Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OM-349 Mconnect signature issue #37

Merged
merged 2 commits into from
Oct 24, 2024
Merged

OM-349 Mconnect signature issue #37

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
febdab4
OM-349 Added logging to xml utils
malinowskikam Oct 22, 2024
92f9e4a
OM-349 Added leeway in timestamp checks
malinowskikam Oct 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions msystems/xml_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import logging
import re
import datetime as py_datetime

Expand All @@ -7,13 +8,19 @@
from core import datetime
from msystems.apps import MsystemsConfig

logger = logging.getLogger(__name__)

ns_envelope = "http://schemas.xmlsoap.org/soap/envelope/"
ns_wss_util = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
ns_wss_s = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"

created_xpath = f"./{{{ns_envelope}}}Header/{{{ns_wss_s}}}Security/{{{ns_wss_util}}}Timestamp/{{{ns_wss_util}}}Created"
expires_xpath = f"./{{{ns_envelope}}}Header/{{{ns_wss_s}}}Security/{{{ns_wss_util}}}Timestamp/{{{ns_wss_util}}}Expires"

# Amount of time allowed over the limit for timestamp checks
# Without it the check can fail when the client and server time doesn't align
allowed_dt_delta = datetime.datetimedelta(seconds=1)


def add_signature(root, key, cert):
key = _make_sign_key(key, cert, None)
Expand Down Expand Up @@ -61,7 +68,9 @@ def verify_timestamp(root):
raise ValueError('Expires timestamp not found')
dt_expires = datetime.datetime.fromisoformat(replace_utc_timezone_with_offset(expires.text))

if dt_created > dt_now:
if dt_created - allowed_dt_delta > dt_now:
logger.debug("Created timestamp is in the future: dt_created=%s dt_now=%s", dt_created, dt_now)
raise ValueError('Created timestamp is in the future')
if dt_expires < dt_now:
if dt_expires + allowed_dt_delta < dt_now:
logger.debug("Envelope has expired: dt_expires=%s dt_now=%s", dt_expires, dt_now)
raise ValueError('Envelope has expired')
Loading