You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2016/07/18 16:26:01 UTC
svn commit: r1753264 - in /webservices/wss4j/branches/2_0_x-fixes:
src/site/xdoc/ ws-security-common/src/main/java/org/apache/wss4j/common/
ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/
ws-security-dom/src/test/java/org/apache/wss4j/dom/c...
Author: coheigea
Date: Mon Jul 18 16:26:01 2016
New Revision: 1753264
URL: http://svn.apache.org/viewvc?rev=1753264&view=rev
Log:
WSS-584 - Don't create ReplayCache instances internally
Modified:
webservices/wss4j/branches/2_0_x-fixes/src/site/xdoc/config.xml
webservices/wss4j/branches/2_0_x-fixes/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/RequestData.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SecurityTestUtil.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/ReplayTest.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ConfigurationConverter.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSSecurityProperties.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/ReplayTest.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java
webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/VulnerabliltyVectorsTest.java
Modified: webservices/wss4j/branches/2_0_x-fixes/src/site/xdoc/config.xml
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/src/site/xdoc/config.xml?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/src/site/xdoc/config.xml (original)
+++ webservices/wss4j/branches/2_0_x-fixes/src/site/xdoc/config.xml Mon Jul 18 16:26:01 2016
@@ -559,23 +559,6 @@ not (for IssuerSerial, Thumbprint, SKI c
not (for IssuerSerial, Thumbprint, SKI cases). Default is "false"</td>
</tr>
<tr>
-<td><b>WSS4J 2.0.0</b> ENABLE_NONCE_CACHE</td>
-<td>enableNonceCache</td>
-<td>Whether to cache UsernameToken nonces. Default is "true"</td>
-</tr>
-<tr>
-<td><b>WSS4J 2.0.0</b> ENABLE_TIMESTAMP_CACHE</td>
-<td>enableTimestampCache</td>
-<td>Whether to cache Timestamp Created Strings (these are only cached in
-conjunction with a message Signature). Default is "true"</td>
-</tr>
-<tr>
-<td><b>WSS4J 2.0.0</b> ENABLE_SAML_ONE_TIME_USE_CACHE</td>
-<td>enableSamlOneTimeUseCache</td>
-<td>Whether to cache SAML2 Token Identifiers, if the token contains a
-"OneTimeUse" Condition. Default is "true". </td>
-</tr>
-<tr>
<td><b>WSS4J 2.0.0</b> USE_2005_12_NAMESPACE</td>
<td>use200512Namespace</td>
<td>Whether to use the 2005/12 namespace for SecureConveration + DerivedKeys,
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java Mon Jul 18 16:26:01 2016
@@ -507,24 +507,7 @@ public class ConfigurationConstants {
public static final String INCLUDE_ENCRYPTION_TOKEN = "includeEncryptionToken";
/**
- * Whether to cache UsernameToken nonces. The default value is "true".
- */
- public static final String ENABLE_NONCE_CACHE = "enableNonceCache";
-
- /**
- * Whether to cache Timestamp Created Strings (these are only cached in conjunction with a message
- * Signature). The default value is "true".
- */
- public static final String ENABLE_TIMESTAMP_CACHE = "enableTimestampCache";
-
- /**
- * Whether to cache SAML2 Token Identifiers, if the token contains a "OneTimeUse" Condition.
- * The default value is "true".
- */
- public static final String ENABLE_SAML_ONE_TIME_USE_CACHE = "enableSamlOneTimeUseCache";
-
- /**
- * Whether to use the "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
+ * Whether to use the "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
* namespace for SecureConversation + Derived Keys. If set to "false", it will use the
* namespace "http://schemas.xmlsoap.org/ws/2005/02/sc".
*
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/RequestData.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/RequestData.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/RequestData.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/RequestData.java Mon Jul 18 16:26:01 2016
@@ -34,7 +34,6 @@ import org.apache.wss4j.common.Encryptio
import org.apache.wss4j.common.SignatureActionToken;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.cache.ReplayCache;
-import org.apache.wss4j.common.cache.ReplayCacheFactory;
import org.apache.wss4j.common.crypto.AlgorithmSuite;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.PasswordEncryptor;
@@ -45,9 +44,7 @@ import org.apache.wss4j.dom.WSSConfig;
import org.apache.wss4j.dom.bsp.BSPEnforcer;
import org.apache.wss4j.dom.message.WSSecHeader;
import org.apache.wss4j.dom.message.token.UsernameToken;
-import org.apache.wss4j.dom.util.WSSecurityUtil;
import org.apache.wss4j.dom.validate.Validator;
-import org.apache.xml.security.utils.Base64;
/**
* This class holds per request data.
