wss4r 0.5

data/lib/wss4r/security/xml/signature.rb

@@ -0,0 +1,69 @@
+module WSS4R
+module Security
+module Xml
+	
+class Signature
+	def initialize(security_token)
+		@security_token = security_token
+	end
+	
+	def process(document)
+		security = Security.new()
+		security = security.process(document)
+		security_token = @security_token.process(document)
+		children = security.children()
+		#children.each{|child|
+		#	security.delete(child)
+		#}		
+		security.add_element(security_token)
+		signature_element = security.add_element(Names::SIGNATURE)
+		#children.each{|child|
+		#	security.add_element(child)
+		#}
+		signature_element.add_namespace("xmlns:ds", Namespaces::DS)
+		signed_info = SignedInfo.new()
+		signed_info_element = signed_info.process(signature_element)
+		signature_value = SignatureValue.new(@security_token, signed_info_element)
+		signature_value.process(document)
+		key_info = KeyInfo.new(@security_token, KeyInfo::REFERENCE).get_xml(signature_element)
+		document
+	end
+
+	def unprocess(signature)
+		@signature_value = XPath.first(signature, "ds:SignatureValue", {"ds" => Namespaces::DS}).text().gsub("\n","")
+		key_info = XPath.first(signature, "ds:KeyInfo", {"ds" => Namespaces::DS})
+		@key_info = KeyInfo.new(key_info)
+		@signed_info = SignedInfo.new()
+		@signed_info.unprocess(signature.document())
+		@signature = signature
+	end
+	
+	def verify_signature()
+		signed_info = XPath.first(@signature, "ds:SignedInfo", {"ds" => Namespaces::DS})
+		inclusive_namespaces = XPath.first(signed_info, "ds:CanonicalizationMethod/InclusiveNamespaces", {"ds" => Namespaces::DS})
+		prefix_list = inclusive_namespaces.attribute("PrefixList") if (inclusive_namespaces)
+		if (prefix_list)
+			prefix_list = prefix_list.value().split()
+		end
+		transformer = TransformerFactory::get_instance(@signed_info.canonicalizer_method())
+		transformer.prefix_list=(prefix_list)
+		result = transformer.canonicalize_element(signed_info)
+		signature_value = Base64.decode64(@signature_value)#.strip()
+		public_key = @key_info.security_token().certificate().public_key()
+		#TODO: check certificate
+		certificate = @key_info.security_token().certificate()
+		
+		verify = public_key.verify(OpenSSL::Digest::SHA1.new(), signature_value, result)
+		raise FaultError.new(VerificationFault.new()) if !(verify)
+		certitificate = @key_info.security_token().certificate()
+	end
+
+	def verify()
+		@signed_info.verify()
+		verify_signature()
+	end
+end
+
+end #Xml
+end #Security
+end #WSS4R

data/lib/wss4r/security/xml/signature_value.rb

@@ -0,0 +1,26 @@
+module WSS4R
+module Security
+module Xml
+
+class SignatureValue
+	def initialize(security_token, signed_info)
+		@security_token = security_token
+		@signed_info = signed_info
+	end
+		
+	def process(document)
+		canonicalizer = TransformerFactory::get_instance("http://www.w3.org/2001/10/xml-exc-c14n#")
+		#esult = canonicalizer.write_document_node(@signed_info) #Broken
+		result = canonicalizer.canonicalize_element(@signed_info)
+		signature_value = @security_token.sign_b64(result)
+		@signed_info = XPath.first(document, "//ds:SignedInfo", {"ds" => Namespaces::DS})
+		signature_value_element = @signed_info.parent().add_element(Names::SIGNATURE_VALUE)
+		signature_value.strip!
+		signature_value_element.text=(signature_value)
+		@signed_info.document()
+	end
+end
+
+end #Xml
+end #Security
+end #WSS4R

