[jbossweb-commits] JBossWeb SVN: r2136 - branches/JBOSSWEB_2_1_12_GA_patch03_JBPAPP-10306/java/org/apache/catalina/authenticator.
Author: aogburn
Date: 2012-12-11 17:38:27 -0500 (Tue, 11 Dec 2012)
New Revision: 2136
Modified:
branches/JBOSSWEB_2_1_12_GA_patch03_JBPAPP-10306/java/org/apache/catalina/authenticator/DigestAuthenticator.java
Log:
[JBPAPP-10306] backport JBWEB-258 for better, more unique DigestAuthenticator nonces
Modified:
branches/JBOSSWEB_2_1_12_GA_patch03_JBPAPP-10306/java/org/apache/catalina/authenticator/DigestAuthenticator.java
===================================================================
---
branches/JBOSSWEB_2_1_12_GA_patch03_JBPAPP-10306/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2012-12-06
18:21:07 UTC (rev 2135)
+++
branches/JBOSSWEB_2_1_12_GA_patch03_JBPAPP-10306/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2012-12-11
22:38:27 UTC (rev 2136)
@@ -294,21 +294,21 @@
/**
* Generate a unique token. The token is generated according to the
* following pattern. NOnceToken = Base64 ( MD5 ( client-IP ":"
- * time-stamp ":" private-key ) ).
+ * client-port ":" time-stamp ":" private-key ) ).
*
* @param request HTTP Servlet request
*/
protected String generateNonce(Request request) {
long currentTime = System.currentTimeMillis();
+ int remotePort = request.getRemotePort();
+ String ipPortTimeKey =
+ request.getRemoteAddr() + ":" + remotePort + ":" +
currentTime + ":" + getKey();
- String ipTimeKey =
- request.getRemoteAddr() + ":" + currentTime + ":" +
getKey();
+ byte[] buffer = ConcurrentMessageDigest.digestMD5(ipPortTimeKey.getBytes());
+ String nonce = currentTime + ":" + remotePort + ":" +
MD5Encoder.encode(buffer);
- byte[] buffer = ConcurrentMessageDigest.digestMD5(ipTimeKey.getBytes());
- String nonce = currentTime + ":" + MD5Encoder.encode(buffer);
-
NonceInfo info = new NonceInfo(currentTime, 100);
synchronized (nonces) {
nonces.put(nonce, info);
@@ -567,13 +567,19 @@
if (i < 0 || (i + 1) == nonce.length()) {
return false;
}
+ int j = nonce.lastIndexOf(":");
+ if (i == j) {
+ return false;
+ }
long nonceTime;
+ int remotePort;
try {
nonceTime = Long.parseLong(nonce.substring(0, i));
+ remotePort = Integer.parseInt(nonce.substring(i + 1, j));
} catch (NumberFormatException nfe) {
return false;
}
- String md5clientIpTimeKey = nonce.substring(i + 1);
+ String md5clientIpPortTimeKey = nonce.substring(j + 1);
long currentTime = System.currentTimeMillis();
if ((currentTime - nonceTime) > nonceValidity) {
nonceStale = true;
@@ -581,12 +587,12 @@
nonces.remove(nonce);
}
}
- String serverIpTimeKey =
- request.getRemoteAddr() + ":" + nonceTime + ":" +
key;
+ String serverIpPortTimeKey =
+ request.getRemoteAddr() + ":" + remotePort + ":" +
nonceTime + ":" + key;
byte[] buffer = ConcurrentMessageDigest.digestMD5(
- serverIpTimeKey.getBytes());
- String md5ServerIpTimeKey = MD5Encoder.encode(buffer);
- if (!md5ServerIpTimeKey.equals(md5clientIpTimeKey)) {
+ serverIpPortTimeKey.getBytes());
+ String md5ServerIpPortTimeKey = MD5Encoder.encode(buffer);
+ if (!md5ServerIpPortTimeKey.equals(md5clientIpPortTimeKey)) {
return false;
}