Skip to content
This repository has been archived by the owner on Feb 2, 2023. It is now read-only.

Commit

Permalink
8279520: SPNEGO has not passed channel binding info into the underlyi…
Browse files Browse the repository at this point in the history 
…ng mechanism

Backport-of: 8d0f385fd0243c3e38b400f463b8d9727b0a5956
  • Loading branch information
Olga Mikhaltsova committed Jul 15, 2022
1 parent 525396a commit e93cf85
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 13 deletions.
4 changes: 3 additions & 1 deletion src/java.security.jgss/share/classes/sun/security/jgss/spnego/SpNegoContext.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -866,6 +866,7 @@ private byte[] GSS_initSecContext(byte[] token) throws GSSException {
mechContext.requestMutualAuth(mutualAuthState);
mechContext.requestReplayDet(replayDetState);
mechContext.requestSequenceDet(sequenceDetState);
mechContext.setChannelBinding(channelBinding);
if (mechContext instanceof GSSContextImpl) {
((GSSContextImpl)mechContext).requestDelegPolicy(
delegPolicyState);
Expand Down Expand Up @@ -899,6 +900,7 @@ private byte[] GSS_acceptSecContext(byte[] token) throws GSSException {
myCred.getInternalCred());
}
mechContext = factory.manager.createContext(cred);
mechContext.setChannelBinding(channelBinding);
}

// pass token to mechanism acceptSecContext
Expand Down
30 changes: 18 additions & 12 deletions test/jdk/sun/security/krb5/auto/IgnoreChannelBinding.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2009, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2009, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand All @@ -23,7 +23,7 @@

/*
* @test
* @bug 6851973 8194486
* @bug 6851973 8194486 8279520
* @summary ignore incoming channel binding if acceptor does not set one
* @library /test/lib
* @run main jdk.test.lib.FileInstaller TestHosts TestHosts
Expand All @@ -33,6 +33,7 @@
import java.net.InetAddress;
import org.ietf.jgss.ChannelBinding;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.Oid;
import sun.security.jgss.GSSUtil;

public class IgnoreChannelBinding {
Expand All @@ -41,33 +42,38 @@ public static void main(String[] args)
throws Exception {

new OneKDC(null).writeJAASConf();
test(GSSUtil.GSS_KRB5_MECH_OID);
test(GSSUtil.GSS_SPNEGO_MECH_OID);
}

static void test(Oid mech) throws Exception {

Context c = Context.fromJAAS("client");
Context s = Context.fromJAAS("server");

// All silent
c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
Context.handshake(c, s);

// Initiator req, acceptor ignore
c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
c.startAsClient(OneKDC.SERVER, mech);
c.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
new byte[0]
));
s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
s.startAsServer(mech);
Context.handshake(c, s);

// Both req, and match
c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
c.startAsClient(OneKDC.SERVER, mech);
c.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
new byte[0]
));
s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
s.startAsServer(mech);
s.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
Expand All @@ -76,13 +82,13 @@ public static void main(String[] args)
Context.handshake(c, s);

// Both req, NOT match
c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
c.startAsClient(OneKDC.SERVER, mech);
c.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
new byte[0]
));
s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
s.startAsServer(mech);
s.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
Expand All @@ -96,8 +102,8 @@ public static void main(String[] args)
}

// Acceptor req, reject
c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
s.x().setChannelBinding(new ChannelBinding(
InetAddress.getByName("client.rabbit.hole"),
InetAddress.getByName("host.rabbit.hole"),
Expand Down

1 comment on commit e93cf85

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review

Issues

Please sign in to comment.