author | mbalao |
Wed, 05 Jun 2019 01:42:11 -0300 | |
changeset 55258 | d65d3c37232c |
parent 53273 | bbc79e0ec9ee |
child 55598 | 091ea1a285dc |
permissions | -rw-r--r-- |
1454 | 1 |
/* |
53273
bbc79e0ec9ee
8216265: [testbug] Introduce Platform.sharedLibraryPathVariableName() and adapt all tests.
goetz
parents:
50750
diff
changeset
|
2 |
* Copyright (c) 2008, 2019, Oracle and/or its affiliates. All rights reserved. |
1454 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
7 |
* published by the Free Software Foundation. |
|
8 |
* |
|
9 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
10 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
11 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
12 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
13 |
* accompanied this code). |
|
14 |
* |
|
15 |
* You should have received a copy of the GNU General Public License version |
|
16 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
17 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
18 |
* |
|
5506 | 19 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
20 |
* or visit www.oracle.com if you need additional information or have any |
|
21 |
* questions. |
|
1454 | 22 |
*/ |
23 |
||
53273
bbc79e0ec9ee
8216265: [testbug] Introduce Platform.sharedLibraryPathVariableName() and adapt all tests.
goetz
parents:
50750
diff
changeset
|
24 |
import jdk.test.lib.Platform; |
bbc79e0ec9ee
8216265: [testbug] Introduce Platform.sharedLibraryPathVariableName() and adapt all tests.
goetz
parents:
50750
diff
changeset
|
25 |
|
1454 | 26 |
import java.lang.reflect.Constructor; |
27 |
import java.lang.reflect.Field; |
|
28 |
import java.lang.reflect.InvocationTargetException; |
|
29 |
import java.net.*; |
|
30 |
import java.io.*; |
|
31 |
import java.lang.reflect.Method; |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
32 |
import java.nio.file.Files; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
33 |
import java.nio.file.Paths; |
1454 | 34 |
import java.util.*; |
35 |
import java.util.concurrent.*; |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
36 |
import java.util.stream.Collectors; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
37 |
import java.util.stream.Stream; |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
38 |
|
1454 | 39 |
import sun.security.krb5.*; |
40 |
import sun.security.krb5.internal.*; |
|
1575
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
41 |
import sun.security.krb5.internal.ccache.CredentialsCache; |
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
42 |
import sun.security.krb5.internal.crypto.EType; |
1454 | 43 |
import sun.security.krb5.internal.crypto.KeyUsage; |
44 |
import sun.security.krb5.internal.ktab.KeyTab; |
|
45 |
import sun.security.util.DerInputStream; |
|
46 |
import sun.security.util.DerOutputStream; |
|
47 |
import sun.security.util.DerValue; |
|
48 |
||
49 |
/** |
|
50 |
* A KDC server. |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
51 |
* |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
52 |
* Note: By setting the system property native.kdc.path to a native |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
53 |
* krb5 installation, this class starts a native KDC with the |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
54 |
* given realm and host. It can also add new principals and save keytabs. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
55 |
* Other features might not be available. |
1454 | 56 |
* <p> |
57 |
* Features: |
|
58 |
* <ol> |
|
59 |
* <li> Supports TCP and UDP |
|
60 |
* <li> Supports AS-REQ and TGS-REQ |
|
61 |
* <li> Principal db and other settings hard coded in application |
|
62 |
* <li> Options, say, request preauth or not |
|
63 |
* </ol> |
|
64 |
* Side effects: |
|
65 |
* <ol> |
|
66 |
* <li> The Sun-internal class <code>sun.security.krb5.Config</code> is a |
|
67 |
* singleton and initialized according to Kerberos settings (krb5.conf and |
|
68 |
* java.security.krb5.* system properties). This means once it's initialized |
|
69 |
* it will not automatically notice any changes to these settings (or file |
|
70 |
* changes of krb5.conf). The KDC class normally does not touch these |
|
71 |
* settings (except for the <code>writeKtab()</code> method). However, to make |
|
72 |
* sure nothing ever goes wrong, if you want to make any changes to these |
|
73 |
* settings after calling a KDC method, call <code>Config.refresh()</code> to |
|
74 |
* make sure your changes are reflected in the <code>Config</code> object. |
|
75 |
* </ol> |
|
4336 | 76 |
* System properties recognized: |
77 |
* <ul> |
|
78 |
* <li>test.kdc.save.ccache |
|
79 |
* </ul> |
|
1454 | 80 |
* Issues and TODOs: |
81 |
* <ol> |
|
82 |
* <li> Generates krb5.conf to be used on another machine, currently the kdc is |
|
83 |
* always localhost |
|
84 |
* <li> More options to KDC, say, error output, say, response nonce != |
|
85 |
* request nonce |
|
86 |
* </ol> |
|
87 |
* Note: This program uses internal krb5 classes (including reflection to |
|
88 |
* access private fields and methods). |
|
89 |
* <p> |
|
90 |
* Usages: |
|
91 |
* <p> |
|
92 |
* 1. Init and start the KDC: |
|
93 |
* <pre> |
|
94 |
* KDC kdc = KDC.create("REALM.NAME", port, isDaemon); |
|
95 |
* KDC kdc = KDC.create("REALM.NAME"); |
|
96 |
* </pre> |
|
97 |
* Here, <code>port</code> is the UDP and TCP port number the KDC server |
|
98 |
* listens on. If zero, a random port is chosen, which you can use getPort() |
|
99 |
* later to retrieve the value. |
|
100 |
* <p> |
|
101 |
* If <code>isDaemon</code> is true, the KDC worker threads will be daemons. |
|
102 |
* <p> |
|
103 |
* The shortcut <code>KDC.create("REALM.NAME")</code> has port=0 and |
|
104 |
* isDaemon=false, and is commonly used in an embedded KDC. |
|
105 |
* <p> |
|
106 |
* 2. Adding users: |
|
107 |
* <pre> |
|
108 |
* kdc.addPrincipal(String principal_name, char[] password); |
|
109 |
* kdc.addPrincipalRandKey(String principal_name); |
|
110 |
* </pre> |
|
111 |
* A service principal's name should look like "host/f.q.d.n". The second form |
|
112 |
* generates a random key. To expose this key, call <code>writeKtab()</code> to |
|
113 |
* save the keys into a keytab file. |
|
114 |
* <p> |
|
115 |
* Note that you need to add the principal name krbtgt/REALM.NAME yourself. |
|
116 |
* <p> |
|
117 |
* Note that you can safely add a principal at any time after the KDC is |
|
118 |
* started and before a user requests info on this principal. |
|
119 |
* <p> |
|
120 |
* 3. Other public methods: |
|
121 |
* <ul> |
|
122 |
* <li> <code>getPort</code>: Returns the port number the KDC uses |
|
123 |
* <li> <code>getRealm</code>: Returns the realm name |
|
124 |
* <li> <code>writeKtab</code>: Writes all principals' keys into a keytab file |
|
125 |
* <li> <code>saveConfig</code>: Saves a krb5.conf file to access this KDC |
|
126 |
* <li> <code>setOption</code>: Sets various options |
|
127 |
* </ul> |
|
128 |
* Read the javadoc for details. Lazy developer can use <code>OneKDC</code> |
|
129 |
* directly. |
|
130 |
*/ |
|
131 |
public class KDC { |
|
132 |
||
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
133 |
public static final int DEFAULT_LIFETIME = 39600; |
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
134 |
public static final int DEFAULT_RENEWTIME = 86400; |
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
135 |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
136 |
public static final String NOT_EXISTING_HOST = "not.existing.host"; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
137 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
138 |
// What etypes the KDC supports. Comma-separated strings. Null for all. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
139 |
// Please note native KDCs might use different names. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
140 |
private static final String SUPPORTED_ETYPES |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
141 |
= System.getProperty("kdc.supported.enctypes"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
142 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
143 |
// The native KDC |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
144 |
private final NativeKdc nativeKdc; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
145 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
146 |
// The native KDC process |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
147 |
private Process kdcProc = null; |
36967
d041d2e80712
8134577: Eliminate or standardize a replacement for sun.net.spi.nameservice.NameServiceDescriptor
msheppar
parents:
34438
diff
changeset
|
148 |
|
1454 | 149 |
// Under the hood. |
150 |
||
7183 | 151 |
// Principal db. principal -> pass. A case-insensitive TreeMap is used |
152 |
// so that even if the client provides a name with different case, the KDC |
|
153 |
// can still locate the principal and give back correct salt. |
|
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7183
diff
changeset
|
154 |
private TreeMap<String,char[]> passwords = new TreeMap<> |
7183 | 155 |
(String.CASE_INSENSITIVE_ORDER); |
156 |
||
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
157 |
// Non default salts. Precisely, there should be different salts for |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
158 |
// different etypes, pretend they are the same at the moment. |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
159 |
private TreeMap<String,String> salts = new TreeMap<> |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
160 |
(String.CASE_INSENSITIVE_ORDER); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
161 |
|
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
162 |
// Non default s2kparams for newer etypes. Precisely, there should be |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
163 |
// different s2kparams for different etypes, pretend they are the same |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
164 |
// at the moment. |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
165 |
private TreeMap<String,byte[]> s2kparamses = new TreeMap<> |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
166 |
(String.CASE_INSENSITIVE_ORDER); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
167 |
|
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
168 |
// Alias for referrals. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
169 |
private TreeMap<String,KDC> aliasReferrals = new TreeMap<> |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
170 |
(String.CASE_INSENSITIVE_ORDER); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
171 |
|
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
172 |
// Alias for local resolution. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
173 |
private TreeMap<String,PrincipalName> alias2Principals = new TreeMap<> |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
174 |
(String.CASE_INSENSITIVE_ORDER); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
175 |
|
1454 | 176 |
// Realm name |
177 |
private String realm; |
|
3046 | 178 |
// KDC |
179 |
private String kdc; |
|
180 |
// Service port number |
|
181 |
private int port; |
|
1454 | 182 |
// The request/response job queue |
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7183
diff
changeset
|
183 |
private BlockingQueue<Job> q = new ArrayBlockingQueue<>(100); |
1454 | 184 |
// Options |
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7183
diff
changeset
|
185 |
private Map<Option,Object> options = new HashMap<>(); |
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
186 |
// Realm-specific krb5.conf settings |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
187 |
private List<String> conf = new ArrayList<>(); |
1454 | 188 |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
189 |
private Thread thread1, thread2, thread3; |
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
190 |
private volatile boolean udpConsumerReady = false; |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
191 |
private volatile boolean tcpConsumerReady = false; |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
192 |
private volatile boolean dispatcherReady = false; |
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
193 |
DatagramSocket u1 = null; |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
194 |
ServerSocket t1 = null; |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
195 |
|
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
196 |
public static enum KtabMode { APPEND, EXISTING }; |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
197 |
|
1454 | 198 |
/** |
199 |
* Option names, to be expanded forever. |
|
200 |
*/ |
|
201 |
public static enum Option { |
|
202 |
/** |
|
203 |
* Whether pre-authentication is required. Default Boolean.TRUE |
|
204 |
*/ |
|
205 |
PREAUTH_REQUIRED, |
|
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
206 |
/** |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
207 |
* Only issue TGT in RC4 |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
208 |
*/ |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
209 |
ONLY_RC4_TGT, |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
210 |
/** |
7183 | 211 |
* Use RC4 as the first in preauth |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
212 |
*/ |
7183 | 213 |
RC4_FIRST_PREAUTH, |
214 |
/** |
|
215 |
* Use only one preauth, so that some keys are not easy to generate |
|
216 |
*/ |
|
217 |
ONLY_ONE_PREAUTH, |
|
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
218 |
/** |
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
219 |
* Set all name-type to a value in response |
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
220 |
*/ |
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
221 |
RESP_NT, |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
222 |
/** |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
223 |
* Multiple ETYPE-INFO-ENTRY with same etype but different salt |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
224 |
*/ |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
225 |
DUP_ETYPE, |
12867 | 226 |
/** |
227 |
* What backend server can be delegated to |
|
228 |
*/ |
|
229 |
OK_AS_DELEGATE, |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
230 |
/** |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
231 |
* Allow S4U2self, List<String> of middle servers. |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
232 |
* If not set, means KDC does not understand S4U2self at all, therefore |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
233 |
