author | weijun |
Tue, 14 Aug 2018 22:39:34 +0800 | |
changeset 51398 | 3c389a284345 |
parent 47216 | 71c04702a3d5 |
permissions | -rw-r--r-- |
2 | 1 |
/* |
51398
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
2 |
* Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
/* |
|
27 |
* |
|
28 |
* (C) Copyright IBM Corp. 1999 All Rights Reserved. |
|
29 |
* Copyright 1997 The Open Group Research Institute. All rights reserved. |
|
30 |
*/ |
|
31 |
||
32 |
package sun.security.krb5.internal.ktab; |
|
33 |
||
51398
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
34 |
import sun.security.action.GetPropertyAction; |
2 | 35 |
import sun.security.krb5.*; |
36 |
import sun.security.krb5.internal.*; |
|
37 |
import sun.security.krb5.internal.crypto.*; |
|
38 |
import java.util.ArrayList; |
|
39 |
import java.util.Arrays; |
|
40 |
import java.io.IOException; |
|
41 |
import java.io.FileInputStream; |
|
42 |
import java.io.FileOutputStream; |
|
43 |
import java.io.File; |
|
9499 | 44 |
import java.io.FileNotFoundException; |
3626
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
45 |
import java.util.Comparator; |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
46 |
import java.util.HashMap; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
47 |
import java.util.Map; |
2 | 48 |
import java.util.StringTokenizer; |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
49 |
import java.util.Vector; |
15649
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
50 |
import sun.security.jgss.krb5.ServiceCreds; |
2 | 51 |
|
52 |
/** |
|
53 |
* This class represents key table. The key table functions deal with storing |
|
54 |
* and retrieving service keys for use in authentication exchanges. |
|
55 |
* |
|
9499 | 56 |
* A KeyTab object is always constructed, if the file specified does not |
57 |
* exist, it's still valid but empty. If there is an I/O error or file format |
|
58 |
* error, it's invalid. |
|
59 |
* |
|
60 |
* The class is immutable on the read side (the write side is only used by |
|
61 |
* the ktab tool). |
|
62 |
* |
|
2 | 63 |
* @author Yanni Zhang |
64 |
*/ |
|
65 |
public class KeyTab implements KeyTabConstants { |
|
9499 | 66 |
|
2 | 67 |
private static final boolean DEBUG = Krb5.DEBUG; |
9499 | 68 |
private static String defaultTabName = null; |
69 |
||
70 |
// Attention: Currently there is no way to remove a keytab from this map, |
|
71 |
// this might lead to a memory leak. |
|
72 |
private static Map<String,KeyTab> map = new HashMap<>(); |
|
73 |
||
74 |
// KeyTab file does not exist. Note: a missing keytab is still valid |
|
75 |
private boolean isMissing = false; |
|
76 |
||
77 |
// KeyTab file is invalid, possibly an I/O error or a file format error. |
|
78 |
private boolean isValid = true; |
|
79 |
||
80 |
private final String tabName; |
|
81 |
private long lastModified; |
|
17713 | 82 |
private int kt_vno = KRB5_KT_VNO; |
9499 | 83 |
|
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7037
diff
changeset
|
84 |
private Vector<KeyTabEntry> entries = new Vector<>(); |
2 | 85 |
|
9499 | 86 |
/** |
87 |
* Constructs a KeyTab object. |
|
88 |
* |
|
89 |
* If there is any I/O error or format errot during the loading, the |
|
90 |
* isValid flag is set to false, and all half-read entries are dismissed. |
|
91 |
* @param filename path name for the keytab file, must not be null |
|
92 |
*/ |
|
93 |
private KeyTab(String filename) { |
|
94 |
tabName = filename; |
|
95 |
try { |
|
96 |
lastModified = new File(tabName).lastModified(); |
|
9542 | 97 |
try (KeyTabInputStream kis = |
98 |
new KeyTabInputStream(new FileInputStream(filename))) { |
|
99 |
load(kis); |
|
100 |
} |
|
9499 | 101 |
} catch (FileNotFoundException e) { |
102 |
entries.clear(); |
|
103 |
isMissing = true; |
|
104 |
} catch (Exception ioe) { |
|
105 |
entries.clear(); |
|
106 |
isValid = false; |
|
2 | 107 |
} |
108 |
} |
|
109 |
||
110 |
/** |
|
9499 | 111 |
* Read a keytab file. Returns a new object and save it into cache when |
112 |
* new content (modified since last read) is available. If keytab file is |
|
113 |
* invalid, the old object will be returned. This is a safeguard for |
|
114 |
* partial-written keytab files or non-stable network. Please note that |
|
115 |
* a missing keytab is valid, which is equivalent to an empty keytab. |
|
116 |
* |
|
117 |
