Quellcode-Bibliothek

^© Kompilation durch diese Firma

[Weder Korrektheit noch Funktionsfähigkeit der Software werden zugesichert.]

Datei: Sprache: JAVA

/*
* Copyright (c) 2008, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

import jdk.test.lib.Platform;

import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.net.*;
import java.io.*;
import java.lang.reflect.Method;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.*;
import java.util.concurrent.*;
import java.util.stream.Collectors;
import java.util.stream.Stream;

import sun.security.krb5.*;
import sun.security.krb5.internal.*;
import sun.security.krb5.internal.ccache.CredentialsCache;
import sun.security.krb5.internal.crypto.EType;
import sun.security.krb5.internal.crypto.KeyUsage;
import sun.security.krb5.internal.ktab.KeyTab;
import sun.security.util.DerInputStream;
import sun.security.util.DerOutputStream;
import sun.security.util.DerValue;

/**
* A KDC server.
*
* Note: By setting the system property native.kdc.path to a native
* krb5 installation, this class starts a native KDC with the
* given realm and host. It can also add new principals and save keytabs.
* Other features might not be available.
* 
* Features:
* <ol>
* <li> Supports TCP and UDP
* <li> Supports AS-REQ and TGS-REQ
* <li> Principal db and other settings hard coded in application
* <li> Options, say, request preauth or not
* </ol>
* Side effects:
* <ol>
* <li> The Sun-internal class <code>sun.security.krb5.Config</code> is a
* singleton and initialized according to Kerberos settings (krb5.conf and
* java.security.krb5.* system properties). This means once it's initialized
* it will not automatically notice any changes to these settings (or file
* changes of krb5.conf). The KDC class normally does not touch these
* settings (except for the <code>writeKtab()</code> method). However, to make
* sure nothing ever goes wrong, if you want to make any changes to these
* settings after calling a KDC method, call <code>Config.refresh()</code> to
* make sure your changes are reflected in the <code>Config</code> object.
* </ol>
* System properties recognized:
* <ul>
* <li>test.kdc.save.ccache
* </ul>
* Issues and TODOs:
* <ol>
* <li> Generates krb5.conf to be used on another machine, currently the kdc is
* always localhost
* <li> More options to KDC, say, error output, say, response nonce !=
* request nonce
* </ol>
* Note: This program uses internal krb5 classes (including reflection to
* access private fields and methods).
* 
* Usages:
* 
* 1. Init and start the KDC:
* <pre>
* KDC kdc = KDC.create("REALM.NAME", port, isDaemon);
* KDC kdc = KDC.create("REALM.NAME");
* </pre>
* Here, <code>port</code> is the UDP and TCP port number the KDC server
* listens on. If zero, a random port is chosen, which you can use getPort()
* later to retrieve the value.
* 
* If <code>isDaemon</code> is true, the KDC worker threads will be daemons.
* 
* The shortcut <code>KDC.create("REALM.NAME")</code> has port=0 and
* isDaemon=false, and is commonly used in an embedded KDC.
* 
* 2. Adding users:
* <pre>
* kdc.addPrincipal(String principal_name, char[] password);
* kdc.addPrincipalRandKey(String principal_name);
* </pre>
* A service principal's name should look like "host/f.q.d.n". The second form
* generates a random key. To expose this key, call <code>writeKtab()</code> to
* save the keys into a keytab file.
* 
* Note that you need to add the principal name krbtgt/REALM.NAME yourself.
* 
* Note that you can safely add a principal at any time after the KDC is
* started and before a user requests info on this principal.
* 
* 3. Other public methods:
* <ul>
* <li> <code>getPort</code>: Returns the port number the KDC uses
* <li> <code>getRealm</code>: Returns the realm name
* <li> <code>writeKtab</code>: Writes all principals' keys into a keytab file
* <li> <code>saveConfig</code>: Saves a krb5.conf file to access this KDC
* <li> <code>setOption</code>: Sets various options
* </ul>
* Read the javadoc for details. Lazy developer can use <code>OneKDC</code>
* directly.
*/
public class KDC {

 public static final int DEFAULT_LIFETIME = 39600;
 public static final int DEFAULT_RENEWTIME = 86400;

 public static final String NOT_EXISTING_HOST = "not.existing.host";

 // What etypes the KDC supports. Comma-separated strings. Null for all.
 // Please note native KDCs might use different names.
 private static final String SUPPORTED_ETYPES
 = System.getProperty("kdc.supported.enctypes");

 // The native KDC
 private final NativeKdc nativeKdc;

 // The native KDC process
 private Process kdcProc = null;

 // Under the hood.

 // Principal db. principal -> pass. A case-insensitive TreeMap is used
 // so that even if the client provides a name with different case, the KDC
 // can still locate the principal and give back correct salt.
 private TreeMap<String,char[]> passwords = new TreeMap<>
 (String.CASE_INSENSITIVE_ORDER);

 // Non default salts. Precisely, there should be different salts for
 // different etypes, pretend they are the same at the moment.
 private TreeMap<String,String> salts = new TreeMap<>
 (String.CASE_INSENSITIVE_ORDER);

 // Non default s2kparams for newer etypes. Precisely, there should be
 // different s2kparams for different etypes, pretend they are the same
 // at the moment.
 private TreeMap<String,byte[]> s2kparamses = new TreeMap<>
 (String.CASE_INSENSITIVE_ORDER);

 // Alias for referrals.
 private TreeMap<String,KDC> aliasReferrals = new TreeMap<>
 (String.CASE_INSENSITIVE_ORDER);

 // Alias for local resolution.
 private TreeMap<String,PrincipalName> alias2Principals = new TreeMap<>
 (String.CASE_INSENSITIVE_ORDER);

 // Realm name
 private String realm;
 // KDC
 private String kdc;
 // Service port number
 private int port;
 // The request/response job queue
 private BlockingQueue<Job> q = new ArrayBlockingQueue<>(100);
 // Options
 private Map<Option,Object> options = new HashMap<>();
 // Realm-specific krb5.conf settings
 private List<String> conf = new ArrayList<>();

 private Thread thread1, thread2, thread3;
 private volatile boolean udpConsumerReady = false;
 private volatile boolean tcpConsumerReady = false;
 private volatile boolean dispatcherReady = false;
 DatagramSocket u1 = null;
 ServerSocket t1 = null;

 public static enum KtabMode { APPEND, EXISTING };

