author | chegar |
Sun, 17 Aug 2014 15:54:13 +0100 | |
changeset 25859 | 3317bb8137f4 |
parent 23010 | jdk/src/share/classes/sun/security/jgss/krb5/InitSecContextToken.java@6dadb192ad81 |
child 26629 | 3b9ed8175488 |
permissions | -rw-r--r-- |
2 | 1 |
/* |
23010
6dadb192ad81
8029235: Update copyright year to match last edit in jdk8 jdk repository for 2013
lana
parents:
15006
diff
changeset
|
2 |
* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
package sun.security.jgss.krb5; |
|
27 |
||
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
28 |
import com.sun.security.jgss.AuthorizationDataEntry; |
2 | 29 |
import org.ietf.jgss.*; |
30 |
import java.io.InputStream; |
|
31 |
import java.io.IOException; |
|
32 |
import sun.security.krb5.*; |
|
33 |
import java.net.InetAddress; |
|
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
34 |
import sun.security.krb5.internal.AuthorizationData; |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
35 |
import sun.security.krb5.internal.KerberosTime; |
2 | 36 |
|
37 |
class InitSecContextToken extends InitialToken { |
|
38 |
||
39 |
private KrbApReq apReq = null; |
|
40 |
||
41 |
/** |
|
42 |
* For the context initiator to call. It constructs a new |
|
43 |
* InitSecContextToken to send over to the peer containing the desired |
|
44 |
* flags and the AP-REQ. It also updates the context with the local |
|
45 |
* sequence number and shared context key. |
|
46 |
* (When mutual auth is enabled the peer has an opportunity to |
|
47 |
* renegotiate the session key in the followup AcceptSecContextToken |
|
48 |
* that it sends.) |
|
49 |
*/ |
|
50 |
InitSecContextToken(Krb5Context context, |
|
51 |
Credentials tgt, |
|
52 |
Credentials serviceTicket) |
|
53 |
throws KrbException, IOException, GSSException { |
|
54 |
||
55 |
boolean mutualRequired = context.getMutualAuthState(); |
|
56 |
boolean useSubkey = true; // MIT Impl will crash if this is not set! |
|
57 |
boolean useSequenceNumber = true; |
|
58 |
||
59 |
OverloadedChecksum gssChecksum = |
|
60 |
new OverloadedChecksum(context, tgt, serviceTicket); |
|
61 |
||
62 |
Checksum checksum = gssChecksum.getChecksum(); |
|
63 |
||
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
64 |
context.setTktFlags(serviceTicket.getFlags()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
65 |
context.setAuthTime( |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
66 |
new KerberosTime(serviceTicket.getAuthTime()).toString()); |
2 | 67 |
apReq = new KrbApReq(serviceTicket, |
68 |
mutualRequired, |
|
69 |
useSubkey, |
|
70 |
useSequenceNumber, |
|
71 |
checksum); |
|
72 |
||
73 |
context.resetMySequenceNumber(apReq.getSeqNumber().intValue()); |
|
74 |
||
75 |
EncryptionKey subKey = apReq.getSubKey(); |
|
76 |
if (subKey != null) |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
77 |
context.setKey(Krb5Context.INITIATOR_SUBKEY, subKey); |
2 | 78 |
else |
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
79 |
context.setKey(Krb5Context.SESSION_KEY, serviceTicket.getSessionKey()); |
2 | 80 |
|
81 |
if (!mutualRequired) |
|
82 |
context.resetPeerSequenceNumber(0); |
|
83 |
} |
|
84 |
||
85 |
/** |
|
86 |
* For the context acceptor to call. It reads the bytes out of an |
|
87 |
* InputStream and constructs an InitSecContextToken with them. |
|
88 |
*/ |
|
15006 | 89 |
InitSecContextToken(Krb5Context context, Krb5AcceptCredential cred, |
2 | 90 |
InputStream is) |
91 |
throws IOException, GSSException, KrbException { |
|
92 |
||
93 |
int tokenId = ((is.read()<<8) | is.read()); |
|
94 |
||
95 |
if (tokenId != Krb5Token.AP_REQ_ID) |
|
96 |
throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1, |
|
97 |
"AP_REQ token id does not match!"); |
|
98 |
||
99 |
// XXX Modify KrbApReq cons to take an InputStream |
|
100 |
byte[] apReqBytes = |
|
101 |
new sun.security.util.DerValue(is).toByteArray(); |
|
102 |
//debug("=====ApReqBytes: [" + getHexBytes(apReqBytes) + "]\n"); |
|
103 |
||
104 |
InetAddress addr = null; |
|
