Skip to content

Commit 71fcd22

Browse files
uhurusurfauhurusurfa
authored
Support non standard sha designations (#351)
* Use RFC5751 algorithm identifiers * Unit rtest for converting to FRC5751 identiifiers * Update to latest libraries and OpenAS2 version * Updated documentation around algorithm identifiers * Standalone method for reuse to adjust algorithm to standard format * Test different forms of the signing algorithm * Release notes
1 parent 443c681 commit 71fcd22

File tree

13 files changed

+103
-42
lines changed

13 files changed

+103
-42
lines changed

‎RELEASE-NOTES.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
# OpenAS2 Server
2-
# Version 3.8.0
2+
# Version 3.9.0
33
# RELEASE NOTES
44
-----
5-
The OpenAS2 project is pleased to announce the release of OpenAS2 3.8.0
5+
The OpenAS2 project is pleased to announce the release of OpenAS2 3.9.0
66

7-
The release download file is: OpenAS2Server-3.8.0.zip
7+
The release download file is: OpenAS2Server-3.9.0.zip
88

99
The zip file contains a PDF document (OpenAS2HowTo.pdf) providing information on installing and using the application.
1010
## NOTE: Testing covers Java 8 to 17. The application should work for older versions down to Java 7 but they are not tested as part of the CI/CD pipeline.
1111

12-
Version 3.8.0 - 2023-11-07
12+
Version 3.9.0 - 2023-12-20
1313
This is an enhancement release:
1414
**IMPORTANT NOTE**: Please review upgrade notes below if you are upgrading
1515

16-
1. Support for configurable dynamic Content-Type based on the file extension. See documentation section 7.5 "Setting Content Type"
16+
1. Support for non-standard algorithm strings for partners that do not conform to the RFC standard. See documentation section 7.2.1 "Signing"
1717

1818
##Upgrade Notes
1919
See the openAS2HowTo appendix for the general process on upgrading OpenAS2.

‎Remote/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>net.sf.openas2</groupId>
66
<artifactId>OpenAS2</artifactId>
7-
<version>3.8.0</version>
7+
<version>3.9.0</version>
88
</parent>
99

1010
<modelVersion>4.0.0</modelVersion>

‎Server/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<!-- DO NOT CHANGE THIS "groupId" WITHOUT CHANGING XMLSession.getManifestAttributes.MANIFEST_VENDOR_ID_ATTRIB -->
88
<groupId>net.sf.openas2</groupId>
99
<artifactId>OpenAS2</artifactId>
10-
<version>3.8.0</version>
10+
<version>3.9.0</version>
1111
<relativePath>../pom.xml</relativePath>
1212
</parent>
1313

‎Server/src/config/partnerships.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
-->
3939

4040
<attribute name="encrypt" value="3DES"/>
41-
<attribute name="sign" value="SHA256"/>
41+
<attribute name="sign" value="SHA-256"/>
4242
<attribute name="resend_max_retries" value="3"/>
4343
<attribute name="prevent_canonicalization_for_mic" value="false"/>
4444
<attribute name="rename_digest_to_old_name" value="false"/>
@@ -92,7 +92,7 @@
9292
<attribute name="as2_receipt_option" value="$properties.as2_async_mdn_url$"/>
9393
-->
9494
<attribute name="encrypt" value="3DES"/>
95-
<attribute name="sign" value="SHA1"/>
95+
<attribute name="sign" value="SHA-1"/>
9696
<attribute name="resend_max_retries" value="3"/>
9797
<attribute name="prevent_canonicalization_for_mic" value="false"/>
9898
<attribute name="rename_digest_to_old_name" value="false"/>

‎Server/src/main/java/org/openas2/lib/helper/BCCryptoHelper.java

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@
8181
import java.util.Collection;
8282
import java.util.Iterator;
8383
import java.util.Map;
84+
import java.util.regex.Matcher;
85+
import java.util.regex.Pattern;
8486

8587
public class BCCryptoHelper implements ICryptoHelper {
8688
private Log logger = LogFactory.getLog(BCCryptoHelper.class.getSimpleName());
@@ -289,7 +291,6 @@ public MimeBodyPart sign(MimeBodyPart part, Certificate cert, Key key, String di
289291
PrivateKey privKey = castKey(key);
290292
String encryptAlg = cert.getPublicKey().getAlgorithm();
291293

