author | weijun |
Thu, 24 Jun 2010 14:26:35 +0800 | |
changeset 5975 | 076cd013e5e4 |
parent 5506 | 202f599c92aa |
child 6113 | 6b79a63f1d4b |
permissions | -rw-r--r-- |
2 | 1 |
/* |
5506 | 2 |
* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
/* |
|
27 |
* |
|
28 |
* (C) Copyright IBM Corp. 1999 All Rights Reserved. |
|
29 |
* Copyright 1997 The Open Group Research Institute. All rights reserved. |
|
30 |
*/ |
|
31 |
package sun.security.krb5; |
|
32 |
||
33 |
import java.io.File; |
|
34 |
import java.io.FileInputStream; |
|
35 |
import java.util.Hashtable; |
|
36 |
import java.util.Vector; |
|
37 |
import java.util.ArrayList; |
|
38 |
import java.io.BufferedReader; |
|
39 |
import java.io.InputStreamReader; |
|
40 |
import java.io.IOException; |
|
41 |
import java.util.Enumeration; |
|
42 |
import java.util.StringTokenizer; |
|
43 |
import java.net.InetAddress; |
|
44 |
import java.net.UnknownHostException; |
|
45 |
import sun.security.krb5.internal.crypto.EType; |
|
46 |
import sun.security.krb5.internal.ktab.*; |
|
47 |
import sun.security.krb5.internal.Krb5; |
|
48 |
||
49 |
/** |
|
50 |
* This class maintains key-value pairs of Kerberos configurable constants |
|
51 |
* from configuration file or from user specified system properties. |
|
52 |
*/ |
|
53 |
||
54 |
public class Config { |
|
55 |
||
56 |
/* |
|
57 |
* Only allow a single instance of Config. |
|
58 |
*/ |
|
59 |
private static Config singleton = null; |
|
60 |
||
61 |
/* |
|
62 |
* Hashtable used to store configuration infomation. |
|
63 |
*/ |
|
64 |
private Hashtable<String,Object> stanzaTable; |
|
65 |
||
66 |
private static boolean DEBUG = sun.security.krb5.internal.Krb5.DEBUG; |
|
67 |
||
68 |
// these are used for hexdecimal calculation. |
|
69 |
private static final int BASE16_0 = 1; |
|
70 |
private static final int BASE16_1 = 16; |
|
71 |
private static final int BASE16_2 = 16 * 16; |
|
72 |
private static final int BASE16_3 = 16 * 16 * 16; |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
73 |
|
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
74 |
/** |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
75 |
* Specified by system properties. Must be both null or non-null. |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
76 |
*/ |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
77 |
private final String defaultRealm; |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
78 |
private final String defaultKDC; |
2 | 79 |
|
80 |
// used for native interface |
|
1819 | 81 |
private static native String getWindowsDirectory(boolean isSystem); |
2 | 82 |
|
83 |
||
84 |
/** |
|
85 |
* Gets an instance of Config class. One and only one instance (the |
|
86 |
* singleton) is returned. |
|
87 |
* |
|
88 |
* @exception KrbException if error occurs when constructing a Config |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
89 |
* instance. Possible causes would be either of java.security.krb5.realm or |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
90 |
* java.security.krb5.kdc not specified, error reading configuration file. |
2 | 91 |
*/ |
92 |
public static synchronized Config getInstance() throws KrbException { |
|
93 |
if (singleton == null) { |
|
94 |
singleton = new Config(); |
|
95 |
} |
|
96 |
return singleton; |
|
97 |
} |
|
98 |
||
99 |
/** |
|
100 |
* Refresh and reload the Configuration. This could involve, |
|
101 |
* for example reading the Configuration file again or getting |
|
102 |
* the java.security.krb5.* system properties again. |
|
103 |
* |
|
104 |
* @exception KrbException if error occurs when constructing a Config |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
105 |
* instance. Possible causes would be either of java.security.krb5.realm or |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
106 |
* java.security.krb5.kdc not specified, error reading configuration file. |
2 | 107 |
*/ |
108 |
||
109 |
public static synchronized void refresh() throws KrbException { |
|
110 |
singleton = new Config(); |
|
111 |
KeyTab.refresh(); |
|
5458 | 112 |
KrbKdcReq.initStatic(); |
2 | 113 |
} |
114 |
||
115 |
||
116 |
/** |
|
117 |
* Private constructor - can not be instantiated externally. |
|
118 |
*/ |
|
119 |
private Config() throws KrbException { |
|
120 |
/* |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
121 |
* If either one system property is specified, we throw exception. |
2 | 122 |
*/ |
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
123 |
String tmp = |
2 | 124 |
java.security.AccessController.doPrivileged( |
125 |
new sun.security.action.GetPropertyAction |
|
126 |
("java.security.krb5.kdc")); |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
127 |
if (tmp != null) { |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
128 |
// The user can specify a list of kdc hosts separated by ":" |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
129 |
defaultKDC = tmp.replace(':', ' '); |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
130 |
} else { |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
131 |
defaultKDC = null; |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
132 |
} |
3221
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
133 |
defaultRealm = |
2 | 134 |
java.security.AccessController.doPrivileged( |
135 |
new sun.security.action.GetPropertyAction |
|
136 |
("java.security.krb5.realm")); |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
137 |
if ((defaultKDC == null && defaultRealm != null) || |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
138 |
(defaultRealm == null && defaultKDC != null)) { |
2 | 139 |
throw new KrbException |
140 |
("System property java.security.krb5.kdc and " + |
|
141 |
"java.security.krb5.realm both must be set or " + |
|
142 |
"neither must be set."); |
|
143 |
} |
|
3221
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
144 |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
145 |
// Always read the Kerberos configuration file |
3221
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
146 |
try { |
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
147 |
Vector<String> configFile; |
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
148 |
configFile = loadConfigFile(); |
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
149 |
stanzaTable = parseStanzaTable(configFile); |
98ac5a3e79e9
6857795: krb5.conf ignored if system properties on realm and kdc are provided
weijun
parents:
2587
diff
changeset
|
150 |
} catch (IOException ioe) { |
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
