3 Securing Network Traffic

Understanding How to Secure Network Traffic

Securing network traffic between your Services Gatekeeper and the users and applications that connect to it over the Internet involves these general categories:

• Configuring Network Traffic Security with ApiFirewallMBean

• Implementing Denial-of-Service Attack Protection with ApiFirewall

• Removing External Entity Reference Security

In addition, there are special considerations for API management users, and communication services. See these sections for details:

• Implementing Network Traffic Security for APIs

• Securing Communication Services

Configuring Network Traffic Security with ApiFirewallMBean

You configure network security traffic by performing the following general tasks:

• Deciding which error message to return when a SOAP or REST message is rejected. The default error message is 400 Bad Request, which is the most descriptive. You set the error message by using the getErrorStatus attribute of ApiFirewallMBean. See the ”All Classes” section of Services Gatekeeper OAM Java API Reference for details.

• Deciding whether to direct Services Gatekeeper to create an EDR and alarm for each firewall violation by using the CreateViolationEdrs attribute to ApiFirewallMBean. The attribute is boolean and the default value is yes.

  The EDR is created with one of these statuses:

  • Reject - no further status is available.

  • Reject: json - An exception was thrown while parsing JSON.

  • Reject: size - The message was too big.

  • Reject: scheme - Protocol scheme was not allowed (for example, HTTP was used to access a HTTPS only API).

  The new alarm number is 390000. For details see "390000: Request Rejected by API Firewall” in Services Gatekeeper Alarms Handling Guide.

  This is an example CreateViolationEdrs EDR:

  ServiceName = null
  Timestamp = 1473942471250
  ContainerTransactionId = null
  ServerName = servername
  Class = oracle.ocsg.api_firewall.filter.GenericAPIFirewallFilter
  Method = doFilter
  Source = Exception
  HttpStatusCode = 400
  Status = Reject: size
  Position = after
  Method = doFilter
  TransactionId = 67e7ed6c-26cc-4c07-b59c-bb36f40e502d
  State = API-FW
  Class = oracle.ocsg.api_firewall.filter.GenericAPIFirewallFilter
  HttpMethod = POST
  Timestamp = 1473942471250
  Source = Exception
  URL = /weather-soap/1/weather
  ErrCat = API-FW
  ServerName = servername
  

• Setting the maximum limits for error messages, including:

  • The maximum total size of a single message entity, such as a comment, by using the MaxItemValueLength attribute of ApiFirewallMBean.

  • The maximum total size of an error message by using the getMaxMessageSize attribute of ApiFirewallMBean.

  • The maximum number of nested message elements by using the getMaxChildElementDepth attribute of ApiFirewallMBean.

  • The maximum number of unbounded elements by using the getMaxUnboundedItems attribute of ApiFirewallMBean.

  Note:

  The maximum size supported for any single message is 200 MB.

• (Optional) Creating a list of trusted APIs. Most of the ApiFirewall MBean security attributes filter messages that are potential security risks. This filtering process degrades performance slightly. To avoid this performance penalty, create a list of trusted APIs that are exempt from the filtering process by using the setApiConfigXml attribute of ApiFirewallMBean. See ”Creating a List of Trusted APIs Using ApiConfigXml” for details.

• (Optional) creating a list of trusted IP addresses for REST-based communication. See "Protecting REST APIs with a White List of IP Addresses" for instructions.

You can change ApiFirewallMBean attributes from the Administration Console or by editing the MBean directly. For a description of the attributes and operations of the ApiFirewallMBean MBean, see the ”All Classes” section of Services Gatekeeper OAM Java API Reference.

<?xml version="1.0" encoding="UTF-8"?>
<schema xmlns="http://www.w3.org/2001/XMLSchema" 
  targetNamespace="http://oracle/ocsg/api_firewall/management/xml"
      xmlns:tns="http://oracle/ocsg/api_firewall/management/xml" 
      elementFormDefault="qualified">
      <element name="baseApis">
              <complexType>
                     <complexContent>
                             <extension base="tns:Apis">
                             </extension>
                     </complexContent>
              </complexType>         
      </element>
 
      <complexType name="Apis">             
              <sequence>
                     <element name="apis" type="tns:Api" minOccurs="0" maxOccurs="unbounded"></element>
              </sequence>
      </complexType>
 
      <complexType name="Api">              
              <sequence>
                <choice>
                     <element name="requestUrl" type="string"></element>
                     <element name="requestUrl_regex" type="string"></element>
            </choice>
                     <element name="method" type="string" minOccurs="0" maxOccurs="unbounded"></element>
              </sequence>            
      </complexType>
</schema>

