KrbSafe.java

/*
 * Copyright (c) 2000, 2004, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

/*
 *  (C) Copyright IBM Corp. 1999 All Rights Reserved.
 *  Copyright 1997 The Open Group Research Institute.  All rights reserved.
 */

package sun.security.krb5;

import sun.security.krb5.EncryptionKey;
import sun.security.krb5.internal.*;
import sun.security.krb5.internal.crypto.*;
import java.io.IOException;

class KrbSafe extends KrbAppMessage {

    private byte[] obuf;
    private byte[] userData;

    public KrbSafe(byte[] userData,
		   Credentials creds,
		   EncryptionKey subKey,
		   KerberosTime timestamp,
		   SeqNumber seqNumber,
		   HostAddress saddr,
		   HostAddress raddr
		   )  throws KrbException, IOException {
	EncryptionKey reqKey = null;
	if (subKey != null)
	    reqKey = subKey;
	else
	    reqKey = creds.key;
	
	obuf = mk_safe(userData,
		       reqKey,
		       timestamp,
		       seqNumber,
		       saddr,
		       raddr
		       );
    }
    
    public KrbSafe(byte[] msg,
		   Credentials creds,
		   EncryptionKey subKey,
		   SeqNumber seqNumber,
		   HostAddress saddr,
		   HostAddress raddr,
		   boolean timestampRequired,
		   boolean seqNumberRequired
		   )  throws KrbException, IOException {
	
	KRBSafe krb_safe = new KRBSafe(msg);
	
	EncryptionKey reqKey = null;
	if (subKey != null)
	    reqKey = subKey;
	else
	    reqKey = creds.key;
	
	userData = rd_safe(
			   krb_safe,
			   reqKey,
			   seqNumber,
			   saddr,
			   raddr,
			   timestampRequired,
			   seqNumberRequired,
			   creds.client,
			   creds.client.getRealm()
			   );
    }
    
    public byte[] getMessage() {
	return obuf;
    }
    
    public byte[] getData() {
	return userData;
    }

    private  byte[] mk_safe(byte[] userData,
			    EncryptionKey key,
			    KerberosTime timestamp,
			    SeqNumber seqNumber,
			    HostAddress sAddress,
			    HostAddress rAddress
			    ) throws Asn1Exception, IOException, KdcErrException,
			    KrbApErrException, KrbCryptoException {
	
				Integer usec = null;
				Integer seqno = null;
	
				if (timestamp != null)
				usec = new Integer(timestamp.getMicroSeconds());
	
				if (seqNumber != null) {
				    seqno = new Integer(seqNumber.current());
				    seqNumber.step();
				}
	
				KRBSafeBody krb_safeBody = 
				new KRBSafeBody(userData,
						timestamp,
						usec,
						seqno,
						sAddress,
						rAddress
						);
	
				byte[] temp = krb_safeBody.asn1Encode();
				Checksum cksum = new Checksum(
				    Checksum.SAFECKSUMTYPE_DEFAULT,
				    temp,
				    key,
				    KeyUsage.KU_KRB_SAFE_CKSUM
				    );
	
				KRBSafe krb_safe = new KRBSafe(krb_safeBody, cksum);
	
				temp = krb_safe.asn1Encode();
	
				return krb_safe.asn1Encode();
			    }
        
    private byte[] rd_safe(KRBSafe krb_safe,
			   EncryptionKey key,
			   SeqNumber seqNumber,
			   HostAddress sAddress,
			   HostAddress rAddress,
			   boolean timestampRequired,
			   boolean seqNumberRequired,
			   PrincipalName cname,
			   Realm crealm
			   ) throws Asn1Exception, KdcErrException, 
			   KrbApErrException, IOException, KrbCryptoException {
	
			       byte[] temp = krb_safe.safeBody.asn1Encode();
	
			       if (!krb_safe.cksum.verifyKeyedChecksum(temp, key,
				   KeyUsage.KU_KRB_SAFE_CKSUM)) {
			               throw new KrbApErrException(
					   Krb5.KRB_AP_ERR_MODIFIED);
			       }
	
			       check(krb_safe.safeBody.timestamp,
				     krb_safe.safeBody.usec,
				     krb_safe.safeBody.seqNumber,
				     krb_safe.safeBody.sAddress,
				     krb_safe.safeBody.rAddress,
				     seqNumber,
				     sAddress,
				     rAddress,
				     timestampRequired,
				     seqNumberRequired,
				     cname,
				     crealm
				     );
	
			       return krb_safe.safeBody.userData;
			   }
}