You are viewing a plain text version of this content. The canonical link for it is here.
Posted to fx-dev@ws.apache.org by we...@apache.org on 2004/06/02 21:35:44 UTC
cvs commit: ws-fx/wss4j/src/org/apache/ws/axis/security/util AxisUtil.java
werner 2004/06/02 12:35:44
Modified: wss4j/src log4j.properties
wss4j/src/org/apache/ws/axis/security WSDoAllReceiver.java
WSDoAllConstants.java WSDoAllSender.java
wss4j/src/org/apache/ws/security/message
WSSAddUsernameToken.java WSSAddSAMLToken.java
WSEncryptBody.java WSBaseMessage.java
WSSignEnvelope.java
wss4j/src/org/apache/ws/security errors.properties
WSConstants.java WSSecurityEngine.java
WSSecurityEngineResult.java
wss4j/src/org/apache/ws/axis/security/util AxisUtil.java
Added: wss4j/src/org/apache/ws/security/message WSAddTimestamp.java
wss4j/src/org/apache/ws/security/message/token
Timestamp.java
Log:
WSFX-9: Implement explicit timestamp handling, patches from Christof.
Revision Changes Path
1.2 +2 -1 ws-fx/wss4j/src/log4j.properties
Index: log4j.properties
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/log4j.properties,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- log4j.properties 26 May 2004 19:15:36 -0000 1.1
+++ log4j.properties 2 Jun 2004 19:35:43 -0000 1.2
@@ -10,7 +10,7 @@
# log4j.logger.org.apache.ws.security.message.WSEncryptBody=INFO
# log4j.logger.org.apache.ws.security.message.WSSignEnvelope=DEBUG
# log4j.logger.org.apache.ws.axis.security.WSDoAllSender=DEBUG
-# log4j.logger.org.apache.ws.axis.security.WSDoAllReceiver=DEBUG
+log4j.logger.org.apache.ws.axis.security.WSDoAllReceiver=DEBUG
# log4j.logger.org.apache.ws.security.transform.STRTransform=DEBUG
# log4j.logger.org.apache.ws.security.WSSecurityEngine=DEBUG
# log4j.logger.org.apache.ws.security.message.token.SecurityTokenReference=DEBUG
@@ -27,6 +27,7 @@
# log4j.logger.wssec.TestWSSecurityST1=DEBUG
# log4j.logger.wssec.TestWSSecurityST2=DEBUG
# log4j.logger.wssec.TestWSSecurityST3=DEBUG
+# log4j.logger.wssec.TestWSSecuritySOAP12=DEBUG
# CONSOLE is set to be a ConsoleAppender using a PatternLayout.
log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
1.12 +76 -0 ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllReceiver.java
Index: WSDoAllReceiver.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllReceiver.java,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- WSDoAllReceiver.java 13 May 2004 14:27:39 -0000 1.11
+++ WSDoAllReceiver.java 2 Jun 2004 19:35:43 -0000 1.12
@@ -38,6 +38,7 @@
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
import org.apache.ws.security.util.WSSecurityUtil;
+import org.apache.ws.security.message.token.Timestamp;
import org.apache.xml.security.utils.XMLUtils;
import org.w3c.dom.Document;
@@ -47,8 +48,11 @@
import java.io.ByteArrayOutputStream;
import java.math.BigInteger;
import java.security.cert.X509Certificate;
+import java.text.SimpleDateFormat;
+import java.util.Calendar;
import java.util.Hashtable;
import java.util.Iterator;
+import java.util.TimeZone;
import java.util.Vector;
public class WSDoAllReceiver extends BasicHandler {
@@ -67,6 +71,9 @@
Crypto decCrypto = null;
String decPropFile = null;
+ /* TODO: Make timeToLive (receiver) configurable in the config file */
+ protected int timeToLive = 60; // Timestamp: time in seconds the receiver accepts between creation and reception
+
/**
* Axis calls invoke to handle a message.
* <p/>
@@ -241,6 +248,28 @@
}
/*
+ * Perform further checks on the timestamp that was transmitted in the header.
+ * In the following implementation the timestamp is valid if it was
+ * created after (now-ttl), where ttl is set on server side, not by the client.
