Examples with AS4CryptParams com.helger.phase4.crypto.AS4CryptParams used on opensource projects

Example 1 with AS4CryptParams

use of com.helger.phase4.crypto.AS4CryptParams in project phase4 by phax.

the class AS4Encryptor method _encryptMimeMessage.

@Nonnull
private static AS4MimeMessage _encryptMimeMessage(@Nonnull final ESoapVersion eSoapVersion, @Nonnull final Document aDoc, @Nullable final ICommonsList<WSS4JAttachment> aAttachments, @Nonnull final IAS4CryptoFactory aCryptoFactory, final boolean bMustUnderstand, @Nonnull @WillNotClose final AS4ResourceHelper aResHelper, @Nonnull final AS4CryptParams aCryptParams) throws WSSecurityException {
    if (LOGGER.isInfoEnabled())
        LOGGER.info("Now encrypting AS4 MIME message");
    final WSSecHeader aSecHeader = new WSSecHeader(aDoc);
    aSecHeader.insertSecurityHeader();
    final WSSecEncrypt aBuilder = _createEncrypt(aSecHeader, aCryptParams);
    // "cid:Attachments" is a predefined ID
    aBuilder.getParts().add(new WSEncryptionPart(MessageHelperMethods.PREFIX_CID + "Attachments", "Content"));
    WSS4JAttachmentCallbackHandler aAttachmentCallbackHandler = null;
    if (CollectionHelper.isNotEmpty(aAttachments)) {
        aAttachmentCallbackHandler = new WSS4JAttachmentCallbackHandler(aAttachments, aResHelper);
        aBuilder.setAttachmentCallbackHandler(aAttachmentCallbackHandler);
    }
    // Ensure mustUnderstand value
    final Attr aMustUnderstand = aSecHeader.getSecurityHeaderElement().getAttributeNodeNS(eSoapVersion.getNamespaceURI(), "mustUnderstand");
    if (aMustUnderstand != null)
        aMustUnderstand.setValue(eSoapVersion.getMustUnderstandValue(bMustUnderstand));
    // Generate a session key
    final KeyGenerator aKeyGen = KeyUtils.getKeyGenerator(WSS4JConstants.AES_128);
    final SecretKey aSymmetricKey = aKeyGen.generateKey();
    // Main sign and/or encrypt
    final Document aEncryptedDoc = aBuilder.build(aCryptoFactory.getCrypto(), aSymmetricKey);
    // The attachment callback handler contains the encrypted attachments
    // Important: read the attachment stream only once!
    ICommonsList<WSS4JAttachment> aEncryptedAttachments = null;
    if (aAttachmentCallbackHandler != null) {
        aEncryptedAttachments = aAttachmentCallbackHandler.getAllResponseAttachments();
        // MIME Type and CTE must be set for encrypted attachments!
        for (final WSS4JAttachment aAttachment : aEncryptedAttachments) {
            aAttachment.overwriteMimeType(CMimeType.APPLICATION_OCTET_STREAM.getAsString());
            aAttachment.setContentTransferEncoding(EContentTransferEncoding.BINARY);
        }
    }
    // Use the encrypted attachments!
    try {
        return MimeMessageCreator.generateMimeMessage(eSoapVersion, aEncryptedDoc, aEncryptedAttachments);
    } catch (final MessagingException ex) {
        throw new WSSecurityException(ErrorCode.FAILURE, ex, "Failed to generate MIME message");
    }
}

Example 2 with AS4CryptParams

use of com.helger.phase4.crypto.AS4CryptParams in project phase4 by phax.

the class AS4RequestHandler method _createResponseUserMessage.