151 |
// No krb5.conf, no problem. We'll use DNS or system property etc. |
2 | 152 |
} |
153 |
} |
|
154 |
||
155 |
/** |
|
156 |
* Gets the default int value for the specified name. |
|
157 |
* @param name the name. |
|
158 |
* @return the default Integer, null is returned if no such name and |
|
159 |
* value are found in configuration file, or error occurs when parsing |
|
160 |
* string to integer. |
|
161 |
*/ |
|
162 |
public int getDefaultIntValue(String name) { |
|
163 |
String result = null; |
|
164 |
int value = Integer.MIN_VALUE; |
|
165 |
result = getDefault(name); |
|
166 |
if (result != null) { |
|
167 |
try { |
|
168 |
value = parseIntValue(result); |
|
169 |
} catch (NumberFormatException e) { |
|
170 |
if (DEBUG) { |
|
171 |
System.out.println("Exception in getting value of " + |
|
172 |
name + " " + |
|
173 |
e.getMessage()); |
|
174 |
System.out.println("Setting " + name + |
|
175 |
" to minimum value"); |
|
176 |
} |
|
177 |
value = Integer.MIN_VALUE; |
|
178 |
} |
|
179 |
} |
|
180 |
return value; |
|
181 |
} |
|
182 |
||
183 |
/** |
|
184 |
* Gets the default int value for the specified name in the specified |
|
185 |
* section. <br>This method is quicker by using section name as the |
|
186 |
* search key. |
|
187 |
* @param name the name. |
|
188 |
* @param sectio the name string of the section. |
|
189 |
* @return the default Integer, null is returned if no such name and |
|
190 |
* value are found in configuration file, or error occurs when parsing |
|
191 |
* string to integer. |
|
192 |
*/ |
|
193 |
public int getDefaultIntValue(String name, String section) { |
|
194 |
String result = null; |
|
195 |
int value = Integer.MIN_VALUE; |
|
196 |
result = getDefault(name, section); |
|
197 |
if (result != null) { |
|
198 |
try { |
|
199 |
value = parseIntValue(result); |
|
200 |
} catch (NumberFormatException e) { |
|
201 |
if (DEBUG) { |
|
202 |
System.out.println("Exception in getting value of " + |
|
203 |
name +" in section " + |
|
204 |
section + " " + e.getMessage()); |
|
205 |
System.out.println("Setting " + name + |
|
206 |
" to minimum value"); |
|
207 |
} |
|
208 |
value = Integer.MIN_VALUE; |
|
209 |
} |
|
210 |
} |
|
211 |
return value; |
|
212 |
} |
|
213 |
||
214 |
/** |
|
215 |
* Gets the default string value for the specified name. |
|
216 |
* @param name the name. |
|
217 |
* @return the default value, null is returned if it cannot be found. |
|
218 |
*/ |
|
219 |
public String getDefault(String name) { |
|
220 |
if (stanzaTable == null) { |
|
221 |
return null; |
|
222 |
} else { |
|
223 |
return getDefault(name, stanzaTable); |
|
224 |
} |
|
225 |
} |
|
226 |
||
227 |
/** |
|
228 |
* This method does the real job to recursively search through the |
|
229 |
* stanzaTable. |
|
230 |
* @param k the key string. |
|
231 |
* @param t stanzaTable or sub hashtable within it. |
|
232 |
* @return the value found in config file, returns null if no value |
|
233 |
* matched with the key is found. |
|
234 |
*/ |
|
235 |
private String getDefault(String k, Hashtable t) { |
|
236 |
String result = null; |
|
237 |
String key; |
|
238 |
if (stanzaTable != null) { |
|
239 |
for (Enumeration e = t.keys(); e.hasMoreElements(); ) { |
|
240 |
key = (String)e.nextElement(); |
|
241 |
Object ob = t.get(key); |
|
242 |
if (ob instanceof Hashtable) { |
|
243 |
result = getDefault(k, (Hashtable)ob); |
|
244 |
if (result != null) { |
|
245 |
return result; |
|
246 |
} |
|
247 |
} else if (key.equalsIgnoreCase(k)) { |
|
248 |
if (ob instanceof String) { |
|
249 |
return (String)(t.get(key)); |
|
250 |
} else if (ob instanceof Vector) { |
|
251 |
result = ""; |
|
252 |
int length = ((Vector)ob).size(); |
|
253 |
for (int i = 0; i < length; i++) { |
|
254 |
if (i == length -1) { |
|
255 |
result += |
|
256 |
(String)(((Vector)ob).elementAt(i)); |
|
257 |
} else { |
|
258 |
result += |
|
259 |
(String)(((Vector)ob).elementAt(i)) + " "; |
|
260 |
} |
|
261 |
} |
|
262 |
return result; |
|
263 |
} |
|
264 |
} |
|
265 |
} |
|
266 |
} |
|
267 |
return result; |
|
268 |
} |
|
269 |
||
270 |
/** |
|
271 |
* Gets the default string value for the specified name in the |
|
272 |
* specified section. |
|
273 |
* <br>This method is quicker by using the section name as the search key. |
|
274 |
* @param name the name. |
|
275 |
* @param section the name of the section. |
|
276 |
* @return the default value, null is returned if it cannot be found. |
|
277 |
*/ |
|
278 |
public String getDefault(String name, String section) { |
|
279 |
String stanzaName; |
|
280 |
String result = null; |
|
281 |
Hashtable subTable; |
|
282 |
||
283 |
if (stanzaTable != null) { |
|
284 |
for (Enumeration e = stanzaTable.keys(); e.hasMoreElements(); ) { |
|
285 |
stanzaName = (String)e.nextElement(); |
|
286 |
subTable = (Hashtable)stanzaTable.get(stanzaName); |
|
287 |
if (stanzaName.equalsIgnoreCase(section)) { |
|
288 |
if (subTable.containsKey(name)) { |
|
289 |
return (String)(subTable.get(name)); |
|
290 |
} |
|
291 |
} else if (subTable.containsKey(section)) { |
|
292 |
Object ob = subTable.get(section); |
|
293 |
if (ob instanceof Hashtable) { |
|
294 |
Hashtable temp = (Hashtable)ob; |
|
295 |
if (temp.containsKey(name)) { |
|
296 |
Object object = temp.get(name); |
|
297 |
if (object instanceof Vector) { |
|
298 |
result = ""; |
|
299 |
int length = ((Vector)object).size(); |
|
300 |
for (int i = 0; i < length; i++) { |
|
301 |
if (i == length - 1) { |
|
302 |
result += |
|
303 |
(String)(((Vector)object).elementAt(i)); |
|
304 |
} else { |
|
305 |
result += |
|
306 |
(String)(((Vector)object).elementAt(i)) |
|
307 |
+ " "; |
|
308 |
} |
|
309 |
} |
|
310 |
} else { |
|
311 |
result = (String)object; |
|
312 |
} |
|
313 |
} |
|
314 |
} |
|
315 |
} |
|
316 |
} |
|
317 |
} |
|
318 |
return result; |
|
319 |
} |
|
320 |
||
321 |
/** |
|
322 |
* Gets the default boolean value for the specified name. |
|
323 |
* @param name the name. |
|
324 |
* @return the default boolean value, false is returned if it cannot be |
|
325 |
* found. |
|
326 |
*/ |
|
327 |
public boolean getDefaultBooleanValue(String name) { |
|
328 |
String val = null; |
|
329 |
if (stanzaTable == null) { |
|
330 |
val = null; |
|
331 |
} else { |
|
332 |
val = getDefault(name, stanzaTable); |
|
333 |
} |
|
334 |
if (val != null && val.equalsIgnoreCase("true")) { |
|
335 |
return true; |
|
336 |
} else { |
|
337 |
return false; |
|
338 |
} |
|
339 |
} |
|
340 |
||
341 |
/** |
|
342 |
* Gets the default boolean value for the specified name in the |
