You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by pl...@apache.org on 2015/07/30 08:24:47 UTC
[40/50] [abbrv] directory-kerby git commit: DIRKRB-344 Encryption
type negotiation issue between client and KDC(kerby client will retry after
preatuh fail.)
DIRKRB-344 Encryption type negotiation issue between client and KDC(kerby client will retry after preatuh fail.)
Project: http://git-wip-us.apache.org/repos/asf/directory-kerby/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-kerby/commit/ea31281a
Tree: http://git-wip-us.apache.org/repos/asf/directory-kerby/tree/ea31281a
Diff: http://git-wip-us.apache.org/repos/asf/directory-kerby/diff/ea31281a
Branch: refs/heads/pkinit-support
Commit: ea31281af2feaecca7787a7b1fd2667e3256e05a
Parents: 8f4eb7f
Author: plusplusjiajia <ji...@intel.com>
Authored: Thu Jul 23 13:26:10 2015 +0800
Committer: plusplusjiajia <ji...@intel.com>
Committed: Thu Jul 23 13:26:10 2015 +0800
----------------------------------------------------------------------
.../kerberos/kdc/EncryptionTypeKdcTest.java | 72 ++++++++++++++++++++
.../kerby/kerberos/kerb/client/KrbHandler.java | 34 ++++++++-
.../kerb/client/preauth/PreauthContext.java | 4 ++
.../kerb/client/request/KdcRequest.java | 4 ++
.../kerby/kerberos/kerb/server/KdcTestBase.java | 7 +-
5 files changed, 118 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/ea31281a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/EncryptionTypeKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/EncryptionTypeKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/EncryptionTypeKdcTest.java
new file mode 100644
index 0000000..e327f1f
--- /dev/null
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/EncryptionTypeKdcTest.java
@@ -0,0 +1,72 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kdc;
+
+import org.apache.kerby.kerberos.kdc.identitybackend.JsonIdentityBackend;
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbConfig;
+import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
+import org.apache.kerby.kerberos.kerb.identity.backend.BackendConfig;
+import org.apache.kerby.kerberos.kerb.server.KdcConfigKey;
+import org.junit.AfterClass;
+import org.junit.Test;
+
+import java.io.File;
+
+public class EncryptionTypeKdcTest extends KerbyKdcTest {
+
+ private static File jsonBackendFile;
+
+ @Override
+ protected void configKdcSeverAndClient() {
+ super.configKdcSeverAndClient();
+ KrbConfig krbConfig = getKrbClient().getKrbConfig();
+ krbConfig.setBoolean(KrbConfigKey.PREAUTH_REQUIRED, false);
+ krbConfig.setString(KrbConfigKey.PERMITTED_ENCTYPES,
+ "es256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des-cbc-crc des-cbc-md5 des3-cbc-sha1");
+ }
+
+ @Override
+ protected void prepareKdc() throws KrbException {
+ super.prepareKdc();
+
+ File testDir = new File(System.getProperty("test.dir", "target"));
+ jsonBackendFile = new File(testDir, "json-backend-file");
+ String jsonBackendFileString = jsonBackendFile.getAbsolutePath();
+
+ BackendConfig backendConfig = getKdcServer().getBackendConfig();
+ backendConfig.setString(
+ JsonIdentityBackend.JSON_IDENTITY_BACKEND_DIR, jsonBackendFileString);
+ backendConfig.setString(KdcConfigKey.KDC_IDENTITY_BACKEND,
+ "org.apache.kerby.kerberos.kdc.identitybackend.JsonIdentityBackend");
+ }
+
+ @Test
+ public void testKdc() throws Exception {
+ performKdcTest();
+ }
+
+ @AfterClass
+ public static void rmJsonBackendFile() {
+ if (jsonBackendFile.exists()) {
+ jsonBackendFile.delete();
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/ea31281a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/KrbHandler.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/KrbHandler.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/KrbHandler.java
index 762d700..b27d9bd 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/KrbHandler.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/KrbHandler.java
@@ -20,21 +20,33 @@
package org.apache.kerby.kerberos.kerb.client;
import org.apache.kerby.kerberos.kerb.KrbCodec;
+import org.apache.kerby.kerberos.kerb.KrbErrorCode;
import org.apache.kerby.kerberos.kerb.KrbException;