+ *
+ * Note: the method verifyTimestamp(Timestamp) allows custom
+ * implementations with other validation algorithms for subclasses.
+ */
+
+ // Extract the timestamp action result from the action vector
+ actionResult = WSSecurityUtil.fetchActionResult(wsResult, WSConstants.TS);
+
+ if (actionResult != null) {
+ Timestamp timestamp = actionResult.getTimestamp();
+
+ if (timestamp != null) {
+ if (!verifyTimestamp(timestamp, timeToLive)) {
+ throw new AxisFault("WSDoAllReceiver: The timestamp could not be validated");
+ }
+ }
+ }
+
+ /*
* now check the security actions: do they match, in right order?
*/
int resultActions = wsResult.size();
@@ -543,5 +572,52 @@
log.debug("WSDoAllReceiver: Certificate path could not be verified for certificate with subject " + subjectString);
return false;
+ }
+
+ /**
+ * Evaluate whether a timestamp is considered valid on receiverside.
+ * Hook to allow subclasses to implement custom validation methods however they see fit.
+ * <p/>
+ * Policy used in this implementation:
+ * 1. The receiver can set its own time to live (besides from that set on sender side)
+ * 2. If the message was created before (now-ttl) the message is rejected
+ *
+ * @param timestamp the timestamp that is validated
+ * @param timeToLive the limit on receiverside, the timestamp is validated against
+ * @return true if the timestamp is before (now-timeToLive), false otherwise
+ * @throws AxisFault
+ */
+ protected boolean verifyTimestamp(Timestamp timestamp, int timeToLive) throws AxisFault {
+
+ // Calculate the time that is allowed for the message to travel
+ Calendar validCreation = Calendar.getInstance();
+ long currentTime = validCreation.getTimeInMillis();
+ currentTime -= timeToLive * 1000;
+ validCreation.setTimeInMillis(currentTime);
+
+ if (doDebug) {
+ log.debug("Preparing to verify the timestamp");
+ SimpleDateFormat zulu = new SimpleDateFormat(
+ "yyyy-MM-dd'T'HH:mm:ss'Z'");
+ zulu.setTimeZone(TimeZone.getTimeZone("GMT"));
+ log.debug("Validation of Timestamp: Current time is "
+ + zulu.format(Calendar.getInstance().getTime()));
+ log.debug("Validation of Timestamp: Valid creation is "
+ + zulu.format(validCreation.getTime()));
+ log.debug("Validation of Timestamp: Timestamp created is "
+ + zulu.format(timestamp.getCreated().getTime()));
+ }
+ // Validate the time it took the message to travel
+ // if (timestamp.getCreated().before(validCreation) ||
+ // !timestamp.getCreated().equals(validCreation)) {
+ if (!timestamp.getCreated().after(validCreation)) {
+ if (doDebug) {
+ log.debug("Validation of Timestamp: The message was created too long ago");
+ }
+ return false;
+ }
+
+ log.debug("Validation of Timestamp: Everything is ok");
+ return true;
}
}
1.9 +5 -0 ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllConstants.java
Index: WSDoAllConstants.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllConstants.java,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- WSDoAllConstants.java 26 May 2004 19:15:37 -0000 1.8
+++ WSDoAllConstants.java 2 Jun 2004 19:35:43 -0000 1.9
@@ -85,6 +85,11 @@
public static final String ENCRYPT = "Encrypt";
/**
+ * Add a timestamp to the security header.
+ */
+ public static final String TIMESTAMP = "Timestamp";
+
+ /**
* Supress the serialization of the SOAP message.
