* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.

*

* Copyright (c) 1997-2013 Oracle and/or its affiliates. All rights reserved.

*

* The contents of this file are subject to the terms of either the GNU

* General Public License Version 2 only ("GPL") or the Common Development

* and Distribution License("CDDL") (collectively, the "License").  You

* may not use this file except in compliance with the License.  You can

* obtain a copy of the License at

* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html

* or packager/legal/LICENSE.txt.  See the License for the specific

* language governing permissions and limitations under the License.

*

* When distributing the software, include this License Header Notice in each

* file and include the License file at packager/legal/LICENSE.txt.

*

* GPL Classpath Exception:

* Oracle designates this particular file as subject to the "Classpath"

* exception as provided by Oracle in the GPL Version 2 section of the License

* file that accompanied this code.

*

* Modifications:

* If applicable, add the following below the License Header, with the fields

* enclosed by brackets [] replaced by your own identifying information:

* "Portions Copyright [year] [name of copyright owner]"

*

* Contributor(s):

* If you wish your version of this file to be governed by only the CDDL or

* only the GPL Version 2, indicate your decision by adding "[Contributor]

* elects to include this software in this distribution under the [CDDL or GPL

* Version 2] license."  If you don't indicate a single choice of license, a

* recipient has the option to distribute your version of this file under

* either the CDDL, the GPL Version 2 or to extend the choice of license to

* its licensees as provided above.  However, if you add GPL Version 2 code

* and therefore, elected the GPL Version 2 license, then the option applies

* only if the new code is made subject to such option by the copyright

* holder.

*/

*

*  @author Vbkumar.Jayanti@Sun.COM, shyam.rao@sun.com

*/

    protected static final Logger log =

            Logger.getLogger(

            LogDomainConstants.WSS_JAXWS_IMPL_DOMAIN,

            LogDomainConstants.WSS_JAXWS_IMPL_DOMAIN_BUNDLE);

    //protected Tube nextTube;

    // TODO: Optimized flag to be set based on some conditions (no SignedElements/EncryptedElements)

    protected boolean optimized = true;

    protected boolean transportOptimization = false;

    // Per-Proxy State for SecureConversation sessions

    // as well as IssuedTokenContext returned by invoking a Trust-Plugin

    // This map stores IssuedTokenContext against the Policy-Id

    protected Hashtable<String, IssuedTokenContext> issuedTokenContextMap = new Hashtable<String, IssuedTokenContext>();

    protected TubeConfiguration tubeConfig = null;

    //static JAXBContext used across the Tube

    protected static JAXBContext jaxbContext;

    protected WSSCVersion wsscVer;

    protected WSTrustVersion wsTrustVer;

    protected RmProtocolVersion rmVer = RmProtocolVersion.WSRM200502;

    protected McProtocolVersion mcVer = McProtocolVersion.WSMC200702;

    protected boolean disablePayloadBuffer = false;

    protected AlgorithmSuite bindingLevelAlgSuite = null;

    private final QName EPREnabled = new QName("http://schemas.sun.com/2006/03/wss/server", "EnableEPRIdentity");

    private final QName encSCServerCancel = new QName("http://schemas.sun.com/2006/03/wss/server", "EncSCCancel");

    private final QName encSCClientCancel = new QName("http://schemas.sun.com/2006/03/wss/client", "EncSCCancel");

    private final QName optServerSecurity = new QName("http://schemas.sun.com/2006/03/wss/server", "DisableStreamingSecurity");

    private final QName optClientSecurity = new QName("http://schemas.sun.com/2006/03/wss/client", "DisableStreamingSecurity");

    private final QName disableSPBuffering = new QName("http://schemas.sun.com/2006/03/wss/server", "DisablePayloadBuffering");

    private final QName disableCPBuffering = new QName("http://schemas.sun.com/2006/03/wss/client", "DisablePayloadBuffering");

    protected boolean disableIncPrefix = false;

    private final QName disableIncPrefixServer = new QName("http://schemas.sun.com/2006/03/wss/server", "DisableInclusivePrefixList");

    private final QName disableIncPrefixClient = new QName("http://schemas.sun.com/2006/03/wss/client", "DisableInclusivePrefixList");

    protected boolean encHeaderContent = false;

    private final QName encHeaderContentServer = new QName("http://schemas.sun.com/2006/03/wss/server", "EncryptHeaderContent");

    private final QName encHeaderContentClient = new QName("http://schemas.sun.com/2006/03/wss/client", "EncryptHeaderContent");

    private final QName bsp10Server = new QName("http://schemas.sun.com/2006/03/wss/server", "BSP10");

    private final QName bsp10Client = new QName("http://schemas.sun.com/2006/03/wss/client", "BSP10");

    protected boolean bsp10 = false;

    protected boolean allowMissingTimestamp = false;

    private final QName allowMissingTSServer = new QName("http://schemas.sun.com/2006/03/wss/server", "AllowMissingTimestamp");

    private final QName allowMissingTSClient = new QName("http://schemas.sun.com/2006/03/wss/client", "AllowMissingTimestamp");

    protected boolean securityMUValue = true;

    private final QName unsetSecurityMUValueServer = new QName("http://schemas.sun.com/2006/03/wss/server", "UnsetSecurityMUValue");

    private final QName unsetSecurityMUValueClient = new QName("http://schemas.sun.com/2006/03/wss/client", "UnsetSecurityMUValue");

    protected boolean encRMLifecycleMsg = false;

    private final QName encRMLifecycleMsgServer = new QName("http://schemas.sun.com/2006/03/wss/server", "EncryptRMLifecycleMessage");

    private final QName encRMLifecycleMsgClient = new QName("http://schemas.sun.com/2006/03/wss/client", "EncryptRMLifecycleMessage");

    protected static final ArrayList<String> securityPolicyNamespaces;

    protected static final List<PolicyAssertion> EMPTY_LIST = Collections.emptyList();