/**
 * With this method it is possible to send a usermessage back, the method will
 * check if signing is needed and if the message needs to be a mime message.
 *
 * @param aState
 *        The state of the incoming message. Never <code>null</code>.
 * @param eSoapVersion
 *        the SOAP version to use. May not be <code>null</code>
 * @param aResponseUserMsg
 *        the response user message that should be sent
 * @param sMessagingID
 *        ID of the "Messaging" element
 * @param aResponseAttachments
 *        attachments if any that should be added
 * @param aSigningParams
 *        Signing parameters
 * @param aCryptParams
 *        Encryption parameters
 * @throws WSSecurityException
 *         on error
 * @throws MessagingException
 *         on error
 */
@Nonnull
private IAS4ResponseFactory _createResponseUserMessage(@Nonnull final IAS4MessageState aState, @Nonnull final ESoapVersion eSoapVersion, @Nonnull final AS4UserMessage aResponseUserMsg, @Nonnull final ICommonsList<WSS4JAttachment> aResponseAttachments, @Nonnull final AS4SigningParams aSigningParams, @Nonnull final AS4CryptParams aCryptParams) throws WSSecurityException, MessagingException {
    final String sResponseMessageID = aResponseUserMsg.getEbms3UserMessage().getMessageInfo().getMessageId();
    final Document aSignedDoc = _signResponseIfNeeded(aResponseAttachments, aSigningParams, aResponseUserMsg.getAsSoapDocument(), eSoapVersion, aResponseUserMsg.getMessagingID());
    final IAS4ResponseFactory ret;
    if (aResponseAttachments.isEmpty()) {
        // FIXME encryption of SOAP body is missing here
        ret = new AS4ResponseFactoryXML(m_aMessageMetadata, aState, sResponseMessageID, aSignedDoc, eSoapVersion.getMimeType());
    } else {
        // Create (maybe encrypted) MIME message
        final AS4MimeMessage aMimeMsg = _createMimeMessageForResponse(aSignedDoc, aResponseAttachments, eSoapVersion, aCryptParams);
        ret = new AS4ResponseFactoryMIME(m_aMessageMetadata, aState, sResponseMessageID, aMimeMsg);
    }
    return ret;
}

Example 3 with AS4CryptParams

use of com.helger.phase4.crypto.AS4CryptParams in project phase4 by phax.

the class AS4RequestHandler method _createMimeMessageForResponse.

/**
 * Returns the MimeMessage with encrypted attachment or without depending on
 * what is configured in the PMode within Leg2.
 *
 * @param aResponseDoc
 *        the document that contains the user message
 * @param aResponseAttachments
 *        The Attachments that should be encrypted
 * @param aLeg
 *        Leg to get necessary information, EncryptionAlgorithm, SOAPVersion
 * @param sEncryptToAlias
 *        The alias into the keystore that should be used for encryption
 * @return a MimeMessage to be sent
 * @throws MessagingException
 * @throws WSSecurityException
 */
@Nonnull
private AS4MimeMessage _createMimeMessageForResponse(@Nonnull final Document aResponseDoc, @Nonnull final ICommonsList<WSS4JAttachment> aResponseAttachments, @Nonnull final ESoapVersion eSoapVersion, @Nonnull final AS4CryptParams aCryptParms) throws WSSecurityException, MessagingException {
    final AS4MimeMessage aMimeMsg;
    if (aCryptParms.isCryptEnabled(LOGGER::warn)) {
        final boolean bMustUnderstand = true;
        aMimeMsg = AS4Encryptor.encryptMimeMessage(eSoapVersion, aResponseDoc, aResponseAttachments, m_aCryptoFactory, bMustUnderstand, m_aResHelper, aCryptParms);
    } else {
        aMimeMsg = MimeMessageCreator.generateMimeMessage(eSoapVersion, aResponseDoc, aResponseAttachments);
    }
    if (aMimeMsg == null)
        throw new IllegalStateException("Failed to create MimeMessage!");
    return aMimeMsg;
}

Example 4 with AS4CryptParams

use of com.helger.phase4.crypto.AS4CryptParams in project phase4 by phax.

the class AS4RequestHandler method _handleSoapMessage.