@@ -137,18 +134,22 @@ public class RequestData {
expandXopIncludeForSignature = true;
}
+ @Deprecated
public boolean isEnableTimestampReplayCache() {
return enableTimestampReplayCache;
}
+ @Deprecated
public void setEnableTimestampReplayCache(boolean enableTimestampReplayCache) {
this.enableTimestampReplayCache = enableTimestampReplayCache;
}
+ @Deprecated
public boolean isEnableNonceReplayCache() {
return enableNonceReplayCache;
}
+ @Deprecated
public void setEnableNonceReplayCache(boolean enableNonceReplayCache) {
this.enableNonceReplayCache = enableNonceReplayCache;
}
@@ -368,19 +369,9 @@ public class RequestData {
* @throws WSSecurityException
*/
public ReplayCache getTimestampReplayCache() throws WSSecurityException {
- if (enableTimestampReplayCache && timestampReplayCache == null) {
- timestampReplayCache = createCache("wss4j.timestamp.cache-");
- }
-
return timestampReplayCache;
}
- private synchronized ReplayCache createCache(String key) throws WSSecurityException {
- ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
- String cacheKey = key + Base64.encode(WSSecurityUtil.generateNonce(10));
- return replayCacheFactory.newReplayCache(cacheKey, null);
- }
-
/**
* Set the replay cache for Nonces
*/
@@ -393,10 +384,6 @@ public class RequestData {
* @throws WSSecurityException
*/
public ReplayCache getNonceReplayCache() throws WSSecurityException {
- if (enableNonceReplayCache && nonceReplayCache == null) {
- nonceReplayCache = createCache("wss4j.nonce.cache-");
- }
-
return nonceReplayCache;
}
@@ -412,10 +399,6 @@ public class RequestData {
* @throws WSSecurityException
*/
public ReplayCache getSamlOneTimeUseReplayCache() throws WSSecurityException {
- if (enableSamlOneTimeUseReplayCache && samlOneTimeUseReplayCache == null) {
- samlOneTimeUseReplayCache = createCache("wss4j.saml.one.time.use.cache-");
- }
-
return samlOneTimeUseReplayCache;
}
@@ -547,10 +530,12 @@ public class RequestData {
this.passwordEncryptor = passwordEncryptor;
}
+ @Deprecated
public boolean isEnableSamlOneTimeUseReplayCache() {
return enableSamlOneTimeUseReplayCache;
}
+ @Deprecated
public void setEnableSamlOneTimeUseReplayCache(boolean enableSamlOneTimeUseReplayCache) {
this.enableSamlOneTimeUseReplayCache = enableSamlOneTimeUseReplayCache;
}
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SecurityTestUtil.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SecurityTestUtil.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SecurityTestUtil.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SecurityTestUtil.java Mon Jul 18 16:26:01 2016
@@ -20,6 +20,12 @@ package org.apache.wss4j.dom.common;
import java.io.File;
+import org.apache.wss4j.common.cache.ReplayCache;
+import org.apache.wss4j.common.cache.ReplayCacheFactory;
+import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.dom.util.WSSecurityUtil;
+import org.apache.xml.security.utils.Base64;
+
/**
* A utility class for security tests
*/
@@ -42,5 +48,10 @@ public final class SecurityTestUtil {
}
}
}
-
+
+ public static ReplayCache createCache(String key) throws WSSecurityException {
+ ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
+ String cacheKey = key + Base64.encode(WSSecurityUtil.generateNonce(10));
+ return replayCacheFactory.newReplayCache(cacheKey, null);
+ }
}
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/ReplayTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/ReplayTest.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/ReplayTest.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/ReplayTest.java Mon Jul 18 16:26:01 2016
@@ -35,6 +35,7 @@ import org.apache.wss4j.dom.common.Secur
import org.apache.wss4j.dom.common.UsernamePasswordCallbackHandler;
import org.apache.wss4j.common.WSEncryptionPart;
import org.apache.wss4j.common.cache.MemoryReplayCache;
+import org.apache.wss4j.common.cache.ReplayCache;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
@@ -162,6 +163,9 @@ public class ReplayTest extends org.juni
data.setWssConfig(wssConfig);
data.setCallbackHandler(callbackHandler);
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.timestamp.cache-");
+ data.setTimestampReplayCache(replayCache);
+
// Successfully verify timestamp
verify(createdDoc, wssConfig, data);
@@ -172,6 +176,8 @@ public class ReplayTest extends org.juni
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.ErrorCode.INVALID_SECURITY);
}
+
+ replayCache.close();
}
@org.junit.Test
@@ -256,6 +262,8 @@ public class ReplayTest extends org.juni
RequestData data = new RequestData();
data.setWssConfig(wssConfig);
data.setCallbackHandler(callbackHandler);
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.timestamp.cache-");
+ data.setTimestampReplayCache(replayCache);
// Successfully verify timestamp
verify(createdDoc, wssConfig, data);