 /**
 * Option names, to be expanded forever.
 */
 public static enum Option {
 /**
 * Whether pre-authentication is required. Default Boolean.TRUE
 */
 PREAUTH_REQUIRED,
 /**
 * Only issue TGT in RC4
 */
 ONLY_RC4_TGT,
 /**
 * Use RC4 as the first in preauth
 */
 RC4_FIRST_PREAUTH,
 /**
 * Use only one preauth, so that some keys are not easy to generate
 */
 ONLY_ONE_PREAUTH,
 /**
 * Set all name-type to a value in response
 */
 RESP_NT,
 /**
 * Multiple ETYPE-INFO-ENTRY with same etype but different salt
 */
 DUP_ETYPE,
 /**
 * What backend server can be delegated to
 */
 OK_AS_DELEGATE,
 /**
 * Allow S4U2self, List<String> of middle servers.
 * If not set, means KDC does not understand S4U2self at all, therefore
 * would ignore any PA-FOR-USER request and send a ticket using the
 * cname of teh requestor. If set, it returns FORWARDABLE tickets to
 * a server with its name in the list
 */
 ALLOW_S4U2SELF,
 /**
 * Allow S4U2proxy, Map<String,List<String>> of middle servers to
 * backends. If not set or a backend not in a server's list,
 * Krb5.KDC_ERR_POLICY will be send for S4U2proxy request.
 */
 ALLOW_S4U2PROXY,
 /**
 * Sensitive accounts can never be delegated.
 */
 SENSITIVE_ACCOUNTS,
 /**
 * If true, will check if TGS-REQ contains a non-null addresses field.
 */
 CHECK_ADDRESSES,
 /**
 * If true, S4U2self ticket is not set forwardable.
 */
 S4U2SELF_NOT_FORWARDABLE,
 /**
 * If true, allow S4U2self ticket not forwardable.
 */
 S4U2SELF_ALLOW_NOT_FORWARDABLE,
 };

 /**
 * A standalone KDC server.
 */
 public static void main(String[] args) throws Exception {
 int port = args.length > 0 ? Integer.parseInt(args[0]) : 0;
 KDC kdc = create("RABBIT.HOLE", "kdc.rabbit.hole", port, false);
 kdc.addPrincipal("dummy", "bogus".toCharArray());
 kdc.addPrincipal("foo", "bar".toCharArray());
 kdc.addPrincipalRandKey("krbtgt/RABBIT.HOLE");
 kdc.addPrincipalRandKey("server/host.rabbit.hole");
 kdc.addPrincipalRandKey("backend/host.rabbit.hole");
 KDC.saveConfig("krb5.conf", kdc, "forwardable = true");
 }

 /**
 * Creates and starts a KDC running as a daemon on a random port.
 * @param realm the realm name
 * @return the running KDC instance
 * @throws java.io.IOException for any socket creation error
 */
 public static KDC create(String realm) throws IOException {
 return create(realm, "kdc." + realm.toLowerCase(Locale.US), 0, true);
 }

 public static KDC existing(String realm, String kdc, int port) {
 KDC k = new KDC(realm, kdc);
 k.port = port;
 return k;
 }

 /**
 * Creates and starts a KDC server.
 * @param realm the realm name
 * @param port the TCP and UDP port to listen to. A random port will to
 * chosen if zero.
 * @param asDaemon if true, KDC threads will be daemons. Otherwise, not.
 * @return the running KDC instance
 * @throws java.io.IOException for any socket creation error
 */
 public static KDC create(String realm, String kdc, int port,
 boolean asDaemon) throws IOException {
 return new KDC(realm, kdc, port, asDaemon);
 }

 /**
 * Sets an option
 * @param key the option name
 * @param value the value
 */
 public void setOption(Option key, Object value) {
 if (value == null) {
 options.remove(key);
 } else {
 options.put(key, value);
 }
 }

 /**
 * Writes or appends keys into a keytab.
 * 
 * Attention: This is the most basic one of a series of methods below on
 * keytab creation or modification. All these methods reference krb5.conf
 * settings. If you need to modify krb5.conf or switch to another krb5.conf
 * later, please call <code>Config.refresh()</code> again. For example:
 * <pre>
 * kdc.writeKtab("/etc/kdc/ktab", true); // Config is initialized,
 * System.setProperty("java.security.krb5.conf", "/home/mykrb5.conf");
 * Config.refresh();
 * </pre>
 * Inside this method there are 2 places krb5.conf is used:
 * <ol>
 * <li> (Fatal) Generating keys: EncryptionKey.acquireSecretKeys
 * <li> (Has workaround) Creating PrincipalName
 * </ol>
 * @param tab the keytab file name
 * @param append true if append, otherwise, overwrite.
 * @param names the names to write into, write all if names is empty
 */
 public void writeKtab(String tab, boolean append, String... names)
 throws IOException, KrbException {
 KeyTab ktab = null;
 if (nativeKdc == null) {
 ktab = append ? KeyTab.getInstance(tab) : KeyTab.create(tab);
 }
 Iterable<String> entries =
 (names.length != 0) ? Arrays.asList(names): passwords.keySet();
 for (String name : entries) {
 if (name.indexOf('@') < 0) {
 name = name + "@" + realm;
 }
 if (nativeKdc == null) {
 char[] pass = passwords.get(name);
 int kvno = 0;
 if (Character.isDigit(pass[pass.length - 1])) {
 kvno = pass[pass.length - 1] - '0';
 }
 PrincipalName pn = new PrincipalName(name,
 name.indexOf('/') < 0 ?
 PrincipalName.KRB_NT_UNKNOWN :
 PrincipalName.KRB_NT_SRV_HST);
 ktab.addEntry(pn,
 getSalt(pn),
 pass,
 kvno,
 true);
 } else {
 nativeKdc.ktadd(name, tab);
 }
 }
 if (nativeKdc == null) {
 ktab.save();
 }
 }

 /**
 * Writes all principals' keys from multiple KDCs into one keytab file.
 * @throws java.io.IOException for any file output error
 * @throws sun.security.krb5.KrbException for any realm and/or principal
 * name error.
 */
 public static void writeMultiKtab(String tab, KDC... kdcs)
 throws IOException, KrbException {
 KeyTab.create(tab).save(); // Empty the old keytab
 appendMultiKtab(tab, kdcs);
 }

 /**
 * Appends all principals' keys from multiple KDCs to one keytab file.
 */
 public static void appendMultiKtab(String tab, KDC... kdcs)
 throws IOException, KrbException {
 for (KDC kdc: kdcs) {
 kdc.writeKtab(tab, true);
 }
 }

 /**
 * Write a ktab for this KDC.
 */
 public void writeKtab(String tab) throws IOException, KrbException {
 writeKtab(tab, false);
 }

 /**
 * Appends keys in this KDC to a ktab.
 */
 public void appendKtab(String tab) throws IOException, KrbException {
 writeKtab(tab, true);
 }

 /**
 * Adds a new principal to this realm with a given password.
 * @param user the principal's name. For a service principal, use the
 * form of host/f.q.d.n
 * @param pass the password for the principal
 */
 public void addPrincipal(String user, char[] pass) {
 addPrincipal(user, pass, null, null);
 }

 /**
 * Adds a new principal to this realm with a given password.
 * @param user the principal's name. For a service principal, use the
 * form of host/f.q.d.n
 * @param pass the password for the principal
 * @param salt the salt, or null if a default value will be used
 * @param s2kparams the s2kparams, or null if a default value will be used
 */
 public void addPrincipal(
 String user, char[] pass, String salt, byte[] s2kparams) {
 if (user.indexOf('@') < 0) {
 user = user + "@" + realm;
 }
 if (nativeKdc != null) {
 if (!user.equals("krbtgt/" + realm)) {
 nativeKdc.addPrincipal(user, new String(pass));
 }
 passwords.put(user, new char[0]);
 } else {
 passwords.put(user, pass);
 if (salt != null) {
 salts.put(user, salt);
 }
 if (s2kparams != null) {
 s2kparamses.put(user, s2kparams);
 }
 }
 }

