Author: hansgk
Date: Fri Jul 6 03:33:34 2007
New Revision: 553829
URL: http://svn.apache.org/viewvc?view=rev&rev=553829
Log:
feature to let you specify an allow timeskew
https://issues.apache.org/jira/browse/RAMPART-4
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/PolicyBasedResultsValidator.java
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/RampartMessageData.java
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/builders/RampartConfigBuilder.java
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/PolicyBasedResultsValidator.java
URL:
http://svn.apache.org/viewvc/webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/PolicyBasedResultsValidator.java?view=diff&rev=553829&r1=553828&r2=553829
==============================================================================
---
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/PolicyBasedResultsValidator.java
(original)
+++
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/PolicyBasedResultsValidator.java
Fri Jul 6 03:33:34 2007
@@ -136,7 +136,7 @@
Timestamp timestamp = actionResult.getTimestamp();
if (timestamp != null) {
- if (!verifyTimestamp(timestamp, rmd.getTimeToLive())) {
+ if (!verifyTimestamp(timestamp, rmd)) {
throw new RampartException("cannotValidateTimestamp");
}
}
@@ -386,17 +386,24 @@
}
-
- private boolean verifyTimestamp(Timestamp timestamp, int timeToLive)
throws RampartException {
-
- // 'now' must be between ts->Created and ts->Expires
- // here we test that now is after ts->Created
- // test that now is before ts->Expires is handled earlier by WSS4J
+ /*
+ * Verify that ts->Created is before 'now'
+ * - testing that timestamp has not expired ('now' is before ts->Expires)
is handled earlier by WSS4J
+ */
+ private boolean verifyTimestamp(Timestamp timestamp, RampartMessageData
rmd) throws RampartException {
Calendar cre = timestamp.getCreated();
if (cre != null) {
- Calendar now = Calendar.getInstance();
- if( now.before( cre ) ) {
+ long now = Calendar.getInstance().getTimeInMillis();
+
+ // ajust 'now' with allowed timeskew
+ long maxSkew = RampartUtil.getTimestampMaxSkew( rmd );
+ if( maxSkew > 0 ) {
+ now += (maxSkew * 1000);
+ }
+
+ // fail if ts->Created is after 'now'
+ if( cre.getTimeInMillis() > now ) {
return false;
}
}
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/RampartMessageData.java
URL:
http://svn.apache.org/viewvc/webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/RampartMessageData.java?view=diff&rev=553829&r1=553828&r2=553829
==============================================================================
---
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/RampartMessageData.java
(original)
+++
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/RampartMessageData.java
Fri Jul 6 03:33:34 2007
@@ -95,6 +95,8 @@
private int timeToLive = 300;
+ private int timestampMaxSkew = 0;
+
private String timestampId;
private Document document;
@@ -317,6 +319,20 @@
*/
public void setTimeToLive(int timeToLive) {
this.timeToLive = timeToLive;
+ }
+
+ /**
+ * @return Returns the timestampMaxSkew.
+ */
+ public int getTimestampMaxSkew() {
+ return timestampMaxSkew;
+ }
+
+ /**
+ * @param timestampMaxSkew The timestampMaxSkew to set.
+ */
+ public void setTimestampMaxSkew(int timestampMaxSkew) {
+ this.timestampMaxSkew = timestampMaxSkew;
}
/**
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/builders/RampartConfigBuilder.java
URL:
http://svn.apache.org/viewvc/webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/builders/RampartConfigBuilder.java?view=diff&rev=553829&r1=553828&r2=553829
==============================================================================
---
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/builders/RampartConfigBuilder.java
(original)
+++
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/builders/RampartConfigBuilder.java
Fri Jul 6 03:33:34 2007
@@ -64,6 +64,12 @@
rampartConfig.setTimestampTTL(childElement.getText().trim());
}
+ childElement = element.getFirstChildWithName(new QName(
+ RampartConfig.NS, RampartConfig.TS_MAX_SKEW_LN));
+ if (childElement != null) {
+ rampartConfig.setTimestampMaxSkew(childElement.getText().trim());
+ }
+
return rampartConfig;
}