* would ignore any PA-FOR-USER request and send a ticket using the |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
234 |
* cname of teh requestor. If set, it returns FORWARDABLE tickets to |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
235 |
* a server with its name in the list |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
236 |
*/ |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
237 |
ALLOW_S4U2SELF, |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
238 |
/** |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
239 |
* Allow S4U2proxy, Map<String,List<String>> of middle servers to |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
240 |
* backends. If not set or a backend not in a server's list, |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
241 |
* Krb5.KDC_ERR_POLICY will be send for S4U2proxy request. |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
242 |
*/ |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
243 |
ALLOW_S4U2PROXY, |
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
244 |
/** |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
245 |
* Sensitive accounts can never be delegated. |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
246 |
*/ |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
247 |
SENSITIVE_ACCOUNTS, |
30959 | 248 |
/** |
249 |
* If true, will check if TGS-REQ contains a non-null addresses field. |
|
250 |
*/ |
|
251 |
CHECK_ADDRESSES, |
|
1454 | 252 |
}; |
253 |
||
254 |
/** |
|
255 |
* A standalone KDC server. |
|
256 |
*/ |
|
257 |
public static void main(String[] args) throws Exception { |
|
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
258 |
int port = args.length > 0 ? Integer.parseInt(args[0]) : 0; |
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
259 |
KDC kdc = create("RABBIT.HOLE", "kdc.rabbit.hole", port, false); |
1454 | 260 |
kdc.addPrincipal("dummy", "bogus".toCharArray()); |
261 |
kdc.addPrincipal("foo", "bar".toCharArray()); |
|
3046 | 262 |
kdc.addPrincipalRandKey("krbtgt/RABBIT.HOLE"); |
263 |
kdc.addPrincipalRandKey("server/host.rabbit.hole"); |
|
264 |
kdc.addPrincipalRandKey("backend/host.rabbit.hole"); |
|
265 |
KDC.saveConfig("krb5.conf", kdc, "forwardable = true"); |
|
1454 | 266 |
} |
267 |
||
268 |
/** |
|
269 |
* Creates and starts a KDC running as a daemon on a random port. |
|
270 |
* @param realm the realm name |
|
271 |
* @return the running KDC instance |
|
272 |
* @throws java.io.IOException for any socket creation error |
|
273 |
*/ |
|
274 |
public static KDC create(String realm) throws IOException { |
|
39484
3cf8b2fa2b9e
8135114: sun/security/krb5/auto tests failed on machine with TR locale
akosarev
parents:
39049
diff
changeset
|
275 |
return create(realm, "kdc." + realm.toLowerCase(Locale.US), 0, true); |
1454 | 276 |
} |
277 |
||
7183 | 278 |
public static KDC existing(String realm, String kdc, int port) { |
279 |
KDC k = new KDC(realm, kdc); |
|
280 |
k.port = port; |
|
281 |
return k; |
|
282 |
} |
|
283 |
||
1454 | 284 |
/** |
285 |
* Creates and starts a KDC server. |
|
286 |
* @param realm the realm name |
|
287 |
* @param port the TCP and UDP port to listen to. A random port will to |
|
288 |
* chosen if zero. |
|
289 |
* @param asDaemon if true, KDC threads will be daemons. Otherwise, not. |
|
290 |
* @return the running KDC instance |
|
291 |
* @throws java.io.IOException for any socket creation error |
|
292 |
*/ |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
293 |
public static KDC create(String realm, String kdc, int port, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
294 |
boolean asDaemon) throws IOException { |
3046 | 295 |
return new KDC(realm, kdc, port, asDaemon); |
1454 | 296 |
} |
297 |
||
298 |
/** |
|
299 |
* Sets an option |
|
300 |
* @param key the option name |
|
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
301 |
* @param value the value |
1454 | 302 |
*/ |
303 |
public void setOption(Option key, Object value) { |
|
12867 | 304 |
if (value == null) { |
305 |
options.remove(key); |
|
306 |
} else { |
|
307 |
options.put(key, value); |
|
308 |
} |
|
1454 | 309 |
} |
310 |
||
311 |
/** |
|
12199 | 312 |
* Writes or appends keys into a keytab. |
313 |
* <p> |
|
314 |
* Attention: This is the most basic one of a series of methods below on |
|
315 |
* keytab creation or modification. All these methods reference krb5.conf |
|
316 |
* settings. If you need to modify krb5.conf or switch to another krb5.conf |
|
317 |
* later, please call <code>Config.refresh()</code> again. For example: |
|
318 |
* <pre> |
|
319 |
* kdc.writeKtab("/etc/kdc/ktab", true); // Config is initialized, |
|
320 |
* System.setProperty("java.security.krb5.conf", "/home/mykrb5.conf"); |
|
321 |
* Config.refresh(); |
|
322 |
* </pre> |
|
323 |
* Inside this method there are 2 places krb5.conf is used: |
|
324 |
* <ol> |
|
325 |
* <li> (Fatal) Generating keys: EncryptionKey.acquireSecretKeys |
|
326 |
* <li> (Has workaround) Creating PrincipalName |
|
327 |
* </ol> |
|
328 |
* @param tab the keytab file name |
|
9499 | 329 |
* @param append true if append, otherwise, overwrite. |
12199 | 330 |
* @param names the names to write into, write all if names is empty |
9499 | 331 |
*/ |
12199 | 332 |
public void writeKtab(String tab, boolean append, String... names) |
9499 | 333 |
throws IOException, KrbException { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
334 |
KeyTab ktab = null; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
335 |
if (nativeKdc == null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
336 |
ktab = append ? KeyTab.getInstance(tab) : KeyTab.create(tab); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
337 |
} |
12199 | 338 |
Iterable<String> entries = |
339 |
(names.length != 0) ? Arrays.asList(names): passwords.keySet(); |
|
340 |
for (String name : entries) { |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
341 |
if (name.indexOf('@') < 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
342 |
name = name + "@" + realm; |
9499 | 343 |
} |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
344 |
if (nativeKdc == null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
345 |
char[] pass = passwords.get(name); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
346 |
int kvno = 0; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
347 |
if (Character.isDigit(pass[pass.length - 1])) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
348 |
kvno = pass[pass.length - 1] - '0'; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
349 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
350 |
PrincipalName pn = new PrincipalName(name, |
15006 | 351 |
name.indexOf('/') < 0 ? |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
352 |
PrincipalName.KRB_NT_UNKNOWN : |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
353 |
PrincipalName.KRB_NT_SRV_HST); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
354 |
ktab.addEntry(pn, |
15006 | 355 |
getSalt(pn), |
12199 | 356 |
pass, |
357 |
kvno, |
|
358 |
true); |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
359 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
360 |
nativeKdc.ktadd(name, tab); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
361 |
} |
9499 | 362 |
} |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
363 |
if (nativeKdc == null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
364 |
ktab.save(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
365 |
} |
9499 | 366 |
} |
367 |
||
368 |
/** |
|
369 |
* Writes all principals' keys from multiple KDCs into one keytab file. |
|
1454 | 370 |
* @throws java.io.IOException for any file output error |
371 |
* @throws sun.security.krb5.KrbException for any realm and/or principal |
|
372 |
* name error. |
|
373 |
*/ |
|
2942
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
374 |
public static void writeMultiKtab(String tab, KDC... kdcs) |
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
375 |
throws IOException, KrbException { |
12199 | 376 |
KeyTab.create(tab).save(); // Empty the old keytab |
377 |
appendMultiKtab(tab, kdcs); |
|
9499 | 378 |
} |
379 |
||
380 |
/** |
|
381 |
* Appends all principals' keys from multiple KDCs to one keytab file. |
|
382 |
*/ |
|
383 |
public static void appendMultiKtab(String tab, KDC... kdcs) |
|
384 |
throws IOException, KrbException { |
|
12199 | 385 |
for (KDC kdc: kdcs) { |
386 |
kdc.writeKtab(tab, true); |
|
387 |
} |
|
1454 | 388 |
} |
389 |
||
390 |
/** |
|
2942
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
391 |
* Write a ktab for this KDC. |
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
392 |
*/ |
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
393 |
public void writeKtab(String tab) throws IOException, KrbException { |
12199 | 394 |
writeKtab(tab, false); |
2942
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
395 |
} |
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
396 |
|
37d9baeb7518
6578647: Undefined requesting URL in java.net.Authenticator.getPasswordAuthentication()
weijun
parents:
1575
diff
changeset
|
397 |
/** |
9499 | 398 |
* Appends keys in this KDC to a ktab. |
399 |
*/ |
|
400 |
public void appendKtab(String tab) throws IOException, KrbException { |
|
12199 | 401 |
writeKtab(tab, true); |
9499 | 402 |
} |
403 |
||
404 |
/** |
|
1454 | 405 |
* Adds a new principal to this realm with a given password. |
406 |
* @param user the principal's name. For a service principal, use the |
|
407 |
* form of host/f.q.d.n |
|
408 |
* @param pass the password for the principal |
|
409 |
*/ |
|
410 |
public void addPrincipal(String user, char[] pass) { |
|
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
411 |
addPrincipal(user, pass, null, null); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
412 |
} |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
413 |
|
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
414 |
/** |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
415 |
* Adds a new principal to this realm with a given password. |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
416 |
* @param user the principal's name. For a service principal, use the |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
417 |
* form of host/f.q.d.n |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
418 |
* @param pass the password for the principal |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
419 |
* @param salt the salt, or null if a default value will be used |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
420 |
* @param s2kparams the s2kparams, or null if a default value will be used |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
421 |
*/ |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
422 |
public void addPrincipal( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
423 |
String user, char[] pass, String salt, byte[] s2kparams) { |
3046 | 424 |
if (user.indexOf('@') < 0) { |
425 |
user = user + "@" + realm; |
|
426 |
} |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
427 |
if (nativeKdc != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
428 |
if (!user.equals("krbtgt/" + realm)) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
429 |
nativeKdc.addPrincipal(user, new String(pass)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
430 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
431 |
passwords.put(user, new char[0]); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
432 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
433 |
passwords.put(user, pass); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
434 |
if (salt != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
435 |
salts.put(user, salt); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
436 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
437 |
if (s2kparams != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
438 |
s2kparamses.put(user, s2kparams); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
439 |
} |
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
440 |
} |
1454 | 441 |
} |
442 |
||
443 |
/** |
|
444 |
* Adds a new principal to this realm with a random password |
|
445 |
* @param user the principal's name. For a service principal, use the |
|
446 |
* form of host/f.q.d.n |
|
447 |
*/ |
|
448 |
public void addPrincipalRandKey(String user) { |
|
3046 | 449 |
addPrincipal(user, randomPassword()); |
1454 | 450 |
} |
451 |
||
452 |
/** |
|
453 |
* Returns the name of this realm |
|
454 |
* @return the name of this realm |
|
455 |
*/ |
|
456 |
public String getRealm() { |
|
457 |
return realm; |
|
458 |
} |
|
459 |
||
460 |
/** |
|
3046 | 461 |
* Returns the name of kdc |
462 |
* @return the name of kdc |
|
463 |
*/ |
|
464 |
public String getKDC() { |
|
465 |
return kdc; |
|
466 |
} |
|
467 |
||
468 |
/** |
|
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
469 |
* Add realm-specific krb5.conf setting |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
470 |
*/ |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
471 |
public void addConf(String s) { |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
472 |
conf.add(s); |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
473 |
} |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
474 |
|
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
475 |
/** |
1454 | 476 |
* Writes a krb5.conf for one or more KDC that includes KDC locations for |
477 |
* each realm and the default realm name. You can also add extra strings |
|
478 |
* into the file. The method should be called like: |
|
479 |
* <pre> |
|
480 |
* KDC.saveConfig("krb5.conf", kdc1, kdc2, ..., line1, line2, ...); |
|
481 |
* </pre> |
|
482 |
* Here you can provide one or more kdc# and zero or more line# arguments. |
|
483 |
* The line# will be put after [libdefaults] and before [realms]. Therefore |
|
484 |
* you can append new lines into [libdefaults] and/or create your new |
|
485 |
* stanzas as well. Note that a newline character will be appended to |
|
486 |
* each line# argument. |
|
487 |
* <p> |
|
488 |
* For example: |
|
489 |
* <pre> |
|
490 |
* KDC.saveConfig("krb5.conf", this); |
|
491 |
* </pre> |
|
492 |
* generates: |
|
493 |
* <pre> |
|
494 |
* [libdefaults] |
|
495 |
* default_realm = REALM.NAME |
|
496 |
* |
|
497 |
* [realms] |
|
498 |
* REALM.NAME = { |
|
3046 | 499 |
* kdc = host:port_number |
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
500 |
* # realm-specific settings |
1454 | 501 |
* } |
502 |
* </pre> |
|
503 |
* |
|
504 |
* Another example: |
|
505 |
* <pre> |
|
506 |
* KDC.saveConfig("krb5.conf", kdc1, kdc2, "forwardable = true", "", |