* @param s file name of keytab, must not be null |
|
118 |
* @return the keytab object, can be invalid, but never null. |
|
2 | 119 |
*/ |
9499 | 120 |
private synchronized static KeyTab getInstance0(String s) { |
121 |
long lm = new File(s).lastModified(); |
|
122 |
KeyTab old = map.get(s); |
|
123 |
if (old != null && old.isValid() && old.lastModified == lm) { |
|
124 |
return old; |
|
2 | 125 |
} |
9499 | 126 |
KeyTab ktab = new KeyTab(s); |
127 |
if (ktab.isValid()) { // A valid new keytab |
|
128 |
map.put(s, ktab); |
|
129 |
return ktab; |
|
130 |
} else if (old != null) { // An existing old one |
|
131 |
return old; |
|
132 |
} else { |
|
133 |
return ktab; // first read is invalid |
|
134 |
} |
|
2 | 135 |
} |
136 |
||
137 |
/** |
|
9499 | 138 |
* Gets a KeyTab object. |
139 |
* @param s the key tab file name. |
|
140 |
* @return the KeyTab object, never null. |
|
141 |
*/ |
|
142 |
public static KeyTab getInstance(String s) { |
|
143 |
if (s == null) { |
|
144 |
return getInstance(); |
|
145 |
} else { |
|
13590
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
146 |
return getInstance0(normalize(s)); |
9499 | 147 |
} |
148 |
} |
|
149 |
||
150 |
/** |
|
151 |
* Gets a KeyTab object. |
|
152 |
* @param file the key tab file. |
|
153 |
* @return the KeyTab object, never null. |
|
154 |
*/ |
|
155 |
public static KeyTab getInstance(File file) { |
|
156 |
if (file == null) { |
|
157 |
return getInstance(); |
|
158 |
} else { |
|
159 |
return getInstance0(file.getPath()); |
|
160 |
} |
|
161 |
} |
|
162 |
||
163 |
/** |
|
164 |
* Gets the default KeyTab object. |
|
165 |
* @return the KeyTab object, never null. |
|
2 | 166 |
*/ |
167 |
public static KeyTab getInstance() { |
|
9499 | 168 |
return getInstance(getDefaultTabName()); |
169 |
} |
|
170 |
||
171 |
public boolean isMissing() { |
|
172 |
return isMissing; |
|
173 |
} |
|
174 |
||
175 |
public boolean isValid() { |
|
176 |
return isValid; |
|
2 | 177 |
} |
178 |
||
179 |
/** |
|
180 |
* The location of keytab file will be read from the configuration file |
|
181 |
* If it is not specified, consider user.home as the keytab file's |
|
182 |
* default location. |
|
9499 | 183 |
* @return never null |
2 | 184 |
*/ |
9499 | 185 |
private static String getDefaultTabName() { |
186 |
if (defaultTabName != null) { |
|
187 |
return defaultTabName; |
|
2 | 188 |
} else { |
189 |
String kname = null; |
|
190 |
try { |
|
14327 | 191 |
String keytab_names = Config.getInstance().get |
192 |
("libdefaults", "default_keytab_name"); |
|
2 | 193 |
if (keytab_names != null) { |
194 |
StringTokenizer st = new StringTokenizer(keytab_names, " "); |
|
195 |
while (st.hasMoreTokens()) { |
|
13590
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
196 |
kname = normalize(st.nextToken()); |
9499 | 197 |
if (new File(kname).exists()) { |
2 | 198 |
break; |
199 |
} |
|
200 |
} |
|
201 |
} |
|
202 |
} catch (KrbException e) { |
|
203 |
kname = null; |
|
204 |
} |
|
205 |
||
206 |
if (kname == null) { |
|
51398
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
207 |
String user_home = GetPropertyAction |
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
208 |
.privilegedGetProperty("user.home"); |
2 | 209 |
|
210 |
if (user_home == null) { |
|
51398
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
211 |
user_home = GetPropertyAction |
3c389a284345
8209416: Refactoring GetPropertyAction calls in security libs
weijun
parents:
47216
diff
changeset
|
212 |
.privilegedGetProperty("user.dir"); |
2 | 213 |
} |
214 |
||
9499 | 215 |
kname = user_home + File.separator + "krb5.keytab"; |
2 | 216 |
} |
9499 | 217 |
defaultTabName = kname; |
2 | 218 |
return kname; |
219 |
} |
|
220 |
} |
|
221 |
||
9499 | 222 |
/** |
13590
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
223 |
* Normalizes some common keytab name formats into the bare file name. |
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
224 |
* For example, FILE:/etc/krb5.keytab to /etc/krb5.keytab |
9499 | 225 |
* @param name never null |
226 |
* @return never null |
|
227 |
*/ |
|
13590
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
228 |
// This method is used in this class and Krb5LoginModule |
f7f85d7f7a82
7152121: Krb5LoginModule no longer handles keyTabNames with "file:" prefix
weijun
parents:
11911
diff
changeset
|
229 |
public static String normalize(String name) { |
