Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
8139348: Deprecate 3DES and RC4 in Kerberos 
Reviewed-by: andrew
Backport-of: ded96ddcde1e9e8556a6ce8948acef27b6e192cc
  • Loading branch information
@gnu-andrew
Ekaterina Vergizova authored and gnu-andrew committed Jun 2, 2023
1 parent 1c802b2 commit 6244292
Show file tree
Hide file tree
Showing 7 changed files with 62 additions and 43 deletions.
6 changes: 3 additions & 3 deletions jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -221,8 +221,8 @@ public static int[] getBuiltInDefaults() {
result = BUILTIN_ETYPES;
}
if (!allowWeakCrypto) {
// The last 2 etypes are now weak ones
return Arrays.copyOfRange(result, 0, result.length - 2);
// The last 4 etypes are now weak ones
return Arrays.copyOfRange(result, 0, result.length - 4);
}
return result;
}
Expand Down
4 changes: 2 additions & 2 deletions jdk/test/sun/security/krb5/auto/NewSalt.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -42,7 +42,7 @@ public static void main(String[] args)
KDC kdc = new OneKDC(null);
if (System.getProperty("onlyonepreauth") != null) {
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
"default_tgs_enctypes=des3-cbc-sha1");
"default_tgs_enctypes=aes128-cts");
Config.refresh();
kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
}
Expand Down
7 changes: 4 additions & 3 deletions jdk/test/sun/security/krb5/auto/W83.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand All @@ -26,11 +26,11 @@
* @bug 6932525 6951366 6959292
* @summary kerberos login failure on win2008 with AD set to win2000 compat mode
* and cannot login if session key and preauth does not use the same etype
* @compile -XDignore.symbol.file W83.java
* @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock -D6932525 W83
* @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock -D6959292 W83
*/
import com.sun.security.auth.module.Krb5LoginModule;
import java.io.File;
import sun.security.krb5.Config;
import sun.security.krb5.EncryptedData;
import sun.security.krb5.PrincipalName;
Expand All @@ -47,7 +47,8 @@ public static void main(String[] args) throws Exception {
KDC kdc = new KDC(OneKDC.REALM, "127.0.0.1", 0, true);
kdc.addPrincipal(OneKDC.USER, OneKDC.PASS);
kdc.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);
KDC.saveConfig(OneKDC.KRB5_CONF, kdc);
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
"allow_weak_crypto = true");
System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF);
Config.refresh();

Expand Down
46 changes: 32 additions & 14 deletions jdk/test/sun/security/krb5/etype/WeakCrypto.java
View file
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand All @@ -22,41 +22,59 @@
*/
/*
* @test
* @bug 6844909 8012679
* @bug 6844909 8012679 8139348
* @run main/othervm WeakCrypto
* @run main/othervm WeakCrypto true
* @run main/othervm WeakCrypto false
* @summary support allow_weak_crypto in krb5.conf
*/

import java.io.File;
import java.lang.Exception;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Arrays;
import java.util.List;

import sun.security.krb5.EncryptionKey;
import sun.security.krb5.internal.crypto.EType;
import sun.security.krb5.EncryptedData;

public class WeakCrypto {

static List<Integer> weakOnes = Arrays.asList(
EncryptedData.ETYPE_DES_CBC_CRC,
EncryptedData.ETYPE_DES_CBC_MD5,
EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD,
EncryptedData.ETYPE_ARCFOUR_HMAC
);

public static void main(String[] args) throws Exception {

String conf = "[libdefaults]\n" +
(args.length > 0 ? ("allow_weak_crypto = " + args[0]) : "");
Files.write(Paths.get("krb5.conf"), conf.getBytes());
System.setProperty("java.security.krb5.conf", "krb5.conf");

boolean expected = args.length != 0 && args[0].equals("true");
int[] etypes = EType.getBuiltInDefaults();
// expected number of supported weak etypes
int expected = 0;
if (args.length != 0 && args[0].equals("true")) {
expected = weakOnes.size();
}

boolean found = false;
for (int i=0, length = etypes.length; i<length; i++) {
if (etypes[i] == EncryptedData.ETYPE_DES_CBC_CRC ||
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD4 ||
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD5) {
found = true;
}
// Ensure EType.getBuiltInDefaults() has the correct etypes
if (Arrays.stream(EType.getBuiltInDefaults())
.filter(weakOnes::contains)
.count() != expected) {
throw new Exception("getBuiltInDefaults fails");
}
if (expected != found) {
throw new Exception();

// Ensure keys generated have the correct etypes
if (Arrays.stream(EncryptionKey.acquireSecretKeys(
"password".toCharArray(), "salt"))
.map(EncryptionKey::getEType)
.filter(weakOnes::contains)
.count() != expected) {
throw new Exception("acquireSecretKeys fails");
}
}
}
2 changes: 0 additions & 2 deletions jdk/test/sun/security/krb5/etype/weakcrypto.conf
View file

This file was deleted.

