1 /*

     2  * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 /*

    27  *

    28  *  (C) Copyright IBM Corp. 1999 All Rights Reserved.

    29  *  Copyright 1997 The Open Group Research Institute.  All rights reserved.

    30  */

    31 

    32 package sun.security.krb5;

    33 

    34 import java.security.AccessController;

    35 import java.security.PrivilegedAction;

    36 import java.security.Security;

    37 import java.util.Locale;

    38 import sun.security.krb5.internal.Krb5;

    39 import sun.security.krb5.internal.UDPClient;

    40 import sun.security.krb5.internal.TCPClient;

    41 import java.io.IOException;

    42 import java.net.SocketTimeoutException;

    43 import java.util.StringTokenizer;

    44 import java.security.AccessController;

    45 import java.security.PrivilegedExceptionAction;

    46 import java.security.PrivilegedActionException;

    47 import java.util.ArrayList;

    48 import java.util.List;

    49 import java.util.Set;

    50 import java.util.HashSet;

    51 

    52 public abstract class KrbKdcReq {

    53 

    54     // The following settings can be configured in [libdefaults]

    55     // section of krb5.conf, which are global for all realms. Each of

    56     // them can also be defined in a realm, which overrides value here.

    57 

    58     /**

    59      * max retry time for a single KDC, default Krb5.KDC_RETRY_LIMIT (3)

    60      */

    61     private static int defaultKdcRetryLimit;

    62     /**

    63      * timeout requesting a ticket from KDC, in millisec, default 30 sec

    64      */

    65     private static int defaultKdcTimeout;

    66     /**

    67      * max UDP packet size, default unlimited (-1)

    68      */

    69     private static int defaultUdpPrefLimit;

    70 

    71     private static final boolean DEBUG = Krb5.DEBUG;

    72 

    73     private static final String BAD_POLICY_KEY = "krb5.kdc.bad.policy";

    74 

    75     /**

    76      * What to do when a KDC is unavailable, specified in the

    77      * java.security file with key krb5.kdc.bad.policy.

    78      * Possible values can be TRY_LAST or TRY_LESS. Reloaded when refreshed.

    79      */

    80     private enum BpType {

    81         NONE, TRY_LAST, TRY_LESS

    82     }

    83     private static int tryLessMaxRetries = 1;

    84     private static int tryLessTimeout = 5000;

    85 

    86     private static BpType badPolicy;

    87 

    88     static {

    89         initStatic();

    90     }

    91 

    92     /**

    93      * Read global settings

    94      */

    95     public static void initStatic() {

    96         String value = AccessController.doPrivileged(

    97         new PrivilegedAction<String>() {

    98             public String run() {

    99                 return Security.getProperty(BAD_POLICY_KEY);

   100             }

   101         });

   102         if (value != null) {

   103             value = value.toLowerCase(Locale.ENGLISH);

   104             String[] ss = value.split(":");

   105             if ("tryless".equals(ss[0])) {

   106                 if (ss.length > 1) {

   107                     String[] params = ss[1].split(",");

   108                     try {

   109                         int tmp0 = Integer.parseInt(params[0]);

   110                         if (params.length > 1) {

   111                             tryLessTimeout = Integer.parseInt(params[1]);

   112                         }

   113                         // Assign here in case of exception at params[1]

   114                         tryLessMaxRetries = tmp0;

   115                     } catch (NumberFormatException nfe) {

   116                         // Ignored. Please note that tryLess is recognized and

   117                         // used, parameters using default values

   118                         if (DEBUG) {

   119                             System.out.println("Invalid " + BAD_POLICY_KEY +

   120                                     " parameter for tryLess: " +

   121                                     value + ", use default");

   122                         }

   123                     }

   124                 }

   125                 badPolicy = BpType.TRY_LESS;

   126             } else if ("trylast".equals(ss[0])) {

   127                 badPolicy = BpType.TRY_LAST;

   128             } else {

   129                 badPolicy = BpType.NONE;

   130             }

   131         } else {

   132             badPolicy = BpType.NONE;

   133         }

   134 

   135 

   136         int timeout = -1;

   137         int max_retries = -1;

   138         int udf_pref_limit = -1;

   139 

   140         try {

   141             Config cfg = Config.getInstance();

   142             String temp = cfg.getDefault("kdc_timeout", "libdefaults");

   143             timeout = parsePositiveIntString(temp);

   144             temp = cfg.getDefault("max_retries", "libdefaults");

   145             max_retries = parsePositiveIntString(temp);

