| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Globalization; |
| | | 6 | | using System.Xml; |
| | | 7 | | using CoreWCF.Runtime; |
| | | 8 | | |
| | | 9 | | namespace CoreWCF.Security |
| | | 10 | | { |
| | | 11 | | internal sealed class SecurityTimestamp |
| | | 12 | | { |
| | | 13 | | private const string DefaultFormat = "yyyy-MM-ddTHH:mm:ss.fffZ"; |
| | 0 | 14 | | internal static readonly TimeSpan defaultTimeToLive = SecurityProtocolFactory.defaultTimestampValidityDuration; |
| | | 15 | | private char[] _computedCreationTimeUtc; |
| | | 16 | | private char[] _computedExpiryTimeUtc; |
| | | 17 | | private DateTime _creationTimeUtc; |
| | | 18 | | private DateTime _expiryTimeUtc; |
| | | 19 | | private readonly byte[] _digest; |
| | | 20 | | |
| | | 21 | | public SecurityTimestamp(DateTime creationTimeUtc, DateTime expiryTimeUtc, string id) |
| | 63 | 22 | | : this(creationTimeUtc, expiryTimeUtc, id, null, null) |
| | | 23 | | { |
| | 63 | 24 | | } |
| | | 25 | | |
| | 157 | 26 | | internal SecurityTimestamp(DateTime creationTimeUtc, DateTime expiryTimeUtc, string id, string digestAlgorithm, |
| | | 27 | | { |
| | | 28 | | Fx.Assert(creationTimeUtc.Kind == DateTimeKind.Utc, "creation time must be in UTC"); |
| | | 29 | | Fx.Assert(expiryTimeUtc.Kind == DateTimeKind.Utc, "expiry time must be in UTC"); |
| | | 30 | | |
| | 157 | 31 | | if (creationTimeUtc > expiryTimeUtc) |
| | | 32 | | { |
| | 0 | 33 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperWarning(new ArgumentOutOfRangeException(nameof(expir |
| | | 34 | | } |
| | | 35 | | |
| | 157 | 36 | | _creationTimeUtc = creationTimeUtc; |
| | 157 | 37 | | _expiryTimeUtc = expiryTimeUtc; |
| | 157 | 38 | | Id = id; |
| | | 39 | | |
| | 157 | 40 | | DigestAlgorithm = digestAlgorithm; |
| | 157 | 41 | | _digest = digest; |
| | 157 | 42 | | } |
| | | 43 | | |
| | | 44 | | public DateTime CreationTimeUtc |
| | | 45 | | { |
| | | 46 | | get |
| | | 47 | | { |
| | 282 | 48 | | return _creationTimeUtc; |
| | | 49 | | } |
| | | 50 | | } |
| | | 51 | | |
| | | 52 | | public DateTime ExpiryTimeUtc |
| | | 53 | | { |
| | | 54 | | get |
| | | 55 | | { |
| | 188 | 56 | | return _expiryTimeUtc; |
| | | 57 | | } |
| | | 58 | | } |
| | | 59 | | |
| | 180 | 60 | | public string Id { get; } |
| | | 61 | | |
| | 0 | 62 | | public string DigestAlgorithm { get; } |
| | | 63 | | |
| | | 64 | | internal byte[] GetDigest() |
| | | 65 | | { |
| | 0 | 66 | | return _digest; |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | internal char[] GetCreationTimeChars() |
| | | 70 | | { |
| | 63 | 71 | | if (_computedCreationTimeUtc == null) |
| | | 72 | | { |
| | 63 | 73 | | _computedCreationTimeUtc = ToChars(ref _creationTimeUtc); |
| | | 74 | | } |
| | 63 | 75 | | return _computedCreationTimeUtc; |
| | | 76 | | } |
| | | 77 | | |
| | | 78 | | internal char[] GetExpiryTimeChars() |
| | | 79 | | { |
| | 63 | 80 | | if (_computedExpiryTimeUtc == null) |
| | | 81 | | { |
| | 63 | 82 | | _computedExpiryTimeUtc = ToChars(ref _expiryTimeUtc); |
| | | 83 | | } |
| | 63 | 84 | | return _computedExpiryTimeUtc; |
| | | 85 | | } |
| | | 86 | | |
| | | 87 | | private static char[] ToChars(ref DateTime utcTime) |
| | | 88 | | { |
| | 126 | 89 | | char[] buffer = new char[DefaultFormat.Length]; |
| | 126 | 90 | | int offset = 0; |
| | | 91 | | |
| | 126 | 92 | | ToChars(utcTime.Year, buffer, ref offset, 4); |
| | 126 | 93 | | buffer[offset++] = '-'; |
| | | 94 | | |
| | 126 | 95 | | ToChars(utcTime.Month, buffer, ref offset, 2); |
| | 126 | 96 | | buffer[offset++] = '-'; |
| | | 97 | | |
| | 126 | 98 | | ToChars(utcTime.Day, buffer, ref offset, 2); |