    // Security Environment reference initialized with a JAAS CallbackHandler

    protected SecurityEnvironment secEnv = null;

    // debug the Secure SOAP Messages (enable dumping)

    protected static final boolean debug = false;

    // SOAP version

    protected boolean isSOAP12 = false;

    protected SOAPVersion soapVersion = null;

    // SOAP Factory

    protected SOAPFactory soapFactory = null;

    protected PolicyMap wsPolicyMap = null;

    //public static final URI ISSUE_REQUEST_URI ;

    //public static final URI CANCEL_REQUEST_URI;

    protected Policy bpMSP = null;

    //milliseconds

    protected long timestampTimeOut = 0;

    protected int iterationsForPDK = 0;

    protected boolean isEPREnabled = false;

    protected boolean isCertValidityVerified = false;

    protected List<PolicyAlternativeHolder> policyAlternatives = new ArrayList<PolicyAlternativeHolder>();

    /**

     * Constants for RM Security Processing

     */

    protected WSDLBoundOperation cachedOperation = null;

    protected Policy wsitConfig = null;

    // store as instance variable

    protected Marshaller marshaller = null;

    protected Unmarshaller unmarshaller = null;

    // store operation resolver

    // protected OperationResolver opResolver = null;

    //store instance variable(s): Binding has IssuedToken/RM/SC Policy

    boolean hasIssuedTokens = false;

    boolean hasSecureConversation = false;

    boolean hasReliableMessaging = false;

    boolean hasMakeConnection = false;

    boolean hasKerberosToken = false;

    //boolean addressingEnabled = false;

    AddressingVersion addVer = null;

    // Security Policy version

    protected SecurityPolicyVersion spVersion = null;

    protected static final String WSDLPORT = "WSDLPort";

    protected static final String WSENDPOINT = "WSEndpoint";

    //flag used as temporary variable for each run

    //boolean isTrustOrSCMessage = false;

    protected X509Certificate serverCert = null;

    private boolean encryptCancelPayload = false;

    private Policy cancelMSP;

    protected boolean isCertValid;

    private AlgorithmSuite bootStrapAlgoSuite;

    static {

        try {

            //TODO: system property maynot be appropriate for server side.

            //debug = Boolean.valueOf(System.getProperty("DebugSecurity"));

            //ISSUE_REQUEST_URI = new URI(WSTrustConstants.REQUEST_SECURITY_TOKEN_ISSUE_ACTION);

            //CANCEL_REQUEST_URI = new URI(WSTrustConstants.CANCEL_REQUEST);

            //jaxbContext = WSTrustElementFactory.getContext();           

            securityPolicyNamespaces = new ArrayList<String>();

            securityPolicyNamespaces.add(SecurityPolicyVersion.SECURITYPOLICY200507.namespaceUri);

        } catch (Exception e) {

            throw new RuntimeException(e);

        }

    }

    public SecurityTubeBase(TubeConfiguration config, Tube nextTube) {

        super(nextTube);

        this.tubeConfig = config;

        soapVersion = tubeConfig.getBinding().getSOAPVersion();

        //addressingEnabled = (pipeConfig.getBinding().getAddressingVersion() == null) ?  false : true;

        isSOAP12 = (soapVersion == SOAPVersion.SOAP_12);

        wsPolicyMap = tubeConfig.getPolicyMap();

        soapFactory = tubeConfig.getBinding().getSOAPVersion().saajSoapFactory;

        //unmarshaller as instance variable of the pipe

        if (wsPolicyMap != null) {

            collectPolicies(policyAlternatives);

        }

        try {

            jaxbContext = WSTrustElementFactory.getContext(wsTrustVer);

            this.marshaller = jaxbContext.createMarshaller();

            this.unmarshaller = jaxbContext.createUnmarshaller();

        } catch (javax.xml.bind.JAXBException ex) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0001_PROBLEM_MAR_UNMAR(), ex);

            throw new RuntimeException(LogStringsMessages.WSSTUBE_0001_PROBLEM_MAR_UNMAR(), ex);

        }

        //unmarshaller = jaxbContext.createUnmarshaller();

        // check whether Service Port has RM

        hasReliableMessaging = isReliableMessagingEnabled(tubeConfig.getWSDLPort());

        hasMakeConnection = isMakeConnectionEnabled(tubeConfig.getWSDLPort());

    //   opResolver = new OperationResolverImpl(inMessagePolicyMap,pipeConfig.getWSDLModel().getBinding());