data/lib/wss4r/security/xml/signed_info.rb

@@ -0,0 +1,83 @@
+module WSS4R
+  module Security
+    module Xml
+
+      class SignedInfo
+	attr_accessor :canonicalizer_method, :signature_method
+
+	def initialize()
+          @reference_elements = ReferenceElements.new()
+	end
+	
+	def process(parent)
+          @par = parent
+          body = SOAPParser.part(SOAPParser::BODY)
+          body.add_namespace("xmlns:wsu", Namespaces::WSU)
+          signed_info_element = parent.add_element(Names::SIGNED_INFO)
+          canonicalization_element = signed_info_element.add_element(Names::CANONICALIZATION_METHOD)
+          canonicalization_element.add_attribute("Algorithm", Types::CANON_C14N_EXCL)
+          signature_method_element = signed_info_element.add_element(Names::SIGNATURE_METHOD)
+          signature_method_element.add_attribute("Algorithm", Types::SIG_ALG_RSA_SHA1)
+          @reference_elements.each{|xpath|
+            element = parent.document.select(xpath)
+            wsu_id = nil
+            element.attributes().each_attribute{|attr|
+              wsu_id = attr if (attr.name() == "Id") #attr.prefix() == "wsu" && 
+            }
+            if (wsu_id == nil)
+              wsu_id = REXML::Attribute.new("wsu:Id", element.object_id().to_s())
+              element.add_attribute(wsu_id)
+            end
+            canonicalizer = TransformerFactory::get_instance(nil)
+            c14n_element = canonicalizer.canonicalize_element(element)
+            reference_element = signed_info_element.add_element(Names::REFERENCE_DS)
+            reference_element.add_attribute("URI","#"+wsu_id.value())
+            transforms_element = reference_element.add_element(Names::TRANSFORMS)
+            transform_element = transforms_element.add_element(Names::TRANSFORM)
+            transform_element.add_attribute("Algorithm", Types::CANON_C14N_EXCL)
+            digest_method_element = reference_element.add_element(Names::DIGEST_METHOD)
+            digest_method_element.add_attribute("Algorithm", Types::DIG_METHOD_SHA1)
+            digest_value_element = reference_element.add_element(Names::DIGEST_VALUE)
+			
+            sha = OpenSSL::Digest::SHA1.new(c14n_element)
+            #Bug from Tony Baines
+            digest_value_element.text=(Base64.encode64(sha.digest()))
+          }
+          signed_info_element
+	end
+
+	def unprocess(document)
+          @reference_list = Array.new()
+		
+          signed_info = XPath.first(document, "//ds:SignedInfo", {"ds" => Namespaces::DS})
+		
+          inclusive_namespaces = XPath.first(signed_info, "ds:CanonicalizationMethod/InclusiveNamespaces", {"ds" => Namespaces::DS})
+          prefix_list = inclusive_namespaces.attribute("PrefixList") if (inclusive_namespaces)
+          if (prefix_list)
+            prefix_list = prefix_list.value().split()
+          end
+		
+          canonicalization_method = XPath.first(signed_info, Names::CANONICALIZATION_METHOD)
+          @canonicalization_method = canonicalization_method.attribute("Algorithm").value()
+		
+          signature_method = XPath.first(signed_info, Names::SIGNATURE_METHOD)
+          @signature_method = signature_method.attribute("Algorithm")
+		
+          signed_info.each_element("ds:Reference"){|reference|
+            @reference_list.push(Reference.new(reference, prefix_list))
+          }
+	end
+	
+	def verify()
+          @reference_list.each{|reference|
+            if (reference.verify() == false)
+              fault = SOAP::SOAPFault.new(SOAP::SOAPString.new("wsse:FailedCheck"), SOAP::SOAPString.new("The signature or decryption was invalid."),SOAP::SOAPString.new(self.class().name())) #,"Error verifying reference: " + reference.uri())
+              raise SOAP::FaultError.new(fault)
+            end
+          }
+	end
+      end
+
+    end #Xml
+  end #Security
+end #WSS4R