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java
URL:
http://svn.apache.org/viewvc/webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java?view=diff&rev=553829&r1=553828&r2=553829
==============================================================================
---
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java
(original)
+++
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java
Fri Jul 6 03:33:34 2007
@@ -35,6 +35,7 @@
* <ramp:encryptionUser>bob</ramp:encryptionUser>
*
<ramp:passwordCallbackClass>org.apache.axis2.security.PWCallback</ramp:passwordCallbackClass>
* <ramp:timestampTTL>300</ramp:timestampTTL>
+ * <ramp:timestampMaxSkew>0</ramp:timestampMaxSkew>
*
<ramp:tokenStoreClass>org.apache.rahas.StorageImpl</ramp:tokenStoreClass>
*
* <ramp:signatureCrypto>
@@ -60,6 +61,8 @@
public static final int DEFAULT_TIMESTAMP_TTL = 300;
+ public static final int DEFAULT_TIMESTAMP_MAX_SKEW = 0;
+
public final static String NS = "http://ws.apache.org/rampart/policy";;
public final static String PREFIX = "rampart";
@@ -80,6 +83,8 @@
public final static String TS_TTL_LN = "timestampTTL";
+ public final static String TS_MAX_SKEW_LN = "timestampMaxSkew";
+
public final static String TOKEN_STORE_CLASS_LN = "tokenStoreClass";
public final static String OPTIMISE_PARTS_LN = "OptimizeParts";
@@ -98,6 +103,8 @@
private String timestampTTL = Integer.toString(DEFAULT_TIMESTAMP_TTL);
+ private String timestampMaxSkew =
Integer.toString(DEFAULT_TIMESTAMP_MAX_SKEW);
+
private String optimizeParts;
private String tokenStoreClass;
@@ -214,6 +221,12 @@
writer.writeEndElement();
}
+ if (getTimestampMaxSkew() != null) {
+ writer.writeStartElement(NS, TS_MAX_SKEW_LN);
+ writer.writeCharacters(getTimestampMaxSkew());
+ writer.writeEndElement();
+ }
+
if (getTokenStoreClass() != null) {
writer.writeStartElement(NS, TOKEN_STORE_CLASS_LN);
writer.writeCharacters(getTokenStoreClass());
@@ -264,6 +277,21 @@
*/
public void setTimestampTTL(String timestampTTL) {
this.timestampTTL = timestampTTL;
+ }
+
+ /**
+ * @return Returns the timestampMaxSkew.
+ */
+ public String getTimestampMaxSkew() {
+ return timestampMaxSkew;
+ }
+
+ /**
+ * @param timestampMaxSkew
+ * The timestampMaxSkew to set.
+ */
+ public void setTimestampMaxSkew(String timestampMaxSkew) {
+ this.timestampMaxSkew = timestampMaxSkew;
}
/**
Modified:
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
URL:
http://svn.apache.org/viewvc/webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java?view=diff&rev=553829&r1=553828&r2=553829
==============================================================================
---
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
(original)
+++
webservices/rampart/branches/java/1_2/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
Fri Jul 6 03:33:34 2007
@@ -318,25 +318,47 @@
public static int getTimeToLive(RampartMessageData messageData) {
RampartConfig rampartConfig =
messageData.getPolicyData().getRampartConfig();
- if(rampartConfig != null) {
- String ttl = rampartConfig.getTimestampTTL();
- int ttl_i = 0;
- if (ttl != null) {
- try {
- ttl_i = Integer.parseInt(ttl);
- } catch (NumberFormatException e) {
+ if (rampartConfig != null) {
+ String ttl = rampartConfig.getTimestampTTL();
+ int ttl_i = 0;
+ if (ttl != null) {
+ try {
+ ttl_i = Integer.parseInt(ttl);
+ } catch (NumberFormatException e) {
+ ttl_i = messageData.getTimeToLive();
+ }
+ }
+ if (ttl_i <= 0) {
ttl_i = messageData.getTimeToLive();
}
- }
- if (ttl_i <= 0) {
- ttl_i = messageData.getTimeToLive();
- }
- return ttl_i;
+ return ttl_i;
} else {
return RampartConfig.DEFAULT_TIMESTAMP_TTL;
}
}
-
+
+ public static int getTimestampMaxSkew(RampartMessageData messageData) {
+
+ RampartConfig rampartConfig =
messageData.getPolicyData().getRampartConfig();
+ if (rampartConfig != null) {
+ String maxSkew = rampartConfig.getTimestampMaxSkew();
+ int maxSkew_i = 0;
+ if (maxSkew != null) {
+ try {
+ maxSkew_i = Integer.parseInt(maxSkew);
+ } catch (NumberFormatException e) {
+ maxSkew_i = messageData.getTimestampMaxSkew();
+ }
+ }
+ if (maxSkew_i < 0) {
+ maxSkew_i = 0;
+ }
+ return maxSkew_i;
+ } else {
+ return RampartConfig.DEFAULT_TIMESTAMP_MAX_SKEW;
+ }
+ }
+
/**
* Obtain a security context token.
* @param rmd