@Nullable
private IAS4ResponseFactory _handleSoapMessage(@Nonnull final HttpHeaderMap aHttpHeaders, @Nonnull final Document aSoapDocument, @Nonnull final ESoapVersion eSoapVersion, @Nonnull final ICommonsList<WSS4JAttachment> aIncomingAttachments, @Nonnull final ICommonsList<Ebms3Error> aErrorMessagesTarget) throws WSSecurityException, MessagingException, Phase4Exception {
    final SOAPHeaderElementProcessorRegistry aRegistry = SOAPHeaderElementProcessorRegistry.createDefault(m_aPModeResolver, m_aCryptoFactory, (IPMode) null);
    final IAS4MessageState aState = AS4IncomingHandler.processEbmsMessage(m_aResHelper, m_aLocale, aRegistry, aHttpHeaders, aSoapDocument, eSoapVersion, aIncomingAttachments, m_aIncomingProfileSelector, aErrorMessagesTarget);
    final IPMode aPMode = aState.getPMode();
    final PModeLeg aEffectiveLeg = aState.getEffectivePModeLeg();
    final String sMessageID = aState.getMessageID();
    final ICommonsList<WSS4JAttachment> aDecryptedAttachments = aState.hasDecryptedAttachments() ? aState.getDecryptedAttachments() : aState.getOriginalAttachments();
    final Node aPayloadNode = aState.getSoapBodyPayloadNode();
    final Ebms3UserMessage aEbmsUserMessage = aState.getEbmsUserMessage();
    final Ebms3SignalMessage aEbmsSignalMessage = aState.getEbmsSignalMessage();
    if (aState.isSoapHeaderElementProcessingSuccessful()) {
        final String sProfileID = aState.getProfileID();
        if (LOGGER.isDebugEnabled())
            LOGGER.debug("No checking for duplicate message with message ID '" + sMessageID + "' and profile ID '" + sProfileID + "'");
        final boolean bIsDuplicate = MetaAS4Manager.getIncomingDuplicateMgr().registerAndCheck(sMessageID, sProfileID, aPMode == null ? null : aPMode.getID()).isBreak();
        if (bIsDuplicate) {
            LOGGER.error("Not invoking SPIs, because message with Message ID '" + sMessageID + "' was already handled!");
            aErrorMessagesTarget.add(EEbmsError.EBMS_OTHER.getAsEbms3Error(m_aLocale, sMessageID, "Another message with the same Message ID '" + sMessageID + "' was already received!"));
        } else {
            if (LOGGER.isDebugEnabled())
                LOGGER.debug("Message is not a duplicate");
        }
    }
    final SPIInvocationResult aSPIResult = new SPIInvocationResult();
    // Storing for two-way response messages
    final ICommonsList<WSS4JAttachment> aResponseAttachments = new CommonsArrayList<>();
    // Invoke SPIs if
    // * No errors so far (sign, encrypt, ...)
    // * Valid PMode
    // * Exactly one UserMessage or SignalMessage
    // * No ping/test message
    // * No Duplicate message ID
    final boolean bCanInvokeSPIs = aErrorMessagesTarget.isEmpty() && !aState.isPingMessage();
    if (bCanInvokeSPIs) {
        // PMode may be null for receipts
        if (aPMode == null || aPMode.getMEPBinding().isSynchronous() || aPMode.getMEPBinding().isAsynchronousInitiator() || aState.getEffectivePModeLegNumber() != 1) {
            // Call synchronous
            // Might add to aErrorMessages
            // Might add to aResponseAttachments
            // Might add to m_aPullReturnUserMsg
            _invokeSPIsForIncoming(aHttpHeaders, aEbmsUserMessage, aEbmsSignalMessage, aPayloadNode, aDecryptedAttachments, aPMode, aState, aErrorMessagesTarget, aResponseAttachments, aSPIResult);
            if (aSPIResult.isFailure())
                LOGGER.warn("Error invoking synchronous SPIs");
            else if (LOGGER.isDebugEnabled())
                LOGGER.debug("Successfully invoked synchronous SPIs");
            if (m_aSoapProcessingFinalizedCB != null)
                m_aSoapProcessingFinalizedCB.onProcessingFinalized(true);
        } else {
            // Call asynchronous
            // Only leg1 can be async!
            final IThrowingRunnable<Exception> r = () -> {
                // Start async
                final ICommonsList<Ebms3Error> aLocalErrorMessages = new CommonsArrayList<>();
                final ICommonsList<WSS4JAttachment> aLocalResponseAttachments = new CommonsArrayList<>();
                final SPIInvocationResult aAsyncSPIResult = new SPIInvocationResult();
                _invokeSPIsForIncoming(aHttpHeaders, aEbmsUserMessage, aEbmsSignalMessage, aPayloadNode, aDecryptedAttachments, aPMode, aState, aLocalErrorMessages, aLocalResponseAttachments, aAsyncSPIResult);
                final IAS4ResponseFactory aAsyncResponseFactory;
                final String sResponseMessageID;
                if (aAsyncSPIResult.isSuccess()) {
                    // SPI processing succeeded
                    assert aLocalErrorMessages.isEmpty();
                    // The response user message has no explicit payload. All data of
                    // the response user message is in the local attachments