data/lib/wss4r/security/xml/timestamp.rb

@@ -0,0 +1,47 @@
+module WSS4R
+  module Security
+    module Xml
+
+      class Timestamp
+	
+	def process(security)
+          timestamp = security.add_element(Names::TIMESTAMP)
+          timestamp.add_attribute("wsu:Id", timestamp.object_id().to_s())
+          created = timestamp.add_element(Names::CREATED)
+          expires = timestamp.add_element(Names::EXPIRES)
+
+		
+          #BUG #4400-------------------------------
+          #created_time = Time.new().gmtime()
+          #expired_time = created_time+5*60 #
+          created_time = Time.new().getutc()
+          expired_time = created_time+(60*5)
+		
+          created_time = created_time.iso8601()
+          expired_time = expired_time.iso8601()
+
+          created.text=(created_time.to_s())
+          expires.text=(expired_time.to_s())
+          security
+	end
+	
+	def unprocess(timestamp)
+          created = XPath.first(timestamp, "wsu:Created", {"wsu"=>Namespaces::WSU}).text()
+          expires = XPath.first(timestamp, "wsu:Expires", {"wsu"=>Namespaces::WSU}).text()
+          created_parms = ParseDate::parsedate(created)
+          expires_parms = ParseDate::parsedate(expires)
+          @created_time = Time.gm(created_parms[0], created_parms[1],created_parms[2],created_parms[3], created_parms[4], created_parms[5])
+          @expires_time = Time.gm(expires_parms[0], expires_parms[1],expires_parms[2],expires_parms[3], expires_parms[4], expires_parms[5])
+	end
+	
+	def verify()
+          time = Time.new().gmtime()
+          if !(@created_time <= time && time <= @expires_time)
+            raise WSS4R::Security::Exceptions::TimestampFault.new()
+          end
+	end
+      end
+
+    end #Xml
+  end #Security
+end #WSS4R

