Gsoap is not encrypting the body of the soap message

[rohitkesarvani55]

I am trying to encrypt the soap message using the function soap_wsse_add_EncryptedKey() but it is not encrypting the soap body.

Here is the snapshot of the code.

soap_wsse_set_wsu_id((*proxy)->soap, "wsse:BinarySecurityToken SOAP-ENV:Body");

if ( soap_wsse_add_BinarySecurityTokenX509((*proxy)->soap, "X509Token", *cert1 )
|| soap_wsse_add_KeyInfo_SecurityTokenReferenceX509((*proxy)->soap, "#X509Token")
|| soap_wsse_sign_body((*proxy)->soap, SOAP_SMD_SIGN_RSA_SHA256, *pkey1, 0)
|| soap_wsse_sign_only((*proxy)->soap, "SOAP-ENV:Body") ) {
	return ( 3 );
}
    soap_wsse_add_EncryptedKey((*proxy)->soap, SOAP_MEC_AES256_CBC, "Cert", <X509> public key cert, NULL, NULL, NULL)

Document says to follow this way to encrypt. but it is failing to encrypt the data, I am using gsoap-2.8.116, same was happening with lower version of gsoap. Any help will be highly appreciated.

[Robert-van-Engelen]

Why are you calling both soap_wsse_sign_body and soap_wsse_sign_only? Does not make sense to call both.

[rohitkesarvani55]

Removed the soap_wsse_sign_only() function this time and observed that soap body encryption is yet not happening. looked further and observed that soap_wsse_add_EncryptedKey() function sets the below line in the wsseapi.c file.

soap->feltbegout = soap_wsse_element_begin_out;

I have to use soap_write_ns2__RequestMessage(proxy->soap, ns2__requestMessage) function to copy the soap data into ns2_requestObject just after soap_wsse_add_EncryptedKey() call . but soap_write_ns2__RequestMessage() function is actually assigning null to soap->feltbegout. soap->feltbegout reference was used in the next step of the function to encrypt the body.

Here is my code looks like.

soap_wsse_set_wsu_id((*proxy)->soap, "wsse:BinarySecurityToken SOAP-ENV:Body");

if ( soap_wsse_add_BinarySecurityTokenX509((*proxy)->soap, "X509Token", *cert1 )
|| soap_wsse_add_KeyInfo_SecurityTokenReferenceX509((*proxy)->soap, "#X509Token")
|| soap_wsse_sign_body((*proxy)->soap, SOAP_SMD_SIGN_RSA_SHA256, *pkey1, 0)
) {
return ( 3 );
}
soap_wsse_add_EncryptedKey((*proxy)->soap, SOAP_MEC_AES256_CBC, "Cert", public key cert, NULL, NULL, NULL)
//After this call soap->feltbegout was set

soap_write_ns2__RequestMessage(proxy->soap, ns2__requestMessage);
//After this call soap->feltbegout because unset

int status = proxy->runTransaction(ns2__requestMessage, **ns2__replyMessage);
//soap->feltbegout reference is used by runTransaction method.

all soap_* functions are returing the SOAP_OK.

[Robert-van-Engelen]

To be more precise: it does not make sense to use soap_wsse_sign_only after soap_wsse_sign_body if you do not include the name Body in the soap_wsse_sign_only string. This is the wsu:Id name of the SOAP Body to sign, see the WSSE documentation. The soap_wsse_sign_only names are wsu:Id's, not XML elements. To add wsu:Id's to elements, use soap_wsse_set_wsu_id to do so with a string of (qualified) element names. It's all in the WSSE documentation.

Also in the documentation: you must compile *all source code with -DWITH_OPENSSL -DWITH_DOM and link with openssl. Compile dom.cpp and recommended to compile stdsoap2.cpp also, instead of using libgsoapssl. If you use ./configure then also use -DHAVE_CONFIG_H to use those settings.

[rohitkesarvani55]

When we call the soap_wsse_sign_body method as above. this method update the value of the soap->omode. once the call is finished the soap->omode store the negative value -2147418112. below is the function definition.

SOAP_FMAC1
int
SOAP_FMAC2
soap_wsse_sign_body(struct soap *soap, int alg, const void *key, int keylen)
{
DBGFUN1("soap_wsse_sign_body", "alg=%x", alg);
soap_wsse_sign_only(soap, NULL);
soap->omode |= SOAP_SEC_WSUID;
return soap_wsse_sign(soap, alg, key, keylen);
}

line soap->omode |= SOAP_SEC_WSUID; evaluates the soap->omode and it gets negative. before this line gets executed the value of soap-omode and SOAP_SEC_WSUID was 65536 and -2147483648.

So when the soap_wsse_element_end_out function is called while soap->level is 1 this condition "soap->level <= 1 && !(soap->mode & SOAP_IO_LENGTH)" gets satisfied and eventually making the feltbegout and feltendout reference to null which will be used later to encrypt the body.

static int
soap_wsse_element_end_out(struct soap *soap, const char *tag)
{

struct soap_wsse_data data = (struct soap_wsse_data)soap_lookup_plugin(soap, soap_wsse_id);
printf("data0: %d %d %d %d\n", soap->level, soap->mode, SOAP_IO_LENGTH, (soap->mode & SOAP_IO_LENGTH));
if (soap->level <= 1 && !(soap->mode & SOAP_IO_LENGTH))
{
printf("data: %d %d %d\n", soap->mode, SOAP_IO_LENGTH, (soap->mode & SOAP_IO_LENGTH));
soap->feltbegout = NULL;
soap->feltendout = NULL;
}
}

I understand the root cause is SOAP_SEC_WSUID variable if some how it store the positive value, soap->omode will also store the positive value. How can we set the SOAP_SEC_WSUID value to some positive value?