@@ -266,7 +274,9 @@ public class ReplayTest extends org.juni
fail("Expected failure on a replay attack");
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.ErrorCode.INVALID_SECURITY);
- }
+ }
+
+ replayCache.close();
}
@org.junit.Test
@@ -361,7 +371,10 @@ public class ReplayTest extends org.juni
RequestData data = new RequestData();
data.setWssConfig(wssConfig);
data.setCallbackHandler(callbackHandler);
-
+
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.timestamp.cache-");
+ data.setTimestampReplayCache(replayCache);
+
// Successfully verify timestamp
verify(createdDoc, wssConfig, data);
@@ -372,6 +385,8 @@ public class ReplayTest extends org.juni
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.ErrorCode.INVALID_SECURITY);
}
+
+ replayCache.close();
}
@org.junit.Test
@@ -429,6 +444,9 @@ public class ReplayTest extends org.juni
data.setCallbackHandler(new UsernamePasswordCallbackHandler());
data.setWssConfig(wssConfig);
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.nonce.cache-");
+ data.setNonceReplayCache(replayCache);
+
// Successfully verify UsernameToken
verify(signedDoc, wssConfig, data);
@@ -438,7 +456,9 @@ public class ReplayTest extends org.juni
fail("Expected failure on a replay attack");
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.ErrorCode.INVALID_SECURITY);
- }
+ }
+
+ replayCache.close();
}
/**
@@ -486,11 +506,16 @@ public class ReplayTest extends org.juni
data.setWssConfig(wssConfig);
data.setCallbackHandler(callbackHandler);
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.saml.one.time.use.cache-");
+ data.setSamlOneTimeUseReplayCache(replayCache);
+
// Successfully verify SAML Token
verify(unsignedDoc, wssConfig, data);
// Now try again - this should work fine as well
verify(unsignedDoc, wssConfig, data);
+
+ replayCache.close();
}
/**
@@ -539,6 +564,9 @@ public class ReplayTest extends org.juni
data.setWssConfig(wssConfig);
data.setCallbackHandler(callbackHandler);
+ ReplayCache replayCache = SecurityTestUtil.createCache("wss4j.saml.one.time.use.cache-");
+ data.setSamlOneTimeUseReplayCache(replayCache);
+
// Successfully verify SAML Token
verify(unsignedDoc, wssConfig, data);
@@ -549,6 +577,8 @@ public class ReplayTest extends org.juni
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.ErrorCode.INVALID_SECURITY);
}
+
+ replayCache.close();
}
/**
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ConfigurationConverter.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ConfigurationConverter.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ConfigurationConverter.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ConfigurationConverter.java Mon Jul 18 16:26:01 2016
@@ -452,20 +452,8 @@ public final class ConfigurationConverte
boolean includeEncryptionToken =
decodeBooleanConfigValue(ConfigurationConstants.INCLUDE_ENCRYPTION_TOKEN, false, config);
properties.setIncludeEncryptionToken(includeEncryptionToken);
-
- boolean enableTimestampCache =
- decodeBooleanConfigValue(ConfigurationConstants.ENABLE_TIMESTAMP_CACHE, true, config);
- properties.setEnableTimestampReplayCache(enableTimestampCache);
-
- boolean enableNonceCache =
- decodeBooleanConfigValue(ConfigurationConstants.ENABLE_NONCE_CACHE, true, config);
- properties.setEnableNonceReplayCache(enableNonceCache);
-
- boolean enableSamlOneTimeUseCache =
- decodeBooleanConfigValue(ConfigurationConstants.ENABLE_SAML_ONE_TIME_USE_CACHE, true, config);
- properties.setEnableSamlOneTimeUseReplayCache(enableSamlOneTimeUseCache);
-
- boolean encryptSymmetricEncryptionKey =
+
+ boolean encryptSymmetricEncryptionKey =
decodeBooleanConfigValue(ConfigurationConstants.ENC_SYM_ENC_KEY, true, config);
properties.setEncryptSymmetricEncryptionKey(encryptSymmetricEncryptionKey);
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSSecurityProperties.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSSecurityProperties.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSSecurityProperties.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSSecurityProperties.java Mon Jul 18 16:26:01 2016
@@ -39,16 +39,13 @@ import javax.xml.namespace.QName;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.cache.ReplayCache;
-import org.apache.wss4j.common.cache.ReplayCacheFactory;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.Merlin;
import org.apache.wss4j.common.crypto.PasswordEncryptor;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.stax.securityToken.WSSecurityTokenConstants;
import org.apache.wss4j.stax.validate.Validator;
-import org.apache.xml.security.exceptions.XMLSecurityException;
import org.apache.xml.security.stax.ext.XMLSecurityProperties;
-import org.apache.xml.security.utils.Base64;
/**
* Main configuration class to supply keys etc.
