[java-opensaml COMMIT] in /trunk: opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageR...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Apr 30 23:17:06 2013
New Revision: 3330

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3330&view=rev
Log:
Rebase ReplayCache on top of storage API and fix tests.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageReplayRule.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/MessageReplayRuleTest.java
    trunk/opensaml-util/src/main/java/org/opensaml/util/storage/ReplayCache.java
    trunk/opensaml-util/src/main/java/org/opensaml/util/storage/ReplayCacheEntry.java
    trunk/opensaml-util/src/test/java/org/opensaml/util/storage/ReplayCacheTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageReplayRule.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageReplayRule.java?rev=3330&r1=3329&r2=3330&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageReplayRule.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/MessageReplayRule.java Tue Apr 30 23:17:06 2013
@@ -17,8 +17,11 @@
 
 package org.opensaml.saml.common.binding.security;
 
+import javax.annotation.Nonnull;
+
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
+import org.joda.time.DateTime;
 import org.opensaml.saml.common.binding.SAMLMessageContext;
 import org.opensaml.util.storage.ReplayCache;
 import org.opensaml.ws.message.MessageContext;
@@ -40,15 +43,19 @@
 
     /** Whether this rule is required to be met. */
     private boolean requiredRule;
+    
+    /** Time in seconds to expire cache entries. Default value: (180) */
+    private long expires;
 
     /**
      * Constructor.
      * 
      * @param newReplayCache the new replay cache instance
      */
-    public MessageReplayRule(ReplayCache newReplayCache) {
+    public MessageReplayRule(@Nonnull ReplayCache newReplayCache) {
         replayCache = newReplayCache;
         requiredRule = true;
+        expires = 180;
     }
 
     /**
@@ -69,8 +76,26 @@
         requiredRule = required;
     }
 
+    /**
+     * Gets the lifetime in seconds of replay entries.
+     * 
+     * @return lifetime in seconds of entries
+     */
+    public long getExpires() {
+        return expires;
+    }
+
+    /**
+     * Sets the lifetime in seconds of replay entries.
+     * 
+     * @param exp lifetime in seconds of entries
+     */
+    public void setExpires(long exp) {
+        expires = exp;
+    }
+
     /** {@inheritDoc} */
-    public void evaluate(MessageContext messageContext) throws SecurityPolicyException {
+    public void evaluate(@Nonnull MessageContext messageContext) throws SecurityPolicyException {
         if (!(messageContext instanceof SAMLMessageContext)) {
             log.debug("Invalid message context type, this policy rule only supports SAMLMessageContext");
             return;
@@ -78,28 +103,30 @@
 
         SAMLMessageContext samlMsgCtx = (SAMLMessageContext) messageContext;
 
-        String messageIsuer = StringSupport.trimOrNull(samlMsgCtx.getInboundMessageIssuer());
-        if (messageIsuer == null) {
-            if (requiredRule) {
-                log.warn("Message contained no Issuer ID, replay check not possible");
-                throw new SecurityPolicyException("Message contained no Issuer ID, replay check not possible");
-            }
-            return;
+        String messageIssuer = StringSupport.trimOrNull(samlMsgCtx.getInboundMessageIssuer());
+        if (messageIssuer == null) {
+            messageIssuer = "(unknown)";
         }
 
         String messageId = StringSupport.trimOrNull(samlMsgCtx.getInboundSAMLMessageId());
         if (messageId == null) {
             if (requiredRule) {
                 log.warn("Message contained no ID, replay check not possible");
-                throw new SecurityPolicyException("SAML message from issuer " + messageIsuer + " did not contain an ID");
+                throw new SecurityPolicyException("SAML message from issuer " + messageIssuer
+                        + " did not contain an ID");
             }
             return;
         }
 
-        if (replayCache.isReplay(messageIsuer, messageId)) {
-            log.warn("Replay detected of message '" + messageId + "' from issuer " + messageIsuer);
+        DateTime issueInstant = samlMsgCtx.getInboundSAMLMessageIssueInstant();
+        if (issueInstant == null) {
+            issueInstant = new DateTime();
+        }
+        
+        if (!replayCache.check(getClass().getName(), messageId, issueInstant.getMillis() / 1000 + expires)) {
+            log.warn("Replay detected of message '" + messageId + "' from issuer " + messageIssuer);
             throw new SecurityPolicyException("Rejecting replayed message ID '" + messageId + "' from issuer "
-                    + messageIsuer);

[... 413 lines stripped ...]