292-
// Fix copied from https://github.com/phax/as2-lib/commit/ed08dd00b6d721ec3e3e7255f642045c9cbee9c3
293294
SMIMESignedGenerator sGen = new SMIMESignedGenerator(adjustDigestToOldName ? SMIMESignedGenerator.RFC3851_MICALGS : SMIMESignedGenerator.RFC5751_MICALGS);
294295
sGen.setContentTransferEncoding(getEncoding(contentTxfrEncoding));
295296
SignerInfoGenerator sig;
@@ -298,10 +299,8 @@ public MimeBodyPart sign(MimeBodyPart part, Certificate cert, Key key, String di
298299
logger.debug("Params for creating SMIME signed generator:: SIGN DIGEST: " + digest + " PUB ENCRYPT ALG: " + encryptAlg + " X509 CERT: " + x509Cert);
299300
logger.debug("Signing on MIME part containing the following headers: " + AS2Util.printHeaders(part.getAllHeaders()));
300301
}
301-
// Remove the dash for SHA based digest for signing call
302-
if (digest.toUpperCase().startsWith("SHA-")) {
303-
digest = digest.replaceAll("-", "");
304-
}
302+
// Standardise identifier and remove the dash for SHA based digest for signing call
303+
digest = standardiseAlgorithmIdentifier(digest, false);
305304
JcaSimpleSignerInfoGeneratorBuilder jSig = new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC");
306305
sig = jSig.build(digest + "with" + encryptAlg, privKey, x509Cert);
307306
// Some AS2 systems cannot handle certain OID's ...
@@ -481,14 +480,31 @@ protected PrivateKey castKey(Key key) throws GeneralSecurityException {
481480
return (PrivateKey) key;
482481
}
483482

484-
protected String convertAlgorithm(String algorithm, boolean toBC) throws NoSuchAlgorithmException {
483+
/**
484+
* Standard for Algorithm identifiers is RFC5751. Cater for non-standard algorithm identifiers by converting the identifier
485+
* as needed.
486+
* @param algorithm - the string identifier of the algorithm to be used
487+
* @param useHyphenSeparator - use the hyphen between SHA and the key size designator or not
488+
* @return
489+
*/
490+
public String standardiseAlgorithmIdentifier(String algorithm, boolean useHyphenSeparator) {
491+
String matchStr = "(sha)[0-9]+[-_]+(.*)$" + (useHyphenSeparator?"|(sha)([0-9]+)$":"|(sha)-([0-9]+)$");
492+
Pattern pttrn = Pattern.compile(matchStr, Pattern.CASE_INSENSITIVE);
493+
Matcher matcher = pttrn.matcher(algorithm);
494+
if (matcher.matches()) {
495+
int baseMatchGroup = matcher.group(2) == null?3:1;
496+
algorithm = matcher.group(baseMatchGroup) + (useHyphenSeparator?"-":"") + matcher.group(baseMatchGroup+1);
497+
}
498+
return algorithm;
499+
500+
}
501+
502+
public String convertAlgorithm(String algorithm, boolean toBC) throws NoSuchAlgorithmException {
485503
if (algorithm == null) {
486504
throw new NoSuchAlgorithmException("Algorithm is null");
487505
}
506+
algorithm = standardiseAlgorithmIdentifier(algorithm, true);
488507
if (toBC) {
489-
if (algorithm.toUpperCase().startsWith("SHA-")) {
490-
algorithm = algorithm.replaceAll("-", "");
491-
}
492508
if (algorithm.equalsIgnoreCase(DIGEST_MD5)) {
493509
return SMIMESignedGenerator.DIGEST_MD5;
494510
} else if (algorithm.equalsIgnoreCase(DIGEST_SHA1)) {

‎Server/src/main/java/org/openas2/lib/helper/ICryptoHelper.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ public interface ICryptoHelper {
1818

1919
String DIGEST_MD2 = "md2";
2020
String DIGEST_MD5 = "md5";
21-
String DIGEST_SHA1 = "sha1";
22-
String DIGEST_SHA224 = "sha224";
23-
String DIGEST_SHA256 = "sha256";
24-
String DIGEST_SHA384 = "sha384";
25-
String DIGEST_SHA512 = "sha512";
21+
String DIGEST_SHA1 = "sha-1";
22+
String DIGEST_SHA224 = "sha-224";
23+
String DIGEST_SHA256 = "sha-256";
24+
String DIGEST_SHA384 = "sha-384";
25+
String DIGEST_SHA512 = "sha-512";
2626
String CRYPT_CAST5 = "cast5";
2727
String CRYPT_3DES = "3des";
2828
String CRYPT_IDEA = "idea";

