Deprecated webapp-folder removed from svn repository.

New DefaultConfiguration.zip integrated in order to allow mocca signatures.
Minor bug concerning choice of cce within the web application fixed.
Signature with new online bku MOCCA integrated (new signature device "moc" created).
Configuration keys for mocca added.
New error codes (371 = signature verification not supported by this connector, 372 = invalid signing time) introduced.
Optional check of the signing time for the web application implemented. At signature creation time the signing time is checked for plausibility. This is a workaround for the ITS:mac-linux signing time bug. New configuration key ("signing_time_tolerance") added (applies to web application only) to overcome invalid signing times. A signature is only accepted if its signing time is within a time frame of [current time - signing_time_tolerance, current time + signing_time_tolerance] where signing_time_tolerance is interpreted as seconds.
Bugfix: Correct extraction of signatures with wrong signing times implemented. (The order of the signatures is still invalid in case of false signing times.)
Optional override of the dynamic creation of the signature retrieval url (locrefcontent) implemented in order to overcome ssl problems (retrieve_signature_data_url_override). Note: Assure that this URL is accessible from the citizen card environment.
Download of signed pdf-file for external application interface adjusted.
Verification of mocca signed documents implemented.
Retrieval of xml response via multipart implemented (mocca strictly follows security layer spec)


git-svn-id: https://joinup.ec.europa.eu/svn/pdf-as/trunk@296 7b5415b0-85f9-ee4d-85bd-d5d0c3b42d1c

2 files changed, 86 insertions, 1 deletions

diff --git a/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java b/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
index a904ad4..6fc7a1a 100644
--- a/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
+++ b/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
@@ -20,6 +20,7 @@ import at.gv.egiz.pdfas.framework.SignatorFactory;
 import at.gv.egiz.pdfas.framework.signator.Signator;

 import at.gv.egiz.pdfas.impl.output.ByteArrayDataSink;

 import at.gv.egiz.pdfas.impl.output.FileBasedDataSink;

+import at.gv.egiz.pdfas.utils.WebUtils;

 import at.gv.egiz.pdfas.web.SignSessionInformation;

 import at.knowcenter.wag.egov.egiz.PdfASID;

 import at.knowcenter.wag.egov.egiz.exceptions.PDFDocumentException;

@@ -135,7 +136,8 @@ public class SignServletHelper
     

     // TODO TR: Web-Applikation verwendet in Loc-Ref-Variante ext. Referenz, um performanter zu sein;

     // nachfolend auskommentieren, wenn anstatt SwA-Connector LocRef-Connector verwendet wird

-    URL signature_data_URL = new URL(LocalRequestHelper.getLocalContextAddress(request, response) + "/RetrieveSignatureData");

+//    URL signature_data_URL = new URL(WebUtils.addJSessionID(LocalRequestHelper.getLocalContextAddress(request, response) + "/RetrieveSignatureData", request));

+    URL signature_data_URL = new URL(WebUtils.buildRetrieveSignatureDataURL(request, response));

     String signature_data_url = response.encodeURL(signature_data_URL.toString());

 

     Connector c = ConnectorChooser.chooseWebConnectorForSign(si.connector, si.type, signature_data_url);

diff --git a/src/main/java/at/gv/egiz/pdfas/web/helper/SigningTimeHelper.java b/src/main/java/at/gv/egiz/pdfas/web/helper/SigningTimeHelper.java
new file mode 100644
index 0000000..673c197
--- /dev/null
+++ b/src/main/java/at/gv/egiz/pdfas/web/helper/SigningTimeHelper.java
@@ -0,0 +1,83 @@
+package at.gv.egiz.pdfas.web.helper;

+

+import java.util.Date;

+

+import org.apache.commons.lang.time.DateFormatUtils;

+import org.apache.commons.logging.Log;

+import org.apache.commons.logging.LogFactory;

+

+import at.gv.egiz.pdfas.exceptions.ErrorCode;

+import at.gv.egiz.pdfas.framework.signator.SignatorInformation;

+import at.knowcenter.wag.egov.egiz.cfg.SettingsReader;

+import at.knowcenter.wag.egov.egiz.exceptions.SettingsException;

+import at.knowcenter.wag.egov.egiz.exceptions.SignatureException;

+import at.knowcenter.wag.egov.egiz.pdf.EGIZDate;

+import at.knowcenter.wag.egov.egiz.sig.connectors.bku.SignSignatureObject;

+

+/**

+ * This class deals with invalid signing times. 

+ * @author tknall

+ */

+public final class SigningTimeHelper {

+   

+   private SigningTimeHelper() {

+   }

+   

+   private static Integer tolerance = null;

+   

+   /**

+    * The log.

+    */

+   private final static Log LOG = LogFactory.getLog(SigningTimeHelper.class);

+   

+   private final static String SIGNING_TIME_TOLERANCE_KEY = "signing_time_tolerance";

+   private final static String FORMAT_UTC_DATE_PATTERN = "yyyy-MM-dd'T'HH:mm:ss'Z'";

+   

+   public static void checkSigningTimeAgainstHostTime(SignatorInformation si) throws SignatureException {

+      checkSigningTimeAgainstHostTime(si.getSignSignatureObject());

+   }

+   

+   public static synchronized void checkSigningTimeAgainstHostTime(SignSignatureObject sso) throws SignatureException {

+      if (tolerance == null) {

+         try {

+            String toleranceString = SettingsReader.getInstance().getSetting(SIGNING_TIME_TOLERANCE_KEY, "-1");

+            tolerance = new Integer(Integer.parseInt(toleranceString));

+         } catch (NumberFormatException e) {

+            LOG.warn("Invalid configuration key = " + SIGNING_TIME_TOLERANCE_KEY + ". Disabling signing time check.");

+            tolerance = new Integer(-1);

+         } catch (SettingsException e) {

+            LOG.error("Error reading settings. Disabling signing time check.", e);

+            tolerance = new Integer(-1);

+         }

+      }

+      if (tolerance.intValue() == -1) {

+         return;

+      }

+      

+      // signing time

+      Date signingTime = EGIZDate.parseDateFromString(sso.getDate());

+      

+      // current time

+      Date currentTime = new Date();

+      

+      // lower limit

+      Date lowerLimit = new Date(currentTime.getTime() - tolerance.intValue()*1000);

+      

+      // upper limit

+      Date upperLimit = new Date(currentTime.getTime() + tolerance.intValue()*1000);

+      

+      String signingTimeString = DateFormatUtils.formatUTC(signingTime, FORMAT_UTC_DATE_PATTERN);

+      

+      if (LOG.isDebugEnabled()) {

+         String lower = DateFormatUtils.formatUTC(lowerLimit, FORMAT_UTC_DATE_PATTERN);

+         String upper = DateFormatUtils.formatUTC(upperLimit, FORMAT_UTC_DATE_PATTERN);

+         LOG.debug("Checking if signing time " + signingTimeString + " is valid according to the given time frame [ " + lower + ", " + upper + " ].");

+      }

+      

+      if (signingTime.before(lowerLimit) || signingTime.after(upperLimit)) {

+         throw new SignatureException(ErrorCode.INVALID_SIGNING_TIME, "The signing time " + signingTimeString + " is out of the given tolerance of " + tolerance.intValue() + " seconds.");

+      }

+      

+   }

+   

+}