ruwin
/
device-mgt-plugins
forked from community/device-mgt-plugins
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #531 from warunalakshitha/release-3.0.x

Browse Source 
Fix find security Bugs
revert-dabc3590
Rasika Perera 8 years ago committed by GitHub
parent 1d0753ab8d 989dc12752
commit 8e8d595655
8 changed files with 77 additions and 91 deletions
Show Stats Download Patch File Download Diff File

14
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.advanced.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/advanced/transport/CommunicationUtils.java
Unescape View File

@ -43,7 +43,7 @@ public class CommunicationUtils {
private static final Log log = LogFactory.getLog(TransportUtils.class); private static final Log log = LogFactory.getLog(TransportUtils.class);
// The Signature Algorithm used. // The Signature Algorithm used.
private static final String SIGNATURE_ALG = "SHA1withRSA"; private static final String SHA_512 = "SHA-512";
// The Encryption Algorithm and the Padding used. // The Encryption Algorithm and the Padding used.
private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding"; private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding";
@ -108,7 +108,7 @@ public class CommunicationUtils {
String signedEncodedString; String signedEncodedString;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initSign(signatureKey); signature.initSign(signatureKey);
signature.update(Base64.decodeBase64(message)); signature.update(Base64.decodeBase64(message));
@ -117,11 +117,11 @@ public class CommunicationUtils {
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = String errorMsg =
"Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {
@ -153,7 +153,7 @@ public class CommunicationUtils {
boolean verified; boolean verified;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initVerify(verificationKey); signature.initVerify(verificationKey);
signature.update(Base64.decodeBase64(data)); signature.update(Base64.decodeBase64(data));
@ -161,11 +161,11 @@ public class CommunicationUtils {
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = String errorMsg =
"Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {

15
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.advanced.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/advanced/transport/TransportUtils.java
Unescape View File

@ -34,6 +34,8 @@ import java.net.ServerSocket;
import java.net.SocketException; import java.net.SocketException;
import java.net.URL; import java.net.URL;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Enumeration; import java.util.Enumeration;
import java.util.HashMap; import java.util.HashMap;
@ -172,28 +174,27 @@ public class TransportUtils {
*/ */
public static synchronized int getAvailablePort(int randomAttempts) { public static synchronized int getAvailablePort(int randomAttempts) {
ArrayList<Integer> failedPorts = new ArrayList<Integer>(randomAttempts); ArrayList<Integer> failedPorts = new ArrayList<Integer>(randomAttempts);
try {
Random randomNum = new Random(); SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
int randomPort = MAX_PORT_NUMBER; int randomPort = MAX_PORT_NUMBER;
while (randomAttempts > 0) { while (randomAttempts > 0) {
randomPort = randomNum.nextInt(MAX_PORT_NUMBER - MIN_PORT_NUMBER) + MIN_PORT_NUMBER; randomPort = secureRandom.nextInt(MAX_PORT_NUMBER - MIN_PORT_NUMBER) + MIN_PORT_NUMBER;
if (checkIfPortAvailable(randomPort)) { if (checkIfPortAvailable(randomPort)) {
return randomPort; return randomPort;
} }
failedPorts.add(randomPort); failedPorts.add(randomPort);
randomAttempts--; randomAttempts--;
} }
randomPort = MAX_PORT_NUMBER; randomPort = MAX_PORT_NUMBER;
while (true) { while (true) {
if (!failedPorts.contains(randomPort) && checkIfPortAvailable(randomPort)) { if (!failedPorts.contains(randomPort) && checkIfPortAvailable(randomPort)) {
return randomPort; return randomPort;
} }
randomPort--; randomPort--;
} }
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("SHA1PRNG algorithm could not be found.");
}
} }

11
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.advanced.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/advanced/virtual/VirtualHardwareManager.java
Unescape View File

