提交 f1a0ff52 编写于 作者: W weijun

8012082: SASL: auth-conf negotiated, but unencrypted data is accepted, reset to unencrypt

Reviewed-by: vinnie
上级 d37a6bcc
...@@ -45,7 +45,6 @@ abstract class GssKrb5Base extends AbstractSaslImpl { ...@@ -45,7 +45,6 @@ abstract class GssKrb5Base extends AbstractSaslImpl {
} }
protected GSSContext secCtx = null; protected GSSContext secCtx = null;
protected MessageProp msgProp; // QOP and privacy for unwrap
protected static final int JGSS_QOP = 0; // unrelated to SASL QOP mask protected static final int JGSS_QOP = 0; // unrelated to SASL QOP mask
protected GssKrb5Base(Map<String, ?> props, String className) protected GssKrb5Base(Map<String, ?> props, String className)
...@@ -74,6 +73,7 @@ abstract class GssKrb5Base extends AbstractSaslImpl { ...@@ -74,6 +73,7 @@ abstract class GssKrb5Base extends AbstractSaslImpl {
} }
try { try {
MessageProp msgProp = new MessageProp(JGSS_QOP, privacy);
byte[] answer = secCtx.unwrap(incoming, start, len, msgProp); byte[] answer = secCtx.unwrap(incoming, start, len, msgProp);
if (logger.isLoggable(Level.FINEST)) { if (logger.isLoggable(Level.FINEST)) {
traceOutput(myClassName, "KRB501:Unwrap", "incoming: ", traceOutput(myClassName, "KRB501:Unwrap", "incoming: ",
...@@ -99,6 +99,7 @@ abstract class GssKrb5Base extends AbstractSaslImpl { ...@@ -99,6 +99,7 @@ abstract class GssKrb5Base extends AbstractSaslImpl {
// Generate GSS token // Generate GSS token
try { try {
MessageProp msgProp = new MessageProp(JGSS_QOP, privacy);
byte[] answer = secCtx.wrap(outgoing, start, len, msgProp); byte[] answer = secCtx.wrap(outgoing, start, len, msgProp);
if (logger.isLoggable(Level.FINEST)) { if (logger.isLoggable(Level.FINEST)) {
traceOutput(myClassName, "KRB503:Wrap", "outgoing: ", traceOutput(myClassName, "KRB503:Wrap", "outgoing: ",
......
...@@ -320,7 +320,6 @@ final class GssKrb5Client extends GssKrb5Base implements SaslClient { ...@@ -320,7 +320,6 @@ final class GssKrb5Client extends GssKrb5Base implements SaslClient {
} }
completed = true; // server authenticated completed = true; // server authenticated
msgProp = new MessageProp(JGSS_QOP, privacy);
return gssOutToken; return gssOutToken;
} catch (GSSException e) { } catch (GSSException e) {
......
...@@ -270,7 +270,6 @@ final class GssKrb5Server extends GssKrb5Base implements SaslServer { ...@@ -270,7 +270,6 @@ final class GssKrb5Server extends GssKrb5Base implements SaslServer {
} else if ((selectedQop&INTEGRITY_ONLY_PROTECTION) != 0) { } else if ((selectedQop&INTEGRITY_ONLY_PROTECTION) != 0) {
integrity = true; integrity = true;
} }
msgProp = new MessageProp(JGSS_QOP, privacy);
// 2nd-4th octets specifies maximum buffer size expected by // 2nd-4th octets specifies maximum buffer size expected by
// client (in network byte order). This is the server's send // client (in network byte order). This is the server's send
......
/*
* Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8012082
* @summary SASL: auth-conf negotiated, but unencrypted data is accepted,
* reset to unencrypt
* @compile -XDignore.symbol.file SaslGSS.java
* @run main/othervm SaslGSS
*/
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.sasl.AuthorizeCallback;
import javax.security.sasl.RealmCallback;
import javax.security.sasl.Sasl;
import javax.security.sasl.SaslServer;
import java.io.IOException;
import java.util.HashMap;
import java.util.Locale;
import org.ietf.jgss.*;
import sun.security.jgss.GSSUtil;
public class SaslGSS {
public static void main(String[] args) throws Exception {
String name = "host." + OneKDC.REALM.toLowerCase(Locale.US);
new OneKDC(null).writeJAASConf();
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
// Client in JGSS so that it can control wrap privacy mode
GSSManager m = GSSManager.getInstance();
GSSContext sc = m.createContext(
m.createName(OneKDC.SERVER, GSSUtil.NT_GSS_KRB5_PRINCIPAL),
GSSUtil.GSS_KRB5_MECH_OID,
null,
GSSContext.DEFAULT_LIFETIME);
sc.requestMutualAuth(false);
// Server in SASL
final HashMap props = new HashMap();
props.put(Sasl.QOP, "auth-conf");
SaslServer ss = Sasl.createSaslServer("GSSAPI", "server",
name, props,
new CallbackHandler() {
public void handle(Callback[] callbacks)
throws IOException, UnsupportedCallbackException {
for (Callback cb : callbacks) {
if (cb instanceof RealmCallback) {
((RealmCallback) cb).setText(OneKDC.REALM);
} else if (cb instanceof AuthorizeCallback) {
((AuthorizeCallback) cb).setAuthorized(true);
}
}
}
});
// Handshake
byte[] token = new byte[0];
token = sc.initSecContext(token, 0, token.length);
token = ss.evaluateResponse(token);
token = sc.unwrap(token, 0, token.length, new MessageProp(0, false));
token[0] = (byte)(((token[0] & 4) != 0) ? 4 : 2);
token = sc.wrap(token, 0, token.length, new MessageProp(0, false));
ss.evaluateResponse(token);
// Talk
// 1. Client sends a auth-int message
byte[] hello = "hello".getBytes();
MessageProp qop = new MessageProp(0, false);
token = sc.wrap(hello, 0, hello.length, qop);
// 2. Server accepts it anyway
ss.unwrap(token, 0, token.length);
// 3. Server sends a message
token = ss.wrap(hello, 0, hello.length);
// 4. Client accepts, should be auth-conf
sc.unwrap(token, 0, token.length, qop);
if (!qop.getPrivacy()) {
throw new Exception();
}
}
}
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册