Merge branch 'theFuture7012' into candidate-7.0.x

dali/server/daldap.cpp

@@ -54,6 +54,7 @@ class CDaliLdapConnection: implements IDaliLdapConnection, public CInterface
     StringAttr              filesdefaultpassword;
     unsigned                ldapflags;
     unsigned                requestSignatureExpiryMinutes;//Age at which a dali permissions request signature becomes invalid
+    unsigned                requestSignatureAllowedClockVarianceSeconds;//Number of seconds that timestamps can vary between nodes
     IDigitalSignatureManager * pDSM = nullptr;
 
     void createDefaultScopes()
@@ -86,6 +87,7 @@ public:
         ldapflags = 0;
         if (ldapprops) {
             requestSignatureExpiryMinutes = ldapprops->getPropInt("@reqSignatureExpiry", 10);
+            requestSignatureAllowedClockVarianceSeconds = ldapprops->getPropInt("@allowedClockVariance", 5);
             if (ldapprops->getPropBool("@checkScopeScans",true))
                 ldapflags |= DLF_SCOPESCANS;
             if (ldapprops->getPropBool("@safeLookup",true))
@@ -164,23 +166,28 @@ public:
 
                 CDateTime now;
                 now.setNow();
-                if (now.compare(reqUTCTimestamp, false) < 0)//timestamp from the future?
+                CDateTime daliTime(now);
+                if (requestSignatureAllowedClockVarianceSeconds)//allow for clock variance between machines
+                    daliTime.adjustTimeSecs(requestSignatureAllowedClockVarianceSeconds);
+
+                if (daliTime.compare(reqUTCTimestamp, false) < 0)//timestamp from the future?
                 {
                     StringBuffer localDaliTimeUTC;
                     now.getString(localDaliTimeUTC, false);//get UTC timestamp
-                    ERRLOG("LDAP: getPermissions(%s) scope=%s user=%s Request digital signature UTC timestamp %s from the future (Dali UTC time %s)",key?key:"NULL",obj?obj:"NULL",username.str(), requestTimestamp.str(), localDaliTimeUTC.str());
+                    ERRLOG("getPermissions(%s) scope=%s user=%s Request digital signature UTC timestamp %s from the future (Dali UTC time %s). Check configured allowedClockVariance (%d sec)",key?key:"NULL",obj?obj:"NULL",username.str(), requestTimestamp.str(), localDaliTimeUTC.str(), requestSignatureAllowedClockVarianceSeconds);
                     return SecAccess_None;//deny
                 }
 
-                CDateTime expiry;
-                expiry.set(now);
-                expiry.adjustTime(requestSignatureExpiryMinutes);//compute expiration timestamp
+                CDateTime expiry(now);
+                expiry.adjustTime(-1 * requestSignatureExpiryMinutes);//compute expiration timestamp
+                if (requestSignatureAllowedClockVarianceSeconds)//allow for clock variance between machines
+                    expiry.adjustTimeSecs(-1 * requestSignatureAllowedClockVarianceSeconds);
 
-                if (expiry.compare(reqUTCTimestamp, false) < 0)//timestamp too far in the past?
+                if (reqUTCTimestamp.compare(expiry, false) < 0)//timestamp too far in the past?
                 {
                     StringBuffer localDaliTimeUTC;
                     now.getString(localDaliTimeUTC, false);//get UTC timestamp
-                    ERRLOG("LDAP: getPermissions(%s) scope=%s user=%s Expired request digital signature UTC timestamp %s (Dali UTC time %s, configured expiry %d minutes)",key?key:"NULL",obj?obj:"NULL",username.str(), requestTimestamp.str(), localDaliTimeUTC.str(), requestSignatureExpiryMinutes);
+                    ERRLOG("getPermissions(%s) scope=%s user=%s Expired request digital signature UTC timestamp %s (Dali UTC time %s, configured expiry %d minutes. Check configured allowedClockVariance (%d sec))",key?key:"NULL",obj?obj:"NULL",username.str(), requestTimestamp.str(), localDaliTimeUTC.str(), requestSignatureExpiryMinutes, requestSignatureAllowedClockVarianceSeconds);
                     return SecAccess_None;//deny
                 }
 

initfiles/componentfiles/configxml/dali.xsd

@@ -409,6 +409,13 @@
         </xs:appinfo>
       </xs:annotation>
     </xs:attribute>
+    <xs:attribute name="allowedClockVariance" use="optional" type="xs:string" default="5">
+      <xs:annotation>
+        <xs:appinfo>
+          <tooltip>Maximum number of seconds that client clocks can vary from Dali clock, used when checking permissions request digital signature.</tooltip>
+        </xs:appinfo>
+      </xs:annotation>
+    </xs:attribute>
     <xs:attribute name="checkScopeScans" type="xs:boolean" use="optional" default="true">
       <xs:annotation>
         <xs:appinfo>

initfiles/componentfiles/configxml/dali.xsl

@@ -240,7 +240,7 @@
         </xsl:element>
         <xsl:if test="string(@ldapServer) != ''">
           <xsl:element name="ldapSecurity">
-            <xsl:copy-of select="@ldapProtocol | @authMethod | @maxConnections | @workunitsBasedn | @filesDefaultUser | @filesDefaultPassword | @reqSignatureExpiry"/>
+            <xsl:copy-of select="@ldapProtocol | @authMethod | @maxConnections | @workunitsBasedn | @filesDefaultUser | @filesDefaultPassword | @reqSignatureExpiry | @allowedClockVariance"/>
             <xsl:variable name="ldapServerName" select="@ldapServer"/>
             <xsl:attribute name="filesBasedn">
                 <xsl:value-of select="/Environment/Software/LDAPServerProcess[@name=$ldapServerName]/@filesBasedn"/>

system/jlib/jtime.cpp

@@ -365,6 +365,13 @@ void CDateTime::adjustTime(int deltaMins)
     set(simple);
 }
 
+void CDateTime::adjustTimeSecs(int deltaSecs)
+{
+    time_t simple = getSimple();
+    simple += deltaSecs;
+    set(simple);
+}
+
 void CDateTime::getDate(unsigned & year, unsigned & month, unsigned & day, bool local) const
 {
     if(local)

system/jlib/jtime.hpp

@@ -88,6 +88,7 @@ public:
     void setTimeString(char const * str, char const * * end = NULL, bool local = false); // Leaves the date alone, sets to the time given as hh:mm:ss[.nnnnnnnnn]
     void setNow();
     void adjustTime(int deltaMins);
+    void adjustTimeSecs(int deltaSecs);
 
     void getDate(unsigned & year, unsigned & month, unsigned & day, bool local = false) const;
     void getTime(unsigned & hour, unsigned & minute, unsigned & second, unsigned & nano, bool local = false) const;