@ -33,6 +33,8 @@ import javax.sound.sampled.Clip;
import javax.swing.*; import javax.swing.*;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
/** /**
* This class use to emulate virtual hardware functionality * This class use to emulate virtual hardware functionality
@ -188,9 +190,12 @@ public class VirtualHardwareManager {
double mn = current - offset; double mn = current - offset;
min = (mn < min) ? min : (int) Math.round(mn); min = (mn < min) ? min : (int) Math.round(mn);
} }
try {
double rnd = Math.random() * (max - min) + min; SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
return (int) Math.round(rnd); return secureRandom.nextInt(max - min) + min;
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("SHA1PRNG algorithm could not be found.");
}
} }

23
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/enrollment/EnrollmentManager.java
Unescape View File

@ -129,11 +129,8 @@ public class EnrollmentManager {
public void setEnrollmentStatus() { public void setEnrollmentStatus() {
KeyStore keyStore; KeyStore keyStore;
try { try {
keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE); keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE);
keyStore.load(new FileInputStream(AgentConstants.DEVICE_KEYSTORE),
AgentConstants.DEVICE_KEYSTORE_PASSWORD.toCharArray());
this.isEnrolled = (keyStore.containsAlias(AgentConstants.DEVICE_CERT_ALIAS) && this.isEnrolled = (keyStore.containsAlias(AgentConstants.DEVICE_CERT_ALIAS) &&
keyStore.containsAlias(AgentConstants.DEVICE_PRIVATE_KEY_ALIAS) && keyStore.containsAlias(AgentConstants.DEVICE_PRIVATE_KEY_ALIAS) &&
@ -146,21 +143,7 @@ public class EnrollmentManager {
log.error(AgentConstants.LOG_APPENDER + e); log.error(AgentConstants.LOG_APPENDER + e);
log.warn(AgentConstants.LOG_APPENDER + "Device will be re-enrolled."); log.warn(AgentConstants.LOG_APPENDER + "Device will be re-enrolled.");
return; return;
} catch (CertificateException | NoSuchAlgorithmException e) {
log.error(AgentConstants.LOG_APPENDER + "An error occurred whilst trying to [load] the device KeyStore '" +
AgentConstants.DEVICE_KEYSTORE + "'.");
log.error(AgentConstants.LOG_APPENDER + e);
log.warn(AgentConstants.LOG_APPENDER + "Device will be re-enrolled.");
return;
} catch (IOException e) {
log.error(AgentConstants.LOG_APPENDER +
"An error occurred whilst trying to load input stream with the keystore file: " +
AgentConstants.DEVICE_KEYSTORE);
log.error(AgentConstants.LOG_APPENDER + e);
log.warn(AgentConstants.LOG_APPENDER + "Device will be re-enrolled.");
return;
} }
try { try {
if (this.isEnrolled) { if (this.isEnrolled) {
this.SCEPCertificate = (X509Certificate) keyStore.getCertificate(AgentConstants.DEVICE_CERT_ALIAS); this.SCEPCertificate = (X509Certificate) keyStore.getCertificate(AgentConstants.DEVICE_CERT_ALIAS);
@ -262,9 +245,6 @@ public class EnrollmentManager {
KeyStore keyStore; KeyStore keyStore;
try { try {
keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE); keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE);
keyStore.load(new FileInputStream(AgentConstants.DEVICE_KEYSTORE),
AgentConstants.DEVICE_KEYSTORE_PASSWORD.toCharArray());
keyStore.setCertificateEntry(alias, certificate); keyStore.setCertificateEntry(alias, certificate);
keyStore.store(new FileOutputStream(AgentConstants.DEVICE_KEYSTORE), keyStore.store(new FileOutputStream(AgentConstants.DEVICE_KEYSTORE),
AgentConstants.DEVICE_KEYSTORE_PASSWORD.toCharArray()); AgentConstants.DEVICE_KEYSTORE_PASSWORD.toCharArray());
@ -285,9 +265,6 @@ public class EnrollmentManager {
KeyStore keyStore; KeyStore keyStore;
try { try {
keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE); keyStore = KeyStore.getInstance(AgentConstants.DEVICE_KEYSTORE_TYPE);
keyStore.load(new FileInputStream(AgentConstants.DEVICE_KEYSTORE),
AgentConstants.DEVICE_KEYSTORE_PASSWORD.toCharArray());
Certificate[] certChain = new Certificate[1]; Certificate[] certChain = new Certificate[1];
certChain[0] = certInCertChain; certChain[0] = certInCertChain;