    }

    protected SecurityTubeBase(SecurityTubeBase that, TubeCloner cloner) {

        super(that, cloner);

        tubeConfig = that.tubeConfig;

        transportOptimization = that.transportOptimization;

        optimized = that.optimized;

        disableIncPrefix = that.disableIncPrefix;

        allowMissingTimestamp = that.allowMissingTimestamp;

        securityMUValue = that.securityMUValue;

        encHeaderContent = that.encHeaderContent;

        issuedTokenContextMap = that.issuedTokenContextMap;

        secEnv = that.secEnv;

        isSOAP12 = that.isSOAP12;

        soapVersion = that.soapVersion;

        this.spVersion = that.spVersion;

        this.soapFactory = that.soapFactory;

        this.addVer = that.addVer;

        this.wsTrustVer = that.wsTrustVer;

        this.wsscVer = that.wsscVer;

        this.rmVer = that.rmVer;

        this.mcVer = that.mcVer;

        this.encRMLifecycleMsg = that.encRMLifecycleMsg;

        wsPolicyMap = that.wsPolicyMap;

        this.policyAlternatives = that.policyAlternatives;

        bindingLevelAlgSuite = that.bindingLevelAlgSuite;

        this.hasIssuedTokens = that.hasIssuedTokens;

        this.hasKerberosToken = that.hasKerberosToken;

        this.hasSecureConversation = that.hasSecureConversation;

        this.hasReliableMessaging = that.hasReliableMessaging;

        this.hasMakeConnection = that.hasMakeConnection;

        //this.opResolver = that.opResolver;

        this.timestampTimeOut = that.timestampTimeOut;

        this.iterationsForPDK = that.iterationsForPDK;

        this.serverCert = that.serverCert;

        this.isCertValidityVerified = that.isCertValidityVerified;

        this.isCertValid = that.isCertValid;

        this.cancelMSP = that.cancelMSP;

        this.encryptCancelPayload = that.encryptCancelPayload;

        try {

            this.marshaller = WSTrustElementFactory.getContext(this.wsTrustVer).createMarshaller();

            this.unmarshaller = WSTrustElementFactory.getContext(this.wsTrustVer).createUnmarshaller();

        } catch (javax.xml.bind.JAXBException ex) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0001_PROBLEM_MAR_UNMAR(), ex);

            throw new RuntimeException("Problem creating JAXB Marshaller/Unmarshaller", ex);

        }

    }

    protected SOAPMessage secureOutboundMessage(SOAPMessage message, ProcessingContext ctx) {

        try {

            ctx.setSOAPMessage(message);

            SecurityAnnotator.secureMessage(ctx);

            return ctx.getSOAPMessage();

        } catch (WssSoapFaultException soapFaultException) {

            throw getSOAPFaultException(soapFaultException);

        } catch (XWSSecurityException xwse) {

            log.log(Level.SEVERE,

                    LogStringsMessages.WSSTUBE_0024_ERROR_SECURING_OUTBOUND_MSG(), xwse);

            WssSoapFaultException wsfe =

                    SecurableSoapMessage.newSOAPFaultException(

                    MessageConstants.WSSE_INTERNAL_SERVER_ERROR,

                    xwse.getMessage(), xwse);

            throw wsfe;

        }

    }

    protected RuntimeException generateInternalError(PolicyException ex) {

        SOAPFault fault;

        try {

            if (isSOAP12) {

                fault = soapFactory.createFault(ex.getMessage(), SOAPConstants.SOAP_SENDER_FAULT);

                fault.appendFaultSubcode(MessageConstants.WSSE_INTERNAL_SERVER_ERROR);

            } else {

                fault = soapFactory.createFault(ex.getMessage(), MessageConstants.WSSE_INTERNAL_SERVER_ERROR);

            }

        } catch (Exception e) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR(), e);

            throw new RuntimeException(LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR(), e);

        }

        return new SOAPFaultException(fault);

    }

    protected Message secureOutboundMessage(Message message, ProcessingContext ctx) {

        try {

            JAXBFilterProcessingContext context = (JAXBFilterProcessingContext) ctx;

            context.setSOAPVersion(soapVersion);

            context.setAllowMissingTimestamp(allowMissingTimestamp);

            context.setMustUnderstandValue(securityMUValue);

            context.setWSSAssertion(((MessagePolicy) ctx.getSecurityPolicy()).getWSSAssertion());

            context.setJAXWSMessage(message, soapVersion);

            context.isOneWayMessage(message.isOneWay(this.tubeConfig.getWSDLPort()));

            context.setDisableIncPrefix(disableIncPrefix);

            context.setEncHeaderContent(encHeaderContent);

            context.setBSP(bsp10);

            SecurityAnnotator.secureMessage(context);

            return context.getJAXWSMessage();

        } catch (XWSSecurityException xwse) {

            log.log(Level.SEVERE,

                    LogStringsMessages.WSSTUBE_0024_ERROR_SECURING_OUTBOUND_MSG(), xwse);

            WssSoapFaultException wsfe =

                    SecurableSoapMessage.newSOAPFaultException(

                    MessageConstants.WSSE_INTERNAL_SERVER_ERROR,

                    xwse.getMessage(), xwse);

            throw wsfe;

        }

    }

    protected SOAPMessage verifyInboundMessage(SOAPMessage message, ProcessingContext ctx)

            throws WssSoapFaultException, XWSSecurityException {

        try {

            ctx.setSOAPMessage(message);

            if (debug) {

                DumpFilter.process(ctx);

