--- a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java Sat Dec 15 15:07:35 2012 +0000
+++ b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java Mon Dec 17 12:18:46 2012 +0800
@@ -555,6 +555,12 @@
int ktype;
boolean etypeFound = false;
+
+ // When no matched kvno is found, returns tke key of the same
+ // etype with the highest kvno
+ int kvno_found = 0;
+ EncryptionKey key_found = null;
+
for (int i = 0; i < keys.length; i++) {
ktype = keys[i].getEType();
if (EType.isSupported(ktype)) {
@@ -563,6 +569,10 @@
etypeFound = true;
if (versionMatches(kvno, kv)) {
return keys[i];
+ } else if (kv > kvno_found) {
+ // kv is not null
+ key_found = keys[i];
+ kvno_found = kv;
}
}
}
@@ -580,12 +590,17 @@
etypeFound = true;
if (versionMatches(kvno, kv)) {
return new EncryptionKey(etype, keys[i].getBytes());
+ } else if (kv > kvno_found) {
+ key_found = new EncryptionKey(etype, keys[i].getBytes());
+ kvno_found = kv;
}
}
}
}
if (etypeFound) {
- throw new KrbException(Krb5.KRB_AP_ERR_BADKEYVER);
+ return key_found;
+ // For compatibility, will not fail here.
+ //throw new KrbException(Krb5.KRB_AP_ERR_BADKEYVER);
}
return null;
}
--- a/jdk/test/sun/security/krb5/auto/DynamicKeytab.java Sat Dec 15 15:07:35 2012 +0000
+++ b/jdk/test/sun/security/krb5/auto/DynamicKeytab.java Mon Dec 17 12:18:46 2012 +0800
@@ -110,11 +110,13 @@
throw new Exception("Should not success");
} catch (GSSException gsse) {
System.out.println(gsse);
- KrbException ke = (KrbException)gsse.getCause();
- if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) {
- throw new Exception("Not expected failure code: " +
- ke.returnCode());
- }
+ // Since 7197159, different kvno is accepted, this return code
+ // will never be thrown out again.
+ //KrbException ke = (KrbException)gsse.getCause();
+ //if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) {
+ // throw new Exception("Not expected failure code: " +
+ // ke.returnCode());
+ //}
}
// Test 8: an empty KDC means revoke all
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/jdk/test/sun/security/krb5/auto/KvnoNA.java Mon Dec 17 12:18:46 2012 +0800
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 7197159
+ * @compile -XDignore.symbol.file KvnoNA.java
+ * @run main/othervm KvnoNA
+ * @summary accept different kvno if there no match
+ */
+
+import org.ietf.jgss.GSSException;
+import sun.security.jgss.GSSUtil;
+import sun.security.krb5.KrbException;
+import sun.security.krb5.PrincipalName;
+import sun.security.krb5.internal.ktab.KeyTab;
+import sun.security.krb5.internal.Krb5;
+
+public class KvnoNA {
+
+ public static void main(String[] args)
+ throws Exception {
+
+ OneKDC kdc = new OneKDC(null);
+ kdc.writeJAASConf();
+
+ // In KDC, it's 2
+ char[] pass = "pass2".toCharArray();
+ kdc.addPrincipal(OneKDC.SERVER, pass);
+
+ // In ktab, kvno is 1 or 3, 3 has the same password
+ KeyTab ktab = KeyTab.create(OneKDC.KTAB);
+ PrincipalName p = new PrincipalName(
+ OneKDC.SERVER+"@"+OneKDC.REALM, PrincipalName.KRB_NT_SRV_HST);
+ ktab.addEntry(p, "pass1".toCharArray(), 1, true);
+ ktab.addEntry(p, "pass2".toCharArray(), 3, true);
+ ktab.save();
+
+ Context c, s;
+
+ c = Context.fromUserPass("dummy", "bogus".toCharArray(), false);
+ s = Context.fromJAAS("server");
+
+ c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
+ s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
+
+ Context.handshake(c, s);
+
+ s.dispose();
+ c.dispose();
+ }
+}
--- a/jdk/test/sun/security/krb5/auto/MoreKvno.java Sat Dec 15 15:07:35 2012 +0000
+++ b/jdk/test/sun/security/krb5/auto/MoreKvno.java Mon Dec 17 12:18:46 2012 +0800
@@ -23,8 +23,7 @@
/*
* @test
- * @bug 6893158
- * @bug 6907425
+ * @bug 6893158 6907425 7197159
* @run main/othervm MoreKvno
* @summary AP_REQ check should use key version number
*/
@@ -69,11 +68,13 @@
go(OneKDC.SERVER, "com.sun.security.jgss.krb5.accept", pass);
throw new Exception("This test should fail");
} catch (GSSException gsse) {
- KrbException ke = (KrbException)gsse.getCause();
- if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) {
- throw new Exception("Not expected failure code: " +
- ke.returnCode());
- }
+ // Since 7197159, different kvno is accepted, this return code
+ // will never be thrown out again.
+ //KrbException ke = (KrbException)gsse.getCause();
+ //if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) {
+ // throw new Exception("Not expected failure code: " +
+ // ke.returnCode());
+ //}
}
}