|
343 |
* specified section. |
|
344 |
* <br>This method is quicker by using the section name as the search key. |
|
345 |
* @param name the name. |
|
346 |
* @param section the name of the section. |
|
347 |
* @return the default boolean value, false is returned if it cannot be |
|
348 |
* found. |
|
349 |
*/ |
|
350 |
public boolean getDefaultBooleanValue(String name, String section) { |
|
351 |
String val = getDefault(name, section); |
|
352 |
if (val != null && val.equalsIgnoreCase("true")) { |
|
353 |
return true; |
|
354 |
} else { |
|
355 |
return false; |
|
356 |
} |
|
357 |
} |
|
358 |
||
359 |
/** |
|
360 |
* Parses a string to an integer. The convertible strings include the |
|
361 |
* string representations of positive integers, negative integers, and |
|
362 |
* hex decimal integers. Valid inputs are, e.g., -1234, +1234, |
|
363 |
* 0x40000. |
|
364 |
* |
|
365 |
* @param input the String to be converted to an Integer. |
|
366 |
* @return an numeric value represented by the string |
|
367 |
* @exception NumberFormationException if the String does not contain a |
|
368 |
* parsable integer. |
|
369 |
*/ |
|
370 |
private int parseIntValue(String input) throws NumberFormatException { |
|
371 |
int value = 0; |
|
372 |
if (input.startsWith("+")) { |
|
373 |
String temp = input.substring(1); |
|
374 |
return Integer.parseInt(temp); |
|
375 |
} else if (input.startsWith("0x")) { |
|
376 |
String temp = input.substring(2); |
|
377 |
char[] chars = temp.toCharArray(); |
|
378 |
if (chars.length > 8) { |
|
379 |
throw new NumberFormatException(); |
|
380 |
} else { |
|
381 |
for (int i = 0; i < chars.length; i++) { |
|
382 |
int index = chars.length - i - 1; |
|
383 |
switch (chars[i]) { |
|
384 |
case '0': |
|
385 |
value += 0; |
|
386 |
break; |
|
387 |
case '1': |
|
388 |
value += 1 * getBase(index); |
|
389 |
break; |
|
390 |
case '2': |
|
391 |
value += 2 * getBase(index); |
|
392 |
break; |
|
393 |
case '3': |
|
394 |
value += 3 * getBase(index); |
|
395 |
break; |
|
396 |
case '4': |
|
397 |
value += 4 * getBase(index); |
|
398 |
break; |
|
399 |
case '5': |
|
400 |
value += 5 * getBase(index); |
|
401 |
break; |
|
402 |
case '6': |
|
403 |
value += 6 * getBase(index); |
|
404 |
break; |
|
405 |
case '7': |
|
406 |
value += 7 * getBase(index); |
|
407 |
break; |
|
408 |
case '8': |
|
409 |
value += 8 * getBase(index); |
|
410 |
break; |
|
411 |
case '9': |
|
412 |
value += 9 * getBase(index); |
|
413 |
break; |
|
414 |
case 'a': |
|
415 |
case 'A': |
|
416 |
value += 10 * getBase(index); |
|
417 |
break; |
|
418 |
case 'b': |
|
419 |
case 'B': |
|
420 |
value += 11 * getBase(index); |
|
421 |
break; |
|
422 |
case 'c': |
|
423 |
case 'C': |
|
424 |
value += 12 * getBase(index); |
|
425 |
break; |
|
426 |
case 'd': |
|
427 |
case 'D': |
|
428 |
value += 13 * getBase(index); |
|
429 |
break; |
|
430 |
case 'e': |
|
431 |
case 'E': |
|
432 |
value += 14 * getBase(index); |
|
433 |
break; |
|
434 |
case 'f': |
|
435 |
case 'F': |
|
436 |
value += 15 * getBase(index); |
|
437 |
break; |
|
438 |
default: |
|
439 |
throw new NumberFormatException("Invalid numerical format"); |
|
440 |
} |
|
441 |
} |
|
442 |
} |
|
443 |
if (value < 0) { |
|
444 |
throw new NumberFormatException("Data overflow."); |
|
445 |
} |
|
446 |
} else { |
|
447 |
value = Integer.parseInt(input); |
|
448 |
} |
|
449 |
return value; |
|
450 |
} |
|
451 |
||
452 |
private int getBase(int i) { |
|
453 |
int result = 16; |
|
454 |
switch (i) { |
|
455 |
case 0: |
|
456 |
result = BASE16_0; |
|
457 |
break; |
|
458 |
case 1: |
|
459 |
result = BASE16_1; |
|
460 |
break; |
|
461 |
case 2: |
|
462 |
result = BASE16_2; |
|
463 |
break; |
|
464 |
case 3: |
|
465 |
result = BASE16_3; |
|
466 |
break; |
|
467 |
default: |
|
468 |
for (int j = 1; j < i; j++) { |
|
469 |
result *= 16; |
|
470 |
} |
|
471 |
} |
|
472 |
return result; |
|
473 |
} |
|
474 |
||
475 |
/** |
|
476 |
* Finds the matching value in the hashtable. |
|
477 |
*/ |
|
478 |
private String find(String key1, String key2) { |
|
479 |
String result; |
|
480 |
if ((stanzaTable != null) && |
|
481 |
((result = (String) |
|
482 |
(((Hashtable)(stanzaTable.get(key1))).get(key2))) != null)) { |
|
483 |
return result; |
|
484 |
} else { |
|
485 |
return ""; |
|
486 |
} |
|
487 |
} |
|
488 |
||
489 |
/** |
|
490 |
* Reads name/value pairs to the memory from the configuration |
|
491 |
* file. The default location of the configuration file is in java home |
|
492 |
* directory. |
|
493 |
* |
|
494 |
* Configuration file contains information about the default realm, |
|
495 |
* ticket parameters, location of the KDC and the admin server for |
|
496 |
* known realms, etc. The file is divided into sections. Each section |
|
497 |
* contains one or more name/value pairs with one pair per line. A |
|
498 |
* typical file would be: |
|
499 |
* [libdefaults] |
|
500 |
* default_realm = EXAMPLE.COM |
|
501 |
* default_tgs_enctypes = des-cbc-md5 |
|
502 |
* default_tkt_enctypes = des-cbc-md5 |
|
503 |
* [realms] |
|
504 |
* EXAMPLE.COM = { |
|
505 |
* kdc = kerberos.example.com |
|
506 |
* kdc = kerberos-1.example.com |
|
507 |
* admin_server = kerberos.example.com |
|
508 |
* } |
|
509 |
* SAMPLE_COM = { |
|
510 |
* kdc = orange.sample.com |
|
511 |
* admin_server = orange.sample.com |
|
512 |
* } |
|
513 |
* [domain_realm] |
|
514 |
* blue.sample.com = TEST.SAMPLE.COM |
|
515 |
* .backup.com = EXAMPLE.COM |
|
516 |
*/ |
|
517 |
private Vector<String> loadConfigFile() throws IOException { |
|
518 |
try { |
|
519 |
final String fileName = getFileName(); |
|
520 |
if (!fileName.equals("")) { |
|
521 |
BufferedReader br = new BufferedReader(new InputStreamReader( |
|
522 |
java.security.AccessController.doPrivileged( |
|
523 |
new java.security.PrivilegedExceptionAction<FileInputStream> () { |
|
524 |
public FileInputStream run() throws IOException { |
|
525 |
return new FileInputStream(fileName); |
|
526 |
} |
|
527 |
}))); |
|
528 |
String Line; |
|
529 |
Vector<String> v = new Vector<String> (); |
|
530 |
String previous = null; |
|
531 |
while ((Line = br.readLine()) != null) { |
|
532 |
// ignore comments and blank line in the configuration file. |
|
533 |
// Comments start with #. |
|
534 |
if (!(Line.startsWith("#") || Line.trim().isEmpty())) { |
|
535 |
String current = Line.trim(); |
|
536 |
// In practice, a subsection might look like: |
|
537 |
// EXAMPLE.COM = |
|
538 |
// { |
|
539 |
// kdc = kerberos.example.com |
|
540 |
// ... |
|
541 |
// } |
|
542 |
