diff --git a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java index ebf794e91cb..ba27220f66f 100644 --- a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java +++ b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java @@ -555,6 +555,12 @@ public class EncryptionKey int ktype; boolean etypeFound = false; + + // When no matched kvno is found, returns tke key of the same + // etype with the highest kvno + int kvno_found = 0; + EncryptionKey key_found = null; + for (int i = 0; i < keys.length; i++) { ktype = keys[i].getEType(); if (EType.isSupported(ktype)) { @@ -563,6 +569,10 @@ public class EncryptionKey etypeFound = true; if (versionMatches(kvno, kv)) { return keys[i]; + } else if (kv > kvno_found) { + // kv is not null + key_found = keys[i]; + kvno_found = kv; } } } @@ -580,12 +590,17 @@ public class EncryptionKey etypeFound = true; if (versionMatches(kvno, kv)) { return new EncryptionKey(etype, keys[i].getBytes()); + } else if (kv > kvno_found) { + key_found = new EncryptionKey(etype, keys[i].getBytes()); + kvno_found = kv; } } } } if (etypeFound) { - throw new KrbException(Krb5.KRB_AP_ERR_BADKEYVER); + return key_found; + // For compatibility, will not fail here. + //throw new KrbException(Krb5.KRB_AP_ERR_BADKEYVER); } return null; } diff --git a/jdk/test/sun/security/krb5/auto/DynamicKeytab.java b/jdk/test/sun/security/krb5/auto/DynamicKeytab.java index 2565d61d47e..6525b8fb49f 100644 --- a/jdk/test/sun/security/krb5/auto/DynamicKeytab.java +++ b/jdk/test/sun/security/krb5/auto/DynamicKeytab.java @@ -110,11 +110,13 @@ public class DynamicKeytab { throw new Exception("Should not success"); } catch (GSSException gsse) { System.out.println(gsse); - KrbException ke = (KrbException)gsse.getCause(); - if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) { - throw new Exception("Not expected failure code: " + - ke.returnCode()); - } + // Since 7197159, different kvno is accepted, this return code + // will never be thrown out again. + //KrbException ke = (KrbException)gsse.getCause(); + //if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) { + // throw new Exception("Not expected failure code: " + + // ke.returnCode()); + //} } // Test 8: an empty KDC means revoke all diff --git a/jdk/test/sun/security/krb5/auto/KvnoNA.java b/jdk/test/sun/security/krb5/auto/KvnoNA.java new file mode 100644 index 00000000000..2c645ecf357 --- /dev/null +++ b/jdk/test/sun/security/krb5/auto/KvnoNA.java @@ -0,0 +1,72 @@ +/* + * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + * @test + * @bug 7197159 + * @compile -XDignore.symbol.file KvnoNA.java + * @run main/othervm KvnoNA + * @summary accept different kvno if there no match + */ + +import org.ietf.jgss.GSSException; +import sun.security.jgss.GSSUtil; +import sun.security.krb5.KrbException; +import sun.security.krb5.PrincipalName; +import sun.security.krb5.internal.ktab.KeyTab; +import sun.security.krb5.internal.Krb5; + +public class KvnoNA { + + public static void main(String[] args) + throws Exception { + + OneKDC kdc = new OneKDC(null); + kdc.writeJAASConf(); + + // In KDC, it's 2 + char[] pass = "pass2".toCharArray(); + kdc.addPrincipal(OneKDC.SERVER, pass); + + // In ktab, kvno is 1 or 3, 3 has the same password + KeyTab ktab = KeyTab.create(OneKDC.KTAB); + PrincipalName p = new PrincipalName( + OneKDC.SERVER+"@"+OneKDC.REALM, PrincipalName.KRB_NT_SRV_HST); + ktab.addEntry(p, "pass1".toCharArray(), 1, true); + ktab.addEntry(p, "pass2".toCharArray(), 3, true); + ktab.save(); + + Context c, s; + + c = Context.fromUserPass("dummy", "bogus".toCharArray(), false); + s = Context.fromJAAS("server"); + + c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID); + s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID); + + Context.handshake(c, s); + + s.dispose(); + c.dispose(); + } +} diff --git a/jdk/test/sun/security/krb5/auto/MoreKvno.java b/jdk/test/sun/security/krb5/auto/MoreKvno.java index 20cac93d0a0..55389f0f185 100644 --- a/jdk/test/sun/security/krb5/auto/MoreKvno.java +++ b/jdk/test/sun/security/krb5/auto/MoreKvno.java @@ -23,8 +23,7 @@ /* * @test - * @bug 6893158 - * @bug 6907425 + * @bug 6893158 6907425 7197159 * @run main/othervm MoreKvno * @summary AP_REQ check should use key version number */ @@ -69,11 +68,13 @@ public class MoreKvno { go(OneKDC.SERVER, "com.sun.security.jgss.krb5.accept", pass); throw new Exception("This test should fail"); } catch (GSSException gsse) { - KrbException ke = (KrbException)gsse.getCause(); - if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) { - throw new Exception("Not expected failure code: " + - ke.returnCode()); - } + // Since 7197159, different kvno is accepted, this return code + // will never be thrown out again. + //KrbException ke = (KrbException)gsse.getCause(); + //if (ke.returnCode() != Krb5.KRB_AP_ERR_BADKEYVER) { + // throw new Exception("Not expected failure code: " + + // ke.returnCode()); + //} } }