Skip to content

Commit e367425

Browse files
rangaranrangaran
authored
Merge pull request #32228 from rangaran/fix-sipcon
Fix the SIP container
2 parents e23a7af + 600610d commit e367425

File tree

4 files changed

+73
-16
lines changed

4 files changed

+73
-16
lines changed

‎dev/com.ibm.ws.sipcontainer/src/com/ibm/ws/sip/security/auth/AuthHeader.java‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2008, 2009 IBM Corporation and others.
2+
* Copyright (c) 2008, 2025 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -23,6 +23,7 @@
2323
import com.ibm.sip.util.log.Log;
2424
import com.ibm.sip.util.log.LogMgr;
2525
import com.ibm.sip.util.log.Situation;
26+
import com.ibm.ws.common.crypto.CryptoUtils;
2627
import com.ibm.ws.sip.container.servlets.SipServletMessageImpl;
2728
import com.ibm.ws.sip.container.servlets.SipServletRequestImpl;
2829
import com.ibm.ws.sip.container.servlets.SipServletResponseImpl;
@@ -259,6 +260,7 @@ private byte[] getBody(SipServletMessageImpl message) {
259260
* @param uri The request URI
260261
* @param algorithm The algorithm requested in the challange
261262
* (either 'MD5' or 'MD5-SESS').
263+
* (either 'SHA256' or 'SHA256-SESS') for fips
262264
* @param opaque An opaque value from the challange response, to be embeded
263265
* in the header. null for none.
264266
* @param body The message body. Only needed if qop="auth-int"
@@ -301,7 +303,8 @@ private String createHeaderString(String sipMethod, String nonce,
301303
* @param cnonce The client-side nonce
302304
* @param uri The request URI
303305
* @param algorithm The algorithm requested in the challange
304-
* (either 'MD5' or 'MD5-SESS').
306+
* (either 'MD5' or 'MD5-SESS')
307+
* (either 'SHA256' or 'SHA256-SESS') for fips
305308
* @param opaque An opaque value from the challange response, to be embeded
306309
* in the header. null for none.
307310
* @param body The message body. Only needed if qop="auth-int"
@@ -325,7 +328,16 @@ private String getAuthParamString(String sipMethod, String nonce,
325328
addParam(header, DigestConstants.PROPERTY_USER_NAME, _username, true);
326329
addParam(header, DigestConstants.PROPERTY_URI, uri, true);
327330
addParam(header, DigestConstants.PROPERTY_NONCE, nonce, true);
328-
algorithm = (algorithm == null ? DigestConstants.ALG_MD5 : algorithm);
331+
332+
//Based on whether fips is enabled or not
333+
if (CryptoUtils.isFips140_3EnabledWithBetaGuard()){
334+
algorithm = (algorithm == null ? DigestConstants.ALG_SHA256 : algorithm);
335+
}
336+
else{
337+
algorithm = (algorithm == null ? DigestConstants.ALG_MD5 : algorithm);
338+
}
339+
340+
329341
addParam(header, DigestConstants.PROPERTY_ALGORITHM, algorithm, true);
330342
if (qop != null) {
331343
addParam(header, DigestConstants.PROPERTY_QOP, qop, true);
@@ -357,6 +369,7 @@ private String getAuthParamString(String sipMethod, String nonce,
357369
* @param uri The request URI
358370
* @param algorithm The algorithm requested in the challange
359371
* (either 'MD5' or 'MD5-SESS').
372+
* (either 'SHA256' or 'SHA256-SESS') for fips
360373
* @param body The message body. Only needed if qop="auth-int"
361374
* @return the calculated digest
362375
*/

‎dev/com.ibm.ws.sipcontainer/src/com/ibm/ws/sip/security/auth/DigestConstants.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2003,2004 IBM Corporation and others.
2+
* Copyright (c) 2003,2025 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -14,12 +14,14 @@
1414