 /**
 * Adds a new principal to this realm with a generated password
 * @param user the principal's name. For a service principal, use the
 * form of host/f.q.d.n
 */
 public void addPrincipalRandKey(String user) {
 addPrincipal(user, randomPassword(user + "@" + realm));
 }

 /**
 * Returns the name of this realm
 * @return the name of this realm
 */
 public String getRealm() {
 return realm;
 }

 /**
 * Returns the name of kdc
 * @return the name of kdc
 */
 public String getKDC() {
 return kdc;
 }

 /**
 * Add realm-specific krb5.conf setting
 */
 public void addConf(String s) {
 conf.add(s);
 }

 /**
 * Writes a krb5.conf for one or more KDC that includes KDC locations for
 * each realm and the default realm name. You can also add extra strings
 * into the file. The method should be called like:
 * <pre>
 * KDC.saveConfig("krb5.conf", kdc1, kdc2, ..., line1, line2, ...);
 * </pre>
 * Here you can provide one or more kdc# and zero or more line# arguments.
 * The line# will be put after [libdefaults] and before [realms]. Therefore
 * you can append new lines into [libdefaults] and/or create your new
 * stanzas as well. Note that a newline character will be appended to
 * each line# argument.
 * 
 * For example:
 * <pre>
 * KDC.saveConfig("krb5.conf", this);
 * </pre>
 * generates:
 * <pre>
 * [libdefaults]
 * default_realm = REALM.NAME
 *
 * [realms]
 * REALM.NAME = {
 * kdc = host:port_number
 * # realm-specific settings
 * }
 * </pre>
 *
 * Another example:
 * <pre>
 * KDC.saveConfig("krb5.conf", kdc1, kdc2, "forwardable = true", "",
 * "[domain_realm]",
 * ".kdc1.com = KDC1.NAME");
 * </pre>
 * generates:
 * <pre>
 * [libdefaults]
 * default_realm = KDC1.NAME
 * forwardable = true
 *
 * [domain_realm]
 * .kdc1.com = KDC1.NAME
 *
 * [realms]
 * KDC1.NAME = {
 * kdc = host:port1
 * }
 * KDC2.NAME = {
 * kdc = host:port2
 * }
 * </pre>
 * @param file the name of the file to write into
 * @param kdc the first (and default) KDC
 * @param more more KDCs or extra lines (in their appearing order) to
 * insert into the krb5.conf file. This method reads each argument's type
 * to determine what it's for. This argument can be empty.
 * @throws java.io.IOException for any file output error
 */
 public static void saveConfig(String file, KDC kdc, Object... more)
 throws IOException {
 StringBuffer sb = new StringBuffer();
 sb.append("[libdefaults]\ndefault_realm = ");
 sb.append(kdc.realm);
 sb.append("\n");
 for (Object o : more) {
 if (o instanceof String) {
 sb.append(o);
 sb.append("\n");
 }
 }
 sb.append("\n[realms]\n");
 sb.append(kdc.realmLine());
 for (Object o : more) {
 if (o instanceof KDC) {
 sb.append(((KDC) o).realmLine());
 }
 }
 Files.write(Paths.get(file), sb.toString().getBytes());
 }

 /**
 * Returns the service port of the KDC server.
 * @return the KDC service port
 */
 public int getPort() {
 return port;
 }

 /**
 * Register an alias name to be referred to a different KDC for
 * resolution, according to RFC 6806.
 * @param alias Alias name (i.e. [email protected]).
 * @param referredKDC KDC to which the alias is referred for resolution.
 */
 public void registerAlias(String alias, KDC referredKDC) {
 aliasReferrals.remove(alias);
 aliasReferrals.put(alias, referredKDC);
 }

 /**
 * Register an alias to be resolved to a Principal Name locally,
 * according to RFC 6806.
 * @param alias Alias name (i.e. [email protected]).
 * @param user Principal Name to which the alias is resolved.
 */
 public void registerAlias(String alias, String user)
 throws RealmException {
 alias2Principals.remove(alias);
 alias2Principals.put(alias, new PrincipalName(user));
 }

 // Private helper methods

 /**
 * Private constructor, cannot be called outside.
 * @param realm
 */
 private KDC(String realm, String kdc) {
 this.realm = realm;
 this.kdc = kdc;
 this.nativeKdc = null;
 }

 /**
 * A constructor that starts the KDC service also.
 */
 protected KDC(String realm, String kdc, int port, boolean asDaemon)
 throws IOException {
 this.realm = realm;
 this.kdc = kdc;
 this.nativeKdc = NativeKdc.get(this);
 startServer(port, asDaemon);
 }
 /**
 * Generates a 32-char password
 * @param user the string to generate from, random is null
 * @return the password
 */
 private static char[] randomPassword(String user) {
 char[] pass;
 if (user == null) {
 pass = new char[32];
 Random r = new Random();
 for (int i = 0; i < 31; i++) {
 pass[i] = (char) ('a' + r.nextInt(26));
 }
 } else {
 try {
 pass = Base64.getEncoder().encodeToString(
 MessageDigest.getInstance("SHA-256").digest((user)
 .getBytes(StandardCharsets.UTF_8)))
 .substring(0, 32)
 .toCharArray();
 } catch (NoSuchAlgorithmException e) {
 throw new AssertionError(e);
 }
 }
 // The last char cannot be a number, otherwise, keyForUser()
 // believes it's a sign of kvno
 pass[31] = 'Z';
 return pass;
 }

 /**
 * Generates a random key for the given encryption type.
 * @param eType the encryption type
 * @return the generated key
 * @throws sun.security.krb5.KrbException for unknown/unsupported etype
 */
 private static EncryptionKey generateRandomKey(int eType)
 throws KrbException {
 return genKey0(randomPassword(null), "NOTHING", null, eType, null);
 }

 /**
 * Returns the password for a given principal
 * @param p principal
 * @return the password
 * @throws sun.security.krb5.KrbException when the principal is not inside
 * the database.
 */
 private char[] getPassword(PrincipalName p, boolean server)
 throws KrbException {
 String pn = p.toString();
 if (p.getRealmString() == null) {
 pn = pn + "@" + getRealm();
 }
 char[] pass = passwords.get(pn);
 if (pass == null) {
 throw new KrbException(server?
 Krb5.KDC_ERR_S_PRINCIPAL_UNKNOWN:
 Krb5.KDC_ERR_C_PRINCIPAL_UNKNOWN, pn.toString());
 }
 return pass;
 }

 /**
 * Returns the salt string for the principal.
 * @param p principal
 * @return the salt
 */
 protected String getSalt(PrincipalName p) {
 String pn = p.toString();
 if (p.getRealmString() == null) {
 pn = pn + "@" + getRealm();
 }
 if (salts.containsKey(pn)) {
 return salts.get(pn);
 }
 if (passwords.containsKey(pn)) {
 try {
 // Find the principal name with correct case.
 p = new PrincipalName(passwords.ceilingEntry(pn).getKey());
 } catch (RealmException re) {
 // Won't happen
 }
 }
 String s = p.getRealmString();
 if (s == null) s = getRealm();
 for (String n: p.getNameStrings()) {
 s += n;
 }
 return s;
 }

