithmus abhängig von der Schlüssellänge machen (bei längeren Schlüsseln SHA256 statt SHA1) - || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { - - return SignatureAlgorithms.SHA1_WITH_RSA; - } else if ( - algorithms.contains(SignatureAlgorithms.ECDSA)) { - return SignatureAlgorithms.ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { - return SignatureAlgorithms.DSA; - } else { - throw new AlgorithmUnavailableException( - "No algorithm for key entry: " + selectedKeyID, - null, - null); + + if (digestMethodXAdES142 == null) { + // XAdES 1.4.2 not enabled - legacy MOA + if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { + + return SignatureAlgorithms.SHA1_WITH_RSA; + } else if ( + algorithms.contains(SignatureAlgorithms.ECDSA)) { + return SignatureAlgorithms.ECDSA; + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } + else { + // XAdES 1.4.2 is enabled: select signature algorithm according to selected digest method + if (digestMethodXAdES142.compareTo("SHA-1") == 0) { + Logger.warn("XAdES version 1.4.2 is enabled, but SHA-1 is configured as digest algorithm. Please revise a use a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)"); + if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) //? + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) //? + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA_OLD) //? + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_RSA)) { //? + + return SignatureAlgorithms.SHA1_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.ECDSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA_PLAIN) + || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.ECDSA; + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-256") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { + + return SignatureAlgorithms.SHA256_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA_PLAIN) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA256_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-384") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_RSA)) { + + return SignatureAlgorithms.SHA384_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA384_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-512") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_RSA)) { + + return SignatureAlgorithms.SHA512_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA512_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } + else { + throw new AlgorithmUnavailableException( + "No signature algorithm found for digest algorithm '" + digestMethodXAdES142, + null, + null); + } + } + + } /** diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java index 5c4a2c76a..d1281c1f1 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java @@ -56,6 +56,7 @@ import at.gv.egovernment.moa.spss.api.xmlsign.CreateXMLSignatureRequest; import at.gv.egovernment.moa.spss.api.xmlsign.DataObjectInfo; import at.gv.egovernment.moa.spss.api.xmlsign.SingleSignatureInfo; import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider; +import at.gv.egovernment.moa.spss.server.config.KeyGroup; import at.gv.egovernment.moa.spss.server.config.KeyGroupEntry; import at.gv.egovernment.moa.spss.server.iaik.xml.CanonicalizationImpl; import at.gv.egovernment.moa.spss.server.iaik.xmlsign.DataObjectTreatmentImpl; @@ -83,6 +84,9 @@ public class XMLSignatureCreationProfileFactory { static { HASH_ALGORITHM_MAPPING = new HashMap(); HASH_ALGORITHM_MAPPING.put(Constants.SHA1_URI, HashAlgorithms.SHA1); + HASH_ALGORITHM_MAPPING.put(Constants.SHA256_URI, HashAlgorithms.SHA256); + HASH_ALGORITHM_MAPPING.put(Constants.SHA384_URI, HashAlgorithms.SHA384); + HASH_ALGORITHM_MAPPING.put(Constants.SHA512_URI, HashAlgorithms.SHA512); } /** The <code>CreateXMLSignatureRequest</code> for which to create the @@ -129,18 +133,62 @@ public class XMLSignatureCreationProfileFactory { HashSet allReservedIDs = new HashSet(reserved); allReservedIDs.addAll(sigInfoReservedIDs); - XMLSignatureCreationProfileImpl profile = - new XMLSignatureCreationProfileImpl(createProfileCount, allReservedIDs); TransactionContext