|
507 |
* "[domain_realm]", |
|
508 |
* ".kdc1.com = KDC1.NAME"); |
|
509 |
* </pre> |
|
510 |
* generates: |
|
511 |
* <pre> |
|
512 |
* [libdefaults] |
|
513 |
* default_realm = KDC1.NAME |
|
514 |
* forwardable = true |
|
515 |
* |
|
516 |
* [domain_realm] |
|
517 |
* .kdc1.com = KDC1.NAME |
|
518 |
* |
|
519 |
* [realms] |
|
520 |
* KDC1.NAME = { |
|
3046 | 521 |
* kdc = host:port1 |
1454 | 522 |
* } |
523 |
* KDC2.NAME = { |
|
3046 | 524 |
* kdc = host:port2 |
1454 | 525 |
* } |
526 |
* </pre> |
|
527 |
* @param file the name of the file to write into |
|
528 |
* @param kdc the first (and default) KDC |
|
529 |
* @param more more KDCs or extra lines (in their appearing order) to |
|
530 |
* insert into the krb5.conf file. This method reads each argument's type |
|
531 |
* to determine what it's for. This argument can be empty. |
|
532 |
* @throws java.io.IOException for any file output error |
|
533 |
*/ |
|
534 |
public static void saveConfig(String file, KDC kdc, Object... more) |
|
535 |
throws IOException { |
|
536 |
StringBuffer sb = new StringBuffer(); |
|
537 |
sb.append("[libdefaults]\ndefault_realm = "); |
|
538 |
sb.append(kdc.realm); |
|
539 |
sb.append("\n"); |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
540 |
for (Object o : more) { |
1454 | 541 |
if (o instanceof String) { |
542 |
sb.append(o); |
|
543 |
sb.append("\n"); |
|
544 |
} |
|
545 |
} |
|
546 |
sb.append("\n[realms]\n"); |
|
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
547 |
sb.append(kdc.realmLine()); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
548 |
for (Object o : more) { |
1454 | 549 |
if (o instanceof KDC) { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
550 |
sb.append(((KDC) o).realmLine()); |
1454 | 551 |
} |
552 |
} |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
553 |
Files.write(Paths.get(file), sb.toString().getBytes()); |
1454 | 554 |
} |
555 |
||
556 |
/** |
|
557 |
* Returns the service port of the KDC server. |
|
558 |
* @return the KDC service port |
|
559 |
*/ |
|
560 |
public int getPort() { |
|
561 |
return port; |
|
562 |
} |
|
563 |
||
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
564 |
/** |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
565 |
* Register an alias name to be referred to a different KDC for |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
566 |
* resolution, according to RFC 6806. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
567 |
* @param alias Alias name (i.e. user@REALM.COM). |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
568 |
* @param referredKDC KDC to which the alias is referred for resolution. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
569 |
*/ |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
570 |
public void registerAlias(String alias, KDC referredKDC) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
571 |
aliasReferrals.remove(alias); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
572 |
aliasReferrals.put(alias, referredKDC); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
573 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
574 |
|
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
575 |
/** |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
576 |
* Register an alias to be resolved to a Principal Name locally, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
577 |
* according to RFC 6806. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
578 |
* @param alias Alias name (i.e. user@REALM.COM). |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
579 |
* @param user Principal Name to which the alias is resolved. |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
580 |
*/ |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
581 |
public void registerAlias(String alias, String user) |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
582 |
throws RealmException { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
583 |
alias2Principals.remove(alias); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
584 |
alias2Principals.put(alias, new PrincipalName(user)); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
585 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
586 |
|
1454 | 587 |
// Private helper methods |
588 |
||
589 |
/** |
|
590 |
* Private constructor, cannot be called outside. |
|
591 |
* @param realm |
|
592 |
*/ |
|
3046 | 593 |
private KDC(String realm, String kdc) { |
1454 | 594 |
this.realm = realm; |
3046 | 595 |
this.kdc = kdc; |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
596 |
this.nativeKdc = null; |
1454 | 597 |
} |
598 |
||
599 |
/** |
|
600 |
* A constructor that starts the KDC service also. |
|
601 |
*/ |
|
3046 | 602 |
protected KDC(String realm, String kdc, int port, boolean asDaemon) |
1454 | 603 |
throws IOException { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
604 |
this.realm = realm; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
605 |
this.kdc = kdc; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
606 |
this.nativeKdc = NativeKdc.get(this); |
1454 | 607 |
startServer(port, asDaemon); |
608 |
} |
|
609 |
/** |
|
610 |
* Generates a 32-char random password |
|
611 |
* @return the password |
|
612 |
*/ |
|
613 |
private static char[] randomPassword() { |
|
614 |
char[] pass = new char[32]; |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
615 |
Random r = new Random(); |
5622 | 616 |
for (int i=0; i<31; i++) |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
617 |
pass[i] = (char)('a' + r.nextInt(26)); |
5622 | 618 |
// The last char cannot be a number, otherwise, keyForUser() |
619 |
// believes it's a sign of kvno |
|
620 |
pass[31] = 'Z'; |
|
1454 | 621 |
return pass; |
622 |
} |
|
623 |
||
624 |
/** |
|
625 |
* Generates a random key for the given encryption type. |
|
626 |
* @param eType the encryption type |
|
627 |
* @return the generated key |
|
628 |
* @throws sun.security.krb5.KrbException for unknown/unsupported etype |
|
629 |
*/ |
|
630 |
private static EncryptionKey generateRandomKey(int eType) |
|
631 |
throws KrbException { |
|
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
632 |
return genKey0(randomPassword(), "NOTHING", null, eType, null); |
1454 | 633 |
} |
634 |
||
635 |
/** |
|
636 |
* Returns the password for a given principal |
|
637 |
* @param p principal |
|
638 |
* @return the password |
|
639 |
* @throws sun.security.krb5.KrbException when the principal is not inside |
|
640 |
* the database. |
|
641 |
*/ |
|
4336 | 642 |
private char[] getPassword(PrincipalName p, boolean server) |
643 |
throws KrbException { |
|
3046 | 644 |
String pn = p.toString(); |
645 |
if (p.getRealmString() == null) { |
|
646 |
pn = pn + "@" + getRealm(); |
|
647 |
} |
|
648 |
char[] pass = passwords.get(pn); |
|
1454 | 649 |
if (pass == null) { |
4336 | 650 |
throw new KrbException(server? |
651 |
Krb5.KDC_ERR_S_PRINCIPAL_UNKNOWN: |
|
15006 | 652 |
Krb5.KDC_ERR_C_PRINCIPAL_UNKNOWN, pn.toString()); |
1454 | 653 |
} |
654 |
return pass; |
|
655 |
} |
|
656 |
||
657 |
/** |
|
3046 | 658 |
* Returns the salt string for the principal. |
1454 | 659 |
* @param p principal |
660 |
* @return the salt |
|
661 |
*/ |
|
15006 | 662 |
protected String getSalt(PrincipalName p) { |
7183 | 663 |
String pn = p.toString(); |
664 |
if (p.getRealmString() == null) { |
|
665 |
pn = pn + "@" + getRealm(); |
|
666 |
} |
|
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
667 |
if (salts.containsKey(pn)) { |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
668 |
return salts.get(pn); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
669 |
} |
7183 | 670 |
if (passwords.containsKey(pn)) { |
671 |
try { |
|
672 |
// Find the principal name with correct case. |
|
673 |
p = new PrincipalName(passwords.ceilingEntry(pn).getKey()); |
|
674 |
} catch (RealmException re) { |
|
675 |
// Won't happen |
|
676 |
} |
|
677 |
} |
|
3046 | 678 |
String s = p.getRealmString(); |
679 |
if (s == null) s = getRealm(); |
|
680 |
for (String n: p.getNameStrings()) { |
|
681 |
s += n; |
|
1454 | 682 |
} |
3046 | 683 |
return s; |
1454 | 684 |
} |
685 |
||
686 |
/** |
|
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
687 |
* Returns the s2kparams for the principal given the etype. |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
688 |
* @param p principal |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
689 |
* @param etype encryption type |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
690 |
* @return the s2kparams, might be null |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
691 |
*/ |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
692 |
protected byte[] getParams(PrincipalName p, int etype) { |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
693 |
switch (etype) { |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
694 |
case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96: |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
695 |
case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: |
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
696 |
case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
697 |
case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: |
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
698 |
String pn = p.toString(); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
699 |
if (p.getRealmString() == null) { |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
700 |
pn = pn + "@" + getRealm(); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
701 |
} |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
702 |
if (s2kparamses.containsKey(pn)) { |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
703 |
return s2kparamses.get(pn); |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
704 |
} |
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
705 |
if (etype < EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128) { |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
706 |
return new byte[]{0, 0, 0x10, 0}; |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
707 |
} else { |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
708 |
return new byte[]{0, 0, (byte) 0x80, 0}; |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
709 |
} |
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
710 |
default: |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
711 |
return null; |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
712 |
} |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
713 |
} |
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
714 |
|
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
715 |
/** |
1454 | 716 |
* Returns the key for a given principal of the given encryption type |
717 |
* @param p the principal |
|
718 |
* @param etype the encryption type |
|
4336 | 719 |
* @param server looking for a server principal? |
1454 | 720 |
* @return the key |
721 |
* @throws sun.security.krb5.KrbException for unknown/unsupported etype |
|
722 |
*/ |
|
4336 | 723 |
private EncryptionKey keyForUser(PrincipalName p, int etype, boolean server) |
724 |
throws KrbException { |
|
1454 | 725 |
try { |
726 |
// Do not call EncryptionKey.acquireSecretKeys(), otherwise |
|
727 |
// the krb5.conf config file would be loaded. |
|
4168
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3046
diff
changeset
|
728 |
Integer kvno = null; |
4532 | 729 |
// For service whose password ending with a number, use it as kvno. |
730 |
// Kvno must be postive. |
|
731 |
if (p.toString().indexOf('/') > 0) { |
|
4336 | 732 |
char[] pass = getPassword(p, server); |
4168
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3046
diff
changeset
|
733 |
if (Character.isDigit(pass[pass.length-1])) { |
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3046
diff
changeset
|
734 |
kvno = pass[pass.length-1] - '0'; |
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3046
diff
changeset
|
735 |
} |
1a8d21bb898c
6893158: AP_REQ check should use key version number
weijun
parents:
3046
diff
changeset
|
736 |
} |
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
737 |
return genKey0(getPassword(p, server), getSalt(p), |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
738 |
getParams(p, etype), etype, kvno); |
4336 | 739 |
} catch (KrbException ke) { |
740 |
throw ke; |
|
1454 | 741 |
} catch (Exception e) { |
742 |
throw new RuntimeException(e); // should not happen |
|
743 |
} |
|
744 |
} |
|
745 |
||
746 |
/** |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
747 |
* Returns a KerberosTime. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
748 |
* |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
749 |
* @param offset offset from NOW in seconds |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
750 |
*/ |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
751 |
private static KerberosTime timeAfter(int offset) { |
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
752 |
return new KerberosTime(new Date().getTime() + offset * 1000L); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
753 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
754 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
755 |
/** |
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
756 |
* Generates key from password. |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
757 |
*/ |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
758 |
private static EncryptionKey genKey0( |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
759 |
char[] pass, String salt, byte[] s2kparams, |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
760 |
int etype, Integer kvno) throws KrbException { |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
761 |
return new EncryptionKey(EncryptionKeyDotStringToKey( |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
762 |
pass, salt, s2kparams, etype), |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
763 |
etype, kvno); |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
764 |
} |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
765 |
|
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
766 |
/** |
1454 | 767 |
* Processes an incoming request and generates a response. |
768 |
* @param in the request |
|
769 |
* @return the response |
|
770 |
* @throws java.lang.Exception for various errors |
|
771 |
*/ |
|
21961
50019af27ca3
8028351: JWS doesn't get authenticated when using kerberos auth proxy
weijun
parents:
18536
diff
changeset
|
772 |
protected byte[] processMessage(byte[] in) throws Exception { |
1454 | 773 |
if ((in[0] & 0x1f) == Krb5.KRB_AS_REQ) |