 /**
 * Returns the s2kparams for the principal given the etype.
 * @param p principal
 * @param etype encryption type
 * @return the s2kparams, might be null
 */
 protected byte[] getParams(PrincipalName p, int etype) {
 switch (etype) {
 case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96:
 case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96:
 case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128:
 case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192:
 String pn = p.toString();
 if (p.getRealmString() == null) {
 pn = pn + "@" + getRealm();
 }
 if (s2kparamses.containsKey(pn)) {
 return s2kparamses.get(pn);
 }
 if (etype < EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128) {
 return new byte[]{0, 0, 0x10, 0};
 } else {
 return new byte[]{0, 0, (byte) 0x80, 0};
 }
 default:
 return null;
 }
 }

 /**
 * Returns the key for a given principal of the given encryption type
 * @param p the principal
 * @param etype the encryption type
 * @param server looking for a server principal?
 * @return the key
 * @throws sun.security.krb5.KrbException for unknown/unsupported etype
 */
 EncryptionKey keyForUser(PrincipalName p, int etype, boolean server)
 throws KrbException {
 try {
 // Do not call EncryptionKey.acquireSecretKeys(), otherwise
 // the krb5.conf config file would be loaded.
 Integer kvno = null;
 // For service whose password ending with a number, use it as kvno.
 // Kvno must be postive.
 if (p.toString().indexOf('/') > 0) {
 char[] pass = getPassword(p, server);
 if (Character.isDigit(pass[pass.length-1])) {
 kvno = pass[pass.length-1] - '0';
 }
 }
 return genKey0(getPassword(p, server), getSalt(p),
 getParams(p, etype), etype, kvno);
 } catch (KrbException ke) {
 throw ke;
 } catch (Exception e) {
 throw new RuntimeException(e); // should not happen
 }
 }

 /**
 * Returns a KerberosTime.
 *
 * @param offset offset from NOW in seconds
 */
 private static KerberosTime timeAfter(int offset) {
 return new KerberosTime(new Date().getTime() + offset * 1000L);
 }

 /**
 * Generates key from password.
 */
 private static EncryptionKey genKey0(
 char[] pass, String salt, byte[] s2kparams,
 int etype, Integer kvno) throws KrbException {
 return new EncryptionKey(EncryptionKeyDotStringToKey(
 pass, salt, s2kparams, etype),
 etype, kvno);
 }

 /**
 * Processes an incoming request and generates a response.
 * @param in the request
 * @return the response
 * @throws java.lang.Exception for various errors
 */
 protected byte[] processMessage(byte[] in) throws Exception {
 if ((in[0] & 0x1f) == Krb5.KRB_AS_REQ)
 return processAsReq(in);
 else
 return processTgsReq(in);
 }

 /**
 * Processes a TGS_REQ and generates a TGS_REP (or KRB_ERROR)
 * @param in the request
 * @return the response
 * @throws java.lang.Exception for various errors
 */
 protected byte[] processTgsReq(byte[] in) throws Exception {
 TGSReq tgsReq = new TGSReq(in);
 PrincipalName service = tgsReq.reqBody.sname;
 if (options.containsKey(KDC.Option.RESP_NT)) {
 service = new PrincipalName((int)options.get(KDC.Option.RESP_NT),
 service.getNameStrings(), service.getRealm());
 }
 try {
 log(tgsReq.reqBody.cname +
 " sends TGS-REQ for " +
 service + ", " + tgsReq.reqBody.kdcOptions);
 KDCReqBody body = tgsReq.reqBody;
 int[] eTypes = filterSupported(KDCReqBodyDotEType(body));
 if (eTypes.length == 0) {
 throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP);
 }
 int e2 = eTypes[0]; // etype for outgoing session key
 int e3 = eTypes[0]; // etype for outgoing ticket

 PAData[] pas = tgsReq.pAData;

 Ticket tkt = null;
 EncTicketPart etp = null;

 PrincipalName cname = null;
 boolean allowForwardable = true;
 boolean isReferral = false;
 if (body.kdcOptions.get(KDCOptions.CANONICALIZE)) {
 log("verifying referral for " +
 body.sname.getNameString());
 KDC referral = aliasReferrals.get(body.sname.getNameString());
 if (referral != null) {
 service = new PrincipalName(
 PrincipalName.TGS_DEFAULT_SRV_NAME +
 PrincipalName.NAME_COMPONENT_SEPARATOR_STR +
 referral.getRealm(), PrincipalName.KRB_NT_SRV_INST,
 this.getRealm());
 log("referral to " +
 referral.getRealm());
 isReferral = true;
 }
 }

 if (pas == null || pas.length == 0) {
 throw new KrbException(Krb5.KDC_ERR_PADATA_TYPE_NOSUPP);
 } else {
 PrincipalName forUserCName = null;
 for (PAData pa: pas) {
 if (pa.getType() == Krb5.PA_TGS_REQ) {
 APReq apReq = new APReq(pa.getValue());
 tkt = apReq.ticket;
 int te = tkt.encPart.getEType();
 EncryptionKey kkey = keyForUser(tkt.sname, te, true);
 byte[] bb = tkt.encPart.decrypt(kkey, KeyUsage.KU_TICKET);
 DerInputStream derIn = new DerInputStream(bb);
 DerValue der = derIn.getDerValue();
 etp = new EncTicketPart(der.toByteArray());
 // Finally, cname will be overwritten by PA-FOR-USER
 // if it exists.
 cname = etp.cname;
 log("presenting a ticket of "
 + etp.cname + " to " + tkt.sname);
 } else if (pa.getType() == Krb5.PA_FOR_USER) {
 if (options.containsKey(Option.ALLOW_S4U2SELF)) {
 PAForUserEnc p4u = new PAForUserEnc(
 new DerValue(pa.getValue()), null);
 forUserCName = p4u.name;
 log("See PA_FOR_USER "
 + " in the name of " + p4u.name);
 }
 }
 }
 if (forUserCName != null) {
 List<String> names = (List<String>)
 options.get(Option.ALLOW_S4U2SELF);
 if (!names.contains(cname.toString())) {
 // Mimic the normal KDC behavior. When a server is not
 // allowed to send S4U2self, do not send an error.
 // Instead, send a ticket which is useless later.
 allowForwardable = false;
 } else if (options.get(Option.S4U2SELF_NOT_FORWARDABLE) == Boolean.TRUE) {
 // Requsted not forwardable
 allowForwardable = false;
 }
 cname = forUserCName;
 }
 if (tkt == null) {
 throw new KrbException(Krb5.KDC_ERR_PADATA_TYPE_NOSUPP);
 }
 }

 // Session key for original ticket, TGT
 EncryptionKey ckey = etp.key;

 // Session key for session with the service
 EncryptionKey key = generateRandomKey(e2);