14
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/transport/CommunicationUtils.java
Unescape View File

@ -43,7 +43,7 @@ public class CommunicationUtils {
private static final Log log = LogFactory.getLog(TransportUtils.class); private static final Log log = LogFactory.getLog(TransportUtils.class);
// The Signature Algorithm used. // The Signature Algorithm used.
private static final String SIGNATURE_ALG = "SHA1withRSA"; private static final String SHA_512 = "SHA-512";
// The Encryption Algorithm and the Padding used. // The Encryption Algorithm and the Padding used.
private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding"; private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding";
@ -107,7 +107,7 @@ public class CommunicationUtils {
String signedEncodedString; String signedEncodedString;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initSign(signatureKey); signature.initSign(signatureKey);
signature.update(Base64.decodeBase64(message)); signature.update(Base64.decodeBase64(message));
@ -116,11 +116,11 @@ public class CommunicationUtils {
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = String errorMsg =
"Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {
@ -152,7 +152,7 @@ public class CommunicationUtils {
boolean verified; boolean verified;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initVerify(verificationKey); signature.initVerify(verificationKey);
signature.update(Base64.decodeBase64(data)); signature.update(Base64.decodeBase64(data));
@ -160,11 +160,11 @@ public class CommunicationUtils {
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = String errorMsg =
"Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new TransportHandlerException(errorMsg, e); throw new TransportHandlerException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {

15
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/transport/TransportUtils.java
Unescape View File

@ -36,6 +36,8 @@ import java.net.ServerSocket;
import java.net.SocketException; import java.net.SocketException;
import java.net.URL; import java.net.URL;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Enumeration; import java.util.Enumeration;
import java.util.HashMap; import java.util.HashMap;
@ -173,28 +175,27 @@ public class TransportUtils {
*/ */
public static synchronized int getAvailablePort(int randomAttempts) { public static synchronized int getAvailablePort(int randomAttempts) {
ArrayList<Integer> failedPorts = new ArrayList<Integer>(randomAttempts); ArrayList<Integer> failedPorts = new ArrayList<Integer>(randomAttempts);
try {
Random randomNum = new Random(); SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
int randomPort = MAX_PORT_NUMBER; int randomPort = MAX_PORT_NUMBER;
while (randomAttempts > 0) { while (randomAttempts > 0) {
randomPort = randomNum.nextInt(MAX_PORT_NUMBER - MIN_PORT_NUMBER) + MIN_PORT_NUMBER; randomPort = secureRandom.nextInt(MAX_PORT_NUMBER - MIN_PORT_NUMBER) + MIN_PORT_NUMBER;
if (checkIfPortAvailable(randomPort)) { if (checkIfPortAvailable(randomPort)) {
return randomPort; return randomPort;
} }
failedPorts.add(randomPort); failedPorts.add(randomPort);
randomAttempts--; randomAttempts--;
} }
randomPort = MAX_PORT_NUMBER; randomPort = MAX_PORT_NUMBER;
while (true) { while (true) {
if (!failedPorts.contains(randomPort) && checkIfPortAvailable(randomPort)) { if (!failedPorts.contains(randomPort) && checkIfPortAvailable(randomPort)) {
return randomPort; return randomPort;
} }
randomPort--; randomPort--;
} }
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("SHA1PRNG algorithm could not be found.");
}
} }

14
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.agent.impl/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/agent/virtual/VirtualHardwareManager.java
Unescape View File