context = TransactionContextManager.getInstance().getTransactionContext(); ConfigurationProvider config = context.getConfiguration(); CanonicalizationImpl canonicalization; List dataObjectTreatmentList; - String keyGroupID; Set keySet; List transformationSupplements; List createTransformsProfiles; + // get the key group id + String keyGroupID = request.getKeyIdentifier(); + // get digest method on key group level (if configured) + String configDigestMethodKG = config.getKeyGroup(keyGroupID).getDigestMethodAlgorithm(); + // get default digest method (if configured) + String configDigestMethod = config.getDigestMethodAlgorithmName(); + + String xadesVersion = config.getXAdESVersion(); + + String digestMethodXAdES142 = null; + boolean isXAdES142 = false; + // if XAdES Version 1.4.2 is configured + if (xadesVersion != null && xadesVersion.compareTo("1.4.2") == 0) { + isXAdES142 = true; + Logger.debug("XAdES version '" + xadesVersion + "' used"); + } + + if (isXAdES142) { + if (configDigestMethodKG != null) { + // if KG specific digest method is configured + digestMethodXAdES142 = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethodKG); + if (digestMethodXAdES142 == null) { + error( + "config.17", + new Object[] { configDigestMethodKG}); + throw new MOASystemException("2900", null); + } + Logger.debug("Digest algorithm: " + digestMethodXAdES142 + "(configured in KeyGroup)"); + } + else { + // else get default configured digest method + digestMethodXAdES142 = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethod); + if (digestMethodXAdES142 == null) { + error( + "config.17", + new Object[] { configDigestMethod}); + throw new MOASystemException("2900", null); + } + Logger.debug("Digest algorithm: " + digestMethodXAdES142 + "(default)"); + + } + } + + XMLSignatureCreationProfileImpl profile = + new XMLSignatureCreationProfileImpl(createProfileCount, allReservedIDs, digestMethodXAdES142); + + // build the transformation supplements createTransformsProfiles = getCreateTransformsInfoProfiles(singleSignatureInfo); @@ -153,11 +201,11 @@ public class XMLSignatureCreationProfileFactory { singleSignatureInfo, createTransformsProfiles, transformationSupplements, - allReservedIDs); + allReservedIDs, + digestMethodXAdES142); profile.setDataObjectTreatmentList(dataObjectTreatmentList); // set the key set - keyGroupID = request.getKeyIdentifier(); keySet = buildKeySet(keyGroupID); if (keySet == null) { throw new MOAApplicationException("2231", null); @@ -184,7 +232,7 @@ public class XMLSignatureCreationProfileFactory { canonicalization = new CanonicalizationImpl(config.getCanonicalizationAlgorithmName()); profile.setSignedInfoCanonicalization(canonicalization); - + // set the signed properties profile.setSignedProperties(Collections.EMPTY_LIST); @@ -299,7 +347,8 @@ public class XMLSignatureCreationProfileFactory { SingleSignatureInfo singleSignatureInfo, List createTransformsInfoProfiles, List transformationSupplements, - Set reservedIDs) + Set reservedIDs, + String digestMethodXAdES142) throws MOASystemException, MOAApplicationException { TransactionContext context = @@ -329,15 +378,25 @@ public class XMLSignatureCreationProfileFactory { treatment.setTransformationList(buildTransformationList(profile)); treatment.setReferenceInManifest(dataObjInfo.isChildOfManifest()); - hashAlgorithmName = - (String) HASH_ALGORITHM_MAPPING.get( - config.getDigestMethodAlgorithmName()); - if (hashAlgorithmName == null) { - error( - "config.17", - new Object[] { config.getDigestMethodAlgorithmName()}); - throw new MOASystemException("2900", null); + // if XAdES version is 1.4.2 + if (digestMethodXAdES142 != null) { + // use configured digest algorithm + hashAlgorithmName = digestMethodXAdES142; + } + else { + // stay as it is + hashAlgorithmName = (String) HASH_ALGORITHM_MAPPING.get( + config.getDigestMethodAlgorithmName()); + if (hashAlgorithmName == null) { + error( + "config.17", + new Object[] { config.getDigestMethodAlgorithmName()}); + throw new MOASystemException("2900", null); + } } + + + treatment.setHashAlgorithmName(hashAlgorithmName); treatment.setIncludedInSignature( diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java index dafb89f16..219bb7cdf 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java @@ -26,12 +26,14 @@ public class ExternalURIVerifier { boolean allowExternalUris = config.getAllowExternalUris();