774 |
return processAsReq(in); |
|
775 |
else |
|
776 |
return processTgsReq(in); |
|
777 |
} |
|
778 |
||
779 |
/** |
|
780 |
* Processes a TGS_REQ and generates a TGS_REP (or KRB_ERROR) |
|
781 |
* @param in the request |
|
782 |
* @return the response |
|
783 |
* @throws java.lang.Exception for various errors |
|
784 |
*/ |
|
21961
50019af27ca3
8028351: JWS doesn't get authenticated when using kerberos auth proxy
weijun
parents:
18536
diff
changeset
|
785 |
protected byte[] processTgsReq(byte[] in) throws Exception { |
1454 | 786 |
TGSReq tgsReq = new TGSReq(in); |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
787 |
PrincipalName service = tgsReq.reqBody.sname; |
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
788 |
if (options.containsKey(KDC.Option.RESP_NT)) { |
13247 | 789 |
service = new PrincipalName((int)options.get(KDC.Option.RESP_NT), |
790 |
service.getNameStrings(), service.getRealm()); |
|
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
791 |
} |
1454 | 792 |
try { |
793 |
System.out.println(realm + "> " + tgsReq.reqBody.cname + |
|
794 |
" sends TGS-REQ for " + |
|
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
795 |
service + ", " + tgsReq.reqBody.kdcOptions); |
1454 | 796 |
KDCReqBody body = tgsReq.reqBody; |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
797 |
int[] eTypes = filterSupported(KDCReqBodyDotEType(body)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
798 |
if (eTypes.length == 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
799 |
throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
800 |
} |
7183 | 801 |
int e2 = eTypes[0]; // etype for outgoing session key |
802 |
int e3 = eTypes[0]; // etype for outgoing ticket |
|
1454 | 803 |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
804 |
PAData[] pas = KDCReqDotPAData(tgsReq); |
1454 | 805 |
|
806 |
Ticket tkt = null; |
|
807 |
EncTicketPart etp = null; |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
808 |
|
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
809 |
PrincipalName cname = null; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
810 |
boolean allowForwardable = true; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
811 |
|
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
812 |
if (body.kdcOptions.get(KDCOptions.CANONICALIZE)) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
813 |
KDC referral = aliasReferrals.get(body.sname.getNameString()); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
814 |
if (referral != null) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
815 |
service = new PrincipalName( |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
816 |
PrincipalName.TGS_DEFAULT_SRV_NAME + |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
817 |
PrincipalName.NAME_COMPONENT_SEPARATOR_STR + |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
818 |
referral.getRealm(), PrincipalName.KRB_NT_SRV_INST, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
819 |
this.getRealm()); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
820 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
821 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
822 |
|
1454 | 823 |
if (pas == null || pas.length == 0) { |
824 |
throw new KrbException(Krb5.KDC_ERR_PADATA_TYPE_NOSUPP); |
|
825 |
} else { |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
826 |
PrincipalName forUserCName = null; |
1454 | 827 |
for (PAData pa: pas) { |
828 |
if (pa.getType() == Krb5.PA_TGS_REQ) { |
|
829 |
APReq apReq = new APReq(pa.getValue()); |
|
830 |
EncryptedData ed = apReq.authenticator; |
|
831 |
tkt = apReq.ticket; |
|
7183 | 832 |
int te = tkt.encPart.getEType(); |
833 |
EncryptionKey kkey = keyForUser(tkt.sname, te, true); |
|
1454 | 834 |
byte[] bb = tkt.encPart.decrypt(kkey, KeyUsage.KU_TICKET); |
835 |
DerInputStream derIn = new DerInputStream(bb); |
|
836 |
DerValue der = derIn.getDerValue(); |
|
837 |
etp = new EncTicketPart(der.toByteArray()); |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
838 |
// Finally, cname will be overwritten by PA-FOR-USER |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
839 |
// if it exists. |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
840 |
cname = etp.cname; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
841 |
System.out.println(realm + "> presenting a ticket of " |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
842 |
+ etp.cname + " to " + tkt.sname); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
843 |
} else if (pa.getType() == Krb5.PA_FOR_USER) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
844 |
if (options.containsKey(Option.ALLOW_S4U2SELF)) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
845 |
PAForUserEnc p4u = new PAForUserEnc( |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
846 |
new DerValue(pa.getValue()), null); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
847 |
forUserCName = p4u.name; |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
848 |
System.out.println(realm + "> See PA_FOR_USER " |
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
849 |
+ " in the name of " + p4u.name); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
850 |
} |
1454 | 851 |
} |
852 |
} |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
853 |
if (forUserCName != null) { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
854 |
List<String> names = (List<String>) |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
855 |
options.get(Option.ALLOW_S4U2SELF); |
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
856 |
if (!names.contains(cname.toString())) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
857 |
// Mimic the normal KDC behavior. When a server is not |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
858 |
// allowed to send S4U2self, do not send an error. |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
859 |
// Instead, send a ticket which is useless later. |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
860 |
allowForwardable = false; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
861 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
862 |
cname = forUserCName; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
863 |
} |
1454 | 864 |
if (tkt == null) { |
865 |
throw new KrbException(Krb5.KDC_ERR_PADATA_TYPE_NOSUPP); |
|
866 |
} |
|
867 |
} |
|
868 |
||
869 |
// Session key for original ticket, TGT |
|
870 |
EncryptionKey ckey = etp.key; |
|
871 |
||
872 |
// Session key for session with the service |
|
7183 | 873 |
EncryptionKey key = generateRandomKey(e2); |
1454 | 874 |
|
875 |
// Check time, TODO |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
876 |
KerberosTime from = body.from; |
1454 | 877 |
KerberosTime till = body.till; |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
878 |
if (from == null || from.isZero()) { |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
879 |
from = timeAfter(0); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
880 |
} |
1454 | 881 |
if (till == null) { |
882 |
throw new KrbException(Krb5.KDC_ERR_NEVER_VALID); // TODO |
|
883 |
} else if (till.isZero()) { |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
884 |
till = timeAfter(DEFAULT_LIFETIME); |
1454 | 885 |
} |
886 |
||
887 |
boolean[] bFlags = new boolean[Krb5.TKT_OPTS_MAX+1]; |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
888 |
if (body.kdcOptions.get(KDCOptions.FORWARDABLE) |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
889 |
&& allowForwardable) { |
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
890 |
List<String> sensitives = (List<String>) |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
891 |
options.get(Option.SENSITIVE_ACCOUNTS); |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
892 |
if (sensitives != null && sensitives.contains(cname.toString())) { |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
893 |
// Cannot make FORWARDABLE |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
894 |
} else { |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
895 |
bFlags[Krb5.TKT_OPTS_FORWARDABLE] = true; |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
896 |
} |
1454 | 897 |
} |
32013
e7ad0380f7be
8132111: Do not request for addresses for forwarded TGT
weijun
parents:
31817
diff
changeset
|
898 |
// We do not request for addresses for FORWARDED tickets |
30959 | 899 |
if (options.containsKey(Option.CHECK_ADDRESSES) |
900 |
&& body.kdcOptions.get(KDCOptions.FORWARDED) |
|
32013
e7ad0380f7be
8132111: Do not request for addresses for forwarded TGT
weijun
parents:
31817
diff
changeset
|
901 |
&& body.addresses != null) { |
30959 | 902 |
throw new KrbException(Krb5.KDC_ERR_BADOPTION); |
903 |
} |
|
1454 | 904 |
if (body.kdcOptions.get(KDCOptions.FORWARDED) || |
905 |
etp.flags.get(Krb5.TKT_OPTS_FORWARDED)) { |
|
906 |
bFlags[Krb5.TKT_OPTS_FORWARDED] = true; |
|
907 |
} |
|
908 |
if (body.kdcOptions.get(KDCOptions.RENEWABLE)) { |
|
909 |
bFlags[Krb5.TKT_OPTS_RENEWABLE] = true; |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
910 |
//renew = timeAfter(3600 * 24 * 7); |
1454 | 911 |
} |
912 |
if (body.kdcOptions.get(KDCOptions.PROXIABLE)) { |
|
913 |
bFlags[Krb5.TKT_OPTS_PROXIABLE] = true; |
|
914 |
} |
|
915 |
if (body.kdcOptions.get(KDCOptions.POSTDATED)) { |
|
916 |
bFlags[Krb5.TKT_OPTS_POSTDATED] = true; |
|
917 |
} |
|
918 |
if (body.kdcOptions.get(KDCOptions.ALLOW_POSTDATE)) { |
|
919 |
bFlags[Krb5.TKT_OPTS_MAY_POSTDATE] = true; |
|
920 |
} |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
921 |
if (body.kdcOptions.get(KDCOptions.CNAME_IN_ADDL_TKT)) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
922 |
if (!options.containsKey(Option.ALLOW_S4U2PROXY)) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
923 |
// Don't understand CNAME_IN_ADDL_TKT |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
924 |
throw new KrbException(Krb5.KDC_ERR_BADOPTION); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
925 |
} else { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
926 |
Map<String,List<String>> map = (Map<String,List<String>>) |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
927 |
options.get(Option.ALLOW_S4U2PROXY); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
928 |
Ticket second = KDCReqBodyDotFirstAdditionalTicket(body); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
929 |
EncryptionKey key2 = keyForUser( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
930 |
second.sname, second.encPart.getEType(), true); |
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
931 |
byte[] bb = second.encPart.decrypt(key2, KeyUsage.KU_TICKET); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
932 |
DerInputStream derIn = new DerInputStream(bb); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
933 |
DerValue der = derIn.getDerValue(); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
934 |
EncTicketPart tktEncPart = new EncTicketPart(der.toByteArray()); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
935 |
if (!tktEncPart.flags.get(Krb5.TKT_OPTS_FORWARDABLE)) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
936 |
//throw new KrbException(Krb5.KDC_ERR_BADOPTION); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
937 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
938 |
PrincipalName client = tktEncPart.cname; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
939 |
System.out.println(realm + "> and an additional ticket of " |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
940 |
+ client + " to " + second.sname); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
941 |
if (map.containsKey(cname.toString())) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
942 |
if (map.get(cname.toString()).contains(service.toString())) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
943 |
System.out.println(realm + "> S4U2proxy OK"); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
944 |
} else { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
945 |
throw new KrbException(Krb5.KDC_ERR_BADOPTION); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
946 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
947 |
} else { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
948 |
throw new KrbException(Krb5.KDC_ERR_BADOPTION); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
949 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
950 |
cname = client; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
951 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
952 |
} |
4336 | 953 |
|
12867 | 954 |
String okAsDelegate = (String)options.get(Option.OK_AS_DELEGATE); |
955 |
if (okAsDelegate != null && ( |
|
956 |
okAsDelegate.isEmpty() || |
|
957 |
okAsDelegate.contains(service.getNameString()))) { |
|
4336 | 958 |
bFlags[Krb5.TKT_OPTS_DELEGATE] = true; |
959 |
} |
|
1454 | 960 |
bFlags[Krb5.TKT_OPTS_INITIAL] = true; |
961 |
||
47005
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
962 |
KerberosTime renewTill = etp.renewTill; |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
963 |
if (renewTill != null && body.kdcOptions.get(KDCOptions.RENEW)) { |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
964 |
// till should never pass renewTill |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
965 |
if (till.greaterThan(renewTill)) { |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
966 |
till = renewTill; |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
967 |
} |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
968 |
if (System.getProperty("test.set.null.renew") != null) { |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
969 |
// Testing 8186576, see NullRenewUntil.java. |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
970 |
renewTill = null; |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
971 |
} |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
972 |
} |
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
973 |
|
1454 | 974 |
TicketFlags tFlags = new TicketFlags(bFlags); |
975 |
EncTicketPart enc = new EncTicketPart( |
|
976 |
tFlags, |
|
977 |
key, |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
978 |
cname, |
1454 | 979 |
new TransitedEncoding(1, new byte[0]), // TODO |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
980 |
timeAfter(0), |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
981 |
from, |
47005
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
982 |
till, renewTill, |
30959 | 983 |
body.addresses != null ? body.addresses |
984 |
: etp.caddr, |
|
1454 | 985 |
null); |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
