Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
8139348: Deprecate 3DES and RC4 in Kerberos 
Reviewed-by: mullan
  • Loading branch information
@wangweij
wangweij committed Feb 25, 2021
1 parent 5a9b701 commit ded96dd
Show file tree
Hide file tree
Showing 7 changed files with 64 additions and 43 deletions.
6 changes: 3 additions & 3 deletions src/java.security.jgss/share/classes/sun/security/krb5/internal/crypto/EType.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -236,8 +236,8 @@ public static int[] getBuiltInDefaults() {
result = BUILTIN_ETYPES;
}
if (!allowWeakCrypto) {
// The last 2 etypes are now weak ones
return Arrays.copyOfRange(result, 0, result.length - 2);
// The last 4 etypes are now weak ones
return Arrays.copyOfRange(result, 0, result.length - 4);
}
return result;
}
Expand Down
4 changes: 2 additions & 2 deletions test/jdk/sun/security/krb5/auto/NewSalt.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -45,7 +45,7 @@ public static void main(String[] args)
KDC kdc = new OneKDC(null);
if (System.getProperty("onlyonepreauth") != null) {
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
"default_tgs_enctypes=des3-cbc-sha1");
"default_tgs_enctypes=aes128-sha1");
Config.refresh();
kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
}
Expand Down
7 changes: 4 additions & 3 deletions test/jdk/sun/security/krb5/auto/W83.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -27,12 +27,12 @@
* @summary kerberos login failure on win2008 with AD set to win2000 compat mode
* and cannot login if session key and preauth does not use the same etype
* @library /test/lib
* @compile -XDignore.symbol.file W83.java
* @run main jdk.test.lib.FileInstaller TestHosts TestHosts
* @run main/othervm -D6932525 -Djdk.net.hosts.file=TestHosts W83
* @run main/othervm -D6959292 -Djdk.net.hosts.file=TestHosts W83
*/
import com.sun.security.auth.module.Krb5LoginModule;
import java.io.File;
import sun.security.krb5.Config;
import sun.security.krb5.EncryptedData;
import sun.security.krb5.PrincipalName;
Expand All @@ -49,7 +49,8 @@ public static void main(String[] args) throws Exception {
KDC kdc = new KDC(OneKDC.REALM, "127.0.0.1", 0, true);
kdc.addPrincipal(OneKDC.USER, OneKDC.PASS);
kdc.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);
KDC.saveConfig(OneKDC.KRB5_CONF, kdc);
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
"allow_weak_crypto = true");
System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF);
Config.refresh();

Expand Down
46 changes: 32 additions & 14 deletions test/jdk/sun/security/krb5/etype/WeakCrypto.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand All @@ -22,7 +22,7 @@
*/
/*
* @test
* @bug 6844909 8012679
* @bug 6844909 8012679 8139348
* @modules java.security.jgss/sun.security.krb5
* java.security.jgss/sun.security.krb5.internal.crypto
* @run main/othervm WeakCrypto
Expand All @@ -31,34 +31,52 @@
* @summary support allow_weak_crypto in krb5.conf
*/

import java.io.File;
import java.lang.Exception;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Arrays;
import java.util.List;

import sun.security.krb5.EncryptionKey;
import sun.security.krb5.internal.crypto.EType;
import sun.security.krb5.EncryptedData;

public class WeakCrypto {

static List<Integer> weakOnes = List.of(
EncryptedData.ETYPE_DES_CBC_CRC,
EncryptedData.ETYPE_DES_CBC_MD5,
EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD,
EncryptedData.ETYPE_ARCFOUR_HMAC
);

public static void main(String[] args) throws Exception {

String conf = "[libdefaults]\n" +
(args.length > 0 ? ("allow_weak_crypto = " + args[0]) : "");
Files.write(Paths.get("krb5.conf"), conf.getBytes());
System.setProperty("java.security.krb5.conf", "krb5.conf");

boolean expected = args.length != 0 && args[0].equals("true");
int[] etypes = EType.getBuiltInDefaults();
// expected number of supported weak etypes
int expected = 0;
if (args.length != 0 && args[0].equals("true")) {
expected = weakOnes.size();
}

boolean found = false;
for (int i=0, length = etypes.length; i<length; i++) {
if (etypes[i] == EncryptedData.ETYPE_DES_CBC_CRC ||
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD4 ||
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD5) {
found = true;
}
// Ensure EType.getBuiltInDefaults() has the correct etypes
if (Arrays.stream(EType.getBuiltInDefaults())
.filter(weakOnes::contains)
.count() != expected) {
throw new Exception("getBuiltInDefaults fails");
}
if (expected != found) {
throw new Exception();

// Ensure keys generated have the correct etypes
if (Arrays.stream(EncryptionKey.acquireSecretKeys(
"password".toCharArray(), "salt"))
.map(EncryptionKey::getEType)
.filter(weakOnes::contains)
.count() != expected) {
throw new Exception("acquireSecretKeys fails");
}
}
}
2 changes: 0 additions & 2 deletions test/jdk/sun/security/krb5/etype/weakcrypto.conf
View file

This file was deleted.