* <p/>
* Usually the handler serializes the processed SOAP message into a string
1.17 +15 -0 ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllSender.java
Index: WSDoAllSender.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/axis/security/WSDoAllSender.java,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- WSDoAllSender.java 30 May 2004 09:24:32 -0000 1.16
+++ WSDoAllSender.java 2 Jun 2004 19:35:43 -0000 1.17
@@ -36,6 +36,7 @@
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
+import org.apache.ws.security.message.WSAddTimestamp;
import org.apache.ws.security.message.WSEncryptBody;
import org.apache.ws.security.message.WSSAddUsernameToken;
import org.apache.ws.security.message.WSSignEnvelope;
@@ -107,6 +108,9 @@
X509Certificate encCert = null;
+ /* TODO: Make timeToLive (sender) configurable in the config file */
+ protected int timeToLive = 300; // Timestamp: time in seconds the receiver accepts between creation and reception
+
/**
* Initialize data fields from previous use in case of cached object. Axis
* may cache the handler object, thus weneed to intiailize (reset) some
@@ -290,6 +294,10 @@
performSTAction(actionToDo, mu, doc);
break;
+ case WSConstants.TS :
+ performTSAction(actionToDo, mu, doc);
+ break;
+
case WSConstants.NO_SERIALIZE :
noSerialization = true;
break;
@@ -523,6 +531,13 @@
"WSDoAllSender: Signed SAML: error during message processing"
+ e);
}
+ }
+
+ private void performTSAction(int actionToDo, boolean mu, Document doc) throws AxisFault {
+ WSAddTimestamp timeStampBuilder =
+ new WSAddTimestamp(actor, mu);
+ // add the Timestamp to the SOAP Enevelope
+ timeStampBuilder.build(doc, timeToLive);
}
/**
1.4 +1 -1 ws-fx/wss4j/src/org/apache/ws/security/message/WSSAddUsernameToken.java
Index: WSSAddUsernameToken.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/message/WSSAddUsernameToken.java,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- WSSAddUsernameToken.java 17 May 2004 04:15:01 -0000 1.3
+++ WSSAddUsernameToken.java 2 Jun 2004 19:35:44 -0000 1.4
@@ -107,7 +107,7 @@
*/
public Document build(Document doc, String username, String password) { // throws Exception {
log.debug("Begin add username token...");
- Element securityHeader = insertSecurityHeader(doc, false);
+ Element securityHeader = insertSecurityHeader(doc);
ut = new UsernameToken(doc, passwordType);
ut.setName(username);
ut.setPassword(password);
1.3 +1 -1 ws-fx/wss4j/src/org/apache/ws/security/message/WSSAddSAMLToken.java
Index: WSSAddSAMLToken.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/message/WSSAddSAMLToken.java,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- WSSAddSAMLToken.java 26 May 2004 19:15:37 -0000 1.2
+++ WSSAddSAMLToken.java 2 Jun 2004 19:35:44 -0000 1.3
@@ -83,7 +83,7 @@
log.debug("Begin add SAMLAssertion token...");
try {
Element element = (Element) assertion.toDOM(doc);
- Element securityHeader = insertSecurityHeader(doc, false);
+ Element securityHeader = insertSecurityHeader(doc);
WSSecurityUtil.prependChildElement(
doc,
securityHeader,
1.14 +2 -2 ws-fx/wss4j/src/org/apache/ws/security/message/WSEncryptBody.java
Index: WSEncryptBody.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/message/WSEncryptBody.java,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- WSEncryptBody.java 12 May 2004 18:45:10 -0000 1.13
+++ WSEncryptBody.java 2 Jun 2004 19:35:44 -0000 1.14
@@ -418,7 +418,7 @@
* 6) The last step sets up the reference list that pints to the encrypted
* data that was encrypted with this encrypted session key :-)
*/
- Element wsseSecurity = insertSecurityHeader(doc, true);
+ Element wsseSecurity = insertSecurityHeader(doc);
Element xencEncryptedKey = createEnrcyptedKey(doc, keyEncAlgo);
WSSecurityUtil.prependChildElement(
doc,
@@ -601,7 +601,7 @@
* 2) The last step sets up the reference list that pints to the encrypted
* data that was encrypted with this encrypted session key :-)
*/
- Element wsseSecurity = insertSecurityHeader(doc, true);
+ Element wsseSecurity = insertSecurityHeader(doc);
tmpE = doc.createElement("temp");
Element refList = createDataRefList(doc, tmpE, encDataRefs);
1.7 +1 -51 ws-fx/wss4j/src/org/apache/ws/security/message/WSBaseMessage.java