List blacklist = config.getBlackListedUris();
+ List whitelist = config.getWhiteListedUris();
InetAddress hostInetAddress = InetAddress.getByName(host);
String ip = hostInetAddress.getHostAddress();
if (allowExternalUris) {
+ // external URIs are allowed - check blacklist
Iterator it = blacklist.iterator();
while (it.hasNext()) {
String[] array = (String[])it.next();
@@ -55,9 +57,46 @@ public class ExternalURIVerifier { }
}
}
- else {
- Logger.debug(new LogMsg("No external URIs allowed (" + host + ")"));
- throw new MOAApplicationException("4001", new Object[]{host});
+ else {
+ // external uris are forbidden - check whitelist
+ Iterator it = whitelist.iterator();
+ boolean allowed = false;
+ while (it.hasNext()) {
+ String[] array = (String[])it.next();
+ String bhost = array[0];
+ String bport = array[1];
+ if (bport == null || port == -1) {
+ // check only host
+ if (ip.startsWith(bhost)) {
+ Logger.debug(new LogMsg("Whitelist check: " + host + " (" + ip + ") whitelisted"));
+ allowed = true;
+ //throw new MOAApplicationException("4002", new Object[]{host + "(" + ip + ")"});
+ }
+ }
+ else {
+ // check host and port
+ int iport = new Integer(bport).intValue();
+ if (ip.startsWith(bhost) && (iport == port)) {
+ Logger.debug(new LogMsg("Whitelist check: " + host + ":" + port + " (" + ip + ":" + port + " whitelisted"));
+ //throw new MOAApplicationException("4002", new Object[]{host + ":" + port + " (" + ip + ":" + port + ")"});
+ allowed = true;
+ }
+
+ }
+ }
+
+ if (!allowed) {
+ if (port != -1) {
+ Logger.debug(new LogMsg("No external URIs allowed (" + host + ")"));
+ throw new MOAApplicationException("4001", new Object[]{host + "(" + ip + ")"});
+ }
+ else {
+ Logger.debug(new LogMsg("No external URIs allowed (" + host + ":" + port + ")"));
+ throw new MOAApplicationException("4001", new Object[]{host + ":" + port + " (" + ip + ":" + port + ")"});
+ }
+
+ }
+
}
Logger.debug(new LogMsg("URI allowed: " + ip + ":" + port));
diff --git a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties index 645ff9f6d..5919cebbc 100644 --- a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties +++ b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties @@ -89,7 +89,7 @@ 3202=Supplement für Signaturumgebung kann nicht geladen werden (Reference="{0}", LocRef-URI="{1}")
3203=Signaturumgebung kann nicht geladen werden (Reference="{0}", LocRef-URI="{1}")
-4001=Externe URI {0} darf nicht geladen werden (externe URIs generell verboten)
+4001=Externe URI {0} darf nicht geladen werden (externe sind URIs verboten und URI befindet sich nicht auf der Whitelist)
4002=Externe URI {0} befindet sich auf der Blacklist und darf nicht geladen werden
4003=IP-Adresse für {0} konnte nicht ermitteln werden
@@ -142,7 +142,7 @@ config.31=Fehler in der Konfiguration der KeyGroup mit id={0}: Der Schlüssel im config.32=Fehler in der Konfiguration: Verzeichnisangabe für den Zertifikatsspeicher ist ungültig ({0}).
config.33=External URIs are allowed. Maybe a URI blacklist exists.
config.34=Blacklisted URI: {0}.
-config.35=External URIs not allowed.
+config.35=External URIs not allowed. Maybe a URI whitelist exists.
config.36=No blacklisted URIs given.
config.37=Fehler beim Erstellen der TSL Konfiguration: Name des TSL Arbeits-Verzeichnisses konnte nicht in eine URL umgewandet werden (Wert="{0}")
config.38=Fehler beim Erstellen der TSL Konfiguration: Das TSL Arbeits-Verzeichnis ist kein Verzeichnis (Wert="{0}")
@@ -154,6 +154,8 @@ config.43=Update truststore with id "{0}" config.44=Retrieve certificates from TSL
config.45=Create store updater
config.46=Start periodical TSL update task at {0} and then every {1} milliseconds
+config.48=No whitelisted URIs given.