105 |
if (context.getChannelBinding() != null) { |
|
106 |
addr = context.getChannelBinding().getInitiatorAddress(); |
|
107 |
} |
|
15006 | 108 |
apReq = new KrbApReq(apReqBytes, cred, addr); |
2 | 109 |
//debug("\nReceived AP-REQ and authenticated it.\n"); |
110 |
||
51 | 111 |
EncryptionKey sessionKey = apReq.getCreds().getSessionKey(); |
2 | 112 |
|
113 |
/* |
|
114 |
System.out.println("\n\nSession key from service ticket is: " + |
|
115 |
getHexBytes(sessionKey.getBytes())); |
|
116 |
*/ |
|
117 |
||
118 |
EncryptionKey subKey = apReq.getSubKey(); |
|
119 |
if (subKey != null) { |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
120 |
context.setKey(Krb5Context.INITIATOR_SUBKEY, subKey); |
2 | 121 |
/* |
122 |
System.out.println("Sub-Session key from authenticator is: " + |
|
123 |
getHexBytes(subKey.getBytes()) + "\n"); |
|
124 |
*/ |
|
125 |
} else { |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
126 |
context.setKey(Krb5Context.SESSION_KEY, sessionKey); |
2 | 127 |
//System.out.println("Sub-Session Key Missing in Authenticator.\n"); |
128 |
} |
|
129 |
||
9249 | 130 |
OverloadedChecksum gssChecksum = new OverloadedChecksum( |
131 |
context, apReq.getChecksum(), sessionKey, subKey); |
|
2 | 132 |
gssChecksum.setContextFlags(context); |
133 |
Credentials delegCred = gssChecksum.getDelegatedCreds(); |
|
134 |
if (delegCred != null) { |
|
135 |
Krb5CredElement credElement = |
|
136 |
Krb5InitCredential.getInstance( |
|
137 |
(Krb5NameElement)context.getSrcName(), |
|
138 |
delegCred); |
|
139 |
context.setDelegCred(credElement); |
|
140 |
} |
|
141 |
||
142 |
Integer apReqSeqNumber = apReq.getSeqNumber(); |
|
143 |
int peerSeqNumber = (apReqSeqNumber != null ? |
|
144 |
apReqSeqNumber.intValue() : |
|
145 |
0); |
|
146 |
context.resetPeerSequenceNumber(peerSeqNumber); |
|
147 |
if (!context.getMutualAuthState()) |
|
148 |
// Use the same sequence number as the peer |
|
149 |
// (Behaviour exhibited by the Windows SSPI server) |
|
150 |
context.resetMySequenceNumber(peerSeqNumber); |
|
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
151 |
context.setAuthTime( |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
152 |
new KerberosTime(apReq.getCreds().getAuthTime()).toString()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
153 |
context.setTktFlags(apReq.getCreds().getFlags()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
154 |
AuthorizationData ad = apReq.getCreds().getAuthzData(); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
155 |
if (ad == null) { |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
156 |
context.setAuthzData(null); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
157 |
} else { |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
158 |
AuthorizationDataEntry[] authzData = |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
159 |
new AuthorizationDataEntry[ad.count()]; |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
160 |
for (int i=0; i<ad.count(); i++) { |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
161 |
authzData[i] = new AuthorizationDataEntry( |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
162 |
ad.item(i).adType, ad.item(i).adData); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
163 |
} |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
164 |
context.setAuthzData(authzData); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
165 |
} |
2 | 166 |
} |
167 |
||
168 |
public final KrbApReq getKrbApReq() { |
|
169 |
return apReq; |
|
170 |
} |
|
171 |
||
172 |
public final byte[] encode() throws IOException { |
|
173 |
byte[] apReqBytes = apReq.getMessage(); |
|
174 |
byte[] retVal = new byte[2 + apReqBytes.length]; |
|
175 |
writeInt(Krb5Token.AP_REQ_ID, retVal, 0); |
|
176 |
System.arraycopy(apReqBytes, 0, retVal, 2, apReqBytes.length); |
|
177 |
// System.out.println("GSS-Token with AP_REQ is:"); |
|
178 |
// System.out.println(getHexBytes(retVal)); |
|
179 |
return retVal; |
|
180 |
} |
|
181 |
} |