data/lib/wss4r/security/xml/tokentypes.rb

@@ -0,0 +1,180 @@
+module WSS4R
+  module Security
+    module Xml
+
+      class SecurityToken
+        def add_namespace(document, prefix, ns)
+          document.root().add_namespace("xmlns:"+prefix, ns)
+        end
+      end
+
+      class BinarySecurityToken < SecurityToken
+      end
+
+      class X509SecurityToken < BinarySecurityToken
+        attr_reader :certificate
+        attr_accessor :private_key
+	
+        def initialize(x509certificate, private_key = nil)
+          if (x509certificate.kind_of?(Certificate))
+            @certificate = x509certificate
+          elsif x509certificate.instance_of?(String)
+            @certificate = Certificate.new(Base64.decode64(x509certificate))
+          end
+          @private_key = private_key
+        end
+   
+        def process(document)
+          e = Element.new(Names::BINARY_SECURITY_TOKEN)
+          e.add_namespace("xmlns:wsu", Namespaces::WSU)
+          der_certificate_string = Base64.encode64(@certificate.to_der())
+          der_certificate_string.delete!("\n\r")
+
+          e.add_text(der_certificate_string)
+          e.add_attribute("wsu:Id", get_id())
+		
+          e.add_attribute("ValueType", Types::REFERENCE_VALUETYPE_X509)
+          e.add_attribute("EncodingType", Types::ENCODING_X509V3)
+          return e
+        end
+   
+        def get_id()
+          unless @id
+            @id = Crypto::CryptHash.new().digest_b64(@certificate.public_key().to_s()+Time.new().to_s()).to_s().strip()
+          end
+          @id
+        end
+
+        def key_identifier()
+          if (@key_identifier == nil)
+            ext = @certificate.extensions()[2]
+            return (Base64.encode64(ext.to_der()[11..30]))
+          else
+            return @key_identifier
+          end
+        end
+
+        def key_identifier=(id)
+          @key_identifier = id
+        end
+	
+        def public_encrypt_b64(text)
+          ciphervalue = @certificate.public_key().public_encrypt(text)
+          return Base64.encode64(ciphervalue)
+        end
+   
+        def private_decrypt_b64(text)
+          @private_key.private_decrypt(Base64.decode64(text.strip()))
+        end
+   
+        def serial_number()
+          @certificate.serial()
+        end
+   
+        def get_issuer_name()
+          @certificate.issuer()
+        end
+   
+        def sign_b64(to_sign)
+          plain_signature = @private_key.sign(OpenSSL::Digest::SHA1.new(), to_sign)
+          signature = Base64.encode64(plain_signature)
+          signature.strip!
+          signature
+        end
+	
+        def public_key()
+          return @certificate.public_key()
+        end
+      end
+
+      class UsernameToken < SecurityToken
+        PLAIN = "PLAIN"
+        HASHED = "HASHED"
+        attr_accessor :username, :password, :type, :nonce, :created, :hash, :type
+	
+        def initialize(username = nil, password = nil, type = HASHED)
+          @username = username
+          @password = password
+          @type = type
+        end
+	
+        def unprocess(usernametoken)
+          @username = XPath.first(usernametoken, "wsse:Username", {"wsse"=>Namespaces::WSSE}).text()
+          @password = XPath.first(usernametoken, "wsse:Password", {"wsse"=>Namespaces::WSSE}).text()
+          password_type = XPath.first(usernametoken, "wsse:Password", {"wsse"=>Namespaces::WSSE}).attribute("Type").value()
+          if password_type == Types::PASSWORD_DIGEST
+            @type = HASHED
+            @nonce    = XPath.first(usernametoken, "wsse:Nonce", {"wsse"=>Namespaces::WSSE}).text()
+            @created  = XPath.first(usernametoken, "wsu:Created", {"wsu"=>Namespaces::WSU}).text()
+          else 
+            @type = PLAIN
+          end
+          @hash = @password
+        end
+	
+        def process(document)
+          wsse_security = XPath.first(document, "/env:Envelope/env:Header/wsse:Security")
+          username_token = wsse_security.add_element("wsse:UsernameToken")
+          username_token.add_namespace("xmlns:wsu", Namespaces::WSU)
+          username_token.add_attribute("wsu:Id", "SecurityToken-" + username_token.object_id().to_s())
+          username = username_token.add_element("wsse:Username")
+          username.text=(@username)
+
+          if @password.nil?
+            # no password provided
+          elsif @type == HASHED
+            password = username_token.add_element("wsse:Password")
+            #BUG #4400
+            #password.add_attribute("Type", Types::PASSWORD_DIGEST)
+            #Solution--------------------------------------------------
+            created = username_token.add_element("wsu:Created")
+            created_time = Time.new.getutc()
+            #created_time = (Time.new()-(60*60*1)).getutc.iso8601()	
+            #----------------------------------------------------------
+            created.text=(created_time)
+
+            password.add_attribute("Type", Types::PASSWORD_DIGEST)
+            nonce = username_token.add_element("wsse:Nonce")
+            nonce_text = OpenSSL::Random.random_bytes(20).to_s().strip()
+            nonce.text=(Base64.encode64(nonce_text))
+            stamp = nonce_text.to_s() + created_time.to_s() + @password.to_s()
+            hash = CryptHash.new().digest_b64(stamp)
+            password.text=(hash.to_s())
+          else
+            password = username_token.add_element("wsse:Password")
+            password.add_attribute("Type", Types::PASSWORD_TEXT)
+            password.text=@password
+          end
+		
+          # BUG #5877 -----------------------------------------------
+          #created_time = (Time.new()-(60*60*1)).iso8601()
+          #created_time = created_time[0..created_time.index("+")]
+          #created_time[-1]="Z"
+          #----------------------------------------------------------
+		
+        end
+      end
+
+    end #Xml
+  end #Security
+end #WSS4R
+
+
+if __FILE__ == $0
+  require "rexml/document"
+  require "pp"
+  require "wss4r/rpc/wssdriver"
+  include REXML
+  document = Document.new(File.new(ARGV[1]))
+  if ARGV[0] == "p"
+    usernametoken = WSS4R::Security::Xml::UsernameToken.new("Ron","noR")
+    usernametoken.process(document)
+    pp(document.to_s())
+  else
+    element = XPath.match(document, "/soap:Envelope/soap:Header/wsse:Security/wsse:UsernameToken")[0]
+    usernametoken = WSS4R::Security::Xml::UsernameToken.new()
+    usernametoken.unprocess(element)
+  end
+end
+	
+	