// Before parsed into stanza table, it needs to be |
|
543 |
// converted into formal style: |
|
544 |
// EXAMPLE.COM = { |
|
545 |
// kdc = kerberos.example.com |
|
546 |
// ... |
|
547 |
// } |
|
548 |
// |
|
549 |
// So, if a line is "{", adhere to the previous line. |
|
550 |
if (current.equals("{")) { |
|
551 |
if (previous == null) { |
|
552 |
throw new IOException( |
|
553 |
"Config file should not start with \"{\""); |
|
554 |
} |
|
555 |
previous += " " + current; |
|
556 |
} else { |
|
557 |
if (previous != null) { |
|
558 |
v.addElement(previous); |
|
559 |
} |
|
560 |
previous = current; |
|
561 |
} |
|
562 |
} |
|
563 |
} |
|
564 |
if (previous != null) { |
|
565 |
v.addElement(previous); |
|
566 |
} |
|
567 |
||
568 |
br.close(); |
|
569 |
return v; |
|
570 |
} |
|
571 |
return null; |
|
572 |
} catch (java.security.PrivilegedActionException pe) { |
|
573 |
throw (IOException)pe.getException(); |
|
574 |
} |
|
575 |
} |
|
576 |
||
577 |
||
578 |
/** |
|
579 |
* Parses stanza names and values from configuration file to |
|
580 |
* stanzaTable (Hashtable). Hashtable key would be stanza names, |
|
581 |
* (libdefaults, realms, domain_realms, etc), and the hashtable value |
|
582 |
* would be another hashtable which contains the key-value pairs under |
|
583 |
* a stanza name. |
|
584 |
*/ |
|
585 |
private Hashtable<String,Object> parseStanzaTable(Vector<String> v) throws KrbException { |
|
586 |
if (v == null) { |
|
587 |
throw new KrbException("I/O error while reading" + |
|
588 |
" configuration file."); |
|
589 |
} |
|
590 |
Hashtable<String,Object> table = new Hashtable<String,Object> (); |
|
591 |
for (int i = 0; i < v.size(); i++) { |
|
592 |
String line = v.elementAt(i).trim(); |
|
593 |
if (line.equalsIgnoreCase("[realms]")) { |
|
594 |
for (int count = i + 1; count < v.size() + 1; count++) { |
|
595 |
// find the next stanza name |
|
596 |
if ((count == v.size()) || |
|
597 |
(v.elementAt(count).startsWith("["))) { |
|
598 |
Hashtable<String,Hashtable<String,Vector<String>>> temp = |
|
599 |
new Hashtable<String,Hashtable<String,Vector<String>>>(); |
|
600 |
temp = parseRealmField(v, i + 1, count); |
|
601 |
table.put("realms", temp); |
|
602 |
i = count - 1; |
|
603 |
break; |
|
604 |
} |
|
605 |
} |
|
606 |
} else if (line.equalsIgnoreCase("[capaths]")) { |
|
607 |
for (int count = i + 1; count < v.size() + 1; count++) { |
|
608 |
// find the next stanza name |
|
609 |
if ((count == v.size()) || |
|
610 |
(v.elementAt(count).startsWith("["))) { |
|
611 |
Hashtable<String,Hashtable<String,Vector<String>>> temp = |
|
612 |
new Hashtable<String,Hashtable<String,Vector<String>>>(); |
|
613 |
temp = parseRealmField(v, i + 1, count); |
|
614 |
table.put("capaths", temp); |
|
615 |
i = count - 1; |
|
616 |
break; |
|
617 |
} |
|
618 |
} |
|
619 |
} else if (line.startsWith("[") && line.endsWith("]")) { |
|
620 |
String key = line.substring(1, line.length() - 1); |
|
621 |
for (int count = i + 1; count < v.size() + 1; count++) { |
|
622 |
// find the next stanza name |
|
623 |
if ((count == v.size()) || |
|
624 |
(v.elementAt(count).startsWith("["))) { |
|
625 |
Hashtable<String,String> temp = |
|
626 |
parseField(v, i + 1, count); |
|
627 |
table.put(key, temp); |
|
628 |
i = count - 1; |
|
629 |
break; |
|
630 |
} |
|
631 |
} |
|
632 |
} |
|
633 |
} |
|
634 |
return table; |
|
635 |
} |
|
636 |
||
637 |
/** |
|
1819 | 638 |
* Gets the default configuration file name. This method will never |
639 |
* return null. |
|
640 |
* |
|
641 |
* If the system property "java.security.krb5.conf" is defined, we'll |
|
642 |
* use its value, no matter if the file exists or not. Otherwise, |
|
643 |
* the file will be searched in a list of possible loations in the |
|
644 |
* following order: |
|
645 |
* |
|
646 |
* 1. at Java home lib\security directory with "krb5.conf" name, |
|
647 |
* 2. at windows directory with the name of "krb5.ini" for Windows, |
|
648 |
* /etc/krb5/krb5.conf for Solaris, /etc/krb5.conf otherwise. |
|
649 |
* |
|
650 |
* Note: When the Terminal Service is started in Windows (from 2003), |
|
651 |
* there are two kinds of Windows directories: A system one (say, |
|
652 |
* C:\Windows), and a user-private one (say, C:\Users\Me\Windows). |
|
653 |
* We will first look for krb5.ini in the user-private one. If not |
|
654 |
* found, try the system one instead. |
|
2 | 655 |
*/ |
656 |
private String getFileName() { |
|
657 |
String name = |
|
658 |
java.security.AccessController.doPrivileged( |
|
659 |
new sun.security.action. |
|
660 |
GetPropertyAction("java.security.krb5.conf")); |
|
1819 | 661 |
if (name == null) { |
2 | 662 |
name = java.security.AccessController.doPrivileged( |
663 |
new sun.security.action. |
|
664 |
GetPropertyAction("java.home")) + File.separator + |
|
665 |
"lib" + File.separator + "security" + |
|
666 |
File.separator + "krb5.conf"; |
|
1819 | 667 |
if (!fileExists(name)) { |
668 |
name = null; |
|
2 | 669 |
String osname = |
670 |
java.security.AccessController.doPrivileged( |
|
671 |
new sun.security.action.GetPropertyAction("os.name")); |
|
672 |
if (osname.startsWith("Windows")) { |
|
673 |
try { |
|
674 |
Credentials.ensureLoaded(); |
|
675 |
} catch (Exception e) { |
|
676 |
// ignore exceptions |
|
677 |
} |
|
678 |
if (Credentials.alreadyLoaded) { |
|
1819 | 679 |
String path = getWindowsDirectory(false); |
680 |
if (path != null) { |
|
681 |
if (path.endsWith("\\")) { |
|
682 |
path = path + "krb5.ini"; |
|
683 |
} else { |
|
684 |
path = path + "\\krb5.ini"; |
|
685 |
} |
|
686 |
if (fileExists(path)) { |
|
687 |
name = path; |
|
688 |
} |
|
2 | 689 |
} |
1819 | 690 |
if (name == null) { |
691 |
path = getWindowsDirectory(true); |
|
692 |
if (path != null) { |
|
693 |
if (path.endsWith("\\")) { |
|
694 |
path = path + "krb5.ini"; |
|
695 |
} else { |
|
696 |
path = path + "\\krb5.ini"; |
|
697 |
} |
|
698 |
name = path; |
|
699 |
} |
|
700 |
} |
|
701 |
} |
|
702 |
if (name == null) { |
|
2 | 703 |
name = "c:\\winnt\\krb5.ini"; |
704 |
} |
|
705 |
} else if (osname.startsWith("SunOS")) { |
|
706 |
name = "/etc/krb5/krb5.conf"; |
|
1819 | 707 |
} else { |
2 | 708 |
name = "/etc/krb5.conf"; |
709 |
} |
|
710 |
} |
|
711 |
} |
|
712 |
if (DEBUG) { |
|
713 |
System.out.println("Config name: " + name); |
|
714 |
} |
|
715 |
return name; |
|
716 |
} |
|
717 |
||
2587
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
718 |
private static String trimmed(String s) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
719 |
s = s.trim(); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