986 |
EncryptionKey skey = keyForUser(service, e3, true); |
7183 | 987 |
if (skey == null) { |
988 |
throw new KrbException(Krb5.KDC_ERR_SUMTYPE_NOSUPP); // TODO |
|
989 |
} |
|
1454 | 990 |
Ticket t = new Ticket( |
45276
633535faf95d
8178794: krb5 client should ignore sname in incoming tickets
weijun
parents:
39484
diff
changeset
|
991 |
System.getProperty("test.kdc.diff.sname") != null ? |
633535faf95d
8178794: krb5 client should ignore sname in incoming tickets
weijun
parents:
39484
diff
changeset
|
992 |
new PrincipalName("xx" + service.toString()) : |
633535faf95d
8178794: krb5 client should ignore sname in incoming tickets
weijun
parents:
39484
diff
changeset
|
993 |
service, |
1454 | 994 |
new EncryptedData(skey, enc.asn1Encode(), KeyUsage.KU_TICKET) |
995 |
); |
|
996 |
EncTGSRepPart enc_part = new EncTGSRepPart( |
|
997 |
key, |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
998 |
new LastReq(new LastReqEntry[] { |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
999 |
new LastReqEntry(0, timeAfter(-10)) |
1454 | 1000 |
}), |
1001 |
body.getNonce(), // TODO: detect replay |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1002 |
timeAfter(3600 * 24), |
1454 | 1003 |
// Next 5 and last MUST be same with ticket |
1004 |
tFlags, |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1005 |
timeAfter(0), |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1006 |
from, |
47005
dbfaf076da58
8186576: KerberosTicket does not properly handle renewable tickets at the end of their lifetime
weijun
parents:
45276
diff
changeset
|
1007 |
till, renewTill, |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1008 |
service, |
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1009 |
body.addresses, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1010 |
null |
1454 | 1011 |
); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1012 |
EncryptedData edata = new EncryptedData(ckey, enc_part.asn1Encode(), |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1013 |
KeyUsage.KU_ENC_TGS_REP_PART_SESSKEY); |
1454 | 1014 |
TGSRep tgsRep = new TGSRep(null, |
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
1015 |
cname, |
1454 | 1016 |
t, |
1017 |
edata); |
|
1018 |
System.out.println(" Return " + tgsRep.cname |
|
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1019 |
+ " ticket for " + tgsRep.ticket.sname + ", flags " |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1020 |
+ tFlags); |
1454 | 1021 |
|
1022 |
DerOutputStream out = new DerOutputStream(); |
|
1023 |
out.write(DerValue.createTag(DerValue.TAG_APPLICATION, |
|
1024 |
true, (byte)Krb5.KRB_TGS_REP), tgsRep.asn1Encode()); |
|
1025 |
return out.toByteArray(); |
|
1026 |
} catch (KrbException ke) { |
|
1027 |
ke.printStackTrace(System.out); |
|
1028 |
KRBError kerr = ke.getError(); |
|
1029 |
KDCReqBody body = tgsReq.reqBody; |
|
1030 |
System.out.println(" Error " + ke.returnCode() |
|
1031 |
+ " " +ke.returnCodeMessage()); |
|
1032 |
if (kerr == null) { |
|
1033 |
kerr = new KRBError(null, null, null, |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1034 |
timeAfter(0), |
1454 | 1035 |
0, |
1036 |
ke.returnCode(), |
|
13247 | 1037 |
body.cname, |
1038 |
service, |
|
1454 | 1039 |
KrbException.errorMessage(ke.returnCode()), |
1040 |
null); |
|
1041 |
} |
|
1042 |
return kerr.asn1Encode(); |
|
1043 |
} |
|
1044 |
} |
|
1045 |
||
1046 |
/** |
|
1047 |
* Processes a AS_REQ and generates a AS_REP (or KRB_ERROR) |
|
1048 |
* @param in the request |
|
1049 |
* @return the response |
|
1050 |
* @throws java.lang.Exception for various errors |
|
1051 |
*/ |
|
21961
50019af27ca3
8028351: JWS doesn't get authenticated when using kerberos auth proxy
weijun
parents:
18536
diff
changeset
|
1052 |
protected byte[] processAsReq(byte[] in) throws Exception { |
1454 | 1053 |
ASReq asReq = new ASReq(in); |
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1054 |
byte[] asReqbytes = asReq.asn1Encode(); |
1454 | 1055 |
int[] eTypes = null; |
7977
f47f211cd627
7008713: diamond conversion of kerberos5 and security tools
smarks
parents:
7183
diff
changeset
|
1056 |
List<PAData> outPAs = new ArrayList<>(); |
7183 | 1057 |
|
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1058 |
PrincipalName service = asReq.reqBody.sname; |
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1059 |
if (options.containsKey(KDC.Option.RESP_NT)) { |
33282 | 1060 |
service = new PrincipalName((int)options.get(KDC.Option.RESP_NT), |
1061 |
service.getNameStrings(), |
|
1062 |
Realm.getDefault()); |
|
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1063 |
} |
1454 | 1064 |
try { |
1065 |
System.out.println(realm + "> " + asReq.reqBody.cname + |
|
1066 |
" sends AS-REQ for " + |
|
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1067 |
service + ", " + asReq.reqBody.kdcOptions); |
1454 | 1068 |
|
1069 |
KDCReqBody body = asReq.reqBody; |
|
1070 |
||
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1071 |
eTypes = filterSupported(KDCReqBodyDotEType(body)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1072 |
if (eTypes.length == 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1073 |
throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1074 |
} |
1454 | 1075 |
int eType = eTypes[0]; |
1076 |
||
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1077 |
if (body.kdcOptions.get(KDCOptions.CANONICALIZE) && |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1078 |
body.cname.getNameType() == PrincipalName.KRB_NT_ENTERPRISE) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1079 |
PrincipalName principal = alias2Principals.get( |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1080 |
body.cname.getNameString()); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1081 |
if (principal != null) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1082 |
body.cname = principal; |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1083 |
} else { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1084 |
KDC referral = aliasReferrals.get(body.cname.getNameString()); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1085 |
if (referral != null) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1086 |
body.cname = new PrincipalName( |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1087 |
PrincipalName.TGS_DEFAULT_SRV_NAME, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1088 |
PrincipalName.KRB_NT_SRV_INST, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1089 |
referral.getRealm()); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1090 |
throw new KrbException(Krb5.KRB_ERR_WRONG_REALM); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1091 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1092 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1093 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1094 |
|
4336 | 1095 |
EncryptionKey ckey = keyForUser(body.cname, eType, false); |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1096 |
EncryptionKey skey = keyForUser(service, eType, true); |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1097 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1098 |
if (options.containsKey(KDC.Option.ONLY_RC4_TGT)) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1099 |
int tgtEType = EncryptedData.ETYPE_ARCFOUR_HMAC; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1100 |
boolean found = false; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1101 |
for (int i=0; i<eTypes.length; i++) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1102 |
if (eTypes[i] == tgtEType) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1103 |
found = true; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1104 |
break; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1105 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1106 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1107 |
if (!found) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1108 |
throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1109 |
} |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1110 |
skey = keyForUser(service, tgtEType, true); |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1111 |
} |
1454 | 1112 |
if (ckey == null) { |
1113 |
throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP); |
|
1114 |
} |
|
1115 |
if (skey == null) { |
|
1116 |
throw new KrbException(Krb5.KDC_ERR_SUMTYPE_NOSUPP); // TODO |
|
1117 |
} |
|
1118 |
||
1119 |
// Session key |
|
1120 |
EncryptionKey key = generateRandomKey(eType); |
|
1121 |
// Check time, TODO |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1122 |
KerberosTime from = body.from; |
1454 | 1123 |
KerberosTime till = body.till; |
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
1124 |
KerberosTime rtime = body.rtime; |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1125 |
if (from == null || from.isZero()) { |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1126 |
from = timeAfter(0); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1127 |
} |
1454 | 1128 |
if (till == null) { |
1129 |
throw new KrbException(Krb5.KDC_ERR_NEVER_VALID); // TODO |
|
1130 |
} else if (till.isZero()) { |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1131 |
till = timeAfter(DEFAULT_LIFETIME); |
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1132 |
} else if (till.greaterThan(timeAfter(24 * 3600)) |
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1133 |
&& System.getProperty("test.kdc.force.till") == null) { |
31817
1cd8bae1ef0c
8131051: KDC might issue a renewable ticket even if not requested
weijun
parents:
31801
diff
changeset
|
1134 |
// If till is more than 1 day later, make it renewable |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1135 |
till = timeAfter(DEFAULT_LIFETIME); |
31817
1cd8bae1ef0c
8131051: KDC might issue a renewable ticket even if not requested
weijun
parents:
31801
diff
changeset
|
1136 |
body.kdcOptions.set(KDCOptions.RENEWABLE, true); |
1cd8bae1ef0c
8131051: KDC might issue a renewable ticket even if not requested
weijun
parents:
31801
diff
changeset
|
1137 |
if (rtime == null) rtime = till; |
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
1138 |
} |
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
1139 |
if (rtime == null && body.kdcOptions.get(KDCOptions.RENEWABLE)) { |
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1140 |
rtime = timeAfter(DEFAULT_RENEWTIME); |
1454 | 1141 |
} |
1142 |
//body.from |
|
1143 |
boolean[] bFlags = new boolean[Krb5.TKT_OPTS_MAX+1]; |
|
1144 |
if (body.kdcOptions.get(KDCOptions.FORWARDABLE)) { |
|
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1145 |
List<String> sensitives = (List<String>) |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1146 |
options.get(Option.SENSITIVE_ACCOUNTS); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1147 |
if (sensitives != null |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1148 |
&& sensitives.contains(body.cname.toString())) { |
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1149 |
// Cannot make FORWARDABLE |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1150 |
} else { |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1151 |
bFlags[Krb5.TKT_OPTS_FORWARDABLE] = true; |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1152 |
} |
1454 | 1153 |
} |
1154 |
if (body.kdcOptions.get(KDCOptions.RENEWABLE)) { |
|
1155 |
bFlags[Krb5.TKT_OPTS_RENEWABLE] = true; |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1156 |
//renew = timeAfter(3600 * 24 * 7); |
1454 | 1157 |
} |
1158 |
if (body.kdcOptions.get(KDCOptions.PROXIABLE)) { |
|
1159 |
bFlags[Krb5.TKT_OPTS_PROXIABLE] = true; |
|
1160 |
} |
|
1161 |
if (body.kdcOptions.get(KDCOptions.POSTDATED)) { |
|
1162 |
bFlags[Krb5.TKT_OPTS_POSTDATED] = true; |
|
1163 |
} |
|
1164 |
if (body.kdcOptions.get(KDCOptions.ALLOW_POSTDATE)) { |
|
1165 |
bFlags[Krb5.TKT_OPTS_MAY_POSTDATE] = true; |
|
1166 |
} |
|
1167 |
bFlags[Krb5.TKT_OPTS_INITIAL] = true; |
|
1168 |
||
7183 | 1169 |
// Creating PA-DATA |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1170 |
DerValue[] pas2 = null, pas = null; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1171 |
if (options.containsKey(KDC.Option.DUP_ETYPE)) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1172 |
int n = (Integer)options.get(KDC.Option.DUP_ETYPE); |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1173 |
switch (n) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1174 |
case 1: // customer's case in 7067974 |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1175 |
pas2 = new DerValue[] { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1176 |
new DerValue(new ETypeInfo2(1, null, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1177 |
new DerValue(new ETypeInfo2(1, "", null).asn1Encode()), |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1178 |
new DerValue(new ETypeInfo2( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1179 |
1, realm, new byte[]{1}).asn1Encode()), |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1180 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1181 |
pas = new DerValue[] { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1182 |
new DerValue(new ETypeInfo(1, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1183 |
new DerValue(new ETypeInfo(1, "").asn1Encode()), |
16504
1e8ff2df7152
8009875: Provide a default udp_preference_limit for krb5.conf
weijun
parents:
15006
diff
changeset
|
1184 |
new DerValue(new ETypeInfo(1, realm).asn1Encode()), |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1185 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1186 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1187 |
case 2: // we still reject non-null s2kparams and prefer E2 over E |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1188 |
pas2 = new DerValue[] { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1189 |
new DerValue(new ETypeInfo2( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1190 |
1, realm, new byte[]{1}).asn1Encode()), |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1191 |
new DerValue(new ETypeInfo2(1, null, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1192 |
new DerValue(new ETypeInfo2(1, "", null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1193 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1194 |
pas = new DerValue[] { |
16504
1e8ff2df7152
8009875: Provide a default udp_preference_limit for krb5.conf
weijun
parents:
15006
diff
changeset
|
1195 |
new DerValue(new ETypeInfo(1, realm).asn1Encode()), |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1196 |