 // Check time, TODO
 KerberosTime from = body.from;
 KerberosTime till = body.till;
 if (from == null || from.isZero()) {
 from = timeAfter(0);
 }
 if (till == null) {
 throw new KrbException(Krb5.KDC_ERR_NEVER_VALID); // TODO
 } else if (till.isZero()) {
 till = timeAfter(DEFAULT_LIFETIME);
 }

 boolean[] bFlags = new boolean[Krb5.TKT_OPTS_MAX+1];
 if (body.kdcOptions.get(KDCOptions.FORWARDABLE)
 && allowForwardable) {
 List<String> sensitives = (List<String>)
 options.get(Option.SENSITIVE_ACCOUNTS);
 if (sensitives != null && sensitives.contains(cname.toString())) {
 // Cannot make FORWARDABLE
 } else {
 bFlags[Krb5.TKT_OPTS_FORWARDABLE] = true;
 }
 }
 // We do not request for addresses for FORWARDED tickets
 if (options.containsKey(Option.CHECK_ADDRESSES)
 && body.kdcOptions.get(KDCOptions.FORWARDED)
 && body.addresses != null) {
 throw new KrbException(Krb5.KDC_ERR_BADOPTION);
 }
 if (body.kdcOptions.get(KDCOptions.FORWARDED) ||
 etp.flags.get(Krb5.TKT_OPTS_FORWARDED)) {
 bFlags[Krb5.TKT_OPTS_FORWARDED] = true;
 }
 if (body.kdcOptions.get(KDCOptions.RENEWABLE)) {
 bFlags[Krb5.TKT_OPTS_RENEWABLE] = true;
 //renew = timeAfter(3600 * 24 * 7);
 }
 if (body.kdcOptions.get(KDCOptions.PROXIABLE)) {
 bFlags[Krb5.TKT_OPTS_PROXIABLE] = true;
 }
 if (body.kdcOptions.get(KDCOptions.POSTDATED)) {
 bFlags[Krb5.TKT_OPTS_POSTDATED] = true;
 }
 if (body.kdcOptions.get(KDCOptions.ALLOW_POSTDATE)) {
 bFlags[Krb5.TKT_OPTS_MAY_POSTDATE] = true;
 }
 if (body.kdcOptions.get(KDCOptions.CNAME_IN_ADDL_TKT)) {
 if (!options.containsKey(Option.ALLOW_S4U2PROXY)) {
 // Don't understand CNAME_IN_ADDL_TKT
 throw new KrbException(Krb5.KDC_ERR_BADOPTION);
 } else {
 Map<String,List<String>> map = (Map<String,List<String>>)
 options.get(Option.ALLOW_S4U2PROXY);
 Ticket second = KDCReqBodyDotFirstAdditionalTicket(body);
 EncryptionKey key2 = keyForUser(
 second.sname, second.encPart.getEType(), true);
 byte[] bb = second.encPart.decrypt(key2, KeyUsage.KU_TICKET);
 DerInputStream derIn = new DerInputStream(bb);
 DerValue der = derIn.getDerValue();
 EncTicketPart tktEncPart = new EncTicketPart(der.toByteArray());
 if (!tktEncPart.flags.get(Krb5.TKT_OPTS_FORWARDABLE)
 && options.get(Option.S4U2SELF_ALLOW_NOT_FORWARDABLE) != Boolean.TRUE) {
 throw new KrbException(Krb5.KDC_ERR_BADOPTION);
 }
 PrincipalName client = tktEncPart.cname;
 log("and an additional ticket of "
 + client + " to " + second.sname);
 if (map.containsKey(cname.toString())) {
 if (map.get(cname.toString()).contains(service.toString())) {
 log("S4U2proxy OK");
 } else {
 throw new KrbException(Krb5.KDC_ERR_BADOPTION);
 }
 } else {
 throw new KrbException(Krb5.KDC_ERR_BADOPTION);
 }
 cname = client;
 }
 }

 String okAsDelegate = (String)options.get(Option.OK_AS_DELEGATE);
 if (okAsDelegate != null && (
 okAsDelegate.isEmpty() ||
 okAsDelegate.contains(service.getNameString()))) {
 bFlags[Krb5.TKT_OPTS_DELEGATE] = true;
 }
 bFlags[Krb5.TKT_OPTS_INITIAL] = true;

 KerberosTime renewTill = etp.renewTill;
 if (renewTill != null && body.kdcOptions.get(KDCOptions.RENEW)) {
 // till should never pass renewTill
 if (till.greaterThan(renewTill)) {
 till = renewTill;
 }
 if (System.getProperty("test.set.null.renew") != null) {
 // Testing 8186576, see NullRenewUntil.java.
 renewTill = null;
 }
 }

 TicketFlags tFlags = new TicketFlags(bFlags);
 EncTicketPart enc = new EncTicketPart(
 tFlags,
 key,
 cname,
 new TransitedEncoding(1, new byte[0]), // TODO
 timeAfter(0),
 from,
 till, renewTill,
 body.addresses != null ? body.addresses
 : etp.caddr,
 null);
 EncryptionKey skey = keyForUser(service, e3, true);
 if (skey == null) {
 throw new KrbException(Krb5.KDC_ERR_SUMTYPE_NOSUPP); // TODO
 }
 Ticket t = new Ticket(
 System.getProperty("test.kdc.diff.sname") != null ?
 new PrincipalName("xx" + service.toString()) :
 service,
 new EncryptedData(skey, enc.asn1Encode(), KeyUsage.KU_TICKET)
 );
 EncTGSRepPart enc_part = new EncTGSRepPart(
 key,
 new LastReq(new LastReqEntry[] {
 new LastReqEntry(0, timeAfter(-10))
 }),
 body.getNonce(), // TODO: detect replay
 timeAfter(3600 * 24),
 // Next 5 and last MUST be same with ticket
 tFlags,
 timeAfter(0),
 from,
 till, renewTill,
 service,
 body.addresses,
 null
 );
 EncryptedData edata = new EncryptedData(ckey, enc_part.asn1Encode(),
 KeyUsage.KU_ENC_TGS_REP_PART_SESSKEY);
 TGSRep tgsRep = new TGSRep(null,
 cname,
 t,
 edata);
 System.out.println(" Return " + tgsRep.cname
 + " ticket for " + tgsRep.ticket.sname + ", flags "
 + tFlags);

 DerOutputStream out = new DerOutputStream();
 out.write(DerValue.createTag(DerValue.TAG_APPLICATION,
 true, (byte)Krb5.KRB_TGS_REP), tgsRep.asn1Encode());
 return out.toByteArray();
 } catch (KrbException ke) {
 ke.printStackTrace(System.out);
 KRBError kerr = ke.getError();
 KDCReqBody body = tgsReq.reqBody;
 System.out.println(" Error " + ke.returnCode()
 + " " +ke.returnCodeMessage());
 if (kerr == null) {
 kerr = new KRBError(null, null, null,
 timeAfter(0),
 0,
 ke.returnCode(),
 body.cname,
 service,
 KrbException.errorMessage(ke.returnCode()),
 null);
 }
 return kerr.asn1Encode();
 }
 }

 /**
 * Processes a AS_REQ and generates a AS_REP (or KRB_ERROR)
 * @param in the request
 * @return the response
 * @throws java.lang.Exception for various errors
 */
 protected byte[] processAsReq(byte[] in) throws Exception {
 ASReq asReq = new ASReq(in);
 byte[] asReqbytes = asReq.asn1Encode();
 int[] eTypes = null;
 List<PAData> outPAs = new ArrayList<>();

