1 /*
2 * Copyright (c) 2020, Azul Systems, Inc. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25 package com.sun.jndi.ldap.sasl;
26
27 import javax.naming.NamingException;
28 import javax.security.sasl.SaslException;
29 import java.security.MessageDigest;
30 import java.security.NoSuchAlgorithmException;
31 import java.security.cert.CertificateEncodingException;
32 import java.security.cert.X509Certificate;
33 import java.util.Arrays;
34 import java.util.Hashtable;
35
36 /**
37 * This class implements the Channel Binding for TLS as defined in
38 * <a href="https://www.ietf.org/rfc/rfc5929.txt">
39 * Channel Bindings for TLS</a>
40 *
41 * Format of the Channel Binding data is also defined in
42 * <a href="https://www.ietf.org/rfc/rfc5056.txt">
43 * On the Use of Channel Bindings to Secure Channels</a>
44 * section 2.1.
45 *
46 */
47
48 public class TlsChannelBinding {
49
50 // TLS channel binding type property
51 public static final String CHANNEL_BINDING_TYPE =
52 "com.sun.jndi.ldap.tls.cbtype";
53
54 // internal TLS channel binding property
55 public static final String CHANNEL_BINDING =
56 "jdk.internal.sasl.tlschannelbinding";
57
58 public enum TlsChannelBindingType {
59
60 /**
61 * Channel binding on the basis of TLS Finished message
62 */
63 TLS_UNIQUE("tls-unique"),
64 /**
65 * Channel binding on the basis of TLS server certificate
66 */
67 TLS_SERVER_END_POINT("tls-server-end-point");
68
69 public String getName() {
70 return name;
71 }
72
73 final private String name;
74 TlsChannelBindingType(String name) {
75 this.name = name;
76 }
77 }
78
79 /**
80 * Parse value of "com.sun.jndi.ldap.tls.cbtype" property
81 * @param cbType
82 * @throws NamingException
83 */
84 public static TlsChannelBindingType parseType(String cbType) throws NamingException {
85 if (cbType != null) {
86 if (cbType.equals(TlsChannelBindingType.TLS_UNIQUE.getName())) {
87 throw new NamingException("Channel binding type " +
88 TlsChannelBindingType.TLS_UNIQUE.getName() +
89 " is not supported");
90 } else if (cbType.equals(TlsChannelBindingType.TLS_SERVER_END_POINT.getName())) {
91 return TlsChannelBindingType.TLS_SERVER_END_POINT;
92 } else {
93 throw new NamingException("Illegal value for " +
94 CHANNEL_BINDING_TYPE + " property.");
95 }
96 }
97 return null;
98 }
99
100 final private TlsChannelBindingType cbType;
101 final private byte[] cbData;
102
103 /**
104 * Construct tls-unique Channel Binding data
105 * @param finishedMessage
106 * @throws SaslException
107 */
108 public static TlsChannelBinding create(byte[] finishedMessage) throws SaslException {
109 throw new UnsupportedOperationException(TlsChannelBindingType.TLS_UNIQUE.getName() +
110 " channel binding is not supported");
111 }
112
113 /**
114 * Construct tls-server-end-point Channel Binding data
115 * @param serverCertificate
116 * @throws SaslException
117 */
118 public static TlsChannelBinding create(X509Certificate serverCertificate) throws SaslException {
119 try {
120 final byte[] prefix =
121 TlsChannelBindingType.TLS_SERVER_END_POINT.getName().concat(":").getBytes();
122 String hashAlg = serverCertificate.getSigAlgName().
123 replace("SHA", "SHA-").toUpperCase();
124 int ind = hashAlg.indexOf("WITH");
125 if (ind > 0) {
126 hashAlg = hashAlg.substring(0, ind);
127 if (hashAlg.equals("MD5") || hashAlg.equals("SHA-1")) {
128 hashAlg = "SHA-256";
129 }
130 } else {
131 hashAlg = "SHA-256";
132 }
133 MessageDigest md = MessageDigest.getInstance(hashAlg);
134 byte[] hash = md.digest(serverCertificate.getEncoded());
135 byte[] cbData = Arrays.copyOf(prefix, prefix.length + hash.length );
136 System.arraycopy(hash, 0, cbData, prefix.length, hash.length);
137 return new TlsChannelBinding(TlsChannelBindingType.TLS_SERVER_END_POINT, cbData);
138 } catch (NoSuchAlgorithmException | CertificateEncodingException e) {
139 throw new SaslException("Cannot create TLS channel binding data", e);
140 }
141 }
142
143 private TlsChannelBinding(TlsChannelBindingType cbType, byte[] cbData) {
144 this.cbType = cbType;
145 this.cbData = cbData;
146 }
147
148 public TlsChannelBindingType getType() {
149 return cbType;
150 }
151 public byte[] getData() {
152 return cbData;
153 }
154 }