‎Server/src/test/java/org/openas2/lib/HelperMethods.java

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package org.openas2.lib;
2+
3+
import org.bouncycastle.mail.smime.SMIMEEnvelopedGenerator;
4+
import org.bouncycastle.mail.smime.SMIMESignedGenerator;
5+
import org.junit.jupiter.api.Test;
6+
import org.junit.jupiter.api.extension.ExtendWith;
7+
import org.mockito.junit.jupiter.MockitoExtension;
8+
import org.openas2.lib.helper.BCCryptoHelper;
9+
import org.openas2.lib.helper.ICryptoHelper;
10+
11+
import static org.hamcrest.Matchers.equalTo;
12+
13+
import java.security.NoSuchAlgorithmException;
14+
import java.util.HashMap;
15+
import java.util.Map;
16+
17+
import static org.hamcrest.MatcherAssert.assertThat;
18+
19+
@ExtendWith(MockitoExtension.class)
20+
21+
public class HelperMethods {
22+
23+
@Test
24+
public void convertAlgorithmString() throws NoSuchAlgorithmException {
25+
Map<String, String> algorithmChecks = new HashMap<String, String>();
26+
algorithmChecks.put(ICryptoHelper.AES128_CBC, SMIMEEnvelopedGenerator.AES128_CBC);
27+
algorithmChecks.put(ICryptoHelper.DIGEST_SHA1.replaceAll("-", ""), SMIMESignedGenerator.DIGEST_SHA1);
28+
algorithmChecks.put(ICryptoHelper.DIGEST_SHA256.replaceAll("-", ""), SMIMESignedGenerator.DIGEST_SHA256);
29+
algorithmChecks.put(ICryptoHelper.DIGEST_SHA256.replaceAll("-", "2_"), SMIMESignedGenerator.DIGEST_SHA256);
30+
algorithmChecks.put(ICryptoHelper.DIGEST_SHA256.replaceAll("-", "2-"), SMIMESignedGenerator.DIGEST_SHA256);
31+
algorithmChecks.put(ICryptoHelper.DIGEST_SHA384.replaceAll("-", "2-"), SMIMESignedGenerator.DIGEST_SHA384);
32+
33+
BCCryptoHelper bch = new BCCryptoHelper();
34+
for (Map.Entry<String, String> entry : algorithmChecks.entrySet()) {
35+
String convertedAlgo = bch.convertAlgorithm(entry.getKey(), true);
36+
assertThat("Algorithm matches expected", convertedAlgo, equalTo(entry.getValue()));
37+
}
38+
}
39+
}

‎Server/src/test/resources/OpenAS2ServerTest/OpenAS2A/config/partnerships.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
value="signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, $attribute.sign$"/>
2626
-->
2727
<attribute name="encrypt" value="3DES"/>
28-
<attribute name="sign" value="SHA1"/>
28+
<attribute name="sign" value="SHA2_256"/>
2929
<attribute name="resend_max_retries" value="3"/>
3030
<attribute name="prevent_canonicalization_for_mic" value="false"/>
3131
<attribute name="rename_digest_to_old_name" value="true"/>
@@ -46,7 +46,7 @@
4646
<attribute name="as2_mdn_options"
4747
value="signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, SHA256"/>
4848
<attribute name="encrypt" value="3DES"/>
49-
<attribute name="sign" value="SHA256"/>
49+
<attribute name="sign" value="SHA-256"/>
5050
<attribute name="prevent_canonicalization_for_mic" value="false"/>
5151
<attribute name="rename_digest_to_old_name" value="false"/>
5252
<attribute name="remove_cms_algorithm_protection_attrib" value="false"/>

‎Server/src/test/resources/SingleServerTest/MyCompany/config/partnerships.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
<attribute name="as2_mdn_options"
2828
value="signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, $attribute.sign$"/>
2929
<attribute name="encrypt" value="3DES"/>
30-
<attribute name="sign" value="SHA256"/>
30+
<attribute name="sign" value="SHA-256"/>
3131
<attribute name="resend_max_retries" value="3"/>
3232
<attribute name="prevent_canonicalization_for_mic" value="false"/>
3333
<attribute name="rename_digest_to_old_name" value="false"/>

‎changes.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
Version 3.9.0 - 2023-12-20
2+
This is an enhancement release:
3+
**IMPORTANT NOTE**: Please review upgrade notes in the RELEASE-NOTES.md if you are upgrading
4+
5+
1. Support for non-standard algorithm strings for partners that do not conform to the RFC standard. See documentation section 7.2.1 "Signing"
6+
17
Version 3.8.0 - 2023-11-07
28
This is an enhancement and minor bugfix release:
39
**IMPORTANT NOTE**: Please review upgrade notes in the RELEASE-NOTES.md if you are upgrading

‎docs/OpenAS2HowTo.odt

716 Bytes
Binary file not shown.

‎docs/OpenAS2HowTo.pdf

146 Bytes
Binary file not shown.

‎pom.xml

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<modelVersion>4.0.0</modelVersion>
66
<groupId>net.sf.openas2</groupId>
77
<artifactId>OpenAS2</artifactId>
8-
<version>3.8.0</version>
8+
<version>3.9.0</version>
99
<name>OpenAS2</name>
1010
<packaging>pom</packaging>
1111