            }

            NewSecurityRecipient.validateMessage(ctx);

            return ctx.getSOAPMessage();

        } catch (WssSoapFaultException soapFaultException) {

            throw getSOAPFaultException(soapFaultException);

        } catch (XWSSecurityException xwse) {

            //TODO: MISSING-LOG

            WssSoapFaultException wsfe =

                    SecurableSoapMessage.newSOAPFaultException(

                    MessageConstants.WSSE_INTERNAL_SERVER_ERROR,

                    xwse.getMessage(), xwse);

            throw getSOAPFaultException(wsfe);

        }

    }

    protected Message verifyInboundMessage(Message message, ProcessingContext ctx) throws XWSSecurityException {

        JAXBFilterProcessingContext context = (JAXBFilterProcessingContext) ctx;

        context.setDisablePayloadBuffering(disablePayloadBuffer);

        context.setDisableIncPrefix(disableIncPrefix);

        if (((MessagePolicy) ctx.getSecurityPolicy()) != null) {

            context.setWSSAssertion(((MessagePolicy) ctx.getSecurityPolicy()).getWSSAssertion());

        }

        context.setAllowMissingTimestamp(allowMissingTimestamp);

        context.setMustUnderstandValue(securityMUValue);

        context.setEncHeaderContent(encHeaderContent);

        context.setBSP(bsp10);

        //  context.setJAXWSMessage(message, soapVersion);

        if (debug) {

            try {

                ((LazyStreamBasedMessage) message).print();

            } catch (XMLStreamException ex) {

                log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0003_PROBLEM_PRINTING_MSG(), ex);

                throw new XWSSecurityException(LogStringsMessages.WSSTUBE_0003_PROBLEM_PRINTING_MSG(), ex);

            }

        }

        LazyStreamBasedMessage lazyStreamMessage = (LazyStreamBasedMessage) message;

        AttachmentSet attachSet = null;

        if (!lazyStreamMessage.mtomLargeData()) {

            attachSet = lazyStreamMessage.getAttachments();

        }

        com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient recipient;

        if (attachSet == null || attachSet.isEmpty()) {

            recipient =

                    new com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient(lazyStreamMessage.readMessage(), soapVersion);

        } else {

            recipient = new com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient(lazyStreamMessage.readMessage(), soapVersion, attachSet);

        }

        return recipient.validateMessage(context);

    }

    protected List<PolicyAssertion> getIssuedTokenPoliciesFromBootstrapPolicy(

            Token scAssertion) {

        SCTokenWrapper token = (SCTokenWrapper) scAssertion;

        return token.getIssuedTokens();

    }

    protected List<PolicyAssertion> getKerberosTokenPoliciesFromBootstrapPolicy(Token scAssertion) {

        SCTokenWrapper token = (SCTokenWrapper) scAssertion;

        return token.getKerberosTokens();

    }

    protected MessagePolicy getOutgoingXWSSecurityPolicy(

            Packet packet, boolean isSCMessage) {

        if (isSCMessage) {

            Token scToken = (Token) packet.invocationProperties.get(SC_ASSERTION);

            return getOutgoingXWSBootstrapPolicy(scToken);

        }

        Message message = packet.getMessage();

        WSDLBoundOperation operation;

        if (isTrustMessage(packet)) {

            operation = getWSDLOpFromAction(packet, false);

        } else {

            operation = message.getOperation(tubeConfig.getWSDLPort());

        }

        //Review : Will this return operation name in all cases , doclit,rpclit, wrap / non wrap ?

        MessagePolicy mp = null;

        PolicyAlternativeHolder applicableAlternative =

                resolveAlternative(packet, isSCMessage);

        //if(operation == null){

        //Body could be encrypted. Security will have to infer the

        //policy from the message till the Body is decrypted.

        //    mp =  new MessagePolicy();

        //}

        if (applicableAlternative.getOutMessagePolicyMap() == null) {

            //empty message policy

            return new MessagePolicy();

        }

        SecurityPolicyHolder sph =

                (SecurityPolicyHolder) applicableAlternative.getOutMessagePolicyMap().get(operation);

        if (sph == null) {

            return new MessagePolicy();

        }

        mp = sph.getMessagePolicy();

        return mp;

    }

    protected WSDLBoundOperation getOperation(Message message) {

        if (cachedOperation == null) {

            cachedOperation = message.getOperation(tubeConfig.getWSDLPort());

        }

        return cachedOperation;

    }

    protected MessagePolicy getInboundXWSBootstrapPolicy(Token scAssertion) {

        return ((SCTokenWrapper) scAssertion).getMessagePolicy();

    }

    protected MessagePolicy getOutgoingXWSBootstrapPolicy(Token scAssertion) {

        return ((SCTokenWrapper) scAssertion).getMessagePolicy();

    }

    @SuppressWarnings("unchecked")

    protected ProcessingContext initializeInboundProcessingContext(

            Packet packet /*, boolean isSCMessage*/) {

        ProcessingContextImpl ctx;

        if (optimized) {

            ctx = new JAXBFilterProcessingContext(packet.invocationProperties);

            ((JAXBFilterProcessingContext) ctx).setAddressingVersion(addVer);

            ((JAXBFilterProcessingContext) ctx).setSOAPVersion(soapVersion);

            ((JAXBFilterProcessingContext) ctx).setSecure(packet.wasTransportSecure);