| | 126 | 99 | | buffer[offset++] = 'T'; |
| | | 100 | | |
| | 126 | 101 | | ToChars(utcTime.Hour, buffer, ref offset, 2); |
| | 126 | 102 | | buffer[offset++] = ':'; |
| | | 103 | | |
| | 126 | 104 | | ToChars(utcTime.Minute, buffer, ref offset, 2); |
| | 126 | 105 | | buffer[offset++] = ':'; |
| | | 106 | | |
| | 126 | 107 | | ToChars(utcTime.Second, buffer, ref offset, 2); |
| | 126 | 108 | | buffer[offset++] = '.'; |
| | | 109 | | |
| | 126 | 110 | | ToChars(utcTime.Millisecond, buffer, ref offset, 3); |
| | 126 | 111 | | buffer[offset++] = 'Z'; |
| | | 112 | | |
| | 126 | 113 | | return buffer; |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | private static void ToChars(int n, char[] buffer, ref int offset, int count) |
| | | 117 | | { |
| | 6048 | 118 | | for (int i = offset + count - 1; i >= offset; i--) |
| | | 119 | | { |
| | 2142 | 120 | | buffer[i] = (char)('0' + (n % 10)); |
| | 2142 | 121 | | n /= 10; |
| | | 122 | | } |
| | | 123 | | Fx.Assert(n == 0, "Overflow in encoding timestamp field"); |
| | 882 | 124 | | offset += count; |
| | 882 | 125 | | } |
| | | 126 | | |
| | | 127 | | public override string ToString() |
| | | 128 | | { |
| | 0 | 129 | | return string.Format( |
| | 0 | 130 | | CultureInfo.InvariantCulture, |
| | 0 | 131 | | "SecurityTimestamp: Id={0}, CreationTimeUtc={1}, ExpirationTimeUtc={2}", |
| | 0 | 132 | | Id, |
| | 0 | 133 | | XmlConvert.ToString(CreationTimeUtc, XmlDateTimeSerializationMode.RoundtripKind), |
| | 0 | 134 | | XmlConvert.ToString(ExpiryTimeUtc, XmlDateTimeSerializationMode.RoundtripKind)); |
| | | 135 | | } |
| | | 136 | | |
| | | 137 | | /// <summary> |
| | | 138 | | /// Internal method that checks if the timestamp is fresh with respect to the |
| | | 139 | | /// timeToLive and allowedClockSkew values passed in. |
| | | 140 | | /// Throws if the timestamp is stale. |
| | | 141 | | /// </summary> |
| | | 142 | | /// <param name="timeToLive"></param> |
| | | 143 | | /// <param name="allowedClockSkew"></param> |
| | | 144 | | internal void ValidateRangeAndFreshness(TimeSpan timeToLive, TimeSpan allowedClockSkew) |
| | | 145 | | { |
| | | 146 | | // Check that the creation time is less than expiry time |
| | 94 | 147 | | if (CreationTimeUtc >= ExpiryTimeUtc) |
| | | 148 | | { |
| | 0 | 149 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Time |
| | | 150 | | } |
| | | 151 | | |
| | 94 | 152 | | ValidateFreshness(timeToLive, allowedClockSkew); |
| | 94 | 153 | | } |
| | | 154 | | |
| | | 155 | | internal void ValidateFreshness(TimeSpan timeToLive, TimeSpan allowedClockSkew) |
| | | 156 | | { |
| | 94 | 157 | | DateTime now = DateTime.UtcNow; |
| | | 158 | | // check that the message has not expired |
| | 94 | 159 | | if (ExpiryTimeUtc <= TimeoutHelper.Subtract(now, allowedClockSkew)) |
| | | 160 | | { |
| | 0 | 161 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Time |
| | | 162 | | } |
| | | 163 | | |
| | | 164 | | // check that creation time is not in the future (modulo clock skew) |
| | 94 | 165 | | if (CreationTimeUtc >= TimeoutHelper.Add(now, allowedClockSkew)) |
| | | 166 | | { |
| | 0 | 167 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Time |
| | | 168 | | } |
| | | 169 | | |
| | | 170 | | // check that the creation time is not more than timeToLive in the past |
| | 94 | 171 | | if (CreationTimeUtc <= TimeoutHelper.Subtract(now, TimeoutHelper.Add(timeToLive, allowedClockSkew))) |
| | | 172 | | { |
| | 0 | 173 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Time |
| | | 174 | | } |
| | | 175 | | |
| | | 176 | | // this is a fresh timestamp |
| | 94 | 177 | | } |
| | | 178 | | } |
| | | 179 | | } |