40 changes: 22 additions & 18 deletions test/jdk/sun/security/krb5/tools/KtabCheck.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -34,7 +34,7 @@

/*
* @test
* @bug 6950546
* @bug 6950546 8139348
* @summary "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
* @requires os.family == "windows"
* @library /test/lib
Expand All @@ -49,39 +49,43 @@ public static void main(String[] args) throws Exception {

Files.deleteIfExists(Path.of(KEYTAB));

// This test uses a krb5.conf file (onlythree.conf) in which
// only 3 etypes in the default_tkt_enctypes setting are enabled
// by default: aes128-cts(17), aes256-cts(18), and aes128-sha2(19).

ktab("-a me mine");
check(1,16,1,23,1,17);
check(1,17,1,18,1,19);
ktab("-a me mine -n 0");
check(0,16,0,23,0,17);
check(0,17,0,18,0,19);
ktab("-a me mine -n 1 -append");
check(0,16,0,23,0,17,1,16,1,23,1,17);
check(0,17,0,18,0,19,1,17,1,18,1,19);
ktab("-a me mine -append");
check(0,16,0,23,0,17,1,16,1,23,1,17,2,16,2,23,2,17);
check(0,17,0,18,0,19,1,17,1,18,1,19,2,17,2,18,2,19);
ktab("-a me mine");
check(3,16,3,23,3,17);
check(3,17,3,18,3,19);
ktab("-a me mine -n 4 -append");
check(3,16,3,23,3,17,4,16,4,23,4,17);
check(3,17,3,18,3,19,4,17,4,18,4,19);
ktab("-a me mine -n 5 -append");
check(3,16,3,23,3,17,4,16,4,23,4,17,5,16,5,23,5,17);
check(3,17,3,18,3,19,4,17,4,18,4,19,5,17,5,18,5,19);
ktab("-a me mine -n 6 -append");
check(3,16,3,23,3,17,4,16,4,23,4,17,5,16,5,23,5,17,6,16,6,23,6,17);
check(3,17,3,18,3,19,4,17,4,18,4,19,5,17,5,18,5,19,6,17,6,18,6,19);
ktab("-d me 3");
check(4,16,4,23,4,17,5,16,5,23,5,17,6,16,6,23,6,17);
ktab("-d me -e 16 6");
check(4,16,4,23,4,17,5,16,5,23,5,17,6,23,6,17);
check(4,17,4,18,4,19,5,17,5,18,5,19,6,17,6,18,6,19);
ktab("-d me -e 17 6");
check(4,16,4,23,4,17,5,16,5,23,5,17,6,23);
ktab("-d me -e 16 5");
check(4,16,4,23,4,17,5,23,5,17,6,23);
check(4,17,4,18,4,19,5,17,5,18,5,19,6,18,6,19);
ktab("-d me -e 19 6");
check(4,17,4,18,4,19,5,17,5,18,5,19,6,18);
ktab("-d me -e 17 5");
check(4,17,4,18,4,19,5,18,5,19,6,18);
ktab("-d me old");
check(4,16,5,17,6,23);
check(4,17,5,19,6,18);
try {
ktab("-d me old");
throw new Exception("Should fail");
} catch (Exception e) {
// no-op
}
check(4,16,5,17,6,23);
check(4,17,5,19,6,18);
ktab("-d me");
check();
}
Expand Down
2 changes: 1 addition & 1 deletion test/jdk/sun/security/krb5/tools/onlythree.conf
View file
@@ -1,6 +1,6 @@
[libdefaults]
default_realm = LOCAL.COM
default_tkt_enctypes = des3-cbc-sha1 rc4-hmac aes128-cts
default_tkt_enctypes = des-cbc-crc des-cbc-md5 des3-cbc-sha1 rc4-hmac aes128-cts aes256-cts aes128-sha2

[realms]
LOCAL.COM = {
Expand Down

3 comments on commit ded96dd

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review

Issues

@GoeLin
Copy link
Member

@GoeLin GoeLin commented on ded96dd Jun 9, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/backport jdk11u-dev

@openjdk
Copy link

@openjdk openjdk bot commented on ded96dd Jun 9, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@GoeLin the backport was successfully created on the branch GoeLin-backport-ded96ddc in my personal fork of openjdk/jdk11u-dev. To create a pull request with this backport targeting openjdk/jdk11u-dev:master, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit ded96ddc from the openjdk/jdk repository.

The commit being backported was authored by Weijun Wang on 25 Feb 2021 and was reviewed by Sean Mullan.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jdk11u-dev:

$ git fetch https://github.com/openjdk-bots/jdk11u-dev GoeLin-backport-ded96ddc:GoeLin-backport-ded96ddc
$ git checkout GoeLin-backport-ded96ddc
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jdk11u-dev GoeLin-backport-ded96ddc

Please sign in to comment.