CODEWITHSUNDEEP
c++gsoapwsse
John Bode
John Bode

Reputation: 123458

gSOAP wsse plugin - what is the proper procedure for signing requests?

I'm using gSOAP (2.8.16 - yes it's old) to develop a C++ client on RHEL that talks to a service that requires messages to be digitally signed. The signature is based on a wsu:Timestamp element. I'm using an X509 (PEM) certificate with an RSA private key. Client was generated using

wsdl2h -g -e -o client-pre.h -t$SOAPHOME/WS/WS-typemap.dat -v $WSDL
sed -f add-imports client-pre.h > client.h # adds import statements for WS-Header.h, dom.h, and wsse.h
soapcpp2 -d ../ -A -L _c -w -j -I $SOAPHOME/import -x -n client.h

Based on the Genevia documentation, the following code should be sufficient (not actual code, but representative of it - error handling omitted to save space):

ServiceSOAPProxy client;
...
soap_register_plugin( client.soap, soap_wsse );
...
soap_ssl_client_context( client.soap, SOAP_SSL_DEFAULT, pemfile, pwd, cafile, NULL, NULL );

_ns__RequestType *req = soap_new__ns__RequestType( cpClient.soap );
// set request parameters

RSA *rsakey = PEM_read_RSAPrivateKey( fp, NULL, NULL, (void *) pwd );
...
X509 *cert = PEM_read_X509( fp, NULL, NULL, NULL );
...
soap_wsse_add_Timestamp( client.soap, timeid.c_str(), duration );

if ( soap_wsse_add_BinarySecurityTokenX509( client.soap, tokid.c_str(), cert ) != SOAP_OK || 
     soap_wsse_add_KeyInfo_SecurityTokenReferenceX509( client.soap, ("#" + tokid).c_str()) != SOAP_OK || 
     soap_wsse_sign( client.soap, SOAP_SMD_SIGN_RSA_SHA256, rsakey, 0 ) != SOAP_OK ||
     soap_wsse_sign_only( client.soap, ("#" + timeid).c_str() ) != SOAP_OK )
{
  soap_print_fault( client.soap, ::stderr );
  // handle error
}

ns__ResponseType *rsp = soap_new_ns__ResponseType( client.soap );
cpClient.SendRequest( req, rsp );

Unfortunately, the signature isn't complete - there's no SignatureValue, there's no SignedInfo, etc., just the SecurityTokenReference:

  <ds:Signature>
    <ds:KeyInfo>
      <wsse:SecurityTokenReference>
        <wsse:Reference URI="#BST-a9ec4d98-41c0-11e9-961e-0e5b675ed876" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
      </wsse:SecurityTokenReference>
    </ds:KeyInfo>
  </ds:Signature>

None of the soap_wsse* methods return an error, but either I'm missing a step or something hasn't been set up properly. There is absolutely nothing in the Genevia documentation that even hints at what I'm doing wrong.

What step am I missing?

EDIT

It turns out I was passing the wrong tag for the timestamp - I was using the reference URI with the leading # (("#" + time_id).c_str()), which was why nothing was being added to the signature.

When I use the correct tag (time_id.c_str()), I get a segfault - somehow, soap->attributes gets set to a bad value. I set a watch on the soap->attributes member in a gdb session and get the following:

Old value = (soap_attribute *) 0x0
New value = (soap_attribute *) 0x9bf1a0
0x00000000005f2d49 in soap_set_attr (soap=0x7ffff7fb7010, name=0x7ffff7fd35d0 "xmlns:SOAP-ENV", value=0x9bf131 "http://schemas.xmlsoap.org/soap/envelope/", flag=1) at stdsoap2.cpp:10456

Old value = (soap_attribute *) 0x9bf1a0
New value = (soap_attribute *) 0xa1aaa0
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0xa1aaa0
New value = (soap_attribute *) 0x9eca10
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9eca10
New value = (soap_attribute *) 0x9bf3b0
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9bf3b0
New value = (soap_attribute *) 0x9c4570
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9c4570
New value = (soap_attribute *) 0x9ec740
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9ec740
New value = (soap_attribute *) 0xa1a960
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0xa1a960
New value = (soap_attribute *) 0x9ec690
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9ec690
New value = (soap_attribute *) 0x9b9f30
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9b9f30
New value = (soap_attribute *) 0x9bf300
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x9bf300
New value = (soap_attribute *) 0x0
soap_clr_attr (soap=0x7ffff7fb7010) at stdsoap2.cpp:10510

Old value = (soap_attribute *) 0x0
New value = (soap_attribute *) 0x2000000000000
soap_smd_begin (soap=0x7ffff7fb7010, alg=10, key=0x95b150, keylen=0) at smdevp.c:373

Why in the world is this happening?

Upvotes: 0

Views: 391

Answers (0)

Related Questions