new DerValue(new ETypeInfo(1, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1197 |
new DerValue(new ETypeInfo(1, "").asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1198 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1199 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1200 |
case 3: // but only E is wrong |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1201 |
pas = new DerValue[] { |
16504
1e8ff2df7152
8009875: Provide a default udp_preference_limit for krb5.conf
weijun
parents:
15006
diff
changeset
|
1202 |
new DerValue(new ETypeInfo(1, realm).asn1Encode()), |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1203 |
new DerValue(new ETypeInfo(1, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1204 |
new DerValue(new ETypeInfo(1, "").asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1205 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1206 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1207 |
case 4: // we also ignore rc4-hmac |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1208 |
pas = new DerValue[] { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1209 |
new DerValue(new ETypeInfo(23, "ANYTHING").asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1210 |
new DerValue(new ETypeInfo(1, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1211 |
new DerValue(new ETypeInfo(1, "").asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1212 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1213 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1214 |
case 5: // "" should be wrong, but we accept it now |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1215 |
// See s.s.k.internal.PAData$SaltAndParams |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1216 |
pas = new DerValue[] { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1217 |
new DerValue(new ETypeInfo(1, "").asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1218 |
new DerValue(new ETypeInfo(1, null).asn1Encode()), |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1219 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1220 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1221 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1222 |
} else { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1223 |
int[] epas = eTypes; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1224 |
if (options.containsKey(KDC.Option.RC4_FIRST_PREAUTH)) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1225 |
for (int i=1; i<epas.length; i++) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1226 |
if (epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1227 |
epas[i] = epas[0]; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1228 |
epas[0] = EncryptedData.ETYPE_ARCFOUR_HMAC; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1229 |
break; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1230 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1231 |
}; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1232 |
} else if (options.containsKey(KDC.Option.ONLY_ONE_PREAUTH)) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1233 |
epas = new int[] { eTypes[0] }; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1234 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1235 |
pas2 = new DerValue[epas.length]; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1236 |
for (int i=0; i<epas.length; i++) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1237 |
pas2[i] = new DerValue(new ETypeInfo2( |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1238 |
epas[i], |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1239 |
epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC ? |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1240 |
null : getSalt(body.cname), |
47226
4f029f064481
8186831: Kerberos ignores PA-DATA with a non-null s2kparams
weijun
parents:
47216
diff
changeset
|
1241 |
getParams(body.cname, epas[i])).asn1Encode()); |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1242 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1243 |
boolean allOld = true; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1244 |
for (int i: eTypes) { |
48651
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
1245 |
if (i >= EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96 && |
67abfee27e69
8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5
weijun
parents:
47227
diff
changeset
|
1246 |
i != EncryptedData.ETYPE_ARCFOUR_HMAC) { |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1247 |
allOld = false; |
7183 | 1248 |
break; |
1249 |
} |
|
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1250 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1251 |
if (allOld) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1252 |
pas = new DerValue[epas.length]; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1253 |
for (int i=0; i<epas.length; i++) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1254 |
pas[i] = new DerValue(new ETypeInfo( |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1255 |
epas[i], |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1256 |
epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC ? |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1257 |
null : getSalt(body.cname) |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1258 |
).asn1Encode()); |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1259 |
} |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1260 |
} |
7183 | 1261 |
} |
1262 |
||
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1263 |
DerOutputStream eid; |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1264 |
if (pas2 != null) { |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1265 |
eid = new DerOutputStream(); |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1266 |
eid.putSequence(pas2); |
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1267 |
outPAs.add(new PAData(Krb5.PA_ETYPE_INFO2, eid.toByteArray())); |
7183 | 1268 |
} |
10432
ef33e56c55a9
7067974: multiple ETYPE-INFO-ENTRY with same etype and different salt
weijun
parents:
10141
diff
changeset
|
1269 |
if (pas != null) { |
7183 | 1270 |
eid = new DerOutputStream(); |
1271 |
eid.putSequence(pas); |
|
1272 |
outPAs.add(new PAData(Krb5.PA_ETYPE_INFO, eid.toByteArray())); |
|
1273 |
} |
|
1274 |
||
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
1275 |
PAData[] inPAs = KDCReqDotPAData(asReq); |
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1276 |
List<PAData> enc_outPAs = new ArrayList<>(); |
7183 | 1277 |
if (inPAs == null || inPAs.length == 0) { |
1454 | 1278 |
Object preauth = options.get(Option.PREAUTH_REQUIRED); |
1279 |
if (preauth == null || preauth.equals(Boolean.TRUE)) { |
|
1280 |
throw new KrbException(Krb5.KDC_ERR_PREAUTH_REQUIRED); |
|
1281 |
} |
|
1282 |
} else { |
|
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1283 |
EncryptionKey pakey = null; |
1454 | 1284 |
try { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1285 |
EncryptedData data = newEncryptedData( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1286 |
new DerValue(inPAs[0].getValue())); |
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1287 |
pakey = keyForUser(body.cname, data.getEType(), false); |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
5627
diff
changeset
|
1288 |
data.decrypt(pakey, KeyUsage.KU_PA_ENC_TS); |
1454 | 1289 |
} catch (Exception e) { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1290 |
KrbException ke = new KrbException(Krb5.KDC_ERR_PREAUTH_FAILED); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1291 |
ke.initCause(e); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1292 |
throw ke; |
1454 | 1293 |
} |
1294 |
bFlags[Krb5.TKT_OPTS_PRE_AUTHENT] = true; |
|
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1295 |
for (PAData pa : inPAs) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1296 |
if (pa.getType() == Krb5.PA_REQ_ENC_PA_REP) { |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1297 |
Checksum ckSum = new Checksum( |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1298 |
Checksum.CKSUMTYPE_HMAC_SHA1_96_AES128, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1299 |
asReqbytes, ckey, KeyUsage.KU_AS_REQ); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1300 |
enc_outPAs.add(new PAData(Krb5.PA_REQ_ENC_PA_REP, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1301 |
ckSum.asn1Encode())); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1302 |
bFlags[Krb5.TKT_OPTS_ENC_PA_REP] = true; |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1303 |
break; |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1304 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1305 |
} |
1454 | 1306 |
} |
1307 |
||
1308 |
TicketFlags tFlags = new TicketFlags(bFlags); |
|
1309 |
EncTicketPart enc = new EncTicketPart( |
|
1310 |
tFlags, |
|
1311 |
key, |
|
1312 |
body.cname, |
|
1313 |
new TransitedEncoding(1, new byte[0]), |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1314 |
timeAfter(0), |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1315 |
from, |
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
1316 |
till, rtime, |
1454 | 1317 |
body.addresses, |
1318 |
null); |
|
1319 |
Ticket t = new Ticket( |
|
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1320 |
service, |
1454 | 1321 |
new EncryptedData(skey, enc.asn1Encode(), KeyUsage.KU_TICKET) |
1322 |
); |
|
1323 |
EncASRepPart enc_part = new EncASRepPart( |
|
1324 |
key, |
|
1325 |
new LastReq(new LastReqEntry[]{ |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1326 |
new LastReqEntry(0, timeAfter(-10)) |
1454 | 1327 |
}), |
1328 |
body.getNonce(), // TODO: detect replay? |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1329 |
timeAfter(3600 * 24), |
1454 | 1330 |
// Next 5 and last MUST be same with ticket |
1331 |
tFlags, |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1332 |
timeAfter(0), |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1333 |
from, |
27946
9f99b93cbbb2
8044500: Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
weijun
parents:
24631
diff
changeset
|
1334 |
till, rtime, |
10141
664ba64d2472
7061379: [Kerberos] Cross-realm authentication fails, due to nameType problem
weijun
parents:
9499
diff
changeset
|
1335 |
service, |
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1336 |
body.addresses, |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1337 |
enc_outPAs.toArray(new PAData[enc_outPAs.size()]) |
1454 | 1338 |
); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1339 |
EncryptedData edata = new EncryptedData(ckey, enc_part.asn1Encode(), |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1340 |
KeyUsage.KU_ENC_AS_REP_PART); |
7183 | 1341 |
ASRep asRep = new ASRep( |
1342 |
outPAs.toArray(new PAData[outPAs.size()]), |
|
1454 | 1343 |
body.cname, |
1344 |
t, |
|
1345 |
edata); |
|
1346 |
||
1347 |
System.out.println(" Return " + asRep.cname |
|
28670
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1348 |
+ " ticket for " + asRep.ticket.sname + ", flags " |
bb9afe681988
8022582: Relax response flags checking in sun.security.krb5.KrbKdcRep.check.
weijun
parents:
27946
diff
changeset
|
1349 |
+ tFlags); |
1454 | 1350 |
|
1351 |
DerOutputStream out = new DerOutputStream(); |
|
1352 |
out.write(DerValue.createTag(DerValue.TAG_APPLICATION, |
|
1353 |
true, (byte)Krb5.KRB_AS_REP), asRep.asn1Encode()); |
|
1575
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1354 |
byte[] result = out.toByteArray(); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1355 |
|
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1356 |
// Added feature: |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1357 |
// Write the current issuing TGT into a ccache file specified |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1358 |
// by the system property below. |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1359 |
String ccache = System.getProperty("test.kdc.save.ccache"); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1360 |
if (ccache != null) { |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1361 |
asRep.encKDCRepPart = enc_part; |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1362 |
sun.security.krb5.internal.ccache.Credentials credentials = |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1363 |
new sun.security.krb5.internal.ccache.Credentials(asRep); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1364 |
CredentialsCache cache = |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1365 |
CredentialsCache.create(asReq.reqBody.cname, ccache); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1366 |
if (cache == null) { |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1367 |
throw new IOException("Unable to create the cache file " + |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1368 |
ccache); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1369 |
} |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1370 |
cache.update(credentials); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1371 |
cache.save(); |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1372 |
} |
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1373 |
|
e0f1979051b5
6765491: Krb5LoginModule a little too restrictive, and the doc is not clear.
weijun
parents:
1456
diff
changeset
|
1374 |
return result; |
1454 | 1375 |
} catch (KrbException ke) { |
1376 |
ke.printStackTrace(System.out); |
|
1377 |
KRBError kerr = ke.getError(); |
|
1378 |
KDCReqBody body = asReq.reqBody; |
|
1379 |
System.out.println(" Error " + ke.returnCode() |
|
1380 |
+ " " +ke.returnCodeMessage()); |
|
1381 |
byte[] eData = null; |
|
1382 |
if (kerr == null) { |
|
1383 |
if (ke.returnCode() == Krb5.KDC_ERR_PREAUTH_REQUIRED || |
|
1384 |
ke.returnCode() == Krb5.KDC_ERR_PREAUTH_FAILED) { |
|
55258
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1385 |
outPAs.add(new PAData(Krb5.PA_ENC_TIMESTAMP, new byte[0])); |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1386 |
} |
d65d3c37232c
8215032: Support Kerberos cross-realm referrals (RFC 6806)
mbalao
parents:
53273
diff
changeset
|
1387 |
if (outPAs.size() > 0) { |
1454 | 1388 |
DerOutputStream bytes = new DerOutputStream(); |
7183 | 1389 |
for (PAData p: outPAs) { |
1390 |
bytes.write(p.asn1Encode()); |
|
1454 | 1391 |
} |
1392 |
DerOutputStream temp = new DerOutputStream(); |
|
1393 |
temp.write(DerValue.tag_Sequence, bytes); |
|
1394 |
eData = temp.toByteArray(); |
|
1395 |
} |
|
1396 |
kerr = new KRBError(null, null, null, |
|
50750
45511dcfed3f
8187218: GSSCredential.getRemainingLifetime() returns negative value for TTL > 24 days.