@@ -734,25 +731,9 @@ public class WSSSecurityProperties exten
* @throws WSSecurityException
*/
public ReplayCache getTimestampReplayCache() throws WSSecurityException {
- if (enableTimestampReplayCache && timestampReplayCache == null) {
- timestampReplayCache = createCache("wss4j.timestamp.cache-");
- }
-
return timestampReplayCache;
}
- private synchronized ReplayCache createCache(String key) throws WSSecurityException {
- ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
- byte[] nonceValue;
- try {
- nonceValue = WSSConstants.generateBytes(10);
- String cacheKey = key + Base64.encode(nonceValue);
- return replayCacheFactory.newReplayCache(cacheKey, null);
- } catch (XMLSecurityException e) {
- throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, e);
- }
- }
-
/**
* Set the replay cache for Nonces
*/
@@ -765,10 +746,6 @@ public class WSSSecurityProperties exten
* @throws WSSecurityException
*/
public ReplayCache getNonceReplayCache() throws WSSecurityException {
- if (enableNonceReplayCache && nonceReplayCache == null) {
- nonceReplayCache = createCache("wss4j.nonce.cache-");
- }
-
return nonceReplayCache;
}
@@ -784,10 +761,6 @@ public class WSSSecurityProperties exten
* @throws WSSecurityException
*/
public ReplayCache getSamlOneTimeUseReplayCache() throws WSSecurityException {
- if (enableSamlOneTimeUseReplayCache && samlOneTimeUseReplayCache == null) {
- samlOneTimeUseReplayCache = createCache("wss4j.saml.one.time.use.cache-");
- }
-
return samlOneTimeUseReplayCache;
}
@@ -879,26 +852,32 @@ public class WSSSecurityProperties exten
this.includeEncryptionToken = includeEncryptionToken;
}
+ @Deprecated
public boolean isEnableTimestampReplayCache() {
return enableTimestampReplayCache;
}
+ @Deprecated
public void setEnableTimestampReplayCache(boolean enableTimestampReplayCache) {
this.enableTimestampReplayCache = enableTimestampReplayCache;
}
+ @Deprecated
public boolean isEnableNonceReplayCache() {
return enableNonceReplayCache;
}
+ @Deprecated
public void setEnableNonceReplayCache(boolean enableNonceReplayCache) {
this.enableNonceReplayCache = enableNonceReplayCache;
}
-
+
+ @Deprecated
public boolean isEnableSamlOneTimeUseReplayCache() {
return enableSamlOneTimeUseReplayCache;
}
+ @Deprecated
public void setEnableSamlOneTimeUseReplayCache(boolean enableSamlOneTimeUseReplayCache) {
this.enableSamlOneTimeUseReplayCache = enableSamlOneTimeUseReplayCache;
}
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/ReplayTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/ReplayTest.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/ReplayTest.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/ReplayTest.java Mon Jul 18 16:26:01 2016
@@ -29,6 +29,8 @@ import javax.xml.transform.dom.DOMSource
import javax.xml.transform.stream.StreamResult;
import org.apache.wss4j.common.cache.ReplayCache;
+import org.apache.wss4j.common.cache.ReplayCacheFactory;
+import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.saml.bean.ConditionsBean;
import org.apache.wss4j.common.saml.builder.SAML2Constants;
import org.apache.wss4j.dom.WSConstants;
@@ -45,8 +47,21 @@ import org.junit.Assert;
import org.junit.Test;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;
+import org.apache.xml.security.utils.Base64;
public class ReplayTest extends AbstractTestBase {
+
+ private ReplayCache createCache(String key) throws WSSecurityException {
+ ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
+ byte[] nonceValue;
+ try {
+ nonceValue = WSSConstants.generateBytes(10);
+ String cacheKey = key + Base64.encode(nonceValue);
+ return replayCacheFactory.newReplayCache(cacheKey, null);
+ } catch (XMLSecurityException e) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, e);
+ }
+ }
@Test
public void testReplayedTimestamp() throws Exception {
@@ -68,10 +83,10 @@ public class ReplayTest extends Abstract
}
//done signature; now test sig-verification:
- ReplayCache replayCache = null;
+ ReplayCache replayCache = createCache("wss4j.timestamp.cache-");
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