            ((JAXBFilterProcessingContext) ctx).setBSP(bsp10);

        } else {

            ctx = new ProcessingContextImpl(packet.invocationProperties);

        }

        /* Issue 1081 Move this to Action Header Processor

        if (isSCRenew(packet)) {

            ctx.isExpired(true);

        }*/

        ctx.setAddressingEnabled(this.isAddressingEnabled());

        ctx.setWsscVer(this.wsscVer);

        String action = null;

        /* Issue 1081 Move this to Action Header Processor

        if (addVer != null) {

            action = getAction(packet);

            ctx.setAction(action);

        }*/

       

        // Set the SecurityPolicy version namespace in processingContext

        ctx.setSecurityPolicyVersion(spVersion.namespaceUri);

        //ctx.setIssuedTokenContextMap(issuedTokenContextMap);

        ctx.setiterationsForPDK(this.iterationsForPDK);

        /* Issue 1081 Move this to Action Header Processor

        if ((action != null && (action.contains("/RST/SCT") || action.contains("/RSTR/SCT"))) && this.bootStrapAlgoSuite != null) {

            ctx.setAlgorithmSuite(getAlgoSuite(this.bootStrapAlgoSuite));

        } else {

            ctx.setAlgorithmSuite(getAlgoSuite(getBindingAlgorithmSuite(packet)));

        }*/

        ctx.setBootstrapAlgoSuite(getAlgoSuite(this.bootStrapAlgoSuite));

        ctx.setAlgorithmSuite(getAlgoSuite(getBindingAlgorithmSuite(packet)));

        //set the server certificate in the context ;

        if (serverCert != null) {

            if (isCertValidityVerified == false) {

                CertificateRetriever cr = new CertificateRetriever();

                isCertValid = cr.setServerCertInTheContext(ctx, secEnv, serverCert);

                cr = null;

                isCertValidityVerified = true;

            } else {

                if (isCertValid == true) {

                    ctx.getExtraneousProperties().put(XWSSConstants.SERVER_CERTIFICATE_PROPERTY, serverCert);

                }

            }

        }

        // setting a flag if issued tokens present

        ctx.hasIssuedToken(bindingHasIssuedTokenPolicy());

        ctx.setSecurityEnvironment(secEnv);

        ctx.isInboundMessage(true);

        /* Issue 1081 Move this to Action Header Processor

        if (isTrustMessage(packet)) {

            ctx.isTrustMessage(true);

        }*/

        ctx.setWsTrustVer(this.wsTrustVer);

       

        if (tubeConfig.getWSDLPort() != null) {

            ctx.getExtraneousProperties().put(SecurityTubeBase.WSDLPORT, tubeConfig.getWSDLPort());

        }

        if (tubeConfig instanceof ServerTubeConfiguration) {

            ctx.getExtraneousProperties().put(SecurityTubeBase.WSENDPOINT, ((ServerTubeConfiguration) tubeConfig).getEndpoint());

        }

        return ctx;

    }

    protected boolean bindingHasIssuedTokenPolicy() {

        return hasIssuedTokens;

    }

    protected boolean bindingHasSecureConversationPolicy() {

        return hasSecureConversation;

    }

    protected boolean bindingHasRMPolicy() {

        return hasReliableMessaging;

    }

    protected boolean hasKerberosTokenPolicy() {

        return hasKerberosToken;

    }

    @SuppressWarnings("unchecked")

    protected ProcessingContext initializeOutgoingProcessingContext(

            Packet packet, boolean isSCMessage) {

        ProcessingContextImpl ctx;

        if (optimized) {

            ctx = new JAXBFilterProcessingContext(packet.invocationProperties);

            ((JAXBFilterProcessingContext) ctx).setAddressingVersion(addVer);

            ((JAXBFilterProcessingContext) ctx).setSOAPVersion(soapVersion);

            ((JAXBFilterProcessingContext) ctx).setBSP(bsp10);

        } else {

            ctx = new ProcessingContextImpl(packet.invocationProperties);

        }

        if (addVer != null) {

            ctx.setAction(getAction(packet));

        }

        // Set the SecurityPolicy version namespace in processingContext

        ctx.setSecurityPolicyVersion(spVersion.namespaceUri);

        ctx.setTimestampTimeout(this.timestampTimeOut);

        ctx.setiterationsForPDK(this.iterationsForPDK);

        // set the policy, issued-token-map, and extraneous properties

        //ctx.setIssuedTokenContextMap(issuedTokenContextMap);

        ctx.setAlgorithmSuite(getAlgoSuite(getBindingAlgorithmSuite(packet)));

        //set the server certificate in the context ;

        if (serverCert != null) {

            if (isCertValidityVerified == false) {

                CertificateRetriever cr = new CertificateRetriever();

                isCertValid = cr.setServerCertInTheContext(ctx, secEnv, serverCert);

                cr = null;

                isCertValidityVerified = true;

            } else {

                if (isCertValid == true) {

                    ctx.getExtraneousProperties().put(XWSSConstants.SERVER_CERTIFICATE_PROPERTY, serverCert);

                }

            }

        }

        try {

            PolicyAlternativeHolder applicableAlternative =

                    resolveAlternative(packet, isSCMessage);