Index: WSBaseMessage.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/message/WSBaseMessage.java,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- WSBaseMessage.java 26 Apr 2004 05:40:23 -0000 1.6
+++ WSBaseMessage.java 2 Jun 2004 19:35:44 -0000 1.7
@@ -25,9 +25,6 @@
import org.w3c.dom.Document;
import org.w3c.dom.Element;
-import java.text.SimpleDateFormat;
-import java.util.Calendar;
-import java.util.TimeZone;
import java.util.Vector;
/**
@@ -215,7 +212,7 @@
* @param doc A SOAP envelope as <code>Document</code>
* @return A <code>wsse:Security</code> element
*/
- protected Element insertSecurityHeader(Document doc, boolean timestamp) {
+ protected Element insertSecurityHeader(Document doc) {
SOAPConstants soapConstants =
WSSecurityUtil.getSOAPConstants(doc.getDocumentElement());
// lookup a security header block that matches actor
@@ -246,53 +243,6 @@
soapConstants.getEnvelopeURI(),
soapPrefix + ":" + WSConstants.ATTR_MUST_UNDERSTAND,
soapConstants.getMustunderstand());
- }
- if (timestamp) {
- Element elementTime =
- doc.createElementNS(
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX
- + ":"
- + WSConstants.TIMESTAMP_TOKEN_LN);
- WSSecurityUtil.setNamespace(
- elementTime,
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX);
-
- SimpleDateFormat zulu =
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
- zulu.setTimeZone(TimeZone.getTimeZone("GMT"));
- Calendar rightNow = Calendar.getInstance();
-
- Element elementCreated =
- doc.createElementNS(
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX + ":" + WSConstants.CREATED_LN);
- WSSecurityUtil.setNamespace(
- elementCreated,
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX);
- elementCreated.appendChild(
- doc.createTextNode(zulu.format(rightNow.getTime())));
-
- long currentTime = rightNow.getTimeInMillis();
- currentTime += timeToLive * 1000;
- rightNow.setTimeInMillis(currentTime);
-
- Element elementExpires =
- doc.createElementNS(
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX + ":" + WSConstants.EXPIRES_LN);
- WSSecurityUtil.setNamespace(
- elementExpires,
- WSConstants.WSU_NS,
- WSConstants.WSU_PREFIX);
- elementExpires.appendChild(
- doc.createTextNode(zulu.format(rightNow.getTime())));
-
- elementTime.appendChild(elementCreated);
- elementTime.appendChild(elementExpires);
- securityHeader.appendChild(elementTime);
}
}
return securityHeader;
1.14 +2 -2 ws-fx/wss4j/src/org/apache/ws/security/message/WSSignEnvelope.java
Index: WSSignEnvelope.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/message/WSSignEnvelope.java,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- WSSignEnvelope.java 26 May 2004 19:15:37 -0000 1.13
+++ WSSignEnvelope.java 2 Jun 2004 19:35:44 -0000 1.14
@@ -220,7 +220,7 @@
Element envelope = doc.getDocumentElement();
SOAPConstants soapConstants = WSSecurityUtil.getSOAPConstants(envelope);
- Element securityHeader = insertSecurityHeader(doc, true);
+ Element securityHeader = insertSecurityHeader(doc);
// Set the id of the elements to be used as digest source
// String id = setBodyID(doc);
@@ -526,7 +526,7 @@
Element envelope = doc.getDocumentElement();
SOAPConstants soapConstants = WSSecurityUtil.getSOAPConstants(envelope);
- Element securityHeader = insertSecurityHeader(doc, true);
+ Element securityHeader = insertSecurityHeader(doc);
X509Certificate[] certs = null;
if (senderVouches) {
1.1 ws-fx/wss4j/src/org/apache/ws/security/message/WSAddTimestamp.java
Index: WSAddTimestamp.java
===================================================================
/*
* Copyright 2003-2004 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.apache.ws.security.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.ws.security.util.WSSecurityUtil;
import org.apache.ws.security.message.token.Timestamp;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
/**
* Builds a WS Timestamp and inserts it into the SOAP Envelope.
* Refer to the WS specification 1.0. chapter 10 / appendix A.2
*
* @author Christof Soehngen (Christof.Soehngen@syracom.de).
*/
public class WSAddTimestamp extends WSBaseMessage {
private static Log log = LogFactory.getLog(WSAddTimestamp.class.getName());
private Timestamp ts = null;
/**
* Constructor.