- replayCache = securityProperties.getTimestampReplayCache();
+ securityProperties.setTimestampReplayCache(replayCache);
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
@@ -100,6 +115,8 @@ public class ReplayTest extends Abstract
org.junit.Assert.assertEquals("The message has expired", e.getCause().getMessage());
}
}
+
+ replayCache.close();
}
@Test
@@ -121,10 +138,10 @@ public class ReplayTest extends Abstract
}
//done UsernameToken; now test verification:
- ReplayCache replayCache = null;
+ ReplayCache replayCache = createCache("wss4j.nonce.cache-");
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
- replayCache = securityProperties.getNonceReplayCache();
+ securityProperties.setNonceReplayCache(replayCache);
securityProperties.setCallbackHandler(new CallbackHandlerImpl());
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
@@ -152,6 +169,8 @@ public class ReplayTest extends Abstract
org.junit.Assert.assertTrue(e.getCause() instanceof XMLSecurityException);
}
}
+
+ replayCache.close();
}
/**
@@ -185,7 +204,7 @@ public class ReplayTest extends Abstract
}
// process SAML Token
- ReplayCache replayCache = null;
+ ReplayCache replayCache = createCache("wss4j.saml.one.time.use.cache-");
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
@@ -194,7 +213,8 @@ public class ReplayTest extends Abstract
securityProperties.addValidator(WSSConstants.TAG_saml2_Assertion, validator);
securityProperties.addValidator(WSSConstants.TAG_saml_Assertion, validator);
- replayCache = securityProperties.getSamlOneTimeUseReplayCache();
+ securityProperties.setSamlOneTimeUseReplayCache(replayCache);
+
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
@@ -218,6 +238,8 @@ public class ReplayTest extends Abstract
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Assert.assertNotNull(document);
}
+
+ replayCache.close();
}
/**
@@ -250,7 +272,7 @@ public class ReplayTest extends Abstract
}
// process SAML Token
- ReplayCache replayCache = null;
+ ReplayCache replayCache = createCache("wss4j.saml.one.time.use.cache-");
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
@@ -259,7 +281,8 @@ public class ReplayTest extends Abstract
securityProperties.addValidator(WSSConstants.TAG_saml2_Assertion, validator);
securityProperties.addValidator(WSSConstants.TAG_saml_Assertion, validator);
- replayCache = securityProperties.getSamlOneTimeUseReplayCache();
+ securityProperties.setSamlOneTimeUseReplayCache(replayCache);
+
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
@@ -287,6 +310,8 @@ public class ReplayTest extends Abstract
org.junit.Assert.assertTrue(e.getCause() instanceof XMLSecurityException);
}
}
+
+ replayCache.close();
}
}
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java Mon Jul 18 16:26:01 2016
@@ -37,6 +37,8 @@ import javax.xml.transform.dom.DOMSource
import javax.xml.transform.stream.StreamResult;
import org.apache.wss4j.common.ConfigurationConstants;
+import org.apache.wss4j.common.cache.ReplayCache;
+import org.apache.wss4j.common.cache.ReplayCacheFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.dom.WSConstants;
import org.apache.wss4j.dom.handler.WSHandlerConstants;
@@ -50,8 +52,10 @@ import org.apache.wss4j.stax.securityEve
import org.apache.wss4j.stax.securityEvent.WSSecurityEventConstants;
import org.apache.wss4j.stax.test.utils.StAX2DOM;
import org.apache.wss4j.stax.test.utils.XmlReaderToWriter;
+import org.apache.xml.security.exceptions.XMLSecurityException;
import org.apache.xml.security.stax.securityEvent.SecurityEvent;
import org.apache.xml.security.stax.securityEvent.SecurityEventListener;
+import org.apache.xml.security.utils.Base64;
import org.junit.Assert;
import org.junit.Test;
import org.w3c.dom.Document;
@@ -263,6 +267,8 @@ public class UsernameTokenTest extends A
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
securityProperties.setCallbackHandler(new CallbackHandlerImpl());
+ ReplayCache replayCache = createCache("wss4j.nonce.cache-");
