8328726: Better Kerberos support

alexeybakhtin · gnu-andrew · commit 165022181994 · 2024-10-05T01:25:30.000+01:00
Reviewed-by: mbalao, andrew
Backport-of: 7325899a11f17bf4516d39495a12796385e459ed
diff --git a/jdk/src/share/classes/com/sun/security/auth/module/Krb5LoginModule.java b/jdk/src/share/classes/com/sun/security/auth/module/Krb5LoginModule.java
@@ -41,7 +41,6 @@
 import sun.security.krb5.*;
 import sun.security.jgss.krb5.Krb5Util;
 import sun.security.krb5.Credentials;
-import sun.misc.HexDumpEncoder;
 
 /**
  * <p> This <code>LoginModule</code> authenticates users using
@@ -786,15 +785,11 @@ private void attemptAuthentication(boolean getPasswdFromSharedState)
 
                 if (debug) {
                     System.out.println("principal is " + principal);
-                    HexDumpEncoder hd = new HexDumpEncoder();
                     if (ktab != null) {
                         System.out.println("Will use keytab");
                     } else if (storeKey) {
                         for (int i = 0; i < encKeys.length; i++) {
-                            System.out.println("EncryptionKey: keyType=" +
-                                encKeys[i].getEType() +
-                                " keyBytes (hex dump)=" +
-                                hd.encodeBuffer(encKeys[i].getBytes()));
+                            System.out.println(encKeys[i].toString());
                         }
                     }
                 }
@@ -895,7 +890,7 @@ private void promptForPass(boolean getPasswdFromSharedState)
             }
             if (debug) {
                 System.out.println
-                    ("password is " + new String(password));
+                    ("Get password from shared state");
             }
             return;
         }
diff --git a/jdk/src/share/classes/javax/security/auth/kerberos/KerberosKey.java b/jdk/src/share/classes/javax/security/auth/kerberos/KerberosKey.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -233,9 +233,9 @@ public String toString() {
         if (destroyed) {
             return "Destroyed Principal";
         }
-        return "Kerberos Principal " + principal.toString() +
-                "Key Version " + versionNum +
-                "key "  + key.toString();
+        return "KerberosKey: principal " + principal +
+                ", version " + versionNum +
+                ", key "  + key.toString();
     }
 
     /**
diff --git a/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java b/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,8 @@
 import javax.crypto.SecretKey;
 import javax.security.auth.Destroyable;
 import javax.security.auth.DestroyFailedException;
-import sun.misc.HexDumpEncoder;
+
+import sun.security.jgss.krb5.Krb5Util;
 import sun.security.krb5.Asn1Exception;
 import sun.security.krb5.PrincipalName;
 import sun.security.krb5.EncryptionKey;
@@ -200,15 +201,8 @@ private void readObject(ObjectInputStream ois)
     }
 
     public String toString() {
-        HexDumpEncoder hd = new HexDumpEncoder();
-        return "EncryptionKey: keyType=" + keyType
-                          + " keyBytes (hex dump)="
-                          + (keyBytes == null || keyBytes.length == 0 ?
-                             " Empty Key" :
-                             '\n' + hd.encodeBuffer(keyBytes)
-                          + '\n');
-
-
+        return "keyType=" + keyType
+                + ", " + Krb5Util.keyInfo(keyBytes);
     }
 
     public int hashCode() {
diff --git a/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Context.java b/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Context.java
@@ -908,15 +908,11 @@ public final int getWrapSizeLimit(int qop, boolean confReq,
 
     public final byte[] wrap(byte inBuf[], int offset, int len,
                              MessageProp msgProp) throws GSSException {
-        if (DEBUG) {
-            System.out.println("Krb5Context.wrap: data=["
-                               + getHexBytes(inBuf, offset, len)
-                               + "]");
-        }
 
-        if (state != STATE_DONE)
-        throw new GSSException(GSSException.NO_CONTEXT, -1,
-                               "Wrap called in invalid state!");
+        if (state != STATE_DONE) {
+            throw new GSSException(GSSException.NO_CONTEXT, -1,
+                    "Wrap called in invalid state!");
+        }
 
         byte[] encToken = null;
         try {
@@ -1061,12 +1057,6 @@ public final byte[] unwrap(byte inBuf[], int offset, int len,
                 setSequencingAndReplayProps(token, msgProp);
             }
 
-            if (DEBUG) {
-                System.out.println("Krb5Context.unwrap: data=["
-                                   + getHexBytes(data, 0, data.length)
-                                   + "]");
-            }
-
             return data;
         }
 
@@ -1412,8 +1402,8 @@ public byte[] getEncoded() {
 
         @Override
         public String toString() {
-            return "Kerberos session key: etype: " + key.getEType() + "\n" +
-                    new sun.misc.HexDumpEncoder().encodeBuffer(key.getBytes());
+            return "Kerberos session key: etype=" + key.getEType()
+                    + ", " + Krb5Util.keyInfo(key.getBytes());
         }
     }
 
diff --git a/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Util.java b/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Util.java
@@ -301,4 +301,19 @@ public static EncryptionKey[] keysFromJavaxKeyTab(
             KeyTab ktab, PrincipalName cname) {
         return snapshotFromJavaxKeyTab(ktab).readServiceKeys(cname);
     }
+
+    public static String keyInfo(byte[] data) {
+        if (data == null) {
+            return "null key";
+        } else if (data.length == 0) {
+            return "empty key";
+        } else {
+            for (byte b : data) {
+                if (b != 0) {
+                    return data.length + "-byte key";
+                }
+            }
+            return data.length + "-byte zero key";
+        }
+    }
 }
diff --git a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java
@@ -31,6 +31,7 @@
 
 package sun.security.krb5;
 