*/
public WSAddTimestamp() {
}
/**
* Constructor.
* <p/>
*
* @param actor the name of the actor of the <code>wsse:Security</code> header
*/
public WSAddTimestamp(String actor) {
super(actor);
}
/**
* Constructor.
* <p/>
*
* @param actor The name of the actor of the <code>wsse:Security</code> header
* @param mu Set <code>mustUnderstand</code> to true or false
*/
public WSAddTimestamp(String actor, boolean mu) {
super(actor, mu);
}
/**
* Adds a new <code>Timestamp</code> to a soap envelope.
* <p/>
* A complete <code>Timestamp</code> is constructed and added to
* the <code>wsse:Security</code> header.
*
* @param doc The SOAP enevlope as W3C document
* @param ttl This is the time difference in seconds between the <code>Created</code> and the <code>Expires</code> in <code>Timestamp</code>
* @return Document with Timestamp added
* @throws Exception
*/
public Document build(Document doc, int ttl) {
log.debug("Begin add timestamp...");
Element securityHeader = insertSecurityHeader(doc);
ts = new Timestamp(doc, ttl);
WSSecurityUtil.prependChildElement(doc, securityHeader, ts.getElement(), true);
return doc;
}
}
1.7 +1 -0 ws-fx/wss4j/src/org/apache/ws/security/errors.properties
Index: errors.properties
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/errors.properties,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- errors.properties 26 May 2004 19:15:37 -0000 1.6
+++ errors.properties 2 Jun 2004 19:35:44 -0000 1.7
@@ -59,6 +59,7 @@
noKeyname=WSSecurityEngine: ds:KeyName does not contain a key name
noEncElement=WSEncryptBody/WSSignEnvelope: Element to encrypt/sign not found: {0}
certpath=Error during certificate path validation: {0}
+invalidTimestamp=WSSecurityEngine: Invalid timestamp {0}
noKeySupplied=WSEncryptBody: No symmetrical encryption key supplied
#
noSAMLdoc=Cannot convert SAML to DOM document
1.19 +2 -1 ws-fx/wss4j/src/org/apache/ws/security/WSConstants.java
Index: WSConstants.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/WSConstants.java,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- WSConstants.java 26 May 2004 19:15:37 -0000 1.18
+++ WSConstants.java 2 Jun 2004 19:35:44 -0000 1.19
@@ -301,7 +301,8 @@
*/
public static final int ST_UNSIGNED = 0x8; // perform SAMLToken unsigned
public static final int ST_SIGNED = 0x10; // perform SAMLToken signed
-
+
+ public static final int TS = 0x20; // insert Timestamp
public static final int NO_SERIALIZE = 0x100;
public static final int SERIALIZE = 0x200;
1.24 +32 -0 ws-fx/wss4j/src/org/apache/ws/security/WSSecurityEngine.java
Index: WSSecurityEngine.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/WSSecurityEngine.java,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- WSSecurityEngine.java 31 May 2004 14:35:29 -0000 1.23
+++ WSSecurityEngine.java 2 Jun 2004 19:35:44 -0000 1.24
@@ -21,6 +21,7 @@
import org.apache.commons.logging.LogFactory;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.message.EnvelopeIdResolver;
+import org.apache.ws.security.message.token.Timestamp;
import org.apache.ws.security.message.token.BinarySecurity;
import org.apache.ws.security.message.token.PKIPathSecurity;
import org.apache.ws.security.message.token.SecurityTokenReference;
@@ -68,8 +69,11 @@
import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
+import java.text.SimpleDateFormat;
+import java.util.Calendar;
import java.util.Hashtable;
import java.util.Map;
+import java.util.TimeZone;
import java.util.Vector;
import java.util.Iterator;
@@ -380,6 +384,13 @@
/*
* Decode Timestamp, add the found time (created/expiry) to result
*/