   146             temp = cfg.getDefault("udp_preference_limit", "libdefaults");

   147             udf_pref_limit = parsePositiveIntString(temp);

   148         } catch (Exception exc) {

   149            // ignore any exceptions; use default values

   150            if (DEBUG) {

   151                 System.out.println ("Exception in getting KDC communication " +

   152                                     "settings, using default value " +

   153                                     exc.getMessage());

   154            }

   155         }

   156         defaultKdcTimeout = timeout > 0 ? timeout : 30*1000; // 30 seconds

   157         defaultKdcRetryLimit =

   158                 max_retries > 0 ? max_retries : Krb5.KDC_RETRY_LIMIT;

   159         defaultUdpPrefLimit = udf_pref_limit;

   160 

   161         KdcAccessibility.reset();

   162     }

   163 

   164     protected byte[] obuf;

   165     protected byte[] ibuf;

   166 

   167     /**

   168      * Sends the provided data to the KDC of the specified realm.

   169      * Returns the response from the KDC.

   170      * Default realm/KDC is used if realm is null.

   171      * @param realm the realm of the KDC where data is to be sent.

   172      * @returns the kdc to which the AS request was sent to

   173      * @exception InterruptedIOException if timeout expires

   174      * @exception KrbException

   175      */

   176 

   177     public String send(String realm)

   178         throws IOException, KrbException {

   179         int udpPrefLimit = getRealmSpecificValue(

   180                 realm, "udp_preference_limit", defaultUdpPrefLimit);

   181 

   182         boolean useTCP = (udpPrefLimit > 0 &&

   183              (obuf != null && obuf.length > udpPrefLimit));

   184 

   185         return (send(realm, useTCP));

   186     }

   187 

   188     public String send(String realm, boolean useTCP)

   189         throws IOException, KrbException {

   190 

   191         if (obuf == null)

   192             return null;

   193         Exception savedException = null;

   194         Config cfg = Config.getInstance();

   195 

   196         if (realm == null) {

   197             realm = cfg.getDefaultRealm();

   198             if (realm == null) {

   199                 throw new KrbException(Krb5.KRB_ERR_GENERIC,

   200                                        "Cannot find default realm");

   201             }

   202         }

   203 

   204         String kdcList = cfg.getKDCList(realm);

   205         if (kdcList == null) {

   206             throw new KrbException("Cannot get kdc for realm " + realm);

   207         }

   208         String tempKdc = null; // may include the port number also

   209         for (String tmp: KdcAccessibility.list(kdcList)) {

   210             tempKdc = tmp;

   211             try {

   212                 send(realm,tempKdc,useTCP);

   213                 KdcAccessibility.removeBad(tempKdc);

   214                 break;

   215             } catch (Exception e) {

   216                 if (DEBUG) {

   217                     System.out.println(">>> KrbKdcReq send: error trying " +

   218                             tempKdc);

   219                     e.printStackTrace(System.out);

   220                 }

   221                 KdcAccessibility.addBad(tempKdc);

   222                 savedException = e;

   223             }

   224         }

   225         if (ibuf == null && savedException != null) {

   226             if (savedException instanceof IOException) {

   227                 throw (IOException) savedException;

   228             } else {

   229                 throw (KrbException) savedException;

   230             }

   231         }

   232         return tempKdc;

   233     }

   234 

   235     // send the AS Request to the specified KDC

   236 

   237     public void send(String realm, String tempKdc, boolean useTCP)

   238         throws IOException, KrbException {

   239 

   240         if (obuf == null)

   241             return;

   242 

   243         int port = Krb5.KDC_INET_DEFAULT_PORT;

   244         int retries = getRealmSpecificValue(

   245                 realm, "max_retries", defaultKdcRetryLimit);

   246         int timeout = getRealmSpecificValue(

   247                 realm, "kdc_timeout", defaultKdcTimeout);

   248         if (badPolicy == BpType.TRY_LESS &&

   249                 KdcAccessibility.isBad(tempKdc)) {

   250             if (retries > tryLessMaxRetries) {

   251                 retries = tryLessMaxRetries; // less retries

   252             }

   253             if (timeout > tryLessTimeout) {

   254                 timeout = tryLessTimeout; // less time

   255             }

   256         }

   257 

   258         String kdc = null;

   259         String portStr = null;

   260 

   261         if (tempKdc.charAt(0) == '[') {     // Explicit IPv6 in []

   262             int pos = tempKdc.indexOf(']', 1);

   263             if (pos == -1) {

   264                 throw new IOException("Illegal KDC: " + tempKdc);