pkoppula
parents:
48668
diff
changeset
|
1397 |
timeAfter(0), |
1454 | 1398 |
0, |
1399 |
ke.returnCode(), |
|
13247 | 1400 |
body.cname, |
1401 |
service, |
|
1454 | 1402 |
KrbException.errorMessage(ke.returnCode()), |
1403 |
eData); |
|
1404 |
} |
|
1405 |
return kerr.asn1Encode(); |
|
1406 |
} |
|
1407 |
} |
|
1408 |
||
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1409 |
private int[] filterSupported(int[] input) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1410 |
int count = 0; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1411 |
for (int i = 0; i < input.length; i++) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1412 |
if (!EType.isSupported(input[i])) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1413 |
continue; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1414 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1415 |
if (SUPPORTED_ETYPES != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1416 |
boolean supported = false; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1417 |
for (String se : SUPPORTED_ETYPES.split(",")) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1418 |
if (Config.getType(se) == input[i]) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1419 |
supported = true; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1420 |
break; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1421 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1422 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1423 |
if (!supported) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1424 |
continue; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1425 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1426 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1427 |
if (count != i) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1428 |
input[count] = input[i]; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1429 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1430 |
count++; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1431 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1432 |
if (count != input.length) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1433 |
input = Arrays.copyOf(input, count); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1434 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1435 |
return input; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1436 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1437 |
|
1454 | 1438 |
/** |
1439 |
* Generates a line for a KDC to put inside [realms] of krb5.conf |
|
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1440 |
* @return REALM.NAME = { kdc = host:port etc } |
1454 | 1441 |
*/ |
24631
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1442 |
private String realmLine() { |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1443 |
StringBuilder sb = new StringBuilder(); |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1444 |
sb.append(realm).append(" = {\n kdc = ") |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1445 |
.append(kdc).append(':').append(port).append('\n'); |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1446 |
for (String s: conf) { |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1447 |
sb.append(" ").append(s).append('\n'); |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1448 |
} |
dafd257bc7f3
8036779: sun.security.krb5.KdcComm interprets kdc_timeout as msec instead of sec
weijun
parents:
23010
diff
changeset
|
1449 |
return sb.append("}\n").toString(); |
1454 | 1450 |
} |
1451 |
||
1452 |
/** |
|
1453 |
* Start the KDC service. This server listens on both UDP and TCP using |
|
1454 |
* the same port number. It uses three threads to deal with requests. |
|
1455 |
* They can be set to daemon threads if requested. |
|
1456 |
* @param port the port number to listen to. If zero, a random available |
|
1457 |
* port no less than 8000 will be chosen and used. |
|
1458 |
* @param asDaemon true if the KDC threads should be daemons |
|
1459 |
* @throws java.io.IOException for any communication error |
|
1460 |
*/ |
|
1461 |
protected void startServer(int port, boolean asDaemon) throws IOException { |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1462 |
if (nativeKdc != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1463 |
startNativeServer(port, asDaemon); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1464 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1465 |
startJavaServer(port, asDaemon); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1466 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1467 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1468 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1469 |
private void startNativeServer(int port, boolean asDaemon) throws IOException { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1470 |
nativeKdc.prepare(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1471 |
nativeKdc.init(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1472 |
kdcProc = nativeKdc.kdc(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1473 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1474 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1475 |
private void startJavaServer(int port, boolean asDaemon) throws IOException { |
1454 | 1476 |
if (port > 0) { |
1477 |
u1 = new DatagramSocket(port, InetAddress.getByName("127.0.0.1")); |
|
1478 |
t1 = new ServerSocket(port); |
|
1479 |
} else { |
|
1480 |
while (true) { |
|
1481 |
// Try to find a port number that's both TCP and UDP free |
|
1482 |
try { |
|
1483 |
port = 8000 + new java.util.Random().nextInt(10000); |
|
1484 |
u1 = null; |
|
1485 |
u1 = new DatagramSocket(port, InetAddress.getByName("127.0.0.1")); |
|
1486 |
t1 = new ServerSocket(port); |
|
1487 |
break; |
|
1488 |
} catch (Exception e) { |
|
1489 |
if (u1 != null) u1.close(); |
|
1490 |
} |
|
1491 |
} |
|
1492 |
} |
|
1493 |
final DatagramSocket udp = u1; |
|
1494 |
final ServerSocket tcp = t1; |
|
1495 |
System.out.println("Start KDC on " + port); |
|
1496 |
||
1497 |
this.port = port; |
|
1498 |
||
1499 |
// The UDP consumer |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1500 |
thread1 = new Thread() { |
1454 | 1501 |
public void run() { |
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1502 |
udpConsumerReady = true; |
1454 | 1503 |
while (true) { |
1504 |
try { |
|
1505 |
byte[] inbuf = new byte[8192]; |
|
1506 |
DatagramPacket p = new DatagramPacket(inbuf, inbuf.length); |
|
1507 |
udp.receive(p); |
|
1508 |
System.out.println("-----------------------------------------------"); |
|
1509 |
System.out.println(">>>>> UDP packet received"); |
|
1510 |
q.put(new Job(processMessage(Arrays.copyOf(inbuf, p.getLength())), udp, p)); |
|
1511 |
} catch (Exception e) { |
|
1512 |
e.printStackTrace(); |
|
1513 |
} |
|
1514 |
} |
|
1515 |
} |
|
1516 |
}; |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1517 |
thread1.setDaemon(asDaemon); |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1518 |
thread1.start(); |
1454 | 1519 |
|
1520 |
// The TCP consumer |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1521 |
thread2 = new Thread() { |
1454 | 1522 |
public void run() { |
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1523 |
tcpConsumerReady = true; |
1454 | 1524 |
while (true) { |
1525 |
try { |
|
1526 |
Socket socket = tcp.accept(); |
|
1527 |
System.out.println("-----------------------------------------------"); |
|
1528 |
System.out.println(">>>>> TCP connection established"); |
|
1529 |
DataInputStream in = new DataInputStream(socket.getInputStream()); |
|
1530 |
DataOutputStream out = new DataOutputStream(socket.getOutputStream()); |
|
34438
9ecd0f296185
8138638: Security tests using jdk/test/sun/security/krb5/auto/KDC.java fail intermittently with OutOfMemoryError
weijun
parents:
33282
diff
changeset
|
1531 |
int len = in.readInt(); |
9ecd0f296185
8138638: Security tests using jdk/test/sun/security/krb5/auto/KDC.java fail intermittently with OutOfMemoryError
weijun
parents:
33282
diff
changeset
|
1532 |
if (len > 65535) { |
9ecd0f296185
8138638: Security tests using jdk/test/sun/security/krb5/auto/KDC.java fail intermittently with OutOfMemoryError
weijun
parents:
33282
diff
changeset
|
1533 |
throw new Exception("Huge request not supported"); |
9ecd0f296185
8138638: Security tests using jdk/test/sun/security/krb5/auto/KDC.java fail intermittently with OutOfMemoryError
weijun
parents:
33282
diff
changeset
|
1534 |
} |
9ecd0f296185
8138638: Security tests using jdk/test/sun/security/krb5/auto/KDC.java fail intermittently with OutOfMemoryError
weijun
parents:
33282
diff
changeset
|
1535 |
byte[] token = new byte[len]; |
1454 | 1536 |
in.readFully(token); |
1537 |
q.put(new Job(processMessage(token), socket, out)); |
|
1538 |
} catch (Exception e) { |
|
1539 |
e.printStackTrace(); |
|
1540 |
} |
|
1541 |
} |
|
1542 |
} |
|
1543 |
}; |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1544 |
thread2.setDaemon(asDaemon); |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1545 |
thread2.start(); |
1454 | 1546 |
|
1547 |
// The dispatcher |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1548 |
thread3 = new Thread() { |
1454 | 1549 |
public void run() { |
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1550 |
dispatcherReady = true; |
1454 | 1551 |
while (true) { |
1552 |
try { |
|
1553 |
q.take().send(); |
|
1554 |
} catch (Exception e) { |
|
1555 |
} |
|
1556 |
} |
|
1557 |
} |
|
1558 |
}; |
|
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1559 |
thread3.setDaemon(true); |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1560 |
thread3.start(); |
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1561 |
|
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1562 |
// wait for the KDC is ready |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1563 |
try { |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1564 |
while (!isReady()) { |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1565 |
Thread.sleep(100); |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1566 |
} |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1567 |
} catch(InterruptedException e) { |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1568 |
throw new IOException(e); |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1569 |
} |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1570 |
} |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1571 |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1572 |
public void kinit(String user, String ccache) throws Exception { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1573 |
if (user.indexOf('@') < 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1574 |
user = user + "@" + realm; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1575 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1576 |
if (nativeKdc != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1577 |
nativeKdc.kinit(user, ccache); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1578 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1579 |
Context.fromUserPass(user, passwords.get(user), false) |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1580 |
.ccache(ccache); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1581 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1582 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1583 |
|
30038
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1584 |
boolean isReady() { |
632939157af2
8075007: Additional tests for krb5-related cipher suites with unbound server
asmotrak
parents:
28670
diff
changeset
|
1585 |
return udpConsumerReady && tcpConsumerReady && dispatcherReady; |
1454 | 1586 |
} |
1587 |
||
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1588 |
public void terminate() { |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1589 |
if (nativeKdc != null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1590 |
System.out.println("Killing kdc..."); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1591 |
kdcProc.destroyForcibly(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1592 |
System.out.println("Done"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1593 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1594 |
try { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1595 |
thread1.stop(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1596 |
thread2.stop(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1597 |
thread3.stop(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1598 |
u1.close(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1599 |
t1.close(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1600 |
} catch (Exception e) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1601 |
// OK |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1602 |
} |
4531
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1603 |
} |
3a9206343ab2
6843127: krb5 should not try to access unavailable kdc too often
weijun
parents:
4336
diff
changeset
|
1604 |
} |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1605 |
|
31801 | 1606 |
public static KDC startKDC(final String host, final String krbConfFileName, |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1607 |
final String realm, final Map<String, String> principals, |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1608 |
final String ktab, final KtabMode mode) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1609 |
|
31801 | 1610 |
KDC kdc; |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1611 |
try { |
31801 | 1612 |
kdc = KDC.create(realm, host, 0, true); |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1613 |
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, Boolean.FALSE); |
31801 | 1614 |
if (krbConfFileName != null) { |
1615 |
KDC.saveConfig(krbConfFileName, kdc); |
|
1616 |
} |
|
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1617 |
|
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1618 |
// Add principals |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1619 |
if (principals != null) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1620 |
principals.forEach((name, password) -> { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1621 |
if (password == null || password.isEmpty()) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1622 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1623 |
"KDC:add a principal '%s' with a random " + |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1624 |
"password", name)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1625 |
kdc.addPrincipalRandKey(name); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1626 |
} else { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1627 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1628 |
"KDC:add a principal '%s' with '%s' password", |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1629 |
name, password)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1630 |
kdc.addPrincipal(name, password.toCharArray()); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1631 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1632 |
}); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1633 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1634 |
|
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1635 |
// Create or append keys to existing keytab file |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1636 |
if (ktab != null) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1637 |
File ktabFile = new File(ktab); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1638 |
switch(mode) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1639 |
case APPEND: |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1640 |
if (ktabFile.exists()) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1641 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1642 |
"KDC:append keys to an exising keytab " |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1643 |
+ "file %s", ktab)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1644 |
kdc.appendKtab(ktab); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1645 |
} else { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1646 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1647 |
"KDC:create a new keytab file %s", ktab)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1648 |
kdc.writeKtab(ktab); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1649 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1650 |
break; |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1651 |
case EXISTING: |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1652 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1653 |
"KDC:use an existing keytab file %s", ktab)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1654 |
break; |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1655 |
default: |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1656 |
throw new RuntimeException(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1657 |
"KDC:unsupported keytab mode: %s", mode)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1658 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1659 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1660 |
|
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1661 |
System.out.println(String.format( |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1662 |
"KDC: started on %s:%s with '%s' realm", |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1663 |
host, kdc.getPort(), realm)); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1664 |
} catch (Exception e) { |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1665 |
throw new RuntimeException("KDC: unexpected exception", e); |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1666 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1667 |
|
31801 | 1668 |
return kdc; |
31429
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1669 |
} |
ce4193650b40
8075301: Tests for sun.security.krb5.principal system property
weijun
parents:
30959
diff
changeset
|
1670 |
|
1454 | 1671 |
/** |
1672 |
* Helper class to encapsulate a job in a KDC. |
|
1673 |
*/ |
|
1674 |
private static class Job { |
|
1675 |
byte[] token; // The received request at creation time and |
|
1676 |
// the response at send time |
|
1677 |
Socket s; // The TCP socket from where the request comes |
|
1678 |
DataOutputStream out; // The OutputStream of the TCP socket |
|
1679 |
DatagramSocket s2; // The UDP socket from where the request comes |
|
1680 |
DatagramPacket dp; // The incoming UDP datagram packet |
|
1681 |
boolean useTCP; // Whether TCP or UDP is used |
|
1682 |
||
1683 |
// Creates a job object for TCP |
|
1684 |
Job(byte[] token, Socket s, DataOutputStream out) { |
|
1685 |
useTCP = true; |
|
1686 |
this.token = token; |
|
1687 |
this.s = s; |
|
1688 |
this.out = out; |
|
1689 |
} |
|
1690 |
||
1691 |
// Creates a job object for UDP |
|
1692 |
Job(byte[] token, DatagramSocket s2, DatagramPacket dp) { |
|
1693 |
useTCP = false; |
|
1694 |
this.token = token; |
|
1695 |
this.s2 = s2; |
|
1696 |
this.dp = dp; |
|
1697 |
} |
|
1698 |
||
1699 |
// Sends the output back to the client |
|
1700 |
void send() { |
|
1701 |
try { |
|
1702 |
if (useTCP) { |
|
1703 |
System.out.println(">>>>> TCP request honored"); |
|
1704 |
out.writeInt(token.length); |
|
1705 |
out.write(token); |
|
1706 |
s.close(); |
|
1707 |
} else { |
|
1708 |
System.out.println(">>>>> UDP request honored"); |
|
1709 |
s2.send(new DatagramPacket(token, token.length, dp.getAddress(), dp.getPort())); |
|
1710 |
} |
|
1711 |
} catch (Exception e) { |
|
1712 |
e.printStackTrace(); |
|
1713 |
} |
|
1714 |
} |
|
1715 |
} |
|
3046 | 1716 |
|
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1717 |
/** |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1718 |
* A native KDC using the binaries in nativePath. Attention: |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1719 |
* this is using binaries, not an existing KDC instance. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1720 |
* An implementation of this takes care of configuration, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1721 |
* principal db managing and KDC startup. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1722 |
*/ |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1723 |
static abstract class NativeKdc { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1724 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1725 |
protected Map<String,String> env; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1726 |
protected String nativePath; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1727 |
protected String base; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1728 |
protected String realm; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1729 |
protected int port; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1730 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1731 |
NativeKdc(String nativePath, KDC kdc) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1732 |
if (kdc.port == 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1733 |
kdc.port = 8000 + new java.util.Random().nextInt(10000); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1734 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1735 |
this.nativePath = nativePath; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1736 |
this.realm = kdc.realm; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1737 |
this.port = kdc.port; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1738 |
this.base = Paths.get("" + port).toAbsolutePath().toString(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1739 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1740 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1741 |
// Add a new principal |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1742 |
abstract void addPrincipal(String user, String pass); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1743 |
// Add a keytab entry |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1744 |
abstract void ktadd(String user, String ktab); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1745 |
// Initialize KDC |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1746 |
abstract void init(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1747 |
// Start kdc |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1748 |
abstract Process kdc(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1749 |
// Configuration |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1750 |
abstract void prepare(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1751 |
// Fill ccache |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1752 |
abstract void kinit(String user, String ccache); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1753 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1754 |
static NativeKdc get(KDC kdc) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1755 |
String prop = System.getProperty("native.kdc.path"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1756 |
if (prop == null) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1757 |
return null; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1758 |
} else if (Files.exists(Paths.get(prop, "sbin/krb5kdc"))) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1759 |
return new MIT(true, prop, kdc); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1760 |
} else if (Files.exists(Paths.get(prop, "kdc/krb5kdc"))) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1761 |
return new MIT(false, prop, kdc); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1762 |
} else if (Files.exists(Paths.get(prop, "libexec/kdc"))) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1763 |
return new Heimdal(prop, kdc); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1764 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1765 |
throw new IllegalArgumentException("Strange " + prop); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1766 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1767 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1768 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1769 |
Process run(boolean wait, String... cmd) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1770 |
try { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1771 |
System.out.println("Running " + cmd2str(env, cmd)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1772 |
ProcessBuilder pb = new ProcessBuilder(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1773 |
pb.inheritIO(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1774 |
pb.environment().putAll(env); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1775 |
Process p = pb.command(cmd).start(); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1776 |
if (wait) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1777 |
if (p.waitFor() < 0) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1778 |
throw new RuntimeException("exit code is not null"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1779 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1780 |
return null; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1781 |
} else { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1782 |
return p; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1783 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1784 |
} catch (Exception e) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1785 |
throw new RuntimeException(e); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1786 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1787 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1788 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1789 |
private String cmd2str(Map<String,String> env, String... cmd) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1790 |
return env.entrySet().stream().map(e -> e.getKey()+"="+e.getValue()) |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1791 |
.collect(Collectors.joining(" ")) + " " + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1792 |
Stream.of(cmd).collect(Collectors.joining(" ")); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1793 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1794 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1795 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1796 |
// Heimdal KDC. Build your own and run "make install" to nativePath. |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1797 |
static class Heimdal extends NativeKdc { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1798 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1799 |
Heimdal(String nativePath, KDC kdc) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1800 |
super(nativePath, kdc); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1801 |
this.env = Map.of( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1802 |
"KRB5_CONFIG", base + "/krb5.conf", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1803 |
"KRB5_TRACE", "/dev/stderr", |
53273
bbc79e0ec9ee
8216265: [testbug] Introduce Platform.sharedLibraryPathVariableName() and adapt all tests.
