You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2011/03/14 13:52:35 UTC
svn commit: r1081352 - in /webservices/wss4j/branches/1_5_x-fixes:
src/org/apache/ws/security/handler/WSHandler.java
src/org/apache/ws/security/handler/WSHandlerConstants.java
test/wssec/TestWSSecurityTimestamp.java
Author: coheigea
Date: Mon Mar 14 12:52:35 2011
New Revision: 1081352
URL: http://svn.apache.org/viewvc?rev=1081352&view=rev
Log:
[WSS-274] - Add support for future dated timestamps.
Modified:
webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandler.java
webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandlerConstants.java
webservices/wss4j/branches/1_5_x-fixes/test/wssec/TestWSSecurityTimestamp.java
Modified: webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandler.java?rev=1081352&r1=1081351&r2=1081352&view=diff
==============================================================================
--- webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandler.java (original)
+++ webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandler.java Mon Mar 14 12:52:35 2011
@@ -1406,18 +1406,49 @@ public abstract class WSHandler {
* @throws WSSecurityException
*/
protected boolean verifyTimestamp(Timestamp timestamp, int timeToLive) throws WSSecurityException {
-
+ return verifyTimestamp(timestamp, timeToLive, 0);
+ }
+
+ /**
+ * Evaluate whether a timestamp is considered valid on the receivers' side. Hook to
+ * allow subclasses to implement custom validation methods however they see fit.
+ *
+ * Policy used in this implementation:
+ *
+ * 1. The receiver can set its own time to live (besides from that set on
+ * sender side)
+ *
+ * 2. If the message was created before (now-ttl) the message is rejected
+ *
+ * @param timestamp
+ * the timestamp that is validated
+ * @param timeToLive
+ * the limit on the receivers' side, that the timestamp is validated against
+ * @param futureTimeToLive
+ * the value in seconds for the future validity of the Created time
+ * @return true if the timestamp is before (now-timeToLive), false otherwise
+ * @throws WSSecurityException
+ */
+ protected boolean verifyTimestamp(
+ Timestamp timestamp,
+ int timeToLive,
+ int futureTimeToLive
+ ) throws WSSecurityException {
// Calculate the time that is allowed for the message to travel
Calendar validCreation = Calendar.getInstance();
- validCreation.setTimeZone(TimeZone.getTimeZone("UTC"));
+ validCreation.setTimeZone(TimeZone.getTimeZone("UTC"));
+ long currentTime = validCreation.getTime().getTime();
+
Calendar cre = timestamp.getCreated();
+ if (futureTimeToLive > 0) {
+ validCreation.setTime(new Date(currentTime + futureTimeToLive * 1000));
+ }
if (cre != null && cre.after(validCreation)) {
if (doDebug) {
log.debug("Validation of Timestamp: The message was created in the future!");
}
return false;
}
- long currentTime = validCreation.getTime().getTime();
currentTime -= timeToLive * 1000;
validCreation.setTime(new Date(currentTime));
Modified: webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandlerConstants.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandlerConstants.java?rev=1081352&r1=1081351&r2=1081352&view=diff
==============================================================================
--- webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandlerConstants.java (original)
+++ webservices/wss4j/branches/1_5_x-fixes/src/org/apache/ws/security/handler/WSHandlerConstants.java Mon Mar 14 12:52:35 2011
@@ -784,6 +784,16 @@ public class WSHandlerConstants {
* 300 seconds (5 minutes).
*/
public static final String TTL_TIMESTAMP = "timeToLive";
+
+ /**
+ * This configuration tag specifies the time in seconds in the future within which
+ * the Created time of an incoming Timestamp is valid. WSS4J rejects by default any
+ * timestamp which is "Created" in the future, and so there could potentially be
+ * problems in a scenario where a client's clock is slightly askew. The default
+ * value for this parameter is "0", meaning that no future-created Timestamps are
+ * allowed.
+ */
+ public static final String TTL_FUTURE_TIMESTAMP = "futureTimeToLive";
/**
* Whether to enable signatureConfirmation or not
Modified: webservices/wss4j/branches/1_5_x-fixes/test/wssec/TestWSSecurityTimestamp.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/1_5_x-fixes/test/wssec/TestWSSecurityTimestamp.java?rev=1081352&r1=1081351&r2=1081352&view=diff
==============================================================================
--- webservices/wss4j/branches/1_5_x-fixes/test/wssec/TestWSSecurityTimestamp.java (original)
+++ webservices/wss4j/branches/1_5_x-fixes/test/wssec/TestWSSecurityTimestamp.java Mon Mar 14 12:52:35 2011
@@ -66,7 +66,6 @@ public class TestWSSecurityTimestamp ext
+ "</SOAP-ENV:Body>"
+ "</SOAP-ENV:Envelope>";
- private WSSecurityEngine secEngine = new WSSecurityEngine();
private MessageContext msgContext;
private SOAPEnvelope unsignedEnvelope;
@@ -264,7 +263,8 @@ public class TestWSSecurityTimestamp ext
/**
* This is a test for processing an Timestamp where the "Created" element is in the future.
- * This Timestamp should be rejected.
+ * This Timestamp should be rejected by default, and then accepted once the future
+ * time-to-live configuration is enabled.
*/
public void testFutureCreated() throws Exception {
@@ -283,7 +283,7 @@ public class TestWSSecurityTimestamp ext
WSConstants.WSU_NS, WSConstants.WSU_PREFIX + ":" + WSConstants.CREATED_LN
);
Date createdDate = new Date();
- long currentTime = createdDate.getTime() + 300000;
+ long currentTime = createdDate.getTime() + 30000;
createdDate.setTime(currentTime);
elementCreated.appendChild(doc.createTextNode(zulu.format(createdDate)));
timestampElement.appendChild(elementCreated);
@@ -312,9 +312,9 @@ public class TestWSSecurityTimestamp ext
if (myHandler.publicVerifyTimestamp(receivedTimestamp, 300)) {
fail("The timestamp validation should have failed");
}
+ assertTrue(myHandler.publicVerifyTimestamp(receivedTimestamp, 300, 60));
}
-
/**
* Verifies the soap envelope
*
@@ -322,6 +322,7 @@ public class TestWSSecurityTimestamp ext
* @throws java.lang.Exception Thrown when there is a problem in verification
*/
private Vector verify(Document doc) throws Exception {
+ WSSecurityEngine secEngine = new WSSecurityEngine();
return secEngine.processSecurityHeader(doc, null, null, null);
}
@@ -356,13 +357,21 @@ public class TestWSSecurityTimestamp ext
getPassword(Object msgContext) {
return null;
}
-
+
boolean publicVerifyTimestamp(
Timestamp timestamp,
int ttl
) throws org.apache.ws.security.WSSecurityException {
return verifyTimestamp(timestamp, ttl);
}
+
+ boolean publicVerifyTimestamp(
+ Timestamp timestamp,
+ int ttl,
+ int futureTimeToLive
+ ) throws org.apache.ws.security.WSSecurityException {
+ return verifyTimestamp(timestamp, ttl, futureTimeToLive);
+ }
}
}