720 |
if (s.charAt(0) == '"' && s.charAt(s.length()-1) == '"' || |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
721 |
s.charAt(0) == '\'' && s.charAt(s.length()-1) == '\'') { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
722 |
s = s.substring(1, s.length()-1).trim(); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
723 |
} |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
724 |
return s; |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
725 |
} |
2 | 726 |
/** |
727 |
* Parses key-value pairs under a stanza name. |
|
728 |
*/ |
|
729 |
private Hashtable<String,String> parseField(Vector<String> v, int start, int end) { |
|
730 |
Hashtable<String,String> table = new Hashtable<String,String> (); |
|
731 |
String line; |
|
732 |
for (int i = start; i < end; i++) { |
|
733 |
line = v.elementAt(i); |
|
734 |
for (int j = 0; j < line.length(); j++) { |
|
735 |
if (line.charAt(j) == '=') { |
|
736 |
String key = (line.substring(0, j)).trim(); |
|
2587
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
737 |
String value = trimmed(line.substring(j + 1)); |
2 | 738 |
table.put(key, value); |
739 |
break; |
|
740 |
} |
|
741 |
} |
|
742 |
} |
|
743 |
return table; |
|
744 |
} |
|
745 |
||
746 |
/** |
|
747 |
* Parses key-value pairs under [realms]. The key would be the realm |
|
748 |
* name, the value would be another hashtable which contains |
|
749 |
* information for the realm given within a pair of braces. |
|
750 |
*/ |
|
751 |
private Hashtable<String,Hashtable<String,Vector<String>>> parseRealmField(Vector<String> v, int start, int end) { |
|
752 |
Hashtable<String,Hashtable<String,Vector<String>>> table = new Hashtable<String,Hashtable<String,Vector<String>>> (); |
|
753 |
String line; |
|
754 |
for (int i = start; i < end; i++) { |
|
755 |
line = v.elementAt(i).trim(); |
|
756 |
if (line.endsWith("{")) { |
|
757 |
String key = ""; |
|
758 |
for (int j = 0; j < line.length(); j++) { |
|
759 |
if (line.charAt(j) == '=') { |
|
760 |
key = line.substring(0, j).trim(); |
|
761 |
// get the key |
|
762 |
break; |
|
763 |
} |
|
764 |
} |
|
765 |
for (int k = i + 1; k < end; k++) { |
|
766 |
boolean found = false; |
|
767 |
line = v.elementAt(k).trim(); |
|
768 |
for (int l = 0; l < line.length(); l++) { |
|
769 |
if (line.charAt(l) == '}') { |
|
770 |
found = true; |
|
771 |
break; |
|
772 |
} |
|
773 |
} |
|
774 |
if (found == true) { |
|
775 |
Hashtable<String,Vector<String>> temp = parseRealmFieldEx(v, i + 1, k); |
|
776 |
table.put(key, temp); |
|
777 |
i = k; |
|
778 |
found = false; |
|
779 |
break; |
|
780 |
} |
|
781 |
||
782 |
} |
|
783 |
} |
|
784 |
} |
|
785 |
return table; |
|
786 |
} |
|
787 |
||
788 |
/** |
|
789 |
* Parses key-value pairs within each braces under [realms]. |
|
790 |
*/ |
|
791 |
private Hashtable<String,Vector<String>> parseRealmFieldEx(Vector<String> v, int start, int end) { |
|
792 |
Hashtable<String,Vector<String>> table = |
|
793 |
new Hashtable<String,Vector<String>> (); |
|
794 |
Vector<String> keyVector = new Vector<String> (); |
|
795 |
Vector<String> nameVector = new Vector<String> (); |
|
796 |
String line = ""; |
|
797 |
String key; |
|
798 |
for (int i = start; i < end; i++) { |
|
799 |
line = v.elementAt(i); |
|
800 |
for (int j = 0; j < line.length(); j++) { |
|
801 |
if (line.charAt(j) == '=') { |
|
802 |
int index; |
|
1236
77c6416750aa
6740833: krb5.conf does not accept kdc=hostname (no spaces around =)
weijun
parents:
715
diff
changeset
|
803 |
key = line.substring(0, j).trim(); |
2 | 804 |
if (! exists(key, keyVector)) { |
805 |
keyVector.addElement(key); |
|
806 |
nameVector = new Vector<String> (); |
|
807 |
} else { |
|
808 |
nameVector = table.get(key); |
|
809 |
} |
|
2587
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
810 |
nameVector.addElement(trimmed(line.substring(j + 1))); |
2 | 811 |
table.put(key, nameVector); |
812 |
break; |
|
813 |
} |
|
814 |
} |
|
815 |
} |
|
816 |
return table; |
|
817 |
} |
|
818 |
||
819 |
/** |
|
820 |
* Compares the key with the known keys to see if it exists. |
|
821 |
*/ |
|
822 |
private boolean exists(String key, Vector v) { |
|
823 |
boolean exists = false; |
|
824 |
for (int i = 0; i < v.size(); i++) { |
|
825 |
if (((String)(v.elementAt(i))).equals(key)) { |
|
826 |
exists = true; |
|
827 |
} |
|
828 |
} |
|
829 |
return exists; |
|
830 |
} |
|
831 |
||
832 |
/** |
|
833 |
* For testing purpose. This method lists all information being parsed from |
|
834 |
* the configuration file to the hashtable. |
|
835 |
*/ |
|
836 |
public void listTable() { |
|
837 |
listTable(stanzaTable); |
|
838 |
} |
|
839 |
||
840 |
private void listTable(Hashtable table) { |
|
841 |
Vector v = new Vector(); |
|
842 |
String key; |
|
843 |
if (stanzaTable != null) { |
|
844 |
for (Enumeration e = table.keys(); e.hasMoreElements(); ) { |
|
845 |
key = (String)e.nextElement(); |
|
846 |
Object object = table.get(key); |
|
847 |
if (table == stanzaTable) { |
|
848 |
System.out.println("[" + key + "]"); |
|
849 |
} |
|
850 |
if (object instanceof Hashtable) { |
|
851 |
if (table != stanzaTable) |
|
852 |
System.out.println("\t" + key + " = {"); |
|
853 |
listTable((Hashtable)object); |
|
854 |
if (table != stanzaTable) |
|
855 |
System.out.println("\t}"); |
|
856 |
||
857 |
} else if (object instanceof String) { |
|
858 |
System.out.println("\t" + key + " = " + |
|
859 |
(String)table.get(key)); |
|
860 |
} else if (object instanceof Vector) { |
|
861 |
v = (Vector)object; |
|
862 |
for (int i = 0; i < v.size(); i++) { |
|
863 |
System.out.println("\t" + key + " = " + |
|
864 |
(String)v.elementAt(i)); |
|
865 |
} |
|
866 |
} |
|
867 |
} |
|
868 |
} else { |
|
869 |
System.out.println("Configuration file not found."); |
|
870 |
} |
|
871 |
} |
|
872 |
||
873 |
/** |
|
874 |
* Returns the default encryption types. |
|
875 |
* |
|
876 |
*/ |
|
877 |
public int[] defaultEtype(String enctypes) { |
|
878 |
String default_enctypes; |
|
879 |
default_enctypes = getDefault(enctypes, "libdefaults"); |
|
880 |
String delim = " "; |
|
881 |
StringTokenizer st; |
|
882 |
int[] etype; |
|
883 |
if (default_enctypes == null) { |
|
884 |
if (DEBUG) { |
|
885 |
System.out.println("Using builtin default etypes for " + |
|
886 |
enctypes); |
|
887 |
} |
|
888 |
etype = EType.getBuiltInDefaults(); |
|
889 |
} else { |
|
890 |
for (int j = 0; j < default_enctypes.length(); j++) { |
|
891 |
if (default_enctypes.substring(j, j + 1).equals(",")) { |
|
892 |
// only two delimiters are allowed to use |
|
893 |