            MessagePolicy policy = null;

            if (isRMMessage(packet) || isMakeConnectionMessage(packet)) {

                SecurityPolicyHolder holder = applicableAlternative.getOutProtocolPM().get("RM");

                policy = holder.getMessagePolicy();

            } else if (isSCCancel(packet)) {

                SecurityPolicyHolder holder = applicableAlternative.getOutProtocolPM().get("SC-CANCEL");

                policy = holder.getMessagePolicy();

            } else if (isSCRenew(packet)) {

                policy = getOutgoingXWSSecurityPolicy(packet, isSCMessage);

                ctx.isExpired(true);

            } else {

                policy = getOutgoingXWSSecurityPolicy(packet, isSCMessage);

            }

            if (debug) {

                policy.dumpMessages(true);

            }

            if (policy.getAlgorithmSuite() != null) {

                //override the binding level suite

                ctx.setAlgorithmSuite(policy.getAlgorithmSuite());

            }

            ctx.setWSSAssertion(policy.getWSSAssertion());

            ctx.setSecurityPolicy(policy);

            ctx.setSecurityEnvironment(secEnv);

            ctx.isInboundMessage(false);

        } catch (XWSSecurityException e) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0006_PROBLEM_INIT_OUT_PROC_CONTEXT(), e);

            throw new RuntimeException(LogStringsMessages.WSSTUBE_0006_PROBLEM_INIT_OUT_PROC_CONTEXT(), e);

        }

        return ctx;

    }

    protected SOAPFault getSOAPFault(WssSoapFaultException sfe) {

        SOAPFault fault;

        try {

            if (isSOAP12) {

                fault = soapFactory.createFault(sfe.getFaultString(), SOAPConstants.SOAP_SENDER_FAULT);

                fault.appendFaultSubcode(sfe.getFaultCode());

            } else {

                fault = soapFactory.createFault(sfe.getFaultString(), sfe.getFaultCode());

            }

        } catch (Exception e) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR());

            throw new RuntimeException(LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR(), e);

        }

        return fault;

    }

    protected SOAPFaultException getSOAPFaultException(WssSoapFaultException sfe) {

        SOAPFault fault;

        try {

            if (isSOAP12) {

                fault = soapFactory.createFault(sfe.getFaultString(), SOAPConstants.SOAP_SENDER_FAULT);

                fault.appendFaultSubcode(sfe.getFaultCode());

            } else {

                fault = soapFactory.createFault(sfe.getFaultString(), sfe.getFaultCode());

            }

        } catch (SOAPException e) {

            log.log(Level.SEVERE, LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR());

            throw new RuntimeException(LogStringsMessages.WSSTUBE_0002_INTERNAL_SERVER_ERROR(), e);

        }

        SOAPFaultException e = new SOAPFaultException(fault);

        e.initCause(sfe);

        return e;

    }

    protected SOAPFaultException getSOAPFaultException(XWSSecurityException xwse) {

        QName qname;

        if (xwse.getCause() instanceof PolicyViolationException) {

            qname = MessageConstants.WSSE_RECEIVER_POLICY_VIOLATION;

        } else {

            qname = MessageConstants.WSSE_FAILED_AUTHENTICATION;

        }

        WssSoapFaultException wsfe =

                SecurableSoapMessage.newSOAPFaultException(

                qname, xwse.getMessage(), xwse);

        //TODO: MISSING-LOG

        return getSOAPFaultException(wsfe);

    }

    /**

     * Summary from Section 4.2, WS-Security Policy spec( version 1.1 July 2005 ).

     * MessagePolicySubject : policy can be attached to

     *   1) wsdl:binding/wsdl:operation/wsdl:input, ./wsdl:output, or ./wsdl:fault

     *

     * OperationPolicySubject : policy can be attached to

     *   1)wsdl:binding/wsdl:operation

     *

     * EndpointPolicySubject : policy can be attached to

     *   1)wsdl:port

     *   2)wsdl:Binding

     */

    protected void collectPolicies(List<PolicyAlternativeHolder> alternatives) {

        try {

            if (wsPolicyMap == null) {

                return;

            }

            //To check: Is this sufficient, any edge cases I need to take care

            QName serviceName = tubeConfig.getWSDLPort().getOwner().getName();

            QName portName = tubeConfig.getWSDLPort().getName();

            //Review: will this take care of EndpointPolicySubject

            //PolicyMerger policyMerge = PolicyMerger.getMerger();

            PolicyMapKey endpointKey = PolicyMap.createWsdlEndpointScopeKey(serviceName, portName);

            //createWsdlEndpointScopeKey(serviceName,portName);

            //Review:Will getEffectivePolicy return null or empty policy ?.