+ Timestamp timestamp = new Timestamp((Element) elem);
+ handleTimestamp(timestamp);
+ returnResults.add(
+ 0,
+ new WSSecurityEngineResult(
+ WSConstants.TS,
+ timestamp));
} else {
/*
* Add check for a BinarySecurityToken, add info to WSDocInfo. If BST is
@@ -781,6 +792,27 @@
}
return assertion;
}
+
+ public void handleTimestamp(Timestamp timestamp) throws WSSecurityException {
+ if (doDebug) {
+ log.debug("Preparing to verify the timestamp");
+
+ SimpleDateFormat zulu = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
+ zulu.setTimeZone(TimeZone.getTimeZone("GMT"));
+
+ log.debug("Current time: " + zulu.format(Calendar.getInstance().getTime()));
+ log.debug("Timestamp created: " + zulu.format(timestamp.getCreated().getTime()));
+ log.debug("Timestamp expires: " + zulu.format(timestamp.getExpires().getTime()));
+ }
+
+ // Validate whether the security semantics have expired
+ Calendar rightNow = Calendar.getInstance();
+ if (timestamp.getExpires().before(rightNow)) {
+ throw new WSSecurityException(WSSecurityException.INVALID_SECURITY, "invalidTimestamp", new Object[] {"The security semantics of message have expired"});
+ }
+
+ return;
+ }
public void handleEncryptedKey(Element xencEncryptedKey, CallbackHandler cb, Crypto crypto) throws WSSecurityException {
long t0=0, t1=0, t2=0;
1.4 +17 -0 ws-fx/wss4j/src/org/apache/ws/security/WSSecurityEngineResult.java
Index: WSSecurityEngineResult.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/security/WSSecurityEngineResult.java,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- WSSecurityEngineResult.java 31 May 2004 14:35:29 -0000 1.3
+++ WSSecurityEngineResult.java 2 Jun 2004 19:35:44 -0000 1.4
@@ -21,6 +21,7 @@
import java.security.Principal;
import java.security.cert.X509Certificate;
+import org.apache.ws.security.message.token.Timestamp;
/**
* @author Werner Dittmann (Werner.Dittmann@siemens.com)
@@ -31,6 +32,7 @@
private Principal principal;
private X509Certificate cert;
private SAMLAssertion assertion;
+ private Timestamp timestamp;
WSSecurityEngineResult(int act, SAMLAssertion ass) {
principal = null;
@@ -44,6 +46,14 @@
action = act;
cert = certificate;
}
+
+ WSSecurityEngineResult(
+ int act,
+ Timestamp tstamp) {
+ action = act;
+ timestamp = tstamp;
+ }
+
/**
* @return the actions vector. These actions were performed by the the
* security engine.
@@ -73,4 +83,11 @@
public SAMLAssertion getAssertion() {
return assertion;
}
+
+ /**
+ * @return the timestamp found
+ */
+ public Timestamp getTimestamp() {
+ return timestamp;
+ }
}
1.1 ws-fx/wss4j/src/org/apache/ws/security/message/token/Timestamp.java
Index: Timestamp.java
===================================================================
/*
* Copyright 2003-2004 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.apache.ws.security.message.token;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.TimeZone;
import java.util.Vector;
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.util.DOM2Writer;
import org.apache.ws.security.util.WSSecurityUtil;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.Text;
/**
* Timestamp according to SOAP Message Security 1.0,
* chapter 10 / appendix A.2
* <p/>
*
* @author Christof Soehngen (christof.soehngen@syracom.de)
*/
public class Timestamp {
protected Element element = null;
protected Element elementCreated = null;
protected Element elementExpires = null;
protected Vector customElements = null;
protected Calendar created;
protected Calendar expires;
/**
* Constructs a <code>Timestamp</code> object and parses the
* <code>wsu:Timestamp</code> element to initialize it.
