Skip to content

Commit aa35f09

Browse files
GoeLinGoeLin
committed
8139348: Deprecate 3DES and RC4 in Kerberos
Backport-of: ded96dd
1 parent 765c5b4 commit aa35f09

File tree

7 files changed

+64
-43
lines changed

7 files changed

+64
-43
lines changed

‎src/java.security.jgss/share/classes/sun/security/krb5/internal/crypto/EType.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -236,8 +236,8 @@ public static int[] getBuiltInDefaults() {
236236
result = BUILTIN_ETYPES;
237237
}
238238
if (!allowWeakCrypto) {
239-
// The last 2 etypes are now weak ones
240-
return Arrays.copyOfRange(result, 0, result.length - 2);
239+
// The last 4 etypes are now weak ones
240+
return Arrays.copyOfRange(result, 0, result.length - 4);
241241
}
242242
return result;
243243
}

‎test/jdk/sun/security/krb5/auto/NewSalt.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -45,7 +45,7 @@ public static void main(String[] args)
4545
KDC kdc = new OneKDC(null);
4646
if (System.getProperty("onlyonepreauth") != null) {
4747
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
48-
"default_tgs_enctypes=des3-cbc-sha1");
48+
"default_tgs_enctypes=aes128-sha1");
4949
Config.refresh();
5050
kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
5151
}

‎test/jdk/sun/security/krb5/auto/W83.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -27,12 +27,12 @@
2727
* @summary kerberos login failure on win2008 with AD set to win2000 compat mode
2828
* and cannot login if session key and preauth does not use the same etype
2929
* @library /test/lib
30+
* @compile -XDignore.symbol.file W83.java
3031
* @run main jdk.test.lib.FileInstaller TestHosts TestHosts
3132
* @run main/othervm -D6932525 -Djdk.net.hosts.file=TestHosts W83
3233
* @run main/othervm -D6959292 -Djdk.net.hosts.file=TestHosts W83
3334
*/
3435
import com.sun.security.auth.module.Krb5LoginModule;
35-
import java.io.File;
3636
import sun.security.krb5.Config;
3737
import sun.security.krb5.EncryptedData;
3838
import sun.security.krb5.PrincipalName;
@@ -49,7 +49,8 @@ public static void main(String[] args) throws Exception {
4949
KDC kdc = new KDC(OneKDC.REALM, "127.0.0.1", 0, true);
5050
kdc.addPrincipal(OneKDC.USER, OneKDC.PASS);
5151
kdc.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);
52-
KDC.saveConfig(OneKDC.KRB5_CONF, kdc);
52+
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
53+
"allow_weak_crypto = true");
5354
System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF);
5455
Config.refresh();
5556

‎test/jdk/sun/security/krb5/etype/WeakCrypto.java‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -22,7 +22,7 @@
2222
*/
2323
/*
2424
* @test
25-
* @bug 6844909 8012679
25+
* @bug 6844909 8012679 8139348
2626
* @modules java.security.jgss/sun.security.krb5
2727
* java.security.jgss/sun.security.krb5.internal.crypto
2828
* @run main/othervm WeakCrypto
@@ -31,34 +31,52 @@
3131
* @summary support allow_weak_crypto in krb5.conf
3232
*/
3333

34-
import java.io.File;
3534
import java.lang.Exception;
3635
import java.nio.file.Files;
3736
import java.nio.file.Paths;
37+
import java.util.Arrays;
38+
import java.util.List;
3839

40+
import sun.security.krb5.EncryptionKey;
3941
import sun.security.krb5.internal.crypto.EType;
4042
import sun.security.krb5.EncryptedData;
4143

4244
public class WeakCrypto {
45+
46+
static List<Integer> weakOnes = List.of(
47+
EncryptedData.ETYPE_DES_CBC_CRC,
48+
EncryptedData.ETYPE_DES_CBC_MD5,
49+
EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD,
50+
EncryptedData.ETYPE_ARCFOUR_HMAC
51+
);
52+
4353
public static void main(String[] args) throws Exception {
54+
4455
String conf = "[libdefaults]\n" +
4556
(args.length > 0 ? ("allow_weak_crypto = " + args[0]) : "");
4657
Files.write(Paths.get("krb5.conf"), conf.getBytes());
4758
System.setProperty("java.security.krb5.conf", "krb5.conf");
4859

49-
boolean expected = args.length != 0 && args[0].equals("true");
50-
int[] etypes = EType.getBuiltInDefaults();
60+
// expected number of supported weak etypes
61+
int expected = 0;
62+
if (args.length != 0 && args[0].equals("true")) {
63+
expected = weakOnes.size();
64+
}
5165