                    sResponseMessageID = MessageHelperMethods.createRandomMessageID();
                    final AS4UserMessage aResponseUserMsg = _createReversedUserMessage(eSoapVersion, sResponseMessageID, aEbmsUserMessage, aLocalResponseAttachments);
                    // Send UserMessage
                    final AS4SigningParams aSigningParams = new AS4SigningParams().setFromPMode(aEffectiveLeg.getSecurity());
                    // Use the original receiver ID as the alias into the keystore for
                    // encrypting the response message
                    final String sEncryptionAlias = aEbmsUserMessage.getPartyInfo().getTo().getPartyIdAtIndex(0).getValue();
                    final AS4CryptParams aCryptParams = new AS4CryptParams().setFromPMode(aEffectiveLeg.getSecurity()).setAlias(sEncryptionAlias);
                    aAsyncResponseFactory = _createResponseUserMessage(aState, aEffectiveLeg.getProtocol().getSoapVersion(), aResponseUserMsg, aResponseAttachments, aSigningParams, aCryptParams);
                } else {
                    // SPI processing failed
                    // Send ErrorMessage Undefined - see
                    // https://github.com/phax/phase4/issues/4
                    final AS4ErrorMessage aResponseErrorMsg = AS4ErrorMessage.create(eSoapVersion, aState.getMessageID(), aLocalErrorMessages);
                    sResponseMessageID = aResponseErrorMsg.getEbms3SignalMessage().getMessageInfo().getMessageId();
                    // Pass error messages to the outside
                    if (m_aErrorConsumer != null && aLocalErrorMessages.isNotEmpty())
                        m_aErrorConsumer.onAS4ErrorMessage(aState, aLocalErrorMessages, aResponseErrorMsg);
                    aAsyncResponseFactory = new AS4ResponseFactoryXML(m_aMessageMetadata, aState, sResponseMessageID, aResponseErrorMsg.getAsSoapDocument(), eSoapVersion.getMimeType());
                }
                // where to send it back (must be determined by SPI!)
                final String sAsyncResponseURL = aAsyncSPIResult.getAsyncResponseURL();
                if (StringHelper.hasNoText(sAsyncResponseURL))
                    throw new IllegalStateException("No asynchronous response URL present - please check your SPI implementation");
                if (LOGGER.isDebugEnabled())
                    LOGGER.debug("Responding asynchronous to: " + sAsyncResponseURL);
                // Ensure HttpEntity is repeatable
                HttpEntity aHttpEntity = aAsyncResponseFactory.getHttpEntityForSending(eSoapVersion.getMimeType());
                aHttpEntity = m_aResHelper.createRepeatableHttpEntity(aHttpEntity);
                // Use the prebuilt entity for dumping
                _invokeSPIsForResponse(aState, aAsyncResponseFactory, aHttpEntity, eSoapVersion.getMimeType(), sResponseMessageID);
                // invoke client with new document
                final BasicHttpPoster aSender = new BasicHttpPoster();
                final Document aAsyncResponse;
                if (true) {
                    final HttpHeaderMap aResponseHttpHeaders = null;
                    // TODO make async send parameters customizable
                    final HttpRetrySettings aRetrySettings = new HttpRetrySettings();
                    aAsyncResponse = aSender.sendGenericMessageWithRetries(sAsyncResponseURL, aResponseHttpHeaders, aHttpEntity, sMessageID, aRetrySettings, new ResponseHandlerXml(), m_aOutgoingDumper, m_aRetryCallback);
                } else {
                    aAsyncResponse = aSender.sendGenericMessage(sAsyncResponseURL, null, aHttpEntity, new ResponseHandlerXml());
                }
                AS4HttpDebug.debug(() -> "SEND-RESPONSE [async sent] received: " + XMLWriter.getNodeAsString(aAsyncResponse, AS4HttpDebug.getDebugXMLWriterSettings()));
            };
            final CompletableFuture<Void> aFuture = PhotonWorkerPool.getInstance().runThrowing(CAS4.LIB_NAME + " async processing", r);
            if (m_aSoapProcessingFinalizedCB != null) {
                // Give the outside world the possibility to get notified when the
                // processing is done
                aFuture.thenRun(() -> m_aSoapProcessingFinalizedCB.onProcessingFinalized(false));
            }
        }
    }
    // Try building error message
    final String sResponseMessageID;
    final IAS4ResponseFactory ret;
    if (!aState.isSoapHeaderElementProcessingSuccessful() || aState.getEbmsError() == null) {
        // Not an incoming Ebms Error Message
        if (aErrorMessagesTarget.isNotEmpty()) {
            if (LOGGER.isDebugEnabled())
                LOGGER.debug("Creating AS4 error message with these " + aErrorMessagesTarget.size() + " errors: " + aErrorMessagesTarget.getAllMapped(Ebms3Error::getDescriptionValue));