9499 | 230 |
String kname; |
2 | 231 |
if ((name.length() >= 5) && |
232 |
(name.substring(0, 5).equalsIgnoreCase("FILE:"))) { |
|
233 |
kname = name.substring(5); |
|
234 |
} else if ((name.length() >= 9) && |
|
235 |
(name.substring(0, 9).equalsIgnoreCase("ANY:FILE:"))) { |
|
236 |
// this format found in MIT's krb5.ini. |
|
237 |
kname = name.substring(9); |
|
238 |
} else if ((name.length() >= 7) && |
|
239 |
(name.substring(0, 7).equalsIgnoreCase("SRVTAB:"))) { |
|
240 |
// this format found in MIT's krb5.ini. |
|
241 |
kname = name.substring(7); |
|
242 |
} else |
|
243 |
kname = name; |
|
244 |
return kname; |
|
245 |
} |
|
246 |
||
247 |
private void load(KeyTabInputStream kis) |
|
248 |
throws IOException, RealmException { |
|
249 |
||
250 |
entries.clear(); |
|
251 |
kt_vno = kis.readVersion(); |
|
252 |
if (kt_vno == KRB5_KT_VNO_1) { |
|
253 |
kis.setNativeByteOrder(); |
|
254 |
} |
|
255 |
int entryLength = 0; |
|
256 |
KeyTabEntry entry; |
|
257 |
while (kis.available() > 0) { |
|
258 |
entryLength = kis.readEntryLength(); |
|
259 |
entry = kis.readEntry(entryLength, kt_vno); |
|
260 |
if (DEBUG) { |
|
261 |
System.out.println(">>> KeyTab: load() entry length: " + |
|
262 |
entryLength + "; type: " + |
|
263 |
(entry != null? entry.keyType : 0)); |
|
264 |
} |
|
265 |
if (entry != null) |
|
266 |
entries.addElement(entry); |
|
267 |
} |
|
268 |
} |
|
269 |
||
270 |
/** |
|
15649
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
271 |
* Returns a principal name in this keytab. Used by |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
272 |
* {@link ServiceCreds#getKKeys()}. |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
273 |
*/ |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
274 |
public PrincipalName getOneName() { |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
275 |
int size = entries.size(); |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
276 |
return size > 0 ? entries.elementAt(size-1).service : null; |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
277 |
} |
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
278 |
|
f6bd3d34f844
8001104: Unbound SASL service: the GSSAPI/krb5 mech
weijun
parents:
15006
diff
changeset
|
279 |
/** |
2 | 280 |
* Reads all keys for a service from the keytab file that have |
18168
f47169155ea0
8014310: JAAS/Krb5LoginModule using des encytypes failure with NPE after JDK-8012679
weijun
parents:
17713
diff
changeset
|
281 |
* etypes that have been configured for use. |
2 | 282 |
* @param service the PrincipalName of the requested service |
9499 | 283 |
* @return an array containing all the service keys, never null |
2 | 284 |
*/ |
285 |
public EncryptionKey[] readServiceKeys(PrincipalName service) { |
|
286 |
KeyTabEntry entry; |
|
287 |
EncryptionKey key; |
|
288 |
int size = entries.size(); |
|
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7037
diff
changeset
|
289 |
ArrayList<EncryptionKey> keys = new ArrayList<>(size); |
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
14342
diff
changeset
|
290 |
if (DEBUG) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
14342
diff
changeset
|
291 |
System.out.println("Looking for keys for: " + service); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
14342
diff
changeset
|
292 |
} |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
293 |
for (int i = size-1; i >= 0; i--) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
294 |
entry = entries.elementAt(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
295 |
if (entry.service.match(service)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
296 |
if (EType.isSupported(entry.keyType)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
297 |
key = new EncryptionKey(entry.keyblock, |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
298 |
entry.keyType, |
25522
10d789df41bb
8049892: Replace uses of 'new Integer()' with appropriate alternative across core classes
prr
parents:
23010
diff
changeset
|
299 |
entry.keyVersion); |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
300 |
keys.add(key); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
301 |
if (DEBUG) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
302 |
System.out.println("Added key: " + entry.keyType + |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