52-
boolean found = false;
53-
for (int i=0, length = etypes.length; i<length; i++) {
54-
if (etypes[i] == EncryptedData.ETYPE_DES_CBC_CRC ||
55-
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD4 ||
56-
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD5) {
57-
found = true;
58-
}
66+
// Ensure EType.getBuiltInDefaults() has the correct etypes
67+
if (Arrays.stream(EType.getBuiltInDefaults())
68+
.filter(weakOnes::contains)
69+
.count() != expected) {
70+
throw new Exception("getBuiltInDefaults fails");
5971
}
60-
if (expected != found) {
61-
throw new Exception();
72+
73+
// Ensure keys generated have the correct etypes
74+
if (Arrays.stream(EncryptionKey.acquireSecretKeys(
75+
"password".toCharArray(), "salt"))
76+
.map(EncryptionKey::getEType)
77+
.filter(weakOnes::contains)
78+
.count() != expected) {
79+
throw new Exception("acquireSecretKeys fails");
6280
}
6381
}
6482
}

‎test/jdk/sun/security/krb5/etype/weakcrypto.conf‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎test/jdk/sun/security/krb5/tools/KtabCheck.java‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2019, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,7 @@
3434

3535
/*
3636
* @test
37-
* @bug 6950546
37+
* @bug 6950546 8139348
3838
* @summary "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
3939
* @requires os.family == "windows"
4040
* @library /test/lib
@@ -49,39 +49,43 @@ public static void main(String[] args) throws Exception {
4949

5050
Files.deleteIfExists(Path.of(KEYTAB));
5151

52+
// This test uses a krb5.conf file (onlythree.conf) in which
53+
// only 3 etypes in the default_tkt_enctypes setting are enabled
54+
// by default: aes128-cts(17), aes256-cts(18), and aes128-sha2(19).
55+
5256
ktab("-a me mine");
53-
check(1,16,1,23,1,17);
57+
check(1,17,1,18,1,19);
5458
ktab("-a me mine -n 0");
55-
check(0,16,0,23,0,17);
59+
check(0,17,0,18,0,19);
5660
ktab("-a me mine -n 1 -append");
57-
check(0,16,0,23,0,17,1,16,1,23,1,17);
61+
check(0,17,0,18,0,19,1,17,1,18,1,19);
5862
ktab("-a me mine -append");
59-
check(0,16,0,23,0,17,1,16,1,23,1,17,2,16,2,23,2,17);
63+
check(0,17,0,18,0,19,1,17,1,18,1,19,2,17,2,18,2,19);
6064
ktab("-a me mine");
61-
check(3,16,3,23,3,17);
65+
check(3,17,3,18,3,19);
6266
ktab("-a me mine -n 4 -append");
63-
check(3,16,3,23,3,17,4,16,4,23,4,17);
67+
check(3,17,3,18,3,19,4,17,4,18,4,19);
6468
ktab("-a me mine -n 5 -append");
65-
check(3,16,3,23,3,17,4,16,4,23,4,17,5,16,5,23,5,17);
69+
check(3,17,3,18,3,19,4,17,4,18,4,19,5,17,5,18,5,19);
6670
ktab("-a me mine -n 6 -append");
67-
check(3,16,3,23,3,17,4,16,4,23,4,17,5,16,5,23,5,17,6,16,6,23,6,17);
71+
check(3,17,3,18,3,19,4,17,4,18,4,19,5,17,5,18,5,19,6,17,6,18,6,19);
6872
ktab("-d me 3");
69-
check(4,16,4,23,4,17,5,16,5,23,5,17,6,16,6,23,6,17);
70-
ktab("-d me -e 16 6");
71-
check(4,16,4,23,4,17,5,16,5,23,5,17,6,23,6,17);
73+
check(4,17,4,18,4,19,5,17,5,18,5,19,6,17,6,18,6,19);
7274
ktab("-d me -e 17 6");
73-
check(4,16,4,23,4,17,5,16,5,23,5,17,6,23);
74-
ktab("-d me -e 16 5");
75-
check(4,16,4,23,4,17,5,23,5,17,6,23);
75+
check(4,17,4,18,4,19,5,17,5,18,5,19,6,18,6,19);
76+
ktab("-d me -e 19 6");
77+
check(4,17,4,18,4,19,5,17,5,18,5,19,6,18);
78+
ktab("-d me -e 17 5");
79+
check(4,17,4,18,4,19,5,18,5,19,6,18);
7680
ktab("-d me old");
77-
check(4,16,5,17,6,23);
81+
check(4,17,5,19,6,18);
7882
try {
7983
ktab("-d me old");
8084
throw new Exception("Should fail");
8185
} catch (Exception e) {
8286
// no-op
8387
}
84-
check(4,16,5,17,6,23);
88+
check(4,17,5,19,6,18);
8589
ktab("-d me");
8690
check();
8791
}

‎test/jdk/sun/security/krb5/tools/onlythree.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[libdefaults]
22
default_realm = LOCAL.COM
3-
default_tkt_enctypes = des3-cbc-sha1 rc4-hmac aes128-cts
3+
default_tkt_enctypes = des-cbc-crc des-cbc-md5 des3-cbc-sha1 rc4-hmac aes128-cts aes256-cts aes128-sha2
44

55
[realms]
66
LOCAL.COM = {

0 commit comments

Comments
 (0)