eclipse-ee4j / eclipse-ee4j/metro-wsit

digest verification error

Open
#338 0 comments 0 reactions 0 assignees View on GitHub
3_1_1-exclude 3-1-2_exclude Component: security ERR: Assignee incomplete metro2_2-waived Priority: Critical Type: Bug
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

When a string of "First line0x0D0x0ASecond line" is sent from a service implemented in MS .NET 4.0, the Java client created by Metro 2.1 will fail because of a digest verification error.

A bug was filed to MS and they are saying that it should be a bug at java side: [https://connect.microsoft.com/VisualStudio/feedback/details/631605/string-digest-verification-failure-in-java-ws-security-client](https://connect.microsoft.com/VisualStudio/feedback/details/631605/string-digest-verification-failure-in-java-ws-security-client).

You may use the attached code to reproduce the bug.

The exceptions:

SEVERE: WSS1717: Error occurred while doing digest verification of body/payload
javax.xml.crypto.dsig.XMLSignatureException: WSS1717: Error occurred while doing digest verification of body/payload
at com.sun.xml.ws.security.opt.impl.incoming.processor.StreamingPayLoadDigester.accept(StreamingPayLoadDigester.java:109)
at com.ctc.wstx.stax.FilteredStreamReader.next(FilteredStreamReader.java:45)
at com.sun.xml.ws.security.opt.impl.util.VerifiedMessageXMLStreamReader.next(VerifiedMessageXMLStreamReader.java:86)
at com.sun.xml.stream.buffer.stax.StreamReaderBufferCreator.storeElementAndChildrenNoEx(StreamReaderBufferCreator.java:245)
at com.sun.xml.stream.buffer.stax.StreamReaderBufferCreator.storeElementAndChildren(StreamReaderBufferCreator.java:177)
at com.sun.xml.stream.buffer.stax.StreamReaderBufferCreator.store(StreamReaderBufferCreator.java:142)
at com.sun.xml.stream.buffer.stax.StreamReaderBufferCreator.create(StreamReaderBufferCreator.java:82)
at com.sun.xml.ws.security.opt.impl.incoming.VerifiedStreamMessage.copy(VerifiedStreamMessage.java:447)
at com.sun.xml.ws.api.message.Packet.copy(Packet.java:220)
at com.sun.xml.ws.dump.LoggingDumpTube.processResponse(LoggingDumpTube.java:124)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:651)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:600)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:585)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:482)
at com.sun.xml.ws.client.Stub.process(Stub.java:323)
at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:161)
at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:113)
at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:93)
at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:144)
at $Proxy40.ping2(Unknown Source)
at com.microsoft.sts.prototype.WSTrustClient.testCustomBindingIService1(WSTrustClient.java:49)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:76)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:49)
at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:467)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:683)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:390)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:197)
#### Environment
MS .NET 4.0 and com.sun.xml.ws.webservices-rt 2.1
#### Affected Versions
[2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1535](https://github.com/javaee/metro-wsit/issues/1535)
Author: glassfishrobot

Contributor guide

Open the contributing guide

Research direction

Start with the attached reproduction and the Metro 2.1 stack trace, especially StreamingPayLoadDigester.java:109, to isolate the digest verification failure for the .NET-sent string. Reproduce the failure in the stated MS .NET 4.0 and Metro 2.1 environment; done means the Java client verifies the payload successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.