+import sun.security.jgss.krb5.Krb5Util;
 import sun.security.util.*;
 import sun.security.krb5.internal.*;
 import sun.security.krb5.internal.crypto.*;
@@ -476,12 +477,7 @@ public synchronized void writeKey(CCacheOutputStream cos)
 
     public String toString() {
         return new String("EncryptionKey: keyType=" + keyType
-                          + " kvno=" + kvno
-                          + " keyValue (hex dump)="
-                          + (keyValue == null || keyValue.length == 0 ?
-                        " Empty Key" : '\n'
-                        + Krb5.hexDumper.encodeBuffer(keyValue)
-                        + '\n'));
+                          + ", kvno=" + kvno + ", " + Krb5Util.keyInfo(keyValue));
     }
 
     /**
diff --git a/jdk/src/share/classes/sun/security/krb5/internal/Krb5.java b/jdk/src/share/classes/sun/security/krb5/internal/Krb5.java
@@ -312,8 +312,6 @@ public static String getErrorMessage(int i) {
     public static final boolean DEBUG =
         java.security.AccessController.doPrivileged(
               new sun.security.action.GetBooleanAction("sun.security.krb5.debug"));
-    public static final sun.misc.HexDumpEncoder hexDumper =
-        new sun.misc.HexDumpEncoder();
 
     static {
         errMsgList = new Hashtable<Integer,String> ();
diff --git a/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java b/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java
@@ -121,11 +121,6 @@ public String toString() {
         buffer.append(pPassword.length);
         buffer.append(Constants.NEWLINE);
 
-        buffer.append(Constants.INDENT);
-        buffer.append("pPassword: ");
-        buffer.append(pPassword);
-        buffer.append(Constants.NEWLINE);
-
         buffer.append(Constants.INDENT);
         buffer.append("ulSaltLen: ");
         buffer.append(pSalt.length);
diff --git a/jdk/src/windows/classes/sun/security/krb5/internal/tools/Kinit.java b/jdk/src/windows/classes/sun/security/krb5/internal/tools/Kinit.java
@@ -192,10 +192,6 @@ private void acquire()
                 System.out.print("Password for " + princName + ":");
                 System.out.flush();
                 psswd = Password.readPassword(System.in);
-                if (DEBUG) {
-                    System.out.println(">>> Kinit console input " +
-                        new String(psswd));
-                }
             }
             builder = new KrbAsReqBuilder(principal, psswd);
         } else {

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,6 @@`
`41`	`41`	`import sun.security.krb5.*;`
`42`	`42`	`import sun.security.jgss.krb5.Krb5Util;`
`43`	`43`	`import sun.security.krb5.Credentials;`
`44`		`-import sun.misc.HexDumpEncoder;`
`45`	`44`
`46`	`45`	`/**`
`47`	`46`	`* <p> This <code>LoginModule</code> authenticates users using`
`@@ -786,15 +785,11 @@ private void attemptAuthentication(boolean getPasswdFromSharedState)`
`786`	`785`
`787`	`786`	`if (debug) {`
`788`	`787`	`System.out.println("principal is " + principal);`
`789`		`- HexDumpEncoder hd = new HexDumpEncoder();`
`790`	`788`	`if (ktab != null) {`
`791`	`789`	`System.out.println("Will use keytab");`
`792`	`790`	`} else if (storeKey) {`
`793`	`791`	`for (int i = 0; i < encKeys.length; i++) {`
`794`		`- System.out.println("EncryptionKey: keyType=" +`
`795`		`- encKeys[i].getEType() +`
`796`		`- " keyBytes (hex dump)=" +`
`797`		`- hd.encodeBuffer(encKeys[i].getBytes()));`
	`792`	`+ System.out.println(encKeys[i].toString());`
`798`	`793`	`}`
`799`	`794`	`}`
`800`	`795`	`}`
`@@ -895,7 +890,7 @@ private void promptForPass(boolean getPasswdFromSharedState)`
`895`	`890`	`}`
`896`	`891`	`if (debug) {`
`897`	`892`	`System.out.println`
`898`		`- ("password is " + new String(password));`
	`893`	`+ ("Get password from shared state");`
`899`	`894`	`}`
`900`	`895`	`return;`
`901`	`896`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`/*`
`2`		`- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.`
	`2`	`+ * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.`
`3`	`3`	`* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.`
`4`	`4`	`*`
`5`	`5`	`* This code is free software; you can redistribute it and/or modify it`
`@@ -233,9 +233,9 @@ public String toString() {`
`233`	`233`	`if (destroyed) {`
`234`	`234`	`return "Destroyed Principal";`
`235`	`235`	`}`
`236`		`- return "Kerberos Principal " + principal.toString() +`
`237`		`- "Key Version " + versionNum +`
`238`		`- "key " + key.toString();`
	`236`	`+ return "KerberosKey: principal " + principal +`
	`237`	`+ ", version " + versionNum +`
	`238`	`+ ", key " + key.toString();`
`239`	`239`	`}`
`240`	`240`
`241`	`241`	`/**`