38 changes: 20 additions & 18 deletions jdk/test/sun/security/krb5/tools/ktcheck.sh
View file
@@ -1,5 +1,5 @@
#
# Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved.
# Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
#
# This code is free software; you can redistribute it and/or modify it
Expand All @@ -22,7 +22,7 @@
#

# @test
# @bug 6950546
# @bug 6950546 8139348
# @summary "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
# @run shell ktcheck.sh
#
Expand Down Expand Up @@ -62,33 +62,35 @@ CHECK="${TESTJAVA}${FS}bin${FS}java ${TESTVMOPTS} ${EXTRA_OPTIONS} KtabCheck $KE

echo ${EXTRA_OPTIONS}

# This test uses a krb5.conf file (onlythree.conf) in which
# only 2 etypes in the default_tkt_enctypes setting are enabled
# by default: aes128-cts(17), aes256-cts(18).

$KTAB -a me mine
$CHECK 1 16 1 23 1 17 || exit 1
$CHECK 1 17 1 18 || exit 1
$KTAB -a me mine -n 0
$CHECK 0 16 0 23 0 17 || exit 1
$CHECK 0 17 0 18 || exit 1
$KTAB -a me mine -n 1 -append
$CHECK 0 16 0 23 0 17 1 16 1 23 1 17 || exit 1
$CHECK 0 17 0 18 1 17 1 18 || exit 1
$KTAB -a me mine -append
$CHECK 0 16 0 23 0 17 1 16 1 23 1 17 2 16 2 23 2 17 || exit 1
$CHECK 0 17 0 18 1 17 1 18 2 17 2 18 || exit 1
$KTAB -a me mine
$CHECK 3 16 3 23 3 17 || exit 1
$CHECK 3 17 3 18 || exit 1
$KTAB -a me mine -n 4 -append
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 || exit 1
$CHECK 3 17 3 18 4 17 4 18 || exit 1
$KTAB -a me mine -n 5 -append
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 5 16 5 23 5 17 || exit 1
$CHECK 3 17 3 18 4 17 4 18 5 17 5 18 || exit 1
$KTAB -a me mine -n 6 -append
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 5 16 5 23 5 17 6 16 6 23 6 17 || exit 1
$CHECK 3 17 3 18 4 17 4 18 5 17 5 18 6 17 6 18 || exit 1
$KTAB -d me 3
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 16 6 23 6 17 || exit 1
$KTAB -d me -e 16 6
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 23 6 17 || exit 1
$CHECK 4 17 4 18 5 17 5 18 6 17 6 18 || exit 1
$KTAB -d me -e 17 6
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 23 || exit 1
$KTAB -d me -e 16 5
$CHECK 4 16 4 23 4 17 5 23 5 17 6 23 || exit 1
$CHECK 4 17 4 18 5 17 5 18 6 18 || exit 1
$KTAB -d me -e 17 5
$CHECK 4 17 4 18 5 18 6 18 || exit 1
$KTAB -d me old
$CHECK 4 16 5 17 6 23 || exit 1
$CHECK 4 17 6 18 || exit 1
$KTAB -d me old
$CHECK 4 16 5 17 6 23 || exit 1
$CHECK 4 17 6 18 || exit 1
$KTAB -d me
$CHECK || exit 1
2 changes: 1 addition & 1 deletion jdk/test/sun/security/krb5/tools/onlythree.conf
View file
@@ -1,6 +1,6 @@
[libdefaults]
default_realm = LOCAL.COM
default_tkt_enctypes = des3-cbc-sha1 rc4-hmac aes128-cts
default_tkt_enctypes = des-cbc-crc des-cbc-md5 des3-cbc-sha1 rc4-hmac aes128-cts aes256-cts

[realms]
LOCAL.COM = {
Expand Down

1 comment on commit 6244292

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review

Issues

Please sign in to comment.