Skip to content

Commit 6244292

Browse files
Ekaterina Vergizovagnu-andrew
Ekaterina Vergizova
authored and
gnu-andrew
committedJun 2, 2023
8139348: Deprecate 3DES and RC4 in Kerberos
Reviewed-by: andrew Backport-of: ded96ddcde1e9e8556a6ce8948acef27b6e192cc
·
jdk8u452-b04jdk8u392-b01
1 parent 1c802b2 commit 6244292

File tree

7 files changed

+62
-43
lines changed

7 files changed

+62
-43
lines changed
 

‎jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -221,8 +221,8 @@ public static int[] getBuiltInDefaults() {
221221
result = BUILTIN_ETYPES;
222222
}
223223
if (!allowWeakCrypto) {
224-
// The last 2 etypes are now weak ones
225-
return Arrays.copyOfRange(result, 0, result.length - 2);
224+
// The last 4 etypes are now weak ones
225+
return Arrays.copyOfRange(result, 0, result.length - 4);
226226
}
227227
return result;
228228
}

‎jdk/test/sun/security/krb5/auto/NewSalt.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -42,7 +42,7 @@ public static void main(String[] args)
4242
KDC kdc = new OneKDC(null);
4343
if (System.getProperty("onlyonepreauth") != null) {
4444
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
45-
"default_tgs_enctypes=des3-cbc-sha1");
45+
"default_tgs_enctypes=aes128-cts");
4646
Config.refresh();
4747
kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
4848
}

‎jdk/test/sun/security/krb5/auto/W83.java

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -26,11 +26,11 @@
2626
* @bug 6932525 6951366 6959292
2727
* @summary kerberos login failure on win2008 with AD set to win2000 compat mode
2828
* and cannot login if session key and preauth does not use the same etype
29+
* @compile -XDignore.symbol.file W83.java
2930
* @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock -D6932525 W83
3031
* @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock -D6959292 W83
3132
*/
3233
import com.sun.security.auth.module.Krb5LoginModule;
33-
import java.io.File;
3434
import sun.security.krb5.Config;
3535
import sun.security.krb5.EncryptedData;
3636
import sun.security.krb5.PrincipalName;
@@ -47,7 +47,8 @@ public static void main(String[] args) throws Exception {
4747
KDC kdc = new KDC(OneKDC.REALM, "127.0.0.1", 0, true);
4848
kdc.addPrincipal(OneKDC.USER, OneKDC.PASS);
4949
kdc.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);
50-
KDC.saveConfig(OneKDC.KRB5_CONF, kdc);
50+
KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
51+
"allow_weak_crypto = true");
5152
System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF);
5253
Config.refresh();
5354

‎jdk/test/sun/security/krb5/etype/WeakCrypto.java

+32-14
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -22,41 +22,59 @@
2222
*/
2323
/*
2424
* @test
25-
* @bug 6844909 8012679
25+
* @bug 6844909 8012679 8139348
2626
* @run main/othervm WeakCrypto
2727
* @run main/othervm WeakCrypto true
2828
* @run main/othervm WeakCrypto false
2929
* @summary support allow_weak_crypto in krb5.conf
3030
*/
3131

32-
import java.io.File;
3332
import java.lang.Exception;
3433
import java.nio.file.Files;
3534
import java.nio.file.Paths;
35+
import java.util.Arrays;
36+
import java.util.List;
3637

38+
import sun.security.krb5.EncryptionKey;
3739
import sun.security.krb5.internal.crypto.EType;
3840
import sun.security.krb5.EncryptedData;
3941

4042
public class WeakCrypto {
43+
44+
static List<Integer> weakOnes = Arrays.asList(
45+
EncryptedData.ETYPE_DES_CBC_CRC,
46+
EncryptedData.ETYPE_DES_CBC_MD5,
47+
EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD,
48+
EncryptedData.ETYPE_ARCFOUR_HMAC
49+
);
50+
4151
public static void main(String[] args) throws Exception {
52+
4253
String conf = "[libdefaults]\n" +
4354
(args.length > 0 ? ("allow_weak_crypto = " + args[0]) : "");
4455
Files.write(Paths.get("krb5.conf"), conf.getBytes());
4556
System.setProperty("java.security.krb5.conf", "krb5.conf");
4657

47-
boolean expected = args.length != 0 && args[0].equals("true");
48-
int[] etypes = EType.getBuiltInDefaults();
58+
// expected number of supported weak etypes
59+
int expected = 0;
60+
if (args.length != 0 && args[0].equals("true")) {
61+
expected = weakOnes.size();
62+
}
4963

50-
boolean found = false;
51-
for (int i=0, length = etypes.length; i<length; i++) {
52-
if (etypes[i] == EncryptedData.ETYPE_DES_CBC_CRC ||
53-
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD4 ||
54-
etypes[i] == EncryptedData.ETYPE_DES_CBC_MD5) {
55-
found = true;
56-
}
64+
// Ensure EType.getBuiltInDefaults() has the correct etypes
65+
if (Arrays.stream(EType.getBuiltInDefaults())
66+
.filter(weakOnes::contains)
67+
.count() != expected) {
68+
throw new Exception("getBuiltInDefaults fails");
5769
}
58-
if (expected != found) {
59-
throw new Exception();
70+
71+
// Ensure keys generated have the correct etypes
72+
if (Arrays.stream(EncryptionKey.acquireSecretKeys(
73+
"password".toCharArray(), "salt"))
74+
.map(EncryptionKey::getEType)
75+
.filter(weakOnes::contains)
76+
.count() != expected) {
77+
throw new Exception("acquireSecretKeys fails");
6078
}
6179
}
6280
}

‎jdk/test/sun/security/krb5/etype/weakcrypto.conf

-2
This file was deleted.