// according to Kerberos DCE doc. |
|
894 |
delim = ","; |
|
895 |
break; |
|
896 |
} |
|
897 |
} |
|
898 |
st = new StringTokenizer(default_enctypes, delim); |
|
899 |
int len = st.countTokens(); |
|
900 |
ArrayList<Integer> ls = new ArrayList<Integer> (len); |
|
901 |
int type; |
|
902 |
for (int i = 0; i < len; i++) { |
|
903 |
type = getType(st.nextToken()); |
|
904 |
if ((type != -1) && |
|
905 |
(EType.isSupported(type))) { |
|
906 |
ls.add(type); |
|
907 |
} |
|
908 |
} |
|
909 |
if (ls.size() == 0) { |
|
910 |
if (DEBUG) { |
|
911 |
System.out.println( |
|
912 |
"no supported default etypes for " + enctypes); |
|
913 |
} |
|
914 |
return null; |
|
915 |
} else { |
|
916 |
etype = new int[ls.size()]; |
|
917 |
for (int i = 0; i < etype.length; i++) { |
|
918 |
etype[i] = ls.get(i); |
|
919 |
} |
|
920 |
} |
|
921 |
} |
|
922 |
||
923 |
if (DEBUG) { |
|
924 |
System.out.print("default etypes for " + enctypes + ":"); |
|
925 |
for (int i = 0; i < etype.length; i++) { |
|
926 |
System.out.print(" " + etype[i]); |
|
927 |
} |
|
928 |
System.out.println("."); |
|
929 |
} |
|
930 |
return etype; |
|
931 |
} |
|
932 |
||
933 |
||
934 |
/** |
|
935 |
* Get the etype and checksum value for the specified encryption and |
|
936 |
* checksum type. |
|
937 |
* |
|
938 |
*/ |
|
939 |
/* |
|
940 |
* This method converts the string representation of encryption type and |
|
941 |
* checksum type to int value that can be later used by EType and |
|
942 |
* Checksum classes. |
|
943 |
*/ |
|
944 |
public int getType(String input) { |
|
945 |
int result = -1; |
|
946 |
if (input == null) { |
|
947 |
return result; |
|
948 |
} |
|
949 |
if (input.startsWith("d") || (input.startsWith("D"))) { |
|
950 |
if (input.equalsIgnoreCase("des-cbc-crc")) { |
|
951 |
result = EncryptedData.ETYPE_DES_CBC_CRC; |
|
952 |
} else if (input.equalsIgnoreCase("des-cbc-md5")) { |
|
953 |
result = EncryptedData.ETYPE_DES_CBC_MD5; |
|
954 |
} else if (input.equalsIgnoreCase("des-mac")) { |
|
955 |
result = Checksum.CKSUMTYPE_DES_MAC; |
|
956 |
} else if (input.equalsIgnoreCase("des-mac-k")) { |
|
957 |
result = Checksum.CKSUMTYPE_DES_MAC_K; |
|
958 |
} else if (input.equalsIgnoreCase("des-cbc-md4")) { |
|
959 |
result = EncryptedData.ETYPE_DES_CBC_MD4; |
|
960 |
} else if (input.equalsIgnoreCase("des3-cbc-sha1") || |
|
961 |
input.equalsIgnoreCase("des3-hmac-sha1") || |
|
962 |
input.equalsIgnoreCase("des3-cbc-sha1-kd") || |
|
963 |
input.equalsIgnoreCase("des3-cbc-hmac-sha1-kd")) { |
|
964 |
result = EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD; |
|
965 |
} |
|
966 |
} else if (input.startsWith("a") || (input.startsWith("A"))) { |
|
967 |
// AES |
|
968 |
if (input.equalsIgnoreCase("aes128-cts") || |
|
969 |
input.equalsIgnoreCase("aes128-cts-hmac-sha1-96")) { |
|
970 |
result = EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96; |
|
971 |
} else if (input.equalsIgnoreCase("aes256-cts") || |
|
972 |
input.equalsIgnoreCase("aes256-cts-hmac-sha1-96")) { |
|
973 |
result = EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96; |
|
974 |
// ARCFOUR-HMAC |
|
975 |
} else if (input.equalsIgnoreCase("arcfour-hmac") || |
|
976 |
input.equalsIgnoreCase("arcfour-hmac-md5")) { |
|
977 |
result = EncryptedData.ETYPE_ARCFOUR_HMAC; |
|
978 |
} |
|
979 |
// RC4-HMAC |
|
980 |
} else if (input.equalsIgnoreCase("rc4-hmac")) { |
|
981 |
result = EncryptedData.ETYPE_ARCFOUR_HMAC; |
|
982 |
} else if (input.equalsIgnoreCase("CRC32")) { |
|
983 |
result = Checksum.CKSUMTYPE_CRC32; |
|
984 |
} else if (input.startsWith("r") || (input.startsWith("R"))) { |
|
985 |
if (input.equalsIgnoreCase("rsa-md5")) { |
|
986 |
result = Checksum.CKSUMTYPE_RSA_MD5; |
|
987 |
} else if (input.equalsIgnoreCase("rsa-md5-des")) { |
|
988 |
result = Checksum.CKSUMTYPE_RSA_MD5_DES; |
|
989 |
} |
|
990 |
} else if (input.equalsIgnoreCase("hmac-sha1-des3-kd")) { |
|
991 |
result = Checksum.CKSUMTYPE_HMAC_SHA1_DES3_KD; |
|
992 |
} else if (input.equalsIgnoreCase("hmac-sha1-96-aes128")) { |
|
993 |
result = Checksum.CKSUMTYPE_HMAC_SHA1_96_AES128; |
|
994 |
} else if (input.equalsIgnoreCase("hmac-sha1-96-aes256")) { |
|
995 |
result = Checksum.CKSUMTYPE_HMAC_SHA1_96_AES256; |
|
996 |
} else if (input.equalsIgnoreCase("hmac-md5-rc4") || |
|
997 |
input.equalsIgnoreCase("hmac-md5-arcfour") || |
|
998 |
input.equalsIgnoreCase("hmac-md5-enc")) { |
|
999 |
result = Checksum.CKSUMTYPE_HMAC_MD5_ARCFOUR; |
|
1000 |
} else if (input.equalsIgnoreCase("NULL")) { |
|
1001 |
result = EncryptedData.ETYPE_NULL; |
|
1002 |
} |
|
1003 |
||
1004 |
return result; |
|
1005 |
} |
|
1006 |
||
1007 |
/** |
|
1008 |
* Resets the default kdc realm. |
|
1009 |
* We do not need to synchronize these methods since assignments are atomic |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1010 |
* |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1011 |
* This method was useless. Kept here in case some class still calls it. |
2 | 1012 |
*/ |
1013 |
public void resetDefaultRealm(String realm) { |
|
1014 |
if (DEBUG) { |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1015 |
System.out.println(">>> Config try resetting default kdc " + realm); |
2 | 1016 |
} |
1017 |
} |
|
1018 |
||
1019 |
/** |
|
1020 |
* Check to use addresses in tickets |
|
1021 |
* use addresses if "no_addresses" or "noaddresses" is set to false |
|
1022 |
*/ |
|
1023 |
public boolean useAddresses() { |
|
1024 |
boolean useAddr = false; |
|
1025 |
// use addresses if "no_addresses" is set to false |
|
1026 |
String value = getDefault("no_addresses", "libdefaults"); |
|
1027 |
useAddr = (value != null && value.equalsIgnoreCase("false")); |
|
1028 |
if (useAddr == false) { |
|
1029 |
// use addresses if "noaddresses" is set to false |
|
1030 |
value = getDefault("noaddresses", "libdefaults"); |
|
1031 |
useAddr = (value != null && value.equalsIgnoreCase("false")); |
|
1032 |
} |
|
1033 |
return useAddr; |
|
1034 |
} |
|
1035 |
||
1036 |
/** |
|
1037 |
* Check if need to use DNS to locate Kerberos services |
|
1038 |
*/ |
|
1039 |
public boolean useDNS(String name) { |
|
93 | 1040 |
String value = getDefault(name, "libdefaults"); |
1041 |
if (value == null) { |
|
1946 | 1042 |
value = getDefault("dns_fallback", "libdefaults"); |
1043 |
if ("false".equalsIgnoreCase(value)) { |
|
1044 |
return false; |
|
1045 |
} else { |
|
1046 |
return true; |
|
1047 |
} |
|
93 | 1048 |
} else { |
1049 |
return value.equalsIgnoreCase("true"); |
|
2 | 1050 |
} |
1051 |
} |
|
1052 |
||
1053 |
/** |
|
1054 |
* Check if need to use DNS to locate the KDC |
|
1055 |