@@ -52,32 +52,32 @@
5252
<dependency>
5353
<groupId>org.bouncycastle</groupId>
5454
<artifactId>bcmail-jdk18on</artifactId>
55-
<version>1.76</version>
55+
<version>1.77</version>
5656
</dependency>
5757
<dependency>
5858
<groupId>org.bouncycastle</groupId>
5959
<artifactId>bcpkix-jdk18on</artifactId>
60-
<version>1.76</version>
60+
<version>1.77</version>
6161
</dependency>
6262
<dependency>
6363
<groupId>org.bouncycastle</groupId>
6464
<artifactId>bcprov-jdk18on</artifactId>
65-
<version>1.76</version>
65+
<version>1.77</version>
6666
</dependency>
6767
<dependency>
6868
<groupId>org.bouncycastle</groupId>
6969
<artifactId>bcprov-ext-jdk18on</artifactId>
70-
<version>1.76</version>
70+
<version>1.77</version>
7171
</dependency>
7272
<dependency>
7373
<groupId>org.bouncycastle</groupId>
7474
<artifactId>bcpg-jdk18on</artifactId>
75-
<version>1.76</version>
75+
<version>1.77</version>
7676
</dependency>
7777
<dependency>
7878
<groupId>org.apache.commons</groupId>
7979
<artifactId>commons-lang3</artifactId>
80-
<version>3.13.0</version>
80+
<version>3.14.0</version>
8181
</dependency>
8282
<dependency>
8383
<groupId>commons-cli</groupId>
@@ -87,7 +87,7 @@
8787
<dependency>
8888
<groupId>commons-logging</groupId>
8989
<artifactId>commons-logging</artifactId>
90-
<version>1.2</version>
90+
<version>1.3.0</version>
9191
</dependency>
9292
<dependency>
9393
<groupId>com.sun.mail</groupId>
@@ -120,7 +120,7 @@
120120
<dependency>
121121
<groupId>org.junit.jupiter</groupId>
122122
<artifactId>junit-jupiter</artifactId>
123-
<version>5.10.0</version>
123+
<version>5.10.1</version>
124124
<scope>test</scope>
125125
</dependency>
126126
<!-- https://mvnrepository.com/artifact/org.mockito/mockito-core -->
@@ -148,7 +148,7 @@
148148
<dependency>
149149
<groupId>commons-io</groupId>
150150
<artifactId>commons-io</artifactId>
151-
<version>2.15.0</version>
151+
<version>2.15.1</version>
152152
</dependency>
153153
<!-- https://mvnrepository.com/artifact/javax.ws.rs/javax.ws.rs-api -->
154154
<dependency>
@@ -165,30 +165,30 @@
165165
<dependency>
166166
<groupId>org.glassfish.jersey.containers</groupId>
167167
<artifactId>jersey-container-grizzly2-http</artifactId>
168-
<version>3.1.3</version>
168+
<version>3.1.5</version>
169169
<type>jar</type>
170170
</dependency>
171171
<dependency>
172172
<groupId>com.fasterxml.jackson.core</groupId>
173173
<artifactId>jackson-databind</artifactId>
174-
<version>2.15.3</version>
174+
<version>2.16.0</version>
175175
<type>jar</type>
176176
</dependency>
177177
<dependency>
178178
<groupId>com.fasterxml.jackson.module</groupId>
179179
<artifactId>jackson-module-jaxb-annotations</artifactId>
180-
<version>2.15.3</version>
180+
<version>2.16.0</version>
181181
</dependency>
182182
<dependency>
183183
<groupId>org.glassfish.jersey.media</groupId>
184184
<artifactId>jersey-media-json-jackson</artifactId>
185-
<version>3.1.3</version>
185+
<version>3.1.5</version>
186186
<type>jar</type>
187187
</dependency>
188188
<dependency>
189189
<groupId>org.glassfish.jersey.inject</groupId>
190190
<artifactId>jersey-hk2</artifactId>
191-
<version>3.1.3</version>
191+
<version>3.1.5</version>
192192
</dependency>
193193
<!-- Removed JavaEE APIs removed from Java 9+ -->
194194
<dependency>
@@ -209,7 +209,7 @@
209209
<dependency>
210210
<groupId>io.sentry</groupId>
211211
<artifactId>sentry</artifactId>
212-
<version>6.33.0</version>
212+
<version>7.1.0</version>
213213
</dependency>
214214
</dependencies>
215215
</dependencyManagement>

0 commit comments

Comments
 (0)