303 |
"version: " + entry.keyVersion); |
2 | 304 |
} |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
305 |
} else if (DEBUG) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
306 |
System.out.println("Found unsupported keytype (" + |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
307 |
entry.keyType + ") for " + service); |
2 | 308 |
} |
309 |
} |
|
310 |
} |
|
311 |
size = keys.size(); |
|
3626
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
312 |
EncryptionKey[] retVal = keys.toArray(new EncryptionKey[size]); |
2 | 313 |
|
18168
f47169155ea0
8014310: JAAS/Krb5LoginModule using des encytypes failure with NPE after JDK-8012679
weijun
parents:
17713
diff
changeset
|
314 |
// Sort the keys by kvno. Sometimes we must choose a single key (say, |
f47169155ea0
8014310: JAAS/Krb5LoginModule using des encytypes failure with NPE after JDK-8012679
weijun
parents:
17713
diff
changeset
|
315 |
// generate encrypted timestamp in AS-REQ). A key with a higher KVNO |
f47169155ea0
8014310: JAAS/Krb5LoginModule using des encytypes failure with NPE after JDK-8012679
weijun
parents:
17713
diff
changeset
|
316 |
// sounds like a newer one. |
3626
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
317 |
Arrays.sort(retVal, new Comparator<EncryptionKey>() { |
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
318 |
@Override |
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
319 |
public int compare(EncryptionKey o1, EncryptionKey o2) { |
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
320 |
return o2.getKeyVersionNumber().intValue() |
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
321 |
- o1.getKeyVersionNumber().intValue(); |
2 | 322 |
} |
3626
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
323 |
}); |
78722c321f85
6867665: Problem with keytabs with multiple kvno's (key versions)
weijun
parents:
3317
diff
changeset
|
324 |
|
2 | 325 |
return retVal; |
326 |
} |
|
327 |
||
328 |
||
329 |
||
330 |
/** |
|
331 |
* Searches for the service entry in the keytab file. |
|
332 |
* The etype of the key must be one that has been configured |
|
333 |
* to be used. |
|
334 |
* @param service the PrincipalName of the requested service. |
|
335 |
* @return true if the entry is found, otherwise, return false. |
|
336 |
*/ |
|
337 |
public boolean findServiceEntry(PrincipalName service) { |
|
338 |
KeyTabEntry entry; |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
339 |
for (int i = 0; i < entries.size(); i++) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
340 |
entry = entries.elementAt(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
341 |
if (entry.service.match(service)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
342 |
if (EType.isSupported(entry.keyType)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
343 |
return true; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
344 |
} else if (DEBUG) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
345 |
System.out.println("Found unsupported keytype (" + |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
346 |
entry.keyType + ") for " + service); |
2 | 347 |
} |
348 |
} |
|
349 |
} |
|
350 |
return false; |
|
351 |
} |
|
352 |
||
9499 | 353 |
public String tabName() { |
354 |
return tabName; |
|
2 | 355 |
} |
356 |
||
9499 | 357 |
/////////////////// THE WRITE SIDE /////////////////////// |
358 |
/////////////// only used by ktab tool ////////////////// |
|
359 |
||
2 | 360 |
/** |
361 |
* Adds a new entry in the key table. |
|
362 |
* @param service the service which will have a new entry in the key table. |
|
363 |
* @param psswd the password which generates the key. |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
364 |
* @param kvno the kvno to use, -1 means automatic increasing |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
365 |
* @param append false if entries with old kvno would be removed. |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
366 |
* Note: if kvno is not -1, entries with the same kvno are always removed |
2 | 367 |
*/ |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
368 |
public void addEntry(PrincipalName service, char[] psswd, |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
369 |
int kvno, boolean append) throws KrbException { |
15006 | 370 |
addEntry(service, service.getSalt(), psswd, kvno, append); |