‎jdk/test/sun/security/krb5/tools/ktcheck.sh

+20-18
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved.
2+
# Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
33
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
#
55
# This code is free software; you can redistribute it and/or modify it
@@ -22,7 +22,7 @@
2222
#
2323

2424
# @test
25-
# @bug 6950546
25+
# @bug 6950546 8139348
2626
# @summary "ktab -d name etype" to "ktab -d name [-e etype] [kvno | all | old]"
2727
# @run shell ktcheck.sh
2828
#
@@ -62,33 +62,35 @@ CHECK="${TESTJAVA}${FS}bin${FS}java ${TESTVMOPTS} ${EXTRA_OPTIONS} KtabCheck $KE
6262

6363
echo ${EXTRA_OPTIONS}
6464

65+
# This test uses a krb5.conf file (onlythree.conf) in which
66+
# only 2 etypes in the default_tkt_enctypes setting are enabled
67+
# by default: aes128-cts(17), aes256-cts(18).
68+
6569
$KTAB -a me mine
66-
$CHECK 1 16 1 23 1 17 || exit 1
70+
$CHECK 1 17 1 18 || exit 1
6771
$KTAB -a me mine -n 0
68-
$CHECK 0 16 0 23 0 17 || exit 1
72+
$CHECK 0 17 0 18 || exit 1
6973
$KTAB -a me mine -n 1 -append
70-
$CHECK 0 16 0 23 0 17 1 16 1 23 1 17 || exit 1
74+
$CHECK 0 17 0 18 1 17 1 18 || exit 1
7175
$KTAB -a me mine -append
72-
$CHECK 0 16 0 23 0 17 1 16 1 23 1 17 2 16 2 23 2 17 || exit 1
76+
$CHECK 0 17 0 18 1 17 1 18 2 17 2 18 || exit 1
7377
$KTAB -a me mine
74-
$CHECK 3 16 3 23 3 17 || exit 1
78+
$CHECK 3 17 3 18 || exit 1
7579
$KTAB -a me mine -n 4 -append
76-
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 || exit 1
80+
$CHECK 3 17 3 18 4 17 4 18 || exit 1
7781
$KTAB -a me mine -n 5 -append
78-
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 5 16 5 23 5 17 || exit 1
82+
$CHECK 3 17 3 18 4 17 4 18 5 17 5 18 || exit 1
7983
$KTAB -a me mine -n 6 -append
80-
$CHECK 3 16 3 23 3 17 4 16 4 23 4 17 5 16 5 23 5 17 6 16 6 23 6 17 || exit 1
84+
$CHECK 3 17 3 18 4 17 4 18 5 17 5 18 6 17 6 18 || exit 1
8185
$KTAB -d me 3
82-
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 16 6 23 6 17 || exit 1
83-
$KTAB -d me -e 16 6
84-
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 23 6 17 || exit 1
86+
$CHECK 4 17 4 18 5 17 5 18 6 17 6 18 || exit 1
8587
$KTAB -d me -e 17 6
86-
$CHECK 4 16 4 23 4 17 5 16 5 23 5 17 6 23 || exit 1
87-
$KTAB -d me -e 16 5
88-
$CHECK 4 16 4 23 4 17 5 23 5 17 6 23 || exit 1
88+
$CHECK 4 17 4 18 5 17 5 18 6 18 || exit 1
89+
$KTAB -d me -e 17 5
90+
$CHECK 4 17 4 18 5 18 6 18 || exit 1
8991
$KTAB -d me old
90-
$CHECK 4 16 5 17 6 23 || exit 1
92+
$CHECK 4 17 6 18 || exit 1
9193
$KTAB -d me old
92-
$CHECK 4 16 5 17 6 23 || exit 1
94+
$CHECK 4 17 6 18 || exit 1
9395
$KTAB -d me
9496
$CHECK || exit 1

‎jdk/test/sun/security/krb5/tools/onlythree.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[libdefaults]
22
default_realm = LOCAL.COM
3-
default_tkt_enctypes = des3-cbc-sha1 rc4-hmac aes128-cts
3+
default_tkt_enctypes = des-cbc-crc des-cbc-md5 des3-cbc-sha1 rc4-hmac aes128-cts aes256-cts
44

55
[realms]
66
LOCAL.COM = {

1 commit comments

Comments
 (1)

openjdk-notifier[bot] commented on Jun 2, 2023

@openjdk-notifier[bot]
openjdk-notifier[bot]
on Jun 2, 2023

Review

Issues

Please sign in to comment.