 PrincipalName service = asReq.reqBody.sname;
 if (options.containsKey(KDC.Option.RESP_NT)) {
 service = new PrincipalName((int)options.get(KDC.Option.RESP_NT),
 service.getNameStrings(),
 Realm.getDefault());
 }
 try {
 log(asReq.reqBody.cname +
 " sends AS-REQ for " +
 service + ", " + asReq.reqBody.kdcOptions);

 KDCReqBody body = asReq.reqBody;

 eTypes = filterSupported(KDCReqBodyDotEType(body));
 if (eTypes.length == 0) {
 throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP);
 }
 int eType = eTypes[0];

 if (body.kdcOptions.get(KDCOptions.CANONICALIZE)) {
 PrincipalName principal = alias2Principals.get(
 body.cname.getNameString());
 if (principal != null) {
 body.cname = principal;
 } else {
 KDC referral = aliasReferrals.get(body.cname.getNameString());
 if (referral != null) {
 body.cname = new PrincipalName(
 PrincipalName.TGS_DEFAULT_SRV_NAME,
 PrincipalName.KRB_NT_SRV_INST,
 referral.getRealm());
 throw new KrbException(Krb5.KRB_ERR_WRONG_REALM);
 }
 }
 }

 EncryptionKey ckey = keyForUser(body.cname, eType, false);
 EncryptionKey skey = keyForUser(service, eType, true);

 if (options.containsKey(KDC.Option.ONLY_RC4_TGT)) {
 int tgtEType = EncryptedData.ETYPE_ARCFOUR_HMAC;
 boolean found = false;
 for (int i=0; i<eTypes.length; i++) {
 if (eTypes[i] == tgtEType) {
 found = true;
 break;
 }
 }
 if (!found) {
 throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP);
 }
 skey = keyForUser(service, tgtEType, true);
 }
 if (ckey == null) {
 throw new KrbException(Krb5.KDC_ERR_ETYPE_NOSUPP);
 }
 if (skey == null) {
 throw new KrbException(Krb5.KDC_ERR_SUMTYPE_NOSUPP); // TODO
 }

 // Session key
 EncryptionKey key = generateRandomKey(eType);
 // Check time, TODO
 KerberosTime from = body.from;
 KerberosTime till = body.till;
 KerberosTime rtime = body.rtime;
 if (from == null || from.isZero()) {
 from = timeAfter(0);
 }
 if (till == null) {
 throw new KrbException(Krb5.KDC_ERR_NEVER_VALID); // TODO
 } else if (till.isZero()) {
 till = timeAfter(DEFAULT_LIFETIME);
 } else if (till.greaterThan(timeAfter(24 * 3600))
 && System.getProperty("test.kdc.force.till") == null) {
 // If till is more than 1 day later, make it renewable
 till = timeAfter(DEFAULT_LIFETIME);
 body.kdcOptions.set(KDCOptions.RENEWABLE, true);
 if (rtime == null) rtime = till;
 }
 if (rtime == null && body.kdcOptions.get(KDCOptions.RENEWABLE)) {
 rtime = timeAfter(DEFAULT_RENEWTIME);
 }
 //body.from
 boolean[] bFlags = new boolean[Krb5.TKT_OPTS_MAX+1];
 if (body.kdcOptions.get(KDCOptions.FORWARDABLE)) {
 List<String> sensitives = (List<String>)
 options.get(Option.SENSITIVE_ACCOUNTS);
 if (sensitives != null
 && sensitives.contains(body.cname.toString())) {
 // Cannot make FORWARDABLE
 } else {
 bFlags[Krb5.TKT_OPTS_FORWARDABLE] = true;
 }
 }
 if (body.kdcOptions.get(KDCOptions.RENEWABLE)) {
 bFlags[Krb5.TKT_OPTS_RENEWABLE] = true;
 //renew = timeAfter(3600 * 24 * 7);
 }
 if (body.kdcOptions.get(KDCOptions.PROXIABLE)) {
 bFlags[Krb5.TKT_OPTS_PROXIABLE] = true;
 }
 if (body.kdcOptions.get(KDCOptions.POSTDATED)) {
 bFlags[Krb5.TKT_OPTS_POSTDATED] = true;
 }
 if (body.kdcOptions.get(KDCOptions.ALLOW_POSTDATE)) {
 bFlags[Krb5.TKT_OPTS_MAY_POSTDATE] = true;
 }
 bFlags[Krb5.TKT_OPTS_INITIAL] = true;
 if (System.getProperty("test.kdc.always.enc.pa.rep") != null) {
 bFlags[Krb5.TKT_OPTS_ENC_PA_REP] = true;
 }

 // Creating PA-DATA
 DerValue[] pas2 = null, pas = null;
 if (options.containsKey(KDC.Option.DUP_ETYPE)) {
 int n = (Integer)options.get(KDC.Option.DUP_ETYPE);
 switch (n) {
 case 1: // customer's case in 7067974
 pas2 = new DerValue[] {
 new DerValue(new ETypeInfo2(1, null, null).asn1Encode()),
 new DerValue(new ETypeInfo2(1, "", null).asn1Encode()),
 new DerValue(new ETypeInfo2(
 1, realm, new byte[]{1}).asn1Encode()),
 };
 pas = new DerValue[] {
 new DerValue(new ETypeInfo(1, null).asn1Encode()),
 new DerValue(new ETypeInfo(1, "").asn1Encode()),
 new DerValue(new ETypeInfo(1, realm).asn1Encode()),
 };
 break;
 case 2: // we still reject non-null s2kparams and prefer E2 over E
 pas2 = new DerValue[] {
 new DerValue(new ETypeInfo2(
 1, realm, new byte[]{1}).asn1Encode()),
 new DerValue(new ETypeInfo2(1, null, null).asn1Encode()),
 new DerValue(new ETypeInfo2(1, "", null).asn1Encode()),
 };
 pas = new DerValue[] {
 new DerValue(new ETypeInfo(1, realm).asn1Encode()),
 new DerValue(new ETypeInfo(1, null).asn1Encode()),
 new DerValue(new ETypeInfo(1, "").asn1Encode()),
 };
 break;
 case 3: // but only E is wrong
 pas = new DerValue[] {
 new DerValue(new ETypeInfo(1, realm).asn1Encode()),
 new DerValue(new ETypeInfo(1, null).asn1Encode()),
 new DerValue(new ETypeInfo(1, "").asn1Encode()),
 };
 break;
 case 4: // we also ignore rc4-hmac
 pas = new DerValue[] {
 new DerValue(new ETypeInfo(23, "ANYTHING").asn1Encode()),
 new DerValue(new ETypeInfo(1, null).asn1Encode()),
 new DerValue(new ETypeInfo(1, "").asn1Encode()),
 };
 break;
 case 5: // "" should be wrong, but we accept it now
 // See s.s.k.internal.PAData$SaltAndParams
 pas = new DerValue[] {
 new DerValue(new ETypeInfo(1, "").asn1Encode()),
 new DerValue(new ETypeInfo(1, null).asn1Encode()),
 };
 break;
 }
 } else {
 int[] epas = eTypes;
 if (options.containsKey(KDC.Option.RC4_FIRST_PREAUTH)) {
 for (int i=1; i<epas.length; i++) {
 if (epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC) {
 epas[i] = epas[0];
 epas[0] = EncryptedData.ETYPE_ARCFOUR_HMAC;
 break;
 }
 };
 } else if (options.containsKey(KDC.Option.ONLY_ONE_PREAUTH)) {
 epas = new int[] { eTypes[0] };
 }
 pas2 = new DerValue[epas.length];
 for (int i=0; i<epas.length; i++) {
 pas2[i] = new DerValue(new ETypeInfo2(
 epas[i],
 epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC ?
 null : getSalt(body.cname),
 getParams(body.cname, epas[i])).asn1Encode());
 }
 boolean allOld = true;
 for (int i: eTypes) {
 if (i >= EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96 &&
 i != EncryptedData.ETYPE_ARCFOUR_HMAC) {
 allOld = false;
 break;
 }
 }
 if (allOld) {
 pas = new DerValue[epas.length];
 for (int i=0; i<epas.length; i++) {
 pas[i] = new DerValue(new ETypeInfo(
 epas[i],
 epas[i] == EncryptedData.ETYPE_ARCFOUR_HMAC ?
 null : getSalt(body.cname)
 ).asn1Encode());
 }
 }
 }