            final AS4ErrorMessage aResponseErrorMsg = AS4ErrorMessage.create(eSoapVersion, aState.getMessageID(), aErrorMessagesTarget);
            // Call optional consumer
            if (m_aErrorConsumer != null)
                m_aErrorConsumer.onAS4ErrorMessage(aState, aErrorMessagesTarget, aResponseErrorMsg);
            // When aLeg == null, the response is true
            if (_isSendErrorAsResponse(aEffectiveLeg)) {
                sResponseMessageID = aResponseErrorMsg.getEbms3SignalMessage().getMessageInfo().getMessageId();
                ret = new AS4ResponseFactoryXML(m_aMessageMetadata, aState, sResponseMessageID, aResponseErrorMsg.getAsSoapDocument(), eSoapVersion.getMimeType());
            } else {
                LOGGER.warn("Not sending back the error, because sending error response is prohibited in PMode");
                sResponseMessageID = null;
                ret = null;
            }
        } else {
            // Do not respond to receipt (except with error message - see above)
            if (aEbmsSignalMessage == null || aEbmsSignalMessage.getReceipt() == null) {
                // So now the incoming message is a user message or a pull request
                if (aPMode.getMEP().isOneWay() || aPMode.getMEPBinding().isAsynchronous()) {
                    // the pull phase
                    if (aPMode.getMEPBinding().equals(EMEPBinding.PULL) || (aPMode.getMEPBinding().equals(EMEPBinding.PULL_PUSH) && aSPIResult.hasPullReturnUserMsg()) || (aPMode.getMEPBinding().equals(EMEPBinding.PUSH_PULL) && aSPIResult.hasPullReturnUserMsg())) {
                        // TODO would be nice to have attachments here I guess
                        final AS4UserMessage aResponseUserMsg = new AS4UserMessage(eSoapVersion, aSPIResult.getPullReturnUserMsg());
                        sResponseMessageID = aResponseUserMsg.getEbms3UserMessage().getMessageInfo().getMessageId();
                        ret = new AS4ResponseFactoryXML(m_aMessageMetadata, aState, sResponseMessageID, aResponseUserMsg.getAsSoapDocument(), eSoapVersion.getMimeType());
                    } else if (aEbmsUserMessage != null) {
                        // We received an incoming user message and no errors occurred
                        final boolean bSendReceiptAsResponse = _isSendReceiptAsResponse(aEffectiveLeg);
                        if (bSendReceiptAsResponse) {
                            sResponseMessageID = MessageHelperMethods.createRandomMessageID();
                            ret = _createResponseReceiptMessage(aState, aSoapDocument, eSoapVersion, sResponseMessageID, aEffectiveLeg, aEbmsUserMessage, aResponseAttachments);
                        } else {
                            // TODO what shall we send back here?
                            LOGGER.info("Not sending back the Receipt response, because sending Receipt response is prohibited in PMode");
                            sResponseMessageID = null;
                            ret = null;
                        }
                    } else {
                        sResponseMessageID = null;
                        ret = null;
                    }
                } else {
                    // synchronous TWO - WAY (= "SYNC")
                    final PModeLeg aLeg2 = aPMode.getLeg2();
                    if (aLeg2 == null)
                        throw new Phase4Exception("PMode has no leg2!");
                    if (MEPHelper.isValidResponseTypeLeg2(aPMode.getMEP(), aPMode.getMEPBinding(), EAS4MessageType.USER_MESSAGE)) {
                        sResponseMessageID = MessageHelperMethods.createRandomMessageID();
                        final AS4UserMessage aResponseUserMsg = _createReversedUserMessage(eSoapVersion, sResponseMessageID, aEbmsUserMessage, aResponseAttachments);
                        final AS4SigningParams aSigningParams = new AS4SigningParams().setFromPMode(aLeg2.getSecurity());
                        final String sEncryptionAlias = aEbmsUserMessage.getPartyInfo().getTo().getPartyIdAtIndex(0).getValue();
                        final AS4CryptParams aCryptParams = new AS4CryptParams().setFromPMode(aLeg2.getSecurity()).setAlias(sEncryptionAlias);
                        ret = _createResponseUserMessage(aState, aLeg2.getProtocol().getSoapVersion(), aResponseUserMsg, aResponseAttachments, aSigningParams, aCryptParams);
                    } else {
                        sResponseMessageID = null;
                        ret = null;
                    }
                }
            } else {
                sResponseMessageID = null;
                ret = null;
            }
        }
    } else {
        sResponseMessageID = null;
        ret = null;
    }
    // Create the HttpEntity on demand
    _invokeSPIsForResponse(aState, ret, null, eSoapVersion.getMimeType(), sResponseMessageID);
    return ret;
}