<?xml version="1.0" encoding="UTF-8"?>
<baseApis xmlns="http://oracle/ocsg/api_firewall/management/xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <apis>
    <requestUrl>/parlayx21/sms/SendSms</requestUrl>
    <method>sendSmsLogo</method>
  </apis>
<apis>
    <requestUrl_regex>/oneapi/1/smsmessaging/outbound/(.*)/requests</requestUrl_regex>
    <method>POST</method>
  </apis>
</baseApis>

Implementing Denial-of-Service Attack Protection with ApiFirewall

Your network implementation can be vulnerable to denial of service (DOS) attacks, which generally try to interfere with legitimate communication inside the Services Gatekeeper Access Tier. To prevent these messages from reaching your network, Services Gatekeeper offers configurable SOAP and RESTful message filtering. You configure this filtering behavior by using the ApiFirewall configuration MBean. ApiFirewall determines how Services Gatekeeper filters messages attempting to enter the Services Gatekeeper application tier.

Table 3-1 lists network attacks that Services Gatekeeper protects against, and lists where you can find information about configuring those protections.

Protecting REST APIs with a White List of IP Addresses

This feature allows you to protect your REST-based APIs by limiting access to them to a specific list of trusted IP addresses. You specify the trusted IP addresses using a special key/value pair in a call to the Services Gatekeeper application tier (AT) using the updateAllSysConfig system configurations operation. The prmIPAddressWhitelist key in this operation matches a value that specifies the white list of IP addresses. The key value accepts alpha-numeric characters, dots, and asterisk (*) wildcard character to specify IP addresses, and commas to separate IP address items. Table 3-2 lists some example values to go with the prmIPAddressWhitelist key.

This example call to updateAllSysConfig creates a white list of IP addresses allowed to communicate with Services Gatekeeper. The list includes all IP addresses that use the first byte of 192:

curl
'http://localhost:8001/prm_pm_rest/services/prm_pm/services/partner_manager/sysconfig/updateAllSysConfig'\
-X PUT -H 'Pragma: no-cache' -H 'Origin: http://localhost:7005' -H 'Accept-Encoding: gzip, deflate,
sdch'\
-H 'Accept-Language: en-US,en;q=0.8' -H 'Authorization: Basic b3A6d2VibG9naWMxMjM='\
-H 'Content-Type: application/json' -H 'Accept: application/json, text/javascript, */*; q=0.01'\
-H 'Cache-Control: no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive'\
-H 'Referer: http://localhost:7005/portal/partner-manager/index/main.html'\
--data-binary '{"updateAllSysConfig":{"sysConfig":[{"key":"obieServerAddress","value":""},
{"key":"obieServerUserName","value":""},{"key":"obieServerPassword","value":"
{AES}tAtwHZPedgVyZISQdjuYng=="},{"key":"mailServerAddress","value":""},
{"key":"mailServerPort","value":""},{"key":"isMailServerSSL","value":"false"},
{"key":"mailServerUsername","value":""},{"key":"mailServerPassword","value":"
{AES}tAtwHZPedgVyZISQdjuYng=="},{"key":"isMailHttpProxy","value":"false"},
{"key":"mailProxyHost","value":""},{"key":"mailProxyPort","value":""},
{"key":"isAutoApprovalReg","value":"true"},{"key":"isAutoApprovalApp","value":"true"},
{"key":"ocsgServerAddr","value":""},{"key":"ocsgServerPort","value":""},
{"key":"ocsgServerSslPort","value":""},{"key":"isOcsgMultiTier","value":"false"},
{"key":"ocsgNtServerAddr","value":""},{"key":"ocsgNtServerPort","value":""},
{"key":"ocsgNtServerSslPort","value":""},{"key":"prmIPAddressWhitelist","value":"192.*"}]}}' --compressed

See "updateAllSysConfig" for more information.

Removing External Entity Reference Security

By default, Services Gatekeeper does not allow references to external entities. You can use this Java system property to remove this protection:

oracle.ocsg.api_firewall.isSupportingExternalEntities=true

Linux example:

JAVA_OPTIONS="${JAVA_OPTIONS} -Doracle.ocsg.api_firewall.isSupportingExternalEntities=true"

Windows example:

set JAVA_OPTIONS=%JAVA_OPTIONS% -Doracle.ocsg.api_firewall.isSupportingExternalEntities=true

Implementing Network Traffic Security for APIs

Securing network traffic between your Services Gatekeeper API management system and the users and applications that connect to it involves these general categories:

• Authenticating Users and Applications

• Implementing Denial-of-Service Attack Protection with ApiFirewall

• Configuring Network Traffic Security with ApiFirewallMBean