1515
import com.ibm.ws.common.crypto.CryptoUtils;
1616

17-
public interface DigestConstants {
17+
public interface DigestConstants{
1818
public static final short DIGEST_LENGTH=6;
1919
public static final String DIGEST = "Digest";
2020
public static final String DIGEST_REALM = "realm=";
2121
public static final String DIGEST_FIRST_REQUEST = "Digest qop=\"auth\",charset=utf-8,algorithm=md5,nonce=";
22+
public static final String DIGEST_FIRST_REQUEST_SHA256 = "Digest qop=\"auth\",charset=utf-8,algorithm=sha256,nonce=";
2223
public static final String DIGEST_FIRST_REQUEST_WITH_AUTH_INT = "Digest qop=\"auth-int\",charset=utf-8,algorithm=md5,nonce=";
24+
public static final String DIGEST_FIRST_REQUEST_WITH_AUTH_INT_SHA256 = "Digest qop=\"auth-int\",charset=utf-8,algorithm=sha256,nonce=";
2325
public static final String DIGEST_AUTH_INFO_RESPONSE = "qop=\"auth\",nextnonce=";
2426

2527
public static final String PROPERTY_USER_NAME = "username";
@@ -37,6 +39,8 @@ public interface DigestConstants {
3739
public static final String QOP_AUTH = "auth";
3840
public static final String QOP_AUTH_INT = "auth-int";
3941
public static final String ALG_MD5 = CryptoUtils.MESSAGE_DIGEST_ALGORITHM_MD5;
42+
public static final String ALG_SHA256 = CryptoUtils.MESSAGE_DIGEST_ALGORITHM_SHA_256;
4043
public static final String ALG_MD5_SESS = "MD5-sess";
44+
public static final String ALG_SHA256_SESS = "SHA256-sess";
4145
public static final String METHOD_DEFAULT="AUTHENTICATE";
4246
}

‎dev/com.ibm.ws.sipcontainer/src/com/ibm/ws/sip/security/auth/DigestUtils.java‎

Lines changed: 48 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2008, 2009 IBM Corporation and others.
2+
* Copyright (c) 2008, 2025 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -16,6 +16,7 @@
1616

1717
import com.ibm.sip.util.log.Log;
1818
import com.ibm.sip.util.log.LogMgr;
19+
import com.ibm.ws.common.crypto.CryptoUtils;
1920

2021
/**
2122
* Digest-generation utilities for the digest code. This class contains code
@@ -68,7 +69,7 @@ private static String toHexString(byte b[]) {
6869
}
6970

7071
/**
71-
* Caculate the MD5 digest of the given byte array.
72+
* Caculate the MD5 or SHA256 digest (based on whether fips is enabled) of the given byte array.
7273
* @param msg The message to hash
7374
* @param digester The digester object to use.
7475
* @return A hashed representation of the message.
@@ -119,14 +120,15 @@ private static String textDigest(byte[] textBytes, MessageDigest digester)
119120

120121
/**
121122
* Calculate the A1 (username-realm-password) value for the digest.
122-
* This is the 'plain md5' version, as opposed to the 'md5-sess' value,
123-
* calculated by the method createA1MD5Sess.
123+
* This is the 'plain md5'/'sha256' version, as opposed to the 'md5-sess'/'sha256-sess' value (based on whether fips is enabled),
124+
* calculated by the method createA1MD5Sess/createA1SHA256Sess.
124125
*
125126
* @param user The username
126127
* @param realm The authentication realm.
127128
* @param passwd The user password.
128129
* @return A1 value as a string.
129130
* @see #createA1MD5Sess(String, String, String, String, String,
131+
* MessageDigest)/#createA1SHA256Sess(String, String, String, String, String,
130132
* MessageDigest)
131133
*/
132134
public static String createHashedA1(String user, String realm,
@@ -187,6 +189,40 @@ private static String createA1MD5Sess(String ha1, String nonce,
187189
}
188190
return hexHash;
189191
}
192+
193+
/**
194+
* Calculate the A1 (username-realm-password) value for the digest.
195+
* This is the 'SHA256-sess' version, which hashes the value username and
196+
* password along with the server and client nonces
197+
*
198+
* @param ha1 The non-sha256-sess value for a1 (hashed once)
199+
* @param nonce The server-side nonce.
200+
* @param cnonce The client-side nonce.
201+
* @param digester The digester to use for hashing.
202+
*
203+
* @return A1 value as a string.
204+
* @see #createA1(String, String, String)
205+
*/
206+
private static String createA1SHA256Sess(String ha1, String nonce,
207+
String cnonce, MessageDigest digester)
208+
{
209+
if (c_logger.isTraceEntryExitEnabled()) {
210+
c_logger.traceEntry(null, "createA1SHA256Sess",
211+
new Object[] {ha1, nonce, cnonce, digester});
212+
}
213+
StringBuffer buff = new StringBuffer(BUFFER_INITIAL_SIZE);
214+
buff.append(ha1);
215+
buff.append(":");
216+
buff.append(nonce);
217+
buff.append(":");
218+
buff.append(cnonce);
219+
String hexHash = buff.toString();
220+
221+
if (c_logger.isTraceEntryExitEnabled()) {
222+
c_logger.traceExit(null, "createA1SHA256Sess", hexHash);
223+
}
224+
return hexHash;
225+
}
190226