371 |
} |
|
372 |
||
373 |
// Called by KDC test |
|
374 |
public void addEntry(PrincipalName service, String salt, char[] psswd, |
|
375 |
int kvno, boolean append) throws KrbException { |
|
2 | 376 |
|
377 |
EncryptionKey[] encKeys = EncryptionKey.acquireSecretKeys( |
|
15006 | 378 |
psswd, salt); |
2 | 379 |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
380 |
// There should be only one maximum KVNO value for all etypes, so that |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
381 |
// all added keys can have the same KVNO. |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
382 |
|
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
383 |
int maxKvno = 0; // only useful when kvno == -1 |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
384 |
for (int i = entries.size()-1; i >= 0; i--) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
385 |
KeyTabEntry e = entries.get(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
386 |
if (e.service.match(service)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
387 |
if (e.keyVersion > maxKvno) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
388 |
maxKvno = e.keyVersion; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
389 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
390 |
if (!append || e.keyVersion == kvno) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
391 |
entries.removeElementAt(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
392 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
393 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
394 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
395 |
if (kvno == -1) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
396 |
kvno = maxKvno + 1; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
397 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
398 |
|
2 | 399 |
for (int i = 0; encKeys != null && i < encKeys.length; i++) { |
400 |
int keyType = encKeys[i].getEType(); |
|
401 |
byte[] keyValue = encKeys[i].getBytes(); |
|
402 |
||
403 |
KeyTabEntry newEntry = new KeyTabEntry(service, |
|
404 |
service.getRealm(), |
|
405 |
new KerberosTime(System.currentTimeMillis()), |
|
406 |
kvno, keyType, keyValue); |
|
407 |
entries.addElement(newEntry); |
|
408 |
} |
|
409 |
} |
|
410 |
||
4168
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3626
diff
changeset
|
411 |
/** |
2 | 412 |
* Gets the list of service entries in key table. |
413 |
* @return array of <code>KeyTabEntry</code>. |
|
414 |
*/ |
|
415 |
public KeyTabEntry[] getEntries() { |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
416 |
KeyTabEntry[] kentries = new KeyTabEntry[entries.size()]; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
417 |
for (int i = 0; i < kentries.length; i++) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
418 |
kentries[i] = entries.elementAt(i); |
2 | 419 |
} |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
420 |
return kentries; |
2 | 421 |
} |
422 |
||
423 |
/** |
|
424 |
* Creates a new default key table. |
|
425 |
*/ |
|
426 |
public synchronized static KeyTab create() |
|
427 |
throws IOException, RealmException { |
|
9499 | 428 |
String dname = getDefaultTabName(); |
2 | 429 |
return create(dname); |
430 |
} |
|
431 |
||
432 |
/** |
|
433 |
* Creates a new default key table. |
|
434 |
*/ |
|
435 |
public synchronized static KeyTab create(String name) |
|
436 |
throws IOException, RealmException { |
|
437 |
||
9542 | 438 |
try (KeyTabOutputStream kos = |
439 |
new KeyTabOutputStream(new FileOutputStream(name))) { |
|
440 |
kos.writeVersion(KRB5_KT_VNO); |
|
441 |
} |
|
9499 | 442 |
return new KeyTab(name); |
2 | 443 |
} |
444 |
||
445 |
/** |
|
446 |
* Saves the file at the directory. |
|
447 |
*/ |
|
448 |
public synchronized void save() throws IOException { |
|
9542 | 449 |
try (KeyTabOutputStream kos = |
450 |
new KeyTabOutputStream(new FileOutputStream(tabName))) { |
|
451 |
kos.writeVersion(kt_vno); |
|
452 |
for (int i = 0; i < entries.size(); i++) { |
|
453 |
kos.writeEntry(entries.elementAt(i)); |
|
454 |
} |
|
2 | 455 |
} |
456 |
} |
|
457 |
||
458 |
/** |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
459 |
* Removes entries from the key table. |
2 | 460 |
* @param service the service <code>PrincipalName</code>. |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
461 |