   265             }

   266             kdc = tempKdc.substring(1, pos);

   267             if (pos != tempKdc.length() - 1) {  // with port number

   268                 if (tempKdc.charAt(pos+1) != ':') {

   269                     throw new IOException("Illegal KDC: " + tempKdc);

   270                 }

   271                 portStr = tempKdc.substring(pos+2);

   272             }

   273         } else {

   274             int colon = tempKdc.indexOf(':');

   275             if (colon == -1) {      // Hostname or IPv4 host only

   276                 kdc = tempKdc;

   277             } else {

   278                 int nextColon = tempKdc.indexOf(':', colon+1);

   279                 if (nextColon > 0) {    // >=2 ":", IPv6 with no port

   280                     kdc = tempKdc;

   281                 } else {                // 1 ":", hostname or IPv4 with port

   282                     kdc = tempKdc.substring(0, colon);

   283                     portStr = tempKdc.substring(colon+1);

   284                 }

   285             }

   286         }

   287         if (portStr != null) {

   288             int tempPort = parsePositiveIntString(portStr);

   289             if (tempPort > 0)

   290                 port = tempPort;

   291         }

   292 

   293         if (DEBUG) {

   294             System.out.println(">>> KrbKdcReq send: kdc=" + kdc

   295                                + (useTCP ? " TCP:":" UDP:")

   296                                +  port +  ", timeout="

   297                                + timeout

   298                                + ", number of retries ="

   299                                + retries

   300                                + ", #bytes=" + obuf.length);

   301         }

   302 

   303         KdcCommunication kdcCommunication =

   304             new KdcCommunication(kdc, port, useTCP, timeout, retries, obuf);

   305         try {

   306             ibuf = AccessController.doPrivileged(kdcCommunication);

   307             if (DEBUG) {

   308                 System.out.println(">>> KrbKdcReq send: #bytes read="

   309                         + (ibuf != null ? ibuf.length : 0));

   310             }

   311         } catch (PrivilegedActionException e) {

   312             Exception wrappedException = e.getException();

   313             if (wrappedException instanceof IOException) {

   314                 throw (IOException) wrappedException;

   315             } else {

   316                 throw (KrbException) wrappedException;

   317             }

   318         }

   319         if (DEBUG) {

   320             System.out.println(">>> KrbKdcReq send: #bytes read="

   321                                + (ibuf != null ? ibuf.length : 0));

   322         }

   323     }

   324 

   325     private static class KdcCommunication

   326         implements PrivilegedExceptionAction<byte[]> {

   327 

   328         private String kdc;

   329         private int port;

   330         private boolean useTCP;

   331         private int timeout;

   332         private int retries;

   333         private byte[] obuf;

   334 

   335         public KdcCommunication(String kdc, int port, boolean useTCP,

   336                                 int timeout, int retries, byte[] obuf) {

   337             this.kdc = kdc;

   338             this.port = port;

   339             this.useTCP = useTCP;

   340             this.timeout = timeout;

   341             this.retries = retries;

   342             this.obuf = obuf;

   343         }

   344 

   345         // The caller only casts IOException and KrbException so don't

   346         // add any new ones!

   347 

   348         public byte[] run() throws IOException, KrbException {

   349 

   350             byte[] ibuf = null;

   351 

   352             if (useTCP) {

   353                 TCPClient kdcClient = new TCPClient(kdc, port);

   354                 if (DEBUG) {

   355                     System.out.println(">>> KDCCommunication: kdc=" + kdc

   356                            + " TCP:"

   357                            +  port

   358                            + ", #bytes=" + obuf.length);

   359                 }

   360                 try {

   361                     /*

   362                      * Send the data to the kdc.

   363                      */

   364                     kdcClient.send(obuf);

   365                     /*

   366                      * And get a response.

   367                      */

   368                     ibuf = kdcClient.receive();

   369                 } finally {

   370                     kdcClient.close();

   371                 }

   372 

   373             } else {

   374                 // For each KDC we try defaultKdcRetryLimit times to

   375                 // get the response

   376                 for (int i=1; i <= retries; i++) {

   377                     UDPClient kdcClient = new UDPClient(kdc, port, timeout);

   378 

   379                     if (DEBUG) {

   380                         System.out.println(">>> KDCCommunication: kdc=" + kdc

   381                                + (useTCP ? " TCP:":" UDP:")

   382                                +  port +  ", timeout="

   383                                + timeout

   384                                + ",Attempt =" + i

   385                                + ", #bytes=" + obuf.length);

   386                     }

   387                     try {

   388                         /*

   389                          * Send the data to the kdc.