import org.apache.kerby.kerberos.kerb.client.preauth.PreauthHandler;
import org.apache.kerby.kerberos.kerb.client.request.KdcRequest;
+import org.apache.kerby.kerberos.kerb.spec.base.EncryptionType;
+import org.apache.kerby.kerberos.kerb.spec.base.EtypeInfo2;
+import org.apache.kerby.kerberos.kerb.spec.base.EtypeInfo2Entry;
import org.apache.kerby.kerberos.kerb.spec.base.KrbError;
import org.apache.kerby.kerberos.kerb.spec.base.KrbMessage;
import org.apache.kerby.kerberos.kerb.spec.base.KrbMessageType;
+import org.apache.kerby.kerberos.kerb.spec.base.MethodData;
import org.apache.kerby.kerberos.kerb.spec.kdc.KdcRep;
import org.apache.kerby.kerberos.kerb.spec.kdc.KdcReq;
+import org.apache.kerby.kerberos.kerb.spec.pa.PaDataEntry;
+import org.apache.kerby.kerberos.kerb.spec.pa.PaDataType;
import org.apache.kerby.kerberos.kerb.transport.KrbTransport;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.List;
public abstract class KrbHandler {
+ private static final Logger LOG = LoggerFactory.getLogger(KrbHandler.class);
private PreauthHandler preauthHandler;
public void init(KrbContext context) {
@@ -83,9 +95,27 @@ public abstract class KrbHandler {
kdcRequest.processResponse((KdcRep) kdcRep);
} else if (messageType == KrbMessageType.KRB_ERROR) {
KrbError error = (KrbError) kdcRep;
- //TODO: Should use the error message, now only print it.
- System.out.println("KDC server responsed with message: "
+ LOG.info("KDC server responsed with message: "
+ error.getErrorCode().getMessage());
+ if (error.getErrorCode() == KrbErrorCode.KDC_ERR_PREAUTH_REQUIRED) {
+ MethodData methodData = KrbCodec.decode(error.getEdata(), MethodData.class);
+ List<PaDataEntry> paDataEntryList = methodData.getElements();
+ List<EncryptionType> encryptionTypes = new ArrayList<>();
+ for (PaDataEntry paDataEntry : paDataEntryList) {
+ if (paDataEntry.getPaDataType() == PaDataType.ETYPE_INFO2) {
+ EtypeInfo2 etypeInfo2 = KrbCodec.decode(paDataEntry.getPaDataValue(),
+ EtypeInfo2.class);
+ List<EtypeInfo2Entry> info2Entries = etypeInfo2.getElements();
+ for (EtypeInfo2Entry info2Entry : info2Entries) {
+ encryptionTypes.add(info2Entry.getEtype());
+ }
+ }
+ }
+ kdcRequest.setEncryptionTypes(encryptionTypes);
+ kdcRequest.setPreauthRequired(true);
+ kdcRequest.resetPrequthContxt();
+ handleRequest(kdcRequest);
+ }
}
}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/ea31281a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/preauth/PreauthContext.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/preauth/PreauthContext.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/preauth/PreauthContext.java
index c8f5858..63c59ab 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/preauth/PreauthContext.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/preauth/PreauthContext.java
@@ -41,6 +41,10 @@ public class PreauthContext {
this.outputPaData = new PaData();
}
+ public void reset() {
+ this.outputPaData = new PaData();
+ }
+
public boolean isPreauthRequired() {
return preauthRequired;
}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/ea31281a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
index 8a3784e..50ae39f 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/KdcRequest.java
@@ -148,6 +148,10 @@ public abstract class KdcRequest {
preauthContext.setPreauthRequired(preauthRequired);
}
+ public void resetPrequthContxt() {
+ preauthContext.reset();
+ }
+
public PreauthContext getPreauthContext() {
return preauthContext;
}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/ea31281a/kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
index ae0c7fe..49bf5cf 100644
--- a/kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+++ b/kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
@@ -116,9 +116,14 @@ public abstract class KdcTestBase {
kdcServer.init();
}
+ protected void configKdcSeverAndClient() {
+ kdcServer.setWorkDir(testDir);
+ }
+
protected void setUpKdcServer() throws Exception {
kdcServer = new TestKdcServer(allowTcp(), allowUdp());
- kdcServer.setWorkDir(testDir);
+
+ configKdcSeverAndClient();
prepareKdc();