 DerOutputStream eid;
 if (pas2 != null) {
 eid = new DerOutputStream();
 eid.putSequence(pas2);
 outPAs.add(new PAData(Krb5.PA_ETYPE_INFO2, eid.toByteArray()));
 }
 if (pas != null) {
 eid = new DerOutputStream();
 eid.putSequence(pas);
 outPAs.add(new PAData(Krb5.PA_ETYPE_INFO, eid.toByteArray()));
 }

 PAData[] inPAs = asReq.pAData;
 List<PAData> enc_outPAs = new ArrayList<>();

 byte[] paEncTimestamp = null;
 if (inPAs != null) {
 for (PAData inPA : inPAs) {
 if (inPA.getType() == Krb5.PA_ENC_TIMESTAMP) {
 paEncTimestamp = inPA.getValue();
 }
 }
 }

 if (paEncTimestamp == null) {
 Object preauth = options.get(Option.PREAUTH_REQUIRED);
 if (preauth == null || preauth.equals(Boolean.TRUE)) {
 throw new KrbException(Krb5.KDC_ERR_PREAUTH_REQUIRED);
 }
 } else {
 EncryptionKey pakey = null;
 try {
 EncryptedData data = newEncryptedData(
 new DerValue(paEncTimestamp));
 pakey = keyForUser(body.cname, data.getEType(), false);
 data.decrypt(pakey, KeyUsage.KU_PA_ENC_TS);
 } catch (Exception e) {
 KrbException ke = new KrbException(Krb5.KDC_ERR_PREAUTH_FAILED);
 ke.initCause(e);
 throw ke;
 }
 bFlags[Krb5.TKT_OPTS_PRE_AUTHENT] = true;
 for (PAData pa : inPAs) {
 if (pa.getType() == Krb5.PA_REQ_ENC_PA_REP) {
 Checksum ckSum = new Checksum(
 Checksum.CKSUMTYPE_HMAC_SHA1_96_AES128,
 asReqbytes, ckey, KeyUsage.KU_AS_REQ);
 enc_outPAs.add(new PAData(Krb5.PA_REQ_ENC_PA_REP,
 ckSum.asn1Encode()));
 bFlags[Krb5.TKT_OPTS_ENC_PA_REP] = true;
 break;
 }
 }
 }

 TicketFlags tFlags = new TicketFlags(bFlags);
 EncTicketPart enc = new EncTicketPart(
 tFlags,
 key,
 body.cname,
 new TransitedEncoding(1, new byte[0]),
 timeAfter(0),
 from,
 till, rtime,
 body.addresses,
 null);
 Ticket t = new Ticket(
 service,
 new EncryptedData(skey, enc.asn1Encode(), KeyUsage.KU_TICKET)
 );
 EncASRepPart enc_part = new EncASRepPart(
 key,
 new LastReq(new LastReqEntry[]{
 new LastReqEntry(0, timeAfter(-10))
 }),
 body.getNonce(), // TODO: detect replay?
 timeAfter(3600 * 24),
 // Next 5 and last MUST be same with ticket
 tFlags,
 timeAfter(0),
 from,
 till, rtime,
 service,
 body.addresses,
 enc_outPAs.toArray(new PAData[enc_outPAs.size()])
 );
 EncryptedData edata = new EncryptedData(ckey, enc_part.asn1Encode(),
 KeyUsage.KU_ENC_AS_REP_PART);
 ASRep asRep = new ASRep(
 outPAs.toArray(new PAData[outPAs.size()]),
 body.cname,
 t,
 edata);

 System.out.println(" Return " + asRep.cname
 + " ticket for " + asRep.ticket.sname + ", flags "
 + tFlags);

 DerOutputStream out = new DerOutputStream();
 out.write(DerValue.createTag(DerValue.TAG_APPLICATION,
 true, (byte)Krb5.KRB_AS_REP), asRep.asn1Encode());
 byte[] result = out.toByteArray();

 // Added feature:
 // Write the current issuing TGT into a ccache file specified
 // by the system property below.
 String ccache = System.getProperty("test.kdc.save.ccache");
 if (ccache != null) {
 asRep.encKDCRepPart = enc_part;
 sun.security.krb5.internal.ccache.Credentials credentials =
 new sun.security.krb5.internal.ccache.Credentials(asRep);
 CredentialsCache cache =
 CredentialsCache.create(asReq.reqBody.cname, ccache);
 if (cache == null) {
 throw new IOException("Unable to create the cache file " +
 ccache);
 }
 cache.update(credentials);
 cache.save();
 }

 return result;
 } catch (KrbException ke) {
 ke.printStackTrace(System.out);
 KRBError kerr = ke.getError();
 KDCReqBody body = asReq.reqBody;
 System.out.println(" Error " + ke.returnCode()
 + " " +ke.returnCodeMessage());
 byte[] eData = null;
 if (kerr == null) {
 if (ke.returnCode() == Krb5.KDC_ERR_PREAUTH_REQUIRED ||
 ke.returnCode() == Krb5.KDC_ERR_PREAUTH_FAILED) {
 outPAs.add(new PAData(Krb5.PA_ENC_TIMESTAMP, new byte[0]));
 }
 if (outPAs.size() > 0) {
 DerOutputStream bytes = new DerOutputStream();
 for (PAData p: outPAs) {
 bytes.write(p.asn1Encode());
 }
 DerOutputStream temp = new DerOutputStream();
 temp.write(DerValue.tag_Sequence, bytes);
 eData = temp.toByteArray();
 }
 kerr = new KRBError(null, null, null,
 timeAfter(0),
 0,
 ke.returnCode(),
 body.cname,
 service,
 KrbException.errorMessage(ke.returnCode()),
 eData);
 }
 return kerr.asn1Encode();
 }
 }

 private int[] filterSupported(int[] input) {
 int count = 0;
 for (int i = 0; i < input.length; i++) {
 if (!EType.isSupported(input[i])) {
 continue;
 }
 if (SUPPORTED_ETYPES != null) {
 boolean supported = false;
 for (String se : SUPPORTED_ETYPES.split(",")) {
 if (Config.getType(se) == input[i]) {
 supported = true;
 break;
 }
 }
 if (!supported) {
 continue;
 }
 }
 if (count != i) {
 input[count] = input[i];
 }
 count++;
 }
 if (count != input.length) {
 input = Arrays.copyOf(input, count);
 }
 return input;
 }