+ securityProperties.setNonceReplayCache(replayCache);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties, false, true);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(req.getBytes())));
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
@@ -274,6 +280,8 @@ public class UsernameTokenTest extends A
} catch (XMLStreamException e) {
Assert.assertEquals(((WSSecurityException) e.getCause()).getFaultCode(), WSSecurityException.FAILED_AUTHENTICATION);
}
+
+ replayCache.close();
}
/**
@@ -827,4 +835,16 @@ public class UsernameTokenTest extends A
Assert.assertEquals(nodeList.item(0).getParentNode().getLocalName(), WSSConstants.TAG_wsse_Security.getLocalPart());
}
}
+
+ private ReplayCache createCache(String key) throws WSSecurityException {
+ ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
+ byte[] nonceValue;
+ try {
+ nonceValue = WSSConstants.generateBytes(10);
+ String cacheKey = key + Base64.encode(nonceValue);
+ return replayCacheFactory.newReplayCache(cacheKey, null);
+ } catch (XMLSecurityException e) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, e);
+ }
+ }
}
Modified: webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/VulnerabliltyVectorsTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/VulnerabliltyVectorsTest.java?rev=1753264&r1=1753263&r2=1753264&view=diff
==============================================================================
--- webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/VulnerabliltyVectorsTest.java (original)
+++ webservices/wss4j/branches/2_0_x-fixes/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/VulnerabliltyVectorsTest.java Mon Jul 18 16:26:01 2016
@@ -18,6 +18,22 @@
*/
package org.apache.wss4j.stax.test;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.lang.reflect.Field;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.xml.stream.XMLStreamException;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpression;
+
import org.apache.commons.compress.compressors.xz.XZCompressorInputStream;
import org.apache.commons.compress.compressors.xz.XZCompressorOutputStream;
import org.apache.wss4j.common.bsp.BSPRule;
@@ -266,43 +282,6 @@ public class VulnerabliltyVectorsTest ex
}
*/
- @Test
- public void testReplayAttackInbound() throws Exception {
-
- ByteArrayOutputStream baos = new ByteArrayOutputStream();
- {
- InputStream sourceDocument = this.getClass().getClassLoader().getResourceAsStream("testdata/plain-soap-1.1.xml");
- String action = WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.SIGNATURE;
- Properties properties = new Properties();
- properties.setProperty(WSHandlerConstants.SIGNATURE_PARTS, "{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body;");
- Document securedDocument = doOutboundSecurityWithWSS4J(sourceDocument, action, properties);
-
- //some test that we can really sure we get what we want from WSS4J
- NodeList nodeList = securedDocument.getElementsByTagNameNS(WSSConstants.TAG_dsig_Signature.getNamespaceURI(), WSSConstants.TAG_dsig_Signature.getLocalPart());
- Assert.assertEquals(nodeList.item(0).getParentNode().getLocalName(), WSSConstants.TAG_wsse_Security.getLocalPart());
-
- javax.xml.transform.Transformer transformer = TRANSFORMER_FACTORY.newTransformer();
- transformer.transform(new DOMSource(securedDocument), new StreamResult(baos));
- }
-
- //done signature; now test sig-verification:
- {
- WSSSecurityProperties securityProperties = new WSSSecurityProperties();
- securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
- InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties, false, true);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
-
- StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
-
- try {
- xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
- StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
- Assert.fail("Expected XMLStreamException");
- } catch (XMLStreamException e) {
- Assert.assertEquals(((WSSecurityException) e.getCause()).getFaultCode(), WSSecurityException.MESSAGE_EXPIRED);
- }
- }
- }
@Test
public void testMaximumAllowedReferencesPerManifest() throws Exception {