*/ |
|
1056 |
public boolean useDNS_KDC() { |
|
1057 |
return useDNS("dns_lookup_kdc"); |
|
1058 |
} |
|
1059 |
||
1060 |
/* |
|
1061 |
* Check if need to use DNS to locate the Realm |
|
1062 |
*/ |
|
1063 |
public boolean useDNS_Realm() { |
|
1064 |
return useDNS("dns_lookup_realm"); |
|
1065 |
} |
|
1066 |
||
1067 |
/** |
|
1068 |
* Gets default realm. |
|
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1069 |
* @throws KrbException where no realm can be located |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1070 |
* @return the default realm, always non null |
2 | 1071 |
*/ |
1072 |
public String getDefaultRealm() throws KrbException { |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1073 |
if (defaultRealm != null) { |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1074 |
return defaultRealm; |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1075 |
} |
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1076 |
Exception cause = null; |
2 | 1077 |
String realm = getDefault("default_realm", "libdefaults"); |
1078 |
if ((realm == null) && useDNS_Realm()) { |
|
1079 |
// use DNS to locate Kerberos realm |
|
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1080 |
try { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1081 |
realm = getRealmFromDNS(); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1082 |
} catch (KrbException ke) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1083 |
cause = ke; |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1084 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1085 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1086 |
if (realm == null) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1087 |
realm = java.security.AccessController.doPrivileged( |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1088 |
new java.security.PrivilegedAction<String>() { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1089 |
@Override |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1090 |
public String run() { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1091 |
String osname = System.getProperty("os.name"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1092 |
if (osname.startsWith("Windows")) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1093 |
return System.getenv("USERDNSDOMAIN"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1094 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1095 |
return null; |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1096 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1097 |
}); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1098 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1099 |
if (realm == null) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1100 |
KrbException ke = new KrbException("Cannot locate default realm"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1101 |
if (cause != null) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1102 |
ke.initCause(cause); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1103 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1104 |
throw ke; |
2 | 1105 |
} |
1106 |
return realm; |
|
1107 |
} |
|
1108 |
||
1109 |
/** |
|
1110 |
* Returns a list of KDC's with each KDC separated by a space |
|
1111 |
* |
|
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1112 |
* @param realm the realm for which the KDC list is desired |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1113 |
* @throws KrbException if there's no way to find KDC for the realm |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1114 |
* @return the list of KDCs separated by a space, always non null |
2 | 1115 |
*/ |
1116 |
public String getKDCList(String realm) throws KrbException { |
|
1117 |
if (realm == null) { |
|
1118 |
realm = getDefaultRealm(); |
|
1119 |
} |
|
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1120 |
if (realm.equalsIgnoreCase(defaultRealm)) { |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1121 |
return defaultKDC; |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1122 |
} |
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1123 |
Exception cause = null; |
2 | 1124 |
String kdcs = getDefault("kdc", realm); |
1125 |
if ((kdcs == null) && useDNS_KDC()) { |
|
1126 |
// use DNS to locate KDC |
|
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1127 |
try { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1128 |
kdcs = getKDCFromDNS(realm); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1129 |
} catch (KrbException ke) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1130 |
cause = ke; |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1131 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1132 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1133 |
if (kdcs == null) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1134 |
kdcs = java.security.AccessController.doPrivileged( |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1135 |
new java.security.PrivilegedAction<String>() { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1136 |
@Override |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1137 |
public String run() { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1138 |
String osname = System.getProperty("os.name"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1139 |
if (osname.startsWith("Windows")) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1140 |
String logonServer = System.getenv("LOGONSERVER"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1141 |
if (logonServer != null |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1142 |
&& logonServer.startsWith("\\\\")) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1143 |
logonServer = logonServer.substring(2); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1144 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1145 |
return logonServer; |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1146 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1147 |
return null; |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1148 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1149 |
}); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1150 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1151 |
if (kdcs == null) { |
3315
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1152 |
if (defaultKDC != null) { |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1153 |
return defaultKDC; |
2c61231c7973
6858589: more changes to Config on system properties
