private static async Task <StepResult> TryVerifyingSignatureAsync(
MessagingContext messagingContext,
SigningVerification verification)
{
try
{
VerifySignatureConfig options =
CreateVerifyOptionsForAS4Message(messagingContext.AS4Message, verification);
Logger.Debug($"Verify signature on the AS4Message {{AllowUnknownRootCertificateAuthority={options.AllowUnknownRootCertificateAuthority}}}");
if (!messagingContext.AS4Message.VerifySignature(options))
{
return(InvalidSignatureResult(
"The signature is invalid",
ErrorAlias.FailedAuthentication,
messagingContext));
}
Logger.Info($"{messagingContext.LogTag} AS4Message has a valid signature present");
JournalLogEntry entry =
JournalLogEntry.CreateFrom(
messagingContext.AS4Message,
$"Signature verified with {(options.AllowUnknownRootCertificateAuthority ? "allowing" : "disallowing")} unknown certificate authorities");
return(await StepResult
.Success(messagingContext)
.WithJournalAsync(entry));
}
catch (CryptographicException exception)
{
var description = "Signature verification failed";
if (messagingContext.AS4Message.IsEncrypted)
{
Logger.Error(
"Signature verification failed because the received message is still encrypted. "
+ "Make sure that you specify <Decryption/> information in the <Security/> element of the "
+ "ReceivingPMode so the ebMS MessagingHeader is first decrypted before it's signature gets verified");
description = "Signature verification failed because the message is still encrypted";
}
Logger.Error($"{messagingContext.LogTag} An exception occured while validating the signature: {exception.Message}");
return(InvalidSignatureResult(
description,
ErrorAlias.FailedAuthentication,
messagingContext));
}
}
/// <summary>
/// Start verifying the Signature of the <see cref="AS4Message"/>
/// </summary>
/// <param name="messagingContext"></param>
/// <returns></returns>
public async Task <StepResult> ExecuteAsync(MessagingContext messagingContext)
{
if (messagingContext == null)
{
throw new ArgumentNullException(nameof(messagingContext));
}
if (messagingContext.AS4Message == null)
{
throw new InvalidOperationException(
$"{nameof(VerifySignatureAS4MessageStep)} requires an AS4Message to verify but no AS4Message is present in the MessagingContext");
}
AS4Message as4Message = messagingContext.AS4Message;
SigningVerification verification = DetermineSigningVerification(messagingContext);
if (verification == null)
{
Logger.Debug("No PMode.Security.SigningVerification element found, so no signature verification will take place");
return(StepResult.Success(messagingContext));
}
(bool unsignedButRequired, string desRequired) = SigningRequiredRule(verification, as4Message);
if (unsignedButRequired)
{
return(InvalidSignatureResult(
desRequired, ErrorAlias.PolicyNonCompliance, messagingContext));
}
(bool signedMessageButNotAllowed, string desNotAllowed) = SigningNotAllowedRule(verification, as4Message);
if (signedMessageButNotAllowed)
{
return(InvalidSignatureResult(desNotAllowed, ErrorAlias.PolicyNonCompliance, messagingContext));
}
if (!as4Message.IsSigned)
{
Logger.Trace("Signature will not be verified since the message is not signed");
return(StepResult.Success(messagingContext));
}
if (verification.Signature == Limit.Ignored)
{
Logger.Debug("Signature will not be verified because the PMode states that Security.SigningVerification=Ignored");
return(StepResult.Success(messagingContext));
}
if (as4Message.MessageUnits.Any(u => u is Receipt) &&
(messagingContext.SendingPMode?.ReceiptHandling?.VerifyNRR ?? false))
{
if (!await VerifyNonRepudiationHashesAsync(as4Message))
{
Logger.Error($"{messagingContext.LogTag} Incoming Receipt hasn't got valid NRI References");
return(InvalidSignatureResult(
"The digest value in the Signature References of the referenced UserMessage " +
"doesn't match the References of the NRI of the incoming Non-Repudiation Receipt",
ErrorAlias.FailedAuthentication,
messagingContext));
}
Logger.Debug($"{messagingContext.LogTag} Incoming Receipt has valid NRI References");
}
return(await TryVerifyingSignatureAsync(messagingContext, verification).ConfigureAwait(false));
}
private static VerifySignatureConfig CreateVerifyOptionsForAS4Message(AS4Message as4Message, SigningVerification v)
{
bool allowUnknownRootCertificateAuthority =
v?.AllowUnknownRootCertificate ?? new SigningVerification().AllowUnknownRootCertificate;
return(new VerifySignatureConfig(allowUnknownRootCertificateAuthority, as4Message.Attachments));
}
private static (bool, string) SigningNotAllowedRule(SigningVerification v, AS4Message m)
{
return(v.Signature == Limit.NotAllowed && m.IsSigned,
"PMode doesn't allow a signed AS4Message and the received AS4Message is signed");
}
private static (bool, string) SigningRequiredRule(SigningVerification v, AS4Message m)
{
return(v.Signature == Limit.Required && !m.IsSigned,
"PMode requires a signed AS4Message but the received AS4message is not signed");
}