@ -33,6 +33,8 @@ import javax.sound.sampled.Clip;
import javax.swing.*; import javax.swing.*;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
/** /**
* This class use to emulate virtual hardware functionality * This class use to emulate virtual hardware functionality
@ -174,19 +176,19 @@ public class VirtualHardwareManager {
} }
private int getRandom(int max, int min, int current, boolean isSmoothed, int svf) { private int getRandom(int max, int min, int current, boolean isSmoothed, int svf) {
if (isSmoothed) { if (isSmoothed) {
int offset = (max - min) * svf / 100; int offset = (max - min) * svf / 100;
double mx = current + offset; double mx = current + offset;
max = (mx > max) ? max : (int) Math.round(mx); max = (mx > max) ? max : (int) Math.round(mx);
double mn = current - offset; double mn = current - offset;
min = (mn < min) ? min : (int) Math.round(mn); min = (mn < min) ? min : (int) Math.round(mn);
} }
try {
double rnd = Math.random() * (max - min) + min; SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
return (int) Math.round(rnd); return secureRandom.nextInt(max - min) + min;
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("SHA1PRNG algorithm could not be found.");
}
} }
private void setAudioSequencer() { private void setAudioSequencer() {

14
components/device-types/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.plugin/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/plugin/impl/VirtualFirealarmSecurityManager.java
Unescape View File

@ -51,7 +51,7 @@ public class VirtualFirealarmSecurityManager {
private static final Log log = LogFactory.getLog(VirtualFirealarmSecurityManager.class); private static final Log log = LogFactory.getLog(VirtualFirealarmSecurityManager.class);
private static PrivateKey serverPrivateKey; private static PrivateKey serverPrivateKey;
private static final String SIGNATURE_ALG = "SHA1withRSA"; private static final String SHA_512 = "SHA-512";
private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding"; private static final String CIPHER_PADDING = "RSA/ECB/PKCS1Padding";
private static CertificateKeystoreConfig certificateKeystoreConfig; private static CertificateKeystoreConfig certificateKeystoreConfig;
private VirtualFirealarmSecurityManager() { private VirtualFirealarmSecurityManager() {
@ -162,7 +162,7 @@ public class VirtualFirealarmSecurityManager {
String signedEncodedString; String signedEncodedString;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initSign(signatureKey); signature.initSign(signatureKey);
signature.update(Base64.decodeBase64(encryptedData)); signature.update(Base64.decodeBase64(encryptedData));
@ -170,11 +170,11 @@ public class VirtualFirealarmSecurityManager {
signedEncodedString = Base64.encodeBase64String(signatureBytes); signedEncodedString = Base64.encodeBase64String(signatureBytes);
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = "Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e); throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e); throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {
@ -193,18 +193,18 @@ public class VirtualFirealarmSecurityManager {
boolean verified; boolean verified;
try { try {
signature = Signature.getInstance(SIGNATURE_ALG); signature = Signature.getInstance(SHA_512);
signature.initVerify(verificationKey); signature.initVerify(verificationKey);
signature.update(Base64.decodeBase64(data)); signature.update(Base64.decodeBase64(data));
verified = signature.verify(Base64.decodeBase64(signedData)); verified = signature.verify(Base64.decodeBase64(signedData));
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
String errorMsg = "Algorithm not found exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Algorithm not found exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e); throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e);
} catch (SignatureException e) { } catch (SignatureException e) {
String errorMsg = "Signature exception occurred for Signature instance of [" + SIGNATURE_ALG + "]"; String errorMsg = "Signature exception occurred for Signature instance of [" + SHA_512 + "]";
log.error(errorMsg); log.error(errorMsg);
throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e); throw new VirtualFirealarmDeviceMgtPluginException(errorMsg, e);
} catch (InvalidKeyException e) { } catch (InvalidKeyException e) {

Write Preview
Loading…
Cancel
Save