*
* @param elem the <code>wsu:Timestamp</code> element that
* contains the timestamp data
*/
public Timestamp(Element element) throws WSSecurityException {
customElements = new Vector();
String strCreated = "";
String strExpires = "";
created = Calendar.getInstance();
expires = Calendar.getInstance();
for (Node currentChild = element.getFirstChild();
currentChild != null;
currentChild = currentChild.getNextSibling()) {
if (WSConstants.CREATED_LN.equals(currentChild.getLocalName()) &&
WSConstants.WSU_NS.equals(currentChild.getNamespaceURI())) {
strCreated = ((Text) ((Element) currentChild).getFirstChild()).getData();
} else if (WSConstants.EXPIRES_LN.equals(currentChild.getLocalName()) &&
WSConstants.WSU_NS.equals(currentChild.getNamespaceURI())) {
strExpires = ((Text) ((Element) currentChild).getFirstChild()).getData();
} else {
customElements.add((Element) currentChild);
}
}
SimpleDateFormat zulu = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
zulu.setTimeZone(TimeZone.getTimeZone("GMT"));
try {
created.setTime(zulu.parse(strCreated));
expires.setTime(zulu.parse(strExpires));
} catch (ParseException e) {
throw new WSSecurityException(
WSSecurityException.INVALID_SECURITY,
"invalidTimestamp",
null, e);
}
}
/**
* Constructs a <code>Timestamp</code> object according
* to the defined parameters.
* <p/>
*
* @param doc the SOAP envelope as <code>Document</code>
* @param ttl the time to live (validity of the security semantics) in seconds
*/
public Timestamp(Document doc, int ttl) {
customElements = new Vector();
element =
doc.createElementNS(
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX
+ ":"
+ WSConstants.TIMESTAMP_TOKEN_LN);
WSSecurityUtil.setNamespace(
element,
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX);
SimpleDateFormat zulu = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
zulu.setTimeZone(TimeZone.getTimeZone("GMT"));
Calendar rightNow = Calendar.getInstance();
elementCreated =
doc.createElementNS(
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX + ":" + WSConstants.CREATED_LN);
WSSecurityUtil.setNamespace(
elementCreated,
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX);
elementCreated.appendChild(
doc.createTextNode(zulu.format(rightNow.getTime())));
element.appendChild(elementCreated);
long currentTime = rightNow.getTimeInMillis();
currentTime += ttl * 1000;
rightNow.setTimeInMillis(currentTime);
elementExpires =
doc.createElementNS(
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX + ":" + WSConstants.EXPIRES_LN);
WSSecurityUtil.setNamespace(
elementExpires,
WSConstants.WSU_NS,
WSConstants.WSU_PREFIX);
elementExpires.appendChild(
doc.createTextNode(zulu.format(rightNow.getTime())));
element.appendChild(elementExpires);
}
/**
* Returns the dom element of this <code>Timestamp</code> object.
*
* @return the <code>wsse:UsernameToken</code> element
*/
public Element getElement() {
return this.element;
}
/**
* Returns the string representation of the token.
*
* @return a XML string representation
*/
public String toString() {
return DOM2Writer.nodeToString((Node) this.element);
}
/**
* Get the time of creation.
* <p/>
*
* @return
*/
public Calendar getCreated() {
return created;
}
/**
* Get the time of expiration.
* <p/>
*
* @return
*/
public Calendar getExpires() {
return expires;
}
/**
* Creates and adds a custom element to this Timestamp
*/
public void addCustomElement(Document doc, Element customElement) {
customElements.add(customElement);
element.appendChild(customElement);
}
/**
* Get the the custom elements from this Timestamp
*
* @return the vector containing the custom elements.
*/
public Vector getCustomElements() {
return this.customElements;
}
}
1.5 +3 -0 ws-fx/wss4j/src/org/apache/ws/axis/security/util/AxisUtil.java
Index: AxisUtil.java
===================================================================
RCS file: /home/cvs/ws-fx/wss4j/src/org/apache/ws/axis/security/util/AxisUtil.java,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- AxisUtil.java 26 May 2004 19:15:37 -0000 1.4
+++ AxisUtil.java 2 Jun 2004 19:35:44 -0000 1.5
@@ -139,6 +139,9 @@
} else if (single[i].equals(WSDoAllConstants.SAML_TOKEN_SIGNED)) {
doAction |= WSConstants.ST_SIGNED;
actions.add(new Integer(WSConstants.ST_SIGNED));
+ } else if (single[i].equals(WSDoAllConstants.TIMESTAMP)) {
+ doAction |= WSConstants.TS;
+ actions.add(new Integer(WSConstants.TS));
} else if (single[i].equals(WSDoAllConstants.NO_SERIALIZATION)) {
doAction |= WSConstants.NO_SERIALIZE;
actions.add(new Integer(WSConstants.NO_SERIALIZE));