* @param etype the etype to match, remove all if -1 |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
462 |
* @param kvno what kvno to remove, -1 for all, -2 for old |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
463 |
* @return the number of entries deleted |
2 | 464 |
*/ |
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
465 |
public int deleteEntries(PrincipalName service, int etype, int kvno) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
466 |
int count = 0; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
467 |
|
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
468 |
// Remember the highest KVNO for each etype. Used for kvno == -2 |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
469 |
Map<Integer,Integer> highest = new HashMap<>(); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
470 |
|
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
471 |
for (int i = entries.size()-1; i >= 0; i--) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
472 |
KeyTabEntry e = entries.get(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
473 |
if (service.match(e.getService())) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
474 |
if (etype == -1 || e.keyType == etype) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
475 |
if (kvno == -2) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
476 |
// Two rounds for kvno == -2. In the first round (here), |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
477 |
// only find out highest KVNO for each etype |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
478 |
if (highest.containsKey(e.keyType)) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
479 |
int n = highest.get(e.keyType); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
480 |
if (e.keyVersion > n) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
481 |
highest.put(e.keyType, e.keyVersion); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
482 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
483 |
} else { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
484 |
highest.put(e.keyType, e.keyVersion); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
485 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
486 |
} else if (kvno == -1 || e.keyVersion == kvno) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
487 |
entries.removeElementAt(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
488 |
count++; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
489 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
490 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
491 |
} |
2 | 492 |
} |
3317 | 493 |
|
7037
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
494 |
// Second round for kvno == -2, remove old entries |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
495 |
if (kvno == -2) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
496 |
for (int i = entries.size()-1; i >= 0; i--) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
497 |
KeyTabEntry e = entries.get(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
498 |
if (service.match(e.getService())) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
499 |
if (etype == -1 || e.keyType == etype) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
500 |
int n = highest.get(e.keyType); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
501 |
if (e.keyVersion != n) { |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
502 |
entries.removeElementAt(i); |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
503 |
count++; |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
504 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
505 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
506 |
} |
9fd3887c8010
6950546: "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
weijun
parents:
5974
diff
changeset
|
507 |
} |
3317 | 508 |
} |
509 |
return count; |
|
2 | 510 |
} |
511 |
||
512 |
/** |
|
513 |
* Creates key table file version. |
|
514 |
* @param file the key table file. |
|
32003 | 515 |
* @exception IOException |
2 | 516 |
*/ |
517 |
public synchronized void createVersion(File file) throws IOException { |
|
9542 | 518 |
try (KeyTabOutputStream kos = |
519 |
new KeyTabOutputStream(new FileOutputStream(file))) { |
|
520 |
kos.write16(KRB5_KT_VNO); |
|
521 |
} |
|
2 | 522 |
} |
523 |
} |