weijun
parents:
3221
diff
changeset
|
1154 |
} |
1947
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1155 |
KrbException ke = new KrbException("Cannot locate KDC"); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1156 |
if (cause != null) { |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1157 |
ke.initCause(cause); |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1158 |
} |
316d79a73e74
6785456: Read Kerberos setting from Windows environment variables
weijun
parents:
1946
diff
changeset
|
1159 |
throw ke; |
2 | 1160 |
} |
1161 |
return kdcs; |
|
1162 |
} |
|
1163 |
||
1164 |
/** |
|
1165 |
* Locate Kerberos realm using DNS |
|
1166 |
* |
|
1167 |
* @return the Kerberos realm |
|
1168 |
*/ |
|
1169 |
private String getRealmFromDNS() throws KrbException { |
|
1170 |
// use DNS to locate Kerberos realm |
|
1171 |
String realm = null; |
|
1172 |
String hostName = null; |
|
1173 |
try { |
|
1946 | 1174 |
hostName = InetAddress.getLocalHost().getCanonicalHostName(); |
2 | 1175 |
} catch (UnknownHostException e) { |
1176 |
KrbException ke = new KrbException(Krb5.KRB_ERR_GENERIC, |
|
1177 |
"Unable to locate Kerberos realm: " + e.getMessage()); |
|
1178 |
ke.initCause(e); |
|
1179 |
throw (ke); |
|
1180 |
} |
|
1181 |
// get the domain realm mapping from the configuration |
|
1182 |
String mapRealm = PrincipalName.mapHostToRealm(hostName); |
|
1183 |
String[] records = null; |
|
1184 |
String newRealm = mapRealm; |
|
1185 |
while ((records == null) && (newRealm != null)) { |
|
1186 |
// locate DNS TXT record |
|
1187 |
records = KrbServiceLocator.getKerberosService(newRealm); |
|
1188 |
newRealm = Realm.parseRealmComponent(newRealm); |
|
1189 |
// if no DNS TXT records found, try again using sub-realm |
|
1190 |
} |
|
1191 |
if (records == null) { |
|
1192 |
// no DNS TXT records |
|
1193 |
throw new KrbException(Krb5.KRB_ERR_GENERIC, |
|
1194 |
"Unable to locate Kerberos realm"); |
|
1195 |
} |
|
1196 |
boolean found = false; |
|
1197 |
for (int i = 0; i < records.length; i++) { |
|
1198 |
if (records[i].equals(mapRealm)) { |
|
1199 |
found = true; |
|
1200 |
realm = records[i]; |
|
1201 |
} |
|
1202 |
} |
|
1203 |
if (found == false) { |
|
1204 |
throw new KrbException(Krb5.KRB_ERR_GENERIC, |
|
1205 |
"Unable to locate Kerberos realm"); |
|
1206 |
} |
|
1207 |
return realm; |
|
1208 |
} |
|
1209 |
||
1210 |
/** |
|
1211 |
* Locate KDC using DNS |
|
1212 |
* |
|
1213 |
* @param realm the realm for which the master KDC is desired |
|
1214 |
* @return the KDC |
|
1215 |
*/ |
|
1216 |
private String getKDCFromDNS(String realm) throws KrbException { |
|
1217 |
// use DNS to locate KDC |
|
1218 |
String kdcs = null; |
|
1219 |
String[] srvs = null; |
|
1220 |
// locate DNS SRV record using UDP |
|
1221 |
srvs = KrbServiceLocator.getKerberosService(realm, "_udp."); |
|
1222 |
if (srvs == null) { |
|
1223 |
// locate DNS SRV record using TCP |
|
1224 |
srvs = KrbServiceLocator.getKerberosService(realm, "_tcp."); |
|
1225 |
} |
|
1226 |
if (srvs == null) { |
|
1227 |
// no DNS SRV records |
|
1228 |
throw new KrbException(Krb5.KRB_ERR_GENERIC, |
|
1229 |
"Unable to locate KDC for realm " + realm); |
|
1230 |
} |
|
1231 |
for (int i = 0; i < srvs.length; i++) { |
|
1232 |
String value = srvs[i]; |
|
1233 |
for (int j = 0; j < srvs[i].length(); j++) { |
|
1234 |
// filter the KDC name |
|
1235 |
if (value.charAt(j) == ':') { |
|
1236 |
kdcs = (value.substring(0, j)).trim(); |
|
1237 |
} |
|
1238 |
} |
|
1239 |
} |
|
1240 |
return kdcs; |
|
1241 |
} |
|
1242 |
||
1819 | 1243 |
private boolean fileExists(String name) { |
1244 |
return java.security.AccessController.doPrivileged( |
|
1245 |
new FileExistsAction(name)); |
|
1246 |
} |
|
1247 |
||
2 | 1248 |
static class FileExistsAction |
1249 |
implements java.security.PrivilegedAction<Boolean> { |
|
1250 |
||
1251 |
private String fileName; |
|
1252 |
||
1253 |
public FileExistsAction(String fileName) { |
|
1254 |
this.fileName = fileName; |
|
1255 |
} |
|
1256 |
||
1257 |
public Boolean run() { |
|
1258 |
return new File(fileName).exists(); |
|
1259 |
} |
|
1260 |
} |
|
1261 |
||
2587
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1262 |
@Override |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1263 |
public String toString() { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1264 |
StringBuffer sb = new StringBuffer(); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1265 |
toStringIndented("", stanzaTable, sb); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1266 |
return sb.toString(); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1267 |
} |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1268 |
private static void toStringIndented(String prefix, Object obj, |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1269 |
StringBuffer sb) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1270 |
if (obj instanceof String) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1271 |
sb.append(prefix); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1272 |
sb.append(obj); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1273 |
sb.append('\n'); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1274 |
} else if (obj instanceof Hashtable) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1275 |
Hashtable tab = (Hashtable)obj; |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1276 |
for (Object o: tab.keySet()) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1277 |
sb.append(prefix); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1278 |
sb.append(o); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1279 |
sb.append(" = {\n"); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1280 |
toStringIndented(prefix + " ", tab.get(o), sb); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1281 |
sb.append(prefix + "}\n"); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1282 |
} |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1283 |
} else if (obj instanceof Vector) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1284 |
Vector v = (Vector)obj; |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1285 |
for (Object o: v.toArray()) { |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1286 |
toStringIndented(prefix + " ", o, sb); |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1287 |
} |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1288 |
} |
42fa8d578501
6714845: Quotes in Kerberos configuration file are included in the values
weijun
parents:
1947
diff
changeset
|
1289 |
} |
2 | 1290 |
} |