data/lib/wss4r/server/wssstandaloneserver.rb

@@ -0,0 +1,27 @@
+require "soap/rpc/standaloneServer"
+require "wss4r/security/security"
+require "wss4r/rpc/wssdriver"
+
+include WSS4R::Security
+
+class SOAP::RPC::StandaloneServer
+   def get_soaplet
+      @soaplet
+   end
+end
+
+module WSS4R
+module Server
+
+class WSSStandaloneServer < SOAP::RPC::StandaloneServer
+   def security()
+      security = get_soaplet().app_scope_router().security()
+      if (security == nil) 
+         security = WSS4R::Security::Security.new()
+      end
+      security
+   end
+end
+
+end #Server
+end #WSS4R

data/lib/wss4r/soap/processor.rb

@@ -0,0 +1,92 @@
+require "wss4r/config/config"
+require "wss4r/security/security"
+require "pp"
+
+include WSS4R
+include Security
+
+module SOAP
+  module Header
+    class HandlerSet
+      def on_inbound(headers)
+        headers.each do |name, item|
+          handler = @store.find { |handler|
+            handler.elename == item.element.elename
+          }
+          if handler
+            handler.on_inbound_headeritem(item)
+          elsif item.mustunderstand
+            #raise UnhandledMustUnderstandHeaderError.new(item.element.elename.to_s)
+          end
+        end
+      end
+    end
+  end
+	
+  module Processor
+    class << self
+      public 
+      alias old_marshal marshal
+      alias old_unmarshal unmarshal
+			
+      def security=(s)
+        @@security = s
+      end
+      def security()
+        @@security = WSS4R::Security::Security.new() if (!defined?(@@security))
+        @@security
+      end
+			
+      def config()
+        store = WSS4R::Config::Store.new()
+        config = store.load()
+        if (config != nil)
+          @security = WSS4R::Security::Security.new()
+          config.build_security(@security)
+        end
+      end
+			
+      def marshal(env,opt = {}, io = nil)
+        #config()
+        xml = Processor.old_marshal(env, opt, io)
+
+        security = opt[:security]
+        if (defined?(@@security) && @@security != nil)
+          security = @@security if (@@security)
+        end
+        document = Document.new(xml)
+        if (security != nil)
+          security.process_document_marshal(document)
+        end
+        document.to_s()
+      end
+         
+      def unmarshal(stream, opt = {})
+        #config()
+        security = opt[:security] 
+        if (defined?(@@security) && @@security != nil)
+          security = @@security if (@@security)
+        end
+        doc = Document.new(stream)
+        if (security != nil)
+          SOAPParser::document=(doc)
+          soap_ns = doc.root().prefix()
+          wsseElement = SOAPParser.part(SOAPParser::SECURITY)
+          if (wsseElement != nil)
+            security.process_document_unmarshal(doc)
+            if (wsseElement.parent() != nil)
+              wsseElement.parent().delete_element(wsseElement)
+            end
+          else
+            #TODO: What to do when no security tokens in header?
+            #if security.tokens().size() > 0
+             # raise Exception.new("No security elements received!")
+            #end
+          end
+        end
+        xml = Processor.old_unmarshal(doc.to_s(), opt)
+        xml
+      end
+    end
+  end
+end