goetz
parents:
50750
diff
changeset
|
1804 |
Platform.sharedLibraryPathVariableName(), nativePath + "/lib"); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1805 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1806 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1807 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1808 |
public void addPrincipal(String user, String pass) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1809 |
run(true, nativePath + "/bin/kadmin", "-l", "-r", realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1810 |
"add", "-p", pass, "--use-defaults", user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1811 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1812 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1813 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1814 |
public void ktadd(String user, String ktab) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1815 |
run(true, nativePath + "/bin/kadmin", "-l", "-r", realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1816 |
"ext_keytab", "-k", ktab, user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1817 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1818 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1819 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1820 |
public void init() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1821 |
run(true, nativePath + "/bin/kadmin", "-l", "-r", realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1822 |
"init", "--realm-max-ticket-life=1day", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1823 |
"--realm-max-renewable-life=1month", realm); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1824 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1825 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1826 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1827 |
public Process kdc() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1828 |
return run(false, nativePath + "/libexec/kdc", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1829 |
"--addresses=127.0.0.1", "-P", "" + port); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1830 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1831 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1832 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1833 |
public void prepare() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1834 |
try { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1835 |
Files.createDirectory(Paths.get(base)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1836 |
Files.write(Paths.get(base + "/krb5.conf"), Arrays.asList( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1837 |
"[libdefaults]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1838 |
"default_realm = " + realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1839 |
"default_keytab_name = FILE:" + base + "/krb5.keytab", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1840 |
"forwardable = true", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1841 |
"dns_lookup_kdc = no", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1842 |
"dns_lookup_realm = no", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1843 |
"dns_canonicalize_hostname = false", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1844 |
"\n[realms]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1845 |
realm + " = {", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1846 |
" kdc = localhost:" + port, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1847 |
"}", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1848 |
"\n[kdc]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1849 |
"db-dir = " + base, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1850 |
"database = {", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1851 |
" label = {", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1852 |
" dbname = " + base + "/current-db", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1853 |
" realm = " + realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1854 |
" mkey_file = " + base + "/mkey.file", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1855 |
" acl_file = " + base + "/heimdal.acl", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1856 |
" log_file = " + base + "/current.log", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1857 |
" }", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1858 |
"}", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1859 |
SUPPORTED_ETYPES == null ? "" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1860 |
: ("\n[kadmin]\ndefault_keys = " |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1861 |
+ (SUPPORTED_ETYPES + ",") |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1862 |
.replaceAll(",", ":pw-salt ")), |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1863 |
"\n[logging]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1864 |
"kdc = 0-/FILE:" + base + "/messages.log", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1865 |
"krb5 = 0-/FILE:" + base + "/messages.log", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1866 |
"default = 0-/FILE:" + base + "/messages.log" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1867 |
)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1868 |
} catch (IOException e) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1869 |
throw new UncheckedIOException(e); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1870 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1871 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1872 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1873 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1874 |
void kinit(String user, String ccache) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1875 |
String tmpName = base + "/" + user + "." + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1876 |
System.identityHashCode(this) + ".keytab"; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1877 |
ktadd(user, tmpName); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1878 |
run(true, nativePath + "/bin/kinit", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1879 |
"-f", "-t", tmpName, "-c", ccache, user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1880 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1881 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1882 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1883 |
// MIT krb5 KDC. Make your own exploded (install == false), or |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1884 |
// "make install" into nativePath (install == true). |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1885 |
static class MIT extends NativeKdc { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1886 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1887 |
private boolean install; // "make install" or "make" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1888 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1889 |
MIT(boolean install, String nativePath, KDC kdc) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1890 |
super(nativePath, kdc); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1891 |
this.install = install; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1892 |
this.env = Map.of( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1893 |
"KRB5_KDC_PROFILE", base + "/kdc.conf", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1894 |
"KRB5_CONFIG", base + "/krb5.conf", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1895 |
"KRB5_TRACE", "/dev/stderr", |
53273
bbc79e0ec9ee
8216265: [testbug] Introduce Platform.sharedLibraryPathVariableName() and adapt all tests.
goetz
parents:
50750
diff
changeset
|
1896 |
Platform.sharedLibraryPathVariableName(), nativePath + "/lib"); |
47227
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1897 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1898 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1899 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1900 |
public void addPrincipal(String user, String pass) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1901 |
run(true, nativePath + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1902 |
(install ? "/sbin/" : "/kadmin/cli/") + "kadmin.local", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1903 |
"-q", "addprinc -pw " + pass + " " + user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1904 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1905 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1906 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1907 |
public void ktadd(String user, String ktab) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1908 |
run(true, nativePath + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1909 |
(install ? "/sbin/" : "/kadmin/cli/") + "kadmin.local", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1910 |
"-q", "ktadd -k " + ktab + " -norandkey " + user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1911 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1912 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1913 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1914 |
public void init() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1915 |
run(true, nativePath + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1916 |
(install ? "/sbin/" : "/kadmin/dbutil/") + "kdb5_util", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1917 |
"create", "-s", "-W", "-P", "olala"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1918 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1919 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1920 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1921 |
public Process kdc() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1922 |
return run(false, nativePath + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1923 |
(install ? "/sbin/" : "/kdc/") + "krb5kdc", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1924 |
"-n"); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1925 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1926 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1927 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1928 |
public void prepare() { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1929 |
try { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1930 |
Files.createDirectory(Paths.get(base)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1931 |
Files.write(Paths.get(base + "/kdc.conf"), Arrays.asList( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1932 |
"[kdcdefaults]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1933 |
"\n[realms]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1934 |
realm + "= {", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1935 |
" kdc_listen = " + this.port, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1936 |
" kdc_tcp_listen = " + this.port, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1937 |
" database_name = " + base + "/principal", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1938 |
" key_stash_file = " + base + "/.k5.ATHENA.MIT.EDU", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1939 |
SUPPORTED_ETYPES == null ? "" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1940 |
: (" supported_enctypes = " |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1941 |
+ (SUPPORTED_ETYPES + ",") |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1942 |
.replaceAll(",", ":normal ")), |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1943 |
"}" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1944 |
)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1945 |
Files.write(Paths.get(base + "/krb5.conf"), Arrays.asList( |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1946 |
"[libdefaults]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1947 |
"default_realm = " + realm, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1948 |
"default_keytab_name = FILE:" + base + "/krb5.keytab", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1949 |
"forwardable = true", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1950 |
"dns_lookup_kdc = no", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1951 |
"dns_lookup_realm = no", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1952 |
"dns_canonicalize_hostname = false", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1953 |
"\n[realms]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1954 |
realm + " = {", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1955 |
" kdc = localhost:" + port, |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1956 |
"}", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1957 |
"\n[logging]", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1958 |
"kdc = FILE:" + base + "/krb5kdc.log" |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1959 |
)); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1960 |
} catch (IOException e) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1961 |
throw new UncheckedIOException(e); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1962 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1963 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1964 |
|
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1965 |
@Override |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1966 |
void kinit(String user, String ccache) { |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1967 |
String tmpName = base + "/" + user + "." + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1968 |
System.identityHashCode(this) + ".keytab"; |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1969 |
ktadd(user, tmpName); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1970 |
run(true, nativePath + |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1971 |
(install ? "/bin/" : "/clients/kinit/") + "kinit", |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1972 |
"-f", "-t", tmpName, "-c", ccache, user); |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1973 |
} |
8052fa06e1b7
8186884: Test native KDC, Java krb5 lib, and native krb5 lib in one test
weijun
parents:
47226
diff
changeset
|
1974 |
} |
7183 | 1975 |
|
1976 |
// Calling private methods thru reflections |
|
1977 |
private static final Field getPADataField; |
|
1978 |
private static final Field getEType; |
|
1979 |
private static final Constructor<EncryptedData> ctorEncryptedData; |
|
1980 |
private static final Method stringToKey; |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
1981 |
private static final Field getAddlTkt; |
7183 | 1982 |
|
1983 |
static { |
|
1984 |
try { |
|
1985 |
ctorEncryptedData = EncryptedData.class.getDeclaredConstructor(DerValue.class); |
|
1986 |
ctorEncryptedData.setAccessible(true); |
|
1987 |
getPADataField = KDCReq.class.getDeclaredField("pAData"); |
|
1988 |
getPADataField.setAccessible(true); |
|
1989 |
getEType = KDCReqBody.class.getDeclaredField("eType"); |
|
1990 |
getEType.setAccessible(true); |
|
1991 |
stringToKey = EncryptionKey.class.getDeclaredMethod( |
|
1992 |
"stringToKey", |
|
1993 |
char[].class, String.class, byte[].class, Integer.TYPE); |
|
1994 |
stringToKey.setAccessible(true); |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
1995 |
getAddlTkt = KDCReqBody.class.getDeclaredField("additionalTickets"); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
1996 |
getAddlTkt.setAccessible(true); |
7183 | 1997 |
} catch (NoSuchFieldException nsfe) { |
1998 |
throw new AssertionError(nsfe); |
|
1999 |
} catch (NoSuchMethodException nsme) { |
|
2000 |
throw new AssertionError(nsme); |
|
2001 |
} |
|
2002 |
} |
|
2003 |
private EncryptedData newEncryptedData(DerValue der) { |
|
2004 |
try { |
|
2005 |
return ctorEncryptedData.newInstance(der); |
|
2006 |
} catch (Exception e) { |
|
2007 |
throw new AssertionError(e); |
|
2008 |
} |
|
2009 |
} |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2010 |
private static PAData[] KDCReqDotPAData(KDCReq req) { |
7183 | 2011 |
try { |
2012 |
return (PAData[])getPADataField.get(req); |
|
2013 |
} catch (Exception e) { |
|
2014 |
throw new AssertionError(e); |
|
2015 |
} |
|
2016 |
} |
|
2017 |
private static int[] KDCReqBodyDotEType(KDCReqBody body) { |
|
2018 |
try { |
|
2019 |
return (int[]) getEType.get(body); |
|
2020 |
} catch (Exception e) { |
|
2021 |
throw new AssertionError(e); |
|
2022 |
} |
|
2023 |
} |
|
2024 |
private static byte[] EncryptionKeyDotStringToKey(char[] password, String salt, |
|
2025 |
byte[] s2kparams, int keyType) throws KrbCryptoException { |
|
2026 |
try { |
|
2027 |
return (byte[])stringToKey.invoke( |
|
2028 |
null, password, salt, s2kparams, keyType); |
|
2029 |
} catch (InvocationTargetException ex) { |
|
2030 |
throw (KrbCryptoException)ex.getCause(); |
|
2031 |
} catch (Exception e) { |
|
2032 |
throw new AssertionError(e); |
|
2033 |
} |
|
2034 |
} |
|
14413
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2035 |
private static Ticket KDCReqBodyDotFirstAdditionalTicket(KDCReqBody body) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2036 |
try { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2037 |
return ((Ticket[])getAddlTkt.get(body))[0]; |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2038 |
} catch (Exception e) { |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2039 |
throw new AssertionError(e); |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2040 |
} |
e954df027393
6355584: Introduce constrained Kerberos delegation
weijun
parents:
13247
diff
changeset
|
2041 |
} |
1454 | 2042 |
} |