   390                          */

   391 

   392                         kdcClient.send(obuf);

   393 

   394                         /*

   395                          * And get a response.

   396                          */

   397                         try {

   398                             ibuf = kdcClient.receive();

   399                             break;

   400                         } catch (SocketTimeoutException se) {

   401                             if (DEBUG) {

   402                                 System.out.println ("SocketTimeOutException with " +

   403                                                     "attempt: " + i);

   404                             }

   405                             if (i == retries) {

   406                                 ibuf = null;

   407                                 throw se;

   408                             }

   409                         }

   410                     } finally {

   411                         kdcClient.close();

   412                     }

   413                 }

   414             }

   415             return ibuf;

   416         }

   417     }

   418 

   419     /**

   420      * Returns krb5.conf setting of {@code key} for a specfic realm,

   421      * which can be:

   422      * 1. defined in the sub-stanza for the given realm inside [realms], or

   423      * 2. defined in [libdefaults], or

   424      * 3. defValue

   425      * @param realm the given realm in which the setting is requested. Returns

   426      * the global setting if null

   427      * @param key the key for the setting

   428      * @param defValue default value

   429      * @return a value for the key

   430      */

   431     private int getRealmSpecificValue(String realm, String key, int defValue) {

   432         int v = defValue;

   433 

   434         if (realm == null) return v;

   435 

   436         int temp = -1;

   437         try {

   438             String value =

   439                Config.getInstance().getDefault(key, realm);

   440             temp = parsePositiveIntString(value);

   441         } catch (Exception exc) {

   442             // Ignored, defValue will be picked up

   443         }

   444 

   445         if (temp > 0) v = temp;

   446 

   447         return v;

   448     }

   449 

   450     private static int parsePositiveIntString(String intString) {

   451         if (intString == null)

   452             return -1;

   453 

   454         int ret = -1;

   455 

   456         try {

   457             ret = Integer.parseInt(intString);

   458         } catch (Exception exc) {

   459             return -1;

   460         }

   461 

   462         if (ret >= 0)

   463             return ret;

   464 

   465         return -1;

   466     }

   467 

   468     /**

   469      * Maintains a KDC accessible list. Unavailable KDCs are put into a

   470      * blacklist, when a KDC in the blacklist is available, it's removed

   471      * from there. No insertion order in the blacklist.

   472      *

   473      * There are two methods to deal with KDCs in the blacklist. 1. Only try

   474      * them when there's no KDC not on the blacklist. 2. Still try them, but

   475      * with lesser number of retries and smaller timeout value.

   476      */

   477     static class KdcAccessibility {

   478         // Known bad KDCs

   479         private static Set<String> bads = new HashSet<String>();

   480 

   481         private static synchronized void addBad(String kdc) {

   482             if (DEBUG) {

   483                 System.out.println(">>> KdcAccessibility: add " + kdc);

   484             }

   485             bads.add(kdc);

   486         }

   487 

   488         private static synchronized void removeBad(String kdc) {

   489             if (DEBUG) {

   490                 System.out.println(">>> KdcAccessibility: remove " + kdc);

   491             }

   492             bads.remove(kdc);

   493         }

   494 

   495         private static synchronized boolean isBad(String kdc) {

   496             return bads.contains(kdc);

   497         }

   498 

   499         private static synchronized void reset() {

   500             if (DEBUG) {

   501                 System.out.println(">>> KdcAccessibility: reset");

   502             }

   503             bads.clear();

   504         }

   505 

   506         // Returns a preferred KDC list by putting the bad ones at the end

   507         private static synchronized String[] list(String kdcList) {

   508             StringTokenizer st = new StringTokenizer(kdcList);

   509             List<String> list = new ArrayList<String>();

   510             if (badPolicy == BpType.TRY_LAST) {

   511                 List<String> badkdcs = new ArrayList<String>();

   512                 while (st.hasMoreTokens()) {

   513                     String t = st.nextToken();

   514                     if (bads.contains(t)) badkdcs.add(t);

   515                     else list.add(t);

   516                 }

   517                 // Bad KDCs are put at last

   518                 list.addAll(badkdcs);

   519             } else {

   520                 // All KDCs are returned in their original order,

   521                 // This include TRY_LESS and NONE

   522                 while (st.hasMoreTokens()) {

   523                     list.add(st.nextToken());

   524                 }

   525             }

   526             return list.toArray(new String[list.size()]);

   527         }

   528     }

   529 }

   530