author | erikj |
Tue, 12 Sep 2017 19:03:39 +0200 | |
changeset 47216 | 71c04702a3d5 |
parent 26629 | jdk/src/java.security.jgss/share/classes/sun/security/jgss/krb5/InitSecContextToken.java@3b9ed8175488 |
child 50187 | 261d0ac3b09d |
permissions | -rw-r--r-- |
2 | 1 |
/* |
23010
6dadb192ad81
8029235: Update copyright year to match last edit in jdk8 jdk repository for 2013
lana
parents:
15006
diff
changeset
|
2 |
* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
package sun.security.jgss.krb5; |
|
27 |
||
28 |
import org.ietf.jgss.*; |
|
29 |
import java.io.InputStream; |
|
30 |
import java.io.IOException; |
|
31 |
import sun.security.krb5.*; |
|
32 |
import java.net.InetAddress; |
|
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
33 |
import sun.security.krb5.internal.AuthorizationData; |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
34 |
import sun.security.krb5.internal.KerberosTime; |
2 | 35 |
|
36 |
class InitSecContextToken extends InitialToken { |
|
37 |
||
38 |
private KrbApReq apReq = null; |
|
39 |
||
40 |
/** |
|
41 |
* For the context initiator to call. It constructs a new |
|
42 |
* InitSecContextToken to send over to the peer containing the desired |
|
43 |
* flags and the AP-REQ. It also updates the context with the local |
|
44 |
* sequence number and shared context key. |
|
45 |
* (When mutual auth is enabled the peer has an opportunity to |
|
46 |
* renegotiate the session key in the followup AcceptSecContextToken |
|
47 |
* that it sends.) |
|
48 |
*/ |
|
49 |
InitSecContextToken(Krb5Context context, |
|
50 |
Credentials tgt, |
|
51 |
Credentials serviceTicket) |
|
52 |
throws KrbException, IOException, GSSException { |
|
53 |
||
54 |
boolean mutualRequired = context.getMutualAuthState(); |
|
55 |
boolean useSubkey = true; // MIT Impl will crash if this is not set! |
|
56 |
boolean useSequenceNumber = true; |
|
57 |
||
58 |
OverloadedChecksum gssChecksum = |
|
59 |
new OverloadedChecksum(context, tgt, serviceTicket); |
|
60 |
||
61 |
Checksum checksum = gssChecksum.getChecksum(); |
|
62 |
||
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
63 |
context.setTktFlags(serviceTicket.getFlags()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
64 |
context.setAuthTime( |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
65 |
new KerberosTime(serviceTicket.getAuthTime()).toString()); |
2 | 66 |
apReq = new KrbApReq(serviceTicket, |
67 |
mutualRequired, |
|
68 |
useSubkey, |
|
69 |
useSequenceNumber, |
|
70 |
checksum); |
|
71 |
||
72 |
context.resetMySequenceNumber(apReq.getSeqNumber().intValue()); |
|
73 |
||
74 |
EncryptionKey subKey = apReq.getSubKey(); |
|
75 |
if (subKey != null) |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
76 |
context.setKey(Krb5Context.INITIATOR_SUBKEY, subKey); |
2 | 77 |
else |
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
78 |
context.setKey(Krb5Context.SESSION_KEY, serviceTicket.getSessionKey()); |
2 | 79 |
|
80 |
if (!mutualRequired) |
|
81 |
context.resetPeerSequenceNumber(0); |
|
82 |
} |
|
83 |
||
84 |
/** |
|
85 |
* For the context acceptor to call. It reads the bytes out of an |
|
86 |
* InputStream and constructs an InitSecContextToken with them. |
|
87 |
*/ |
|
15006 | 88 |
InitSecContextToken(Krb5Context context, Krb5AcceptCredential cred, |
2 | 89 |
InputStream is) |
90 |
throws IOException, GSSException, KrbException { |
|
91 |
||
92 |
int tokenId = ((is.read()<<8) | is.read()); |
|
93 |
||
94 |
if (tokenId != Krb5Token.AP_REQ_ID) |
|
95 |
throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1, |
|
96 |
"AP_REQ token id does not match!"); |
|
97 |