 /**
 * Generates a line for a KDC to put inside [realms] of krb5.conf
 * @return REALM.NAME = { kdc = host:port etc }
 */
 private String realmLine() {
 StringBuilder sb = new StringBuilder();
 sb.append(realm).append(" = {\n kdc = ")
 .append(kdc).append(':').append(port).append('\n');
 for (String s: conf) {
 sb.append(" ").append(s).append('\n');
 }
 return sb.append("}\n").toString();
 }

 /**
 * Start the KDC service. This server listens on both UDP and TCP using
 * the same port number. It uses three threads to deal with requests.
 * They can be set to daemon threads if requested.
 * @param port the port number to listen to. If zero, a random available
 * port no less than 8000 will be chosen and used.
 * @param asDaemon true if the KDC threads should be daemons
 * @throws java.io.IOException for any communication error
 */
 protected void startServer(int port, boolean asDaemon) throws IOException {
 if (nativeKdc != null) {
 startNativeServer(port, asDaemon);
 } else {
 startJavaServer(port, asDaemon);
 }
 }

 private void startNativeServer(int port, boolean asDaemon) throws IOException {
 nativeKdc.prepare();
 nativeKdc.init();
 kdcProc = nativeKdc.kdc();
 }

 private void startJavaServer(int port, boolean asDaemon) throws IOException {
 if (port > 0) {
 u1 = new DatagramSocket(port, InetAddress.getByName("127.0.0.1"));
 t1 = new ServerSocket(port);
 } else {
 while (true) {
 // Try to find a port number that's both TCP and UDP free
 try {
 port = 8000 + new java.util.Random().nextInt(10000);
 u1 = null;
 u1 = new DatagramSocket(port, InetAddress.getByName("127.0.0.1"));
 t1 = new ServerSocket(port);
 break;
 } catch (Exception e) {
 if (u1 != null) u1.close();
 }
 }
 }
 final DatagramSocket udp = u1;
 final ServerSocket tcp = t1;
 System.out.println("Start KDC on " + port);

 this.port = port;

 // The UDP consumer
 thread1 = new Thread() {
 public void run() {
 udpConsumerReady = true;
 while (true) {
 try {
 byte[] inbuf = new byte[8192];
 DatagramPacket p = new DatagramPacket(inbuf, inbuf.length);
 udp.receive(p);
 System.out.println("-----------------------------------------------");
 System.out.println(">>>>> UDP packet received");
 q.put(new Job(processMessage(Arrays.copyOf(inbuf, p.getLength())), udp, p));
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
 }
 };
 thread1.setDaemon(asDaemon);
 thread1.start();

 // The TCP consumer
 thread2 = new Thread() {
 public void run() {
 tcpConsumerReady = true;
 while (true) {
 try {
 Socket socket = tcp.accept();
 System.out.println("-----------------------------------------------");
 System.out.println(">>>>> TCP connection established");
 DataInputStream in = new DataInputStream(socket.getInputStream());
 DataOutputStream out = new DataOutputStream(socket.getOutputStream());
 int len = in.readInt();
 if (len > 65535) {
 throw new Exception("Huge request not supported");
 }
 byte[] token = new byte[len];
 in.readFully(token);
 q.put(new Job(processMessage(token), socket, out));
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
 }
 };
 thread2.setDaemon(asDaemon);
 thread2.start();

 // The dispatcher
 thread3 = new Thread() {
 public void run() {
 dispatcherReady = true;
 while (true) {
 try {
 q.take().send();
 } catch (Exception e) {
 }
 }
 }
 };
 thread3.setDaemon(true);
 thread3.start();

 // wait for the KDC is ready
 try {
 while (!isReady()) {
 Thread.sleep(100);
 }
 } catch(InterruptedException e) {
 throw new IOException(e);
 }
 }

 public void kinit(String user, String ccache) throws Exception {
 if (user.indexOf('@') < 0) {
 user = user + "@" + realm;
 }
 if (nativeKdc != null) {
 nativeKdc.kinit(user, ccache);
 } else {
 Context.fromUserPass(user, passwords.get(user), false)
 .ccache(ccache);
 }
 }

 boolean isReady() {
 return udpConsumerReady && tcpConsumerReady && dispatcherReady;
 }

 void log(String s) {
 System.out.println(realm + ":" + port + "> " + s);
 }

 public void terminate() {
 if (nativeKdc != null) {
 System.out.println("Killing kdc...");
 kdcProc.destroyForcibly();
 System.out.println("Done");
 } else {
 try {
 thread1.stop();
 thread2.stop();
 thread3.stop();
 u1.close();
 t1.close();
 } catch (Exception e) {
 // OK
 }
 }
 }

 public static KDC startKDC(final String host, final String krbConfFileName,
 final String realm, final Map<String, String> principals,
 final String ktab, final KtabMode mode) {

 KDC kdc;
 try {
 kdc = KDC.create(realm, host, 0, true);
 kdc.setOption(KDC.Option.PREAUTH_REQUIRED, Boolean.FALSE);
 if (krbConfFileName != null) {
 KDC.saveConfig(krbConfFileName, kdc);
 }

 // Add principals
 if (principals != null) {
 principals.forEach((name, password) -> {
 if (password == null || password.isEmpty()) {
 System.out.println(String.format(
 "KDC:add a principal '%s' with a random " +
 "password", name));
 kdc.addPrincipalRandKey(name);
 } else {
 System.out.println(String.format(
 "KDC:add a principal '%s' with '%s' password",
 name, password));
 kdc.addPrincipal(name, password.toCharArray());
 }
 });
 }

 // Create or append keys to existing keytab file
 if (ktab != null) {
 File ktabFile = new File(ktab);
 switch(mode) {
 case APPEND:
 if (ktabFile.exists()) {
 System.out.println(String.format(
--> --------------------

--> maximum size reached

--> --------------------

¤ Diese beiden folgenden Angebotsgruppen bietet das Unternehmen0.124Angebot Wie Sie bei der Firma Beratungs- und Dienstleistungen beauftragen können ¤

Druckansicht unsichere Verbindung
Druckansicht Hier finden Sie eine Liste der Produkte des Unternehmens
Mittel

Quellcode-Bibliothek

^© Kompilation durch diese Firma

[Weder Korrektheit noch Funktionsfähigkeit der Software werden zugesichert.]

Datei: Sprache: JAVA

¤ Diese beiden folgenden Angebotsgruppen bietet das Unternehmen0.124Angebot Wie Sie bei der Firma Beratungs- und Dienstleistungen beauftragen können ¤

Lebenszyklus

Ziele

Bot Zugriff