            Policy endpointPolicy = wsPolicyMap.getEndpointEffectivePolicy(endpointKey);

            //This will be used for setting credentials like  spVersion... etc for binding level policies

            setPolicyCredentials(endpointPolicy);

            //This will be used for setting credentials like  spVersion... etc for operation level policies

            for (WSDLBoundOperation operation : tubeConfig.getWSDLPort().getBinding().getBindingOperations()) {

                QName operationName = new QName(operation.getBoundPortType().getName().getNamespaceURI(), operation.getName().getLocalPart());

                PolicyMapKey operationKey = PolicyMap.createWsdlOperationScopeKey(serviceName, portName, operationName);

                Policy operationPolicy = wsPolicyMap.getOperationEffectivePolicy(operationKey);

                setPolicyCredentials(operationPolicy);

            }

            if (endpointPolicy == null) {

                ArrayList<Policy> policyList = new ArrayList<Policy>();

                PolicyAlternativeHolder ph = new PolicyAlternativeHolder(null, spVersion, bpMSP);

                alternatives.add(ph);

                collectOperationAndMessageLevelPolicies(wsPolicyMap, null, policyList, ph);

                return;

            }

            Iterator<AssertionSet> policiesIter = endpointPolicy.iterator();

            while (policiesIter.hasNext()) {

                ArrayList<Policy> policyList = new ArrayList<Policy>();

                AssertionSet ass = policiesIter.next();

                PolicyAlternativeHolder ph = new PolicyAlternativeHolder(ass, spVersion, bpMSP);

                alternatives.add(ph);

                Collection<AssertionSet> coll = new ArrayList<AssertionSet>();

                coll.add(ass);

                Policy singleAlternative = Policy.createPolicy(

                        endpointPolicy.getNamespaceVersion(), endpointPolicy.getName(), endpointPolicy.getId(), coll);

                buildProtocolPolicy(singleAlternative, ph);

                //if(endpointPolicy != null){

                policyList.add(singleAlternative);

                //}

                collectOperationAndMessageLevelPolicies(wsPolicyMap, singleAlternative, policyList, ph);

            }

        } catch (PolicyException pe) {

            throw generateInternalError(pe);

        }

    }

    //TODO:POLALT Alternatives only at BindingLevel for Now

    private void collectOperationAndMessageLevelPolicies(PolicyMap wsPolicyMap,

            Policy singleAlternative, ArrayList<Policy> policyList, PolicyAlternativeHolder ph) {

        if (wsPolicyMap == null) {

            return;

        }

        try {

            QName serviceName = tubeConfig.getWSDLPort().getOwner().getName();

            QName portName = tubeConfig.getWSDLPort().getName();

            PolicyMerger policyMerge = PolicyMerger.getMerger();

            for (WSDLBoundOperation operation : tubeConfig.getWSDLPort().getBinding().getBindingOperations()) {

                QName operationName = new QName(operation.getBoundPortType().getName().getNamespaceURI(),

                        operation.getName().getLocalPart());

                PolicyMapKey messageKey = PolicyMap.createWsdlMessageScopeKey(

                        serviceName, portName, operationName);

                PolicyMapKey operationKey = PolicyMap.createWsdlOperationScopeKey(serviceName, portName, operationName);

                //Review:Not sure if this is need and what is the

                //difference between operation and message level key.

                //securityPolicyNamespaces

                Policy operationPolicy = wsPolicyMap.getOperationEffectivePolicy(operationKey);

                if (operationPolicy != null) {

                    policyList.add(operationPolicy);

                } else {

                    //log fine message

                    //System.out.println("Operation Level Security policy is null");

                }

                Policy imPolicy = null;

                imPolicy = wsPolicyMap.getInputMessageEffectivePolicy(messageKey);

                if (imPolicy != null) {

                    policyList.add(imPolicy);

                }

                //input message effective policy to be used. Policy elements at various

                //scopes merged.

                Policy imEP = policyMerge.merge(policyList);

                SecurityPolicyHolder outPH = null;

                if (imEP != null) {

                    outPH = addOutgoingMP(operation, imEP, ph);

                }

                if (imPolicy != null) {

                    policyList.remove(imPolicy);

                }

                //one way

                SecurityPolicyHolder inPH = null;

                Policy omPolicy = null;

                omPolicy = wsPolicyMap.getOutputMessageEffectivePolicy(messageKey);

                if (omPolicy != null) {

                    policyList.add(omPolicy);

                }

                //ouput message effective policy to be used. Policy elements at various

                //scopes merged.

                Policy omEP = policyMerge.merge(policyList);

                if (omPolicy != null) {

                    policyList.remove(omPolicy);

                }

                if (omEP != null) {

                    inPH = addIncomingMP(operation, omEP, ph);

                }

                Iterator faults = operation.getOperation().getFaults().iterator();

                ArrayList<Policy> faultPL = new ArrayList<Policy>();

                if (singleAlternative != null) {

                    faultPL.add(singleAlternative);

                }

                if (operationPolicy != null) {

                    faultPL.add(operationPolicy);

                }

                while (faults.hasNext()) {

                    WSDLFault fault = (WSDLFault) faults.next();

                    PolicyMapKey fKey = null;

                    fKey = PolicyMap.createWsdlFaultMessageScopeKey(

                            serviceName, portName, operationName,

                            new QName(operationName.getNamespaceURI(), fault.getName()));

                    Policy fPolicy = wsPolicyMap.getFaultMessageEffectivePolicy(fKey);

                    if (fPolicy != null) {

                        faultPL.add(fPolicy);

                    } else {

                        //continue;

                    }

                    Policy ep = policyMerge.merge(faultPL);

                    if (inPH != null) {

                        addIncomingFaultPolicy(ep, inPH, fault);

                    }

                    if (outPH != null) {

                        addOutgoingFaultPolicy(ep, outPH, fault);

                    }

                    faultPL.remove(fPolicy);

                }

                if (operationPolicy != null) {

                    policyList.remove(operationPolicy);