+config.49=Whitelisted URI: {0}.
handler.00=Starte neue Transaktion: TID={0}, Service={1}
handler.01=Aufruf von Adresse={0}
diff --git a/spss/server/serverws/.classpath b/spss/server/serverws/.classpath index 330efc0e1..767a2a2de 100644 --- a/spss/server/serverws/.classpath +++ b/spss/server/serverws/.classpath @@ -1,120 +1,25 @@ <?xml version="1.0" encoding="UTF-8"?>
<classpath>
- <classpathentry kind="var" path="M2_REPO/javax/activation/activation/1.1/activation-1.1.jar">
+ <classpathentry kind="src" output="target/classes" path="src/main/java">
<attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/javax/mail/mail/1.4/mail-1.4.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.5"/>
- <classpathentry kind="src" path="/moa-spss-lib"/>
- <classpathentry kind="var" path="M2_REPO/axis/axis/1.0_IAIK/axis-1.0_IAIK.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/org/apache/axis/axis-jaxrpc/1.4/axis-jaxrpc-1.4.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/org/apache/axis/axis-saaj/1.4/axis-saaj-1.4.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/axis/axis-wsdl4j/1.5.1/axis-wsdl4j-1.5.1.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/commons-discovery/commons-discovery/0.2/commons-discovery-0.2.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/commons-logging/commons-logging/1.0.4/commons-logging-1.0.4.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/log4j/log4j/1.2.14/log4j-1.2.14.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/postgresql/postgresql/7.2/postgresql-7.2.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
+ <attribute name="optional" value="true"/>
+ <attribute name="maven.pomderived" value="true"/>
</attributes>
</classpathentry>
- <classpathentry kind="var" path="M2_REPO/xalan-bin-dist/xalan/2.7.0/xalan-2.7.0.jar">
+ <classpathentry kind="src" output="target/test-classes" path="src/test/java">
<attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
+ <attribute name="optional" value="true"/>
+ <attribute name="maven.pomderived" value="true"/>
</attributes>
</classpathentry>
- <classpathentry kind="var" path="M2_REPO/xerces/xercesImpl/2.7.1/xercesImpl-2.7.1.jar">
+ <classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.5">
<attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/xalan-bin-dist/xml-apis/2.7.0/xml-apis-2.7.0.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/xalan-bin-dist/serializer/2.7.0/serializer-2.7.0.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_moa/1.32/iaik_moa-1.32.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_ixsil/1.2.2.5/iaik_ixsil-1.2.2.5.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_jce_full/4.0_MOA/iaik_jce_full-4.0_MOA.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_ecc/2.19/iaik_ecc-2.19.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_cms/4.1_MOA/iaik_cms-4.1_MOA.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_Pkcs11Provider/1.2.4/iaik_Pkcs11Provider-1.2.4.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="var" path="M2_REPO/iaik/prod/iaik_Pkcs11Wrapper/1.2.17/iaik_Pkcs11Wrapper-1.2.17.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
- </attributes>
- </classpathentry>
- <classpathentry kind="src" path="/moa-common"/>
- <classpathentry kind="var" path="M2_REPO/jaxen/jaxen/1.0-FCS/jaxen-1.0-FCS.jar">
- <attributes>
- <attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
+ <attribute name="maven.pomderived" value="true"/>
</attributes>
</classpathentry>
- <classpathentry kind="var" path="M2_REPO/saxpath/saxpath/1.0-FCS/saxpath-1.0-FCS.jar">
+ <classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
<attributes>
+ <attribute name="maven.pomderived" value="true"/>
<attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
</attributes>
</classpathentry>
diff --git a/spss/server/serverws/.project b/spss/server/serverws/.project index ddf2e7061..fa2286335 100644 --- a/spss/server/serverws/.project +++ b/spss/server/serverws/.project @@ -5,15 +5,6 @@ <projects>
<project>moa-spss-lib</project>
<project>moa-common</project>
- <project>moa-spss-tools</project>
- <project>MOA</project>
- <project>TestTimerTask</project>
- <project>moa-spss-handbook-apiClient</project>
- <project>stork-saml-engine</project>
- <project>moa-spss</project>