||
98 |
// XXX Modify KrbApReq cons to take an InputStream |
|
99 |
byte[] apReqBytes = |
|
100 |
new sun.security.util.DerValue(is).toByteArray(); |
|
101 |
//debug("=====ApReqBytes: [" + getHexBytes(apReqBytes) + "]\n"); |
|
102 |
||
103 |
InetAddress addr = null; |
|
104 |
if (context.getChannelBinding() != null) { |
|
105 |
addr = context.getChannelBinding().getInitiatorAddress(); |
|
106 |
} |
|
15006 | 107 |
apReq = new KrbApReq(apReqBytes, cred, addr); |
2 | 108 |
//debug("\nReceived AP-REQ and authenticated it.\n"); |
109 |
||
51 | 110 |
EncryptionKey sessionKey = apReq.getCreds().getSessionKey(); |
2 | 111 |
|
112 |
/* |
|
113 |
System.out.println("\n\nSession key from service ticket is: " + |
|
114 |
getHexBytes(sessionKey.getBytes())); |
|
115 |
*/ |
|
116 |
||
117 |
EncryptionKey subKey = apReq.getSubKey(); |
|
118 |
if (subKey != null) { |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
119 |
context.setKey(Krb5Context.INITIATOR_SUBKEY, subKey); |
2 | 120 |
/* |
121 |
System.out.println("Sub-Session key from authenticator is: " + |
|
122 |
getHexBytes(subKey.getBytes()) + "\n"); |
|
123 |
*/ |
|
124 |
} else { |
|
10697
ecee258b7d87
7077646: gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY
weijun
parents:
9249
diff
changeset
|
125 |
context.setKey(Krb5Context.SESSION_KEY, sessionKey); |
2 | 126 |
//System.out.println("Sub-Session Key Missing in Authenticator.\n"); |
127 |
} |
|
128 |
||
9249 | 129 |
OverloadedChecksum gssChecksum = new OverloadedChecksum( |
130 |
context, apReq.getChecksum(), sessionKey, subKey); |
|
2 | 131 |
gssChecksum.setContextFlags(context); |
132 |
Credentials delegCred = gssChecksum.getDelegatedCreds(); |
|
133 |
if (delegCred != null) { |
|
134 |
Krb5CredElement credElement = |
|
135 |
Krb5InitCredential.getInstance( |
|
136 |
(Krb5NameElement)context.getSrcName(), |
|
137 |
delegCred); |
|
138 |
context.setDelegCred(credElement); |
|
139 |
} |
|
140 |
||
141 |
Integer apReqSeqNumber = apReq.getSeqNumber(); |
|
142 |
int peerSeqNumber = (apReqSeqNumber != null ? |
|
143 |
apReqSeqNumber.intValue() : |
|
144 |
0); |
|
145 |
context.resetPeerSequenceNumber(peerSeqNumber); |
|
146 |
if (!context.getMutualAuthState()) |
|
147 |
// Use the same sequence number as the peer |
|
148 |
// (Behaviour exhibited by the Windows SSPI server) |
|
149 |
context.resetMySequenceNumber(peerSeqNumber); |
|
3483
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
150 |
context.setAuthTime( |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
151 |
new KerberosTime(apReq.getCreds().getAuthTime()).toString()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
152 |
context.setTktFlags(apReq.getCreds().getFlags()); |
a16fce1820ef
6821190: more InquireType values for ExtendedGSSContext
weijun
parents:
715
diff
changeset
|
153 |
AuthorizationData ad = apReq.getCreds().getAuthzData(); |
26629
3b9ed8175488
8042900: Allow com.sun.security.jgss to be in different module than org.ietf.jgss
weijun
parents:
25859
diff
changeset
|
154 |
context.setAuthzData(ad); |
2 | 155 |
} |
156 |
||
157 |
public final KrbApReq getKrbApReq() { |
|
158 |
return apReq; |
|
159 |
} |
|
160 |
||
161 |
public final byte[] encode() throws IOException { |
|
162 |
byte[] apReqBytes = apReq.getMessage(); |
|
163 |
byte[] retVal = new byte[2 + apReqBytes.length]; |
|
164 |
writeInt(Krb5Token.AP_REQ_ID, retVal, 0); |
|
165 |
System.arraycopy(apReqBytes, 0, retVal, 2, apReqBytes.length); |
|
166 |
// System.out.println("GSS-Token with AP_REQ is:"); |
|
167 |
// System.out.println(getHexBytes(retVal)); |
|
168 |
return retVal; |
|
169 |
} |
|
170 |
} |