                }

            }

        } catch (PolicyException pe) {

            throw generateInternalError(pe);

        }

    }

    //TODO:POLALT : should this method look over all alternatives

    protected List<PolicyAssertion> getInBoundSCP(Message message) {

        SecurityPolicyHolder sph = null;

        //TODO:encapsulate this explicit public member access p.x below

        for (PolicyAlternativeHolder p : policyAlternatives) {

            if (p.getInMessagePolicyMap() == null) {

                return Collections.emptyList();

            }

            Collection coll = p.getInMessagePolicyMap().values();

            Iterator itr = coll.iterator();

            while (itr.hasNext()) {

                SecurityPolicyHolder ph = (SecurityPolicyHolder) itr.next();

                if (ph != null) {

                    sph = ph;

                    break;

                }

            }

            if (sph == null) {

                return EMPTY_LIST;

            }

        }

        return sph.getSecureConversationTokens();

    }

    //TODO:POLALT : should this method look over all alternatives

    protected List<PolicyAssertion> getOutBoundSCP(

            Message message) {

        SecurityPolicyHolder sph = null;

        //TODO:encapsulate this explicit public member access p.x below

        for (PolicyAlternativeHolder p : policyAlternatives) {

            if (p.getOutMessagePolicyMap() == null) {

                return Collections.emptyList();

            }

            Collection coll = p.getOutMessagePolicyMap().values();

            Iterator itr = coll.iterator();

            while (itr.hasNext()) {

                SecurityPolicyHolder ph = (SecurityPolicyHolder) itr.next();

                if (ph != null) {

                    sph = ph;

                    break;

                }

            }

            if (sph == null) {

                return EMPTY_LIST;

            }

        }

        return sph.getSecureConversationTokens();

    }

    //TODO:POLALT : should this method look over all alternatives

    protected List<PolicyAssertion> getOutBoundKTP(Packet packet, boolean isSCMessage) {

        if (isSCMessage) {

            Token scToken = (Token) packet.invocationProperties.get(SC_ASSERTION);

            return ((SCTokenWrapper) scToken).getKerberosTokens();

        }

        SecurityPolicyHolder sph = null;

        //TODO:encapsulate this explicit public member access p.x below

        for (PolicyAlternativeHolder p : policyAlternatives) {

            if (p.getOutMessagePolicyMap() == null) {

                return Collections.emptyList();

            }

            Message message = packet.getMessage();

            Collection coll = p.getOutMessagePolicyMap().values();

            Iterator itr = coll.iterator();

            while (itr.hasNext()) {

                SecurityPolicyHolder ph = (SecurityPolicyHolder) itr.next();

                if (ph != null) {

                    sph = ph;

                    break;

                }

            }

            if (sph == null) {

                return EMPTY_LIST;

            }

        }

        return sph.getKerberosTokens();

    }

    //TODO:POLALT : should this method look over all alternatives

    protected List<PolicyAssertion> getSecureConversationPolicies(

            Message message, String scope) {

        SecurityPolicyHolder sph = null;

        //TODO:encapsulate this explicit public member access p.x below

        for (PolicyAlternativeHolder p : policyAlternatives) {

            if (p.getOutMessagePolicyMap() == null) {

                return Collections.emptyList();

            }

            Collection coll = p.getOutMessagePolicyMap().values();

            Iterator itr = coll.iterator();

            while (itr.hasNext()) {

                SecurityPolicyHolder ph = (SecurityPolicyHolder) itr.next();

                if (ph != null) {

                    sph = ph;

                    break;

                }

            }

            if (sph == null) {

                return EMPTY_LIST;

            }

        }

        return sph.getSecureConversationTokens();

    }

    //TODO :: Refactor

    protected ArrayList<PolicyAssertion> getTokens(Policy policy) {

        ArrayList<PolicyAssertion> tokenList = new ArrayList<PolicyAssertion>();

        for (AssertionSet assertionSet : policy) {

            for (PolicyAssertion assertion : assertionSet) {

                if (PolicyUtil.isAsymmetricBinding(assertion, spVersion)) {

                    AsymmetricBinding sb = (AsymmetricBinding) assertion;

                    Token iToken = sb.getInitiatorToken();

                    if (iToken != null) {

                        addToken(iToken, tokenList);

                    } else {

                        addToken(sb.getInitiatorSignatureToken(), tokenList);

                        addToken(sb.getInitiatorEncryptionToken(), tokenList);

                    }

                    Token rToken = sb.getRecipientToken();

                    if (rToken != null) {

                        addToken(rToken, tokenList);

                    } else {

                        addToken(sb.getRecipientSignatureToken(), tokenList);

                        addToken(sb.getRecipientEncryptionToken(), tokenList);

                    }

                } else if (PolicyUtil.isSymmetricBinding(assertion, spVersion)) {

                    SymmetricBinding sb = (SymmetricBinding) assertion;

                    Token token = sb.getProtectionToken();

                    if (token != null) {

                        addToken(token, tokenList);

                    } else {

                        addToken(sb.getEncryptionToken(), tokenList);

                        addToken(sb.getSignatureToken(), tokenList);

                    }

                } else if (PolicyUtil.isSupportingTokens(assertion, spVersion)) {

                    SupportingTokens st = (SupportingTokens) assertion;

                    Iterator itr = st.getTokens();