191227
/**
192228
* Create an A2 value for use with the auth-int QOP value. I.e. one that
@@ -307,7 +343,7 @@ private static String createKD(String HA1, String nonce, String nc,
307343
* @param cnonce The client-side nonce
308344
* @param uri The request URI
309345
* @param algorithm The algorithm to use. Could be either 'MD5' or
310-
* 'MD5-sess'
346+
* 'MD5-sess' / 'SHA256' or 'SHA256-sess'
311347
* @param sipMethod The sip method of the client request.
312348
* @param body The message body to authenticate. Only needed if
313349
* qop="auth-int"
@@ -355,7 +391,7 @@ public static String createDigestFromAuthParams(String username,
355391
* @param cnonce The client-side nonce
356392
* @param uri The request URI
357393
* @param algorithm The algorithm to use. Could be either 'MD5' or
358-
* 'MD5-sess'
394+
* 'MD5-sess'/ 'SHA256' or 'SHA256-sess'
359395
* @param sipMethod The sip method of the client request.
360396
* @param body The message body to authenticate. Only needed if
361397
* qop="auth-int"
@@ -371,11 +407,14 @@ public static String createDigestFromAuthParams(String ha1, String nonce,
371407
cnonce, uri, algorithm, sipMethod, body});
372408
}
373409
MessageDigest digester = ThreadLocalStorage.getMessageDigest();
374-
if (algorithm != null && algorithm.equals(DigestConstants.ALG_MD5_SESS)) {
375-
String A1 = createA1MD5Sess(ha1, nonce, cnonce, digester);
376-
ha1 = textDigest(A1, digester);
410+
String A1 = createA1MD5Sess(ha1, nonce, cnonce, digester);
411+
412+
//if fips is enabled
413+
if (CryptoUtils.isFips140_3EnabledWithBetaGuard() && algorithm != null && algorithm.equals(DigestConstants.ALG_SHA256_SESS)) {
414+
A1 = createA1SHA256Sess(ha1, nonce, cnonce, digester);
377415
}
378416

417+
ha1 = textDigest(A1, digester);
379418
String A2 = null;
380419
if (sipMethod == null)
381420
sipMethod = DigestConstants.METHOD_DEFAULT;

‎dev/com.ibm.ws.sipcontainer/src/com/ibm/ws/sip/security/auth/ThreadLocalStorage.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*******************************************************************************
2-
* Copyright (c) 2003 IBM Corporation and others.
2+
* Copyright (c) 2003,2025 IBM Corporation and others.
33
* All rights reserved. This program and the accompanying materials
44
* are made available under the terms of the Eclipse Public License 2.0
55
* which accompanies this distribution, and is available at
@@ -32,7 +32,8 @@ public class ThreadLocalStorage
3232
private static MessageDigest createMsgDigest(){
3333
MessageDigest digester = null;
3434
try {
35-
digester = MessageDigest.getInstance(CryptoUtils.MESSAGE_DIGEST_ALGORITHM_MD5);
35+
//Based on whether fips is enabled or not
36+
digester = CryptoUtils.isFips140_3EnabledWithBetaGuard() ? MessageDigest.getInstance(CryptoUtils.MESSAGE_DIGEST_ALGORITHM_SHA256) : MessageDigest.getInstance(CryptoUtils.MESSAGE_DIGEST_ALGORITHM_MD5);
3637
_msgDigest.set( digester);
3738
} catch (NoSuchAlgorithmException e) {
3839
e.printStackTrace();

0 commit comments

Comments
 (0)