- <project>spss</project>
- <project>moa-spss-handbook-webserviceClient</project>
- <project>moa-id-lib</project>
</projects>
<buildSpec>
<buildCommand>
@@ -32,12 +23,12 @@ </arguments>
</buildCommand>
<buildCommand>
- <name>org.eclipse.m2e.core.maven2Builder</name>
+ <name>org.maven.ide.eclipse.maven2Builder</name>
<arguments>
</arguments>
</buildCommand>
<buildCommand>
- <name>org.maven.ide.eclipse.maven2Builder</name>
+ <name>org.eclipse.m2e.core.maven2Builder</name>
<arguments>
</arguments>
</buildCommand>
diff --git a/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs b/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs index 0e32dbb18..cbb750c06 100644 --- a/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs +++ b/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs @@ -1,8 +1,12 @@ -#Thu Dec 27 15:45:22 CET 2012
+eclipse.preferences.version=1
+org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
+org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
+org.eclipse.jdt.core.compiler.compliance=1.5
+org.eclipse.jdt.core.compiler.debug.lineNumber=generate
+org.eclipse.jdt.core.compiler.debug.localVariable=generate
+org.eclipse.jdt.core.compiler.debug.sourceFile=generate
+org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
-eclipse.preferences.version=1
org.eclipse.jdt.core.compiler.source=1.5
-org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/spss/server/serverws/.settings/org.eclipse.wst.common.component b/spss/server/serverws/.settings/org.eclipse.wst.common.component index b8a1c3877..c325a5007 100644 --- a/spss/server/serverws/.settings/org.eclipse.wst.common.component +++ b/spss/server/serverws/.settings/org.eclipse.wst.common.component @@ -1,14 +1,14 @@ -<?xml version="1.0" encoding="UTF-8"?>
-<project-modules id="moduleCoreId" project-version="1.5.0">
+<?xml version="1.0" encoding="UTF-8"?><project-modules id="moduleCoreId" project-version="1.5.0">
<wb-module deploy-name="moa-spss-ws">
- <wb-resource deploy-path="/" source-path="/src/main/webapp"/>
- <dependent-module deploy-path="/WEB-INF/lib" handle="module:/resource/moa-spss-lib/moa-spss-lib">
+ <dependent-module archiveName="moa-spss-lib-1.5.2.jar" deploy-path="/WEB-INF/lib" handle="module:/resource/moa-spss-lib/moa-spss-lib">
<dependency-type>uses</dependency-type>
</dependent-module>
- <dependent-module deploy-path="/WEB-INF/lib" handle="module:/resource/moa-common/moa-common">
+ <dependent-module archiveName="moa-common-1.5.2.jar" deploy-path="/WEB-INF/lib" handle="module:/resource/moa-common/moa-common">
<dependency-type>uses</dependency-type>
</dependent-module>
- <property name="context-root" value="moa-spss-ws"/>
+ <wb-resource deploy-path="/" source-path="/target/m2e-wtp/web-resources"/>
+ <wb-resource deploy-path="/" source-path="/src/main/webapp" tag="defaultRootSource"/>
<property name="java-output-path" value="/target/classes"/>
+ <property name="context-root" value="moa-spss"/>
</wb-module>
</project-modules>
diff --git a/spss/server/serverws/.settings/org.eclipse.wst.common.project.facet.core.xml b/spss/server/serverws/.settings/org.eclipse.wst.common.project.facet.core.xml index 564572b10..ac59587b0 100644 --- a/spss/server/serverws/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/spss/server/serverws/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ <faceted-project>
<fixed facet="jst.java"/>
<fixed facet="jst.web"/>
- <installed facet="jst.web" version="2.4"/>
<installed facet="jst.java" version="5.0"/>
-</faceted-project>
\ No newline at end of file + <installed facet="jst.web" version="2.3"/>
+</faceted-project>
diff --git a/spss/server/tools/.project b/spss/server/tools/.project index ca7797d46..21f65b370 100644 --- a/spss/server/tools/.project +++ b/spss/server/tools/.project @@ -11,14 +11,14 @@ <name>org.eclipse.jdt.core.javabuilder</name>
</buildCommand>
<buildCommand>
- <name>org.eclipse.m2e.core.maven2Builder</name>
- </buildCommand>
- <buildCommand>
<name>org.eclipse.wst.validation.validationbuilder</name>
</buildCommand>
<buildCommand>
<name>org.maven.ide.eclipse.maven2Builder</name>
</buildCommand>
+ <buildCommand>
+ <name>org.eclipse.m2e.core.maven2Builder</name>
+ </buildCommand>
</buildSpec>
<natures>
<nature>org.eclipse.m2e.core.maven2Nature</nature>
|