1 /* 2 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 3 * 4 * This code is free software; you can redistribute it and/or modify it 5 * under the terms of the GNU General Public License version 2 only, as 6 * published by the Free Software Foundation. Oracle designates this 7 * particular file as subject to the "Classpath" exception as provided 8 * by Oracle in the LICENSE file that accompanied this code. 9 * 10 * This code is distributed in the hope that it will be useful, but WITHOUT 11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 13 * version 2 for more details (a copy is included in the LICENSE file that 14 * accompanied this code). 15 * 16 * You should have received a copy of the GNU General Public License version 17 * 2 along with this work; if not, write to the Free Software Foundation, 18 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 19 * 20 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 21 * or visit www.oracle.com if you need additional information or have any 22 * questions. 23 */ 24 25 /* 26 * 27 * (C) Copyright IBM Corp. 1999 All Rights Reserved. 28 * Copyright 1997 The Open Group Research Institute. All rights reserved. 29 */ 30 31 package sun.security.krb5; 32 33 import sun.security.krb5.internal.*; 34 35 abstract class KrbKdcRep { 36 37 static void check( 38 boolean isAsReq, 39 KDCReq req, 40 KDCRep rep 41 ) throws KrbApErrException { 42 43 if (isAsReq && !req.reqBody.cname.equals(rep.cname)) { 44 rep.encKDCRepPart.key.destroy(); 45 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 46 } 47 48 if (!req.reqBody.sname.equals(rep.encKDCRepPart.sname)) { 49 rep.encKDCRepPart.key.destroy(); 50 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 51 } 52 53 if (req.reqBody.getNonce() != rep.encKDCRepPart.nonce) { 54 rep.encKDCRepPart.key.destroy(); 55 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 56 } 57 58 if ( 59 ((req.reqBody.addresses != null && rep.encKDCRepPart.caddr != null) && 60 !req.reqBody.addresses.equals(rep.encKDCRepPart.caddr))) { 61 rep.encKDCRepPart.key.destroy(); 62 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 63 } 64 65 // We allow KDC to return a non-forwardable ticket if request has -f 66 for (int i = 2; i < 6; i++) { 67 if (req.reqBody.kdcOptions.get(i) != 68 rep.encKDCRepPart.flags.get(i)) { 69 if (Krb5.DEBUG) { 70 System.out.println("> KrbKdcRep.check: at #" + i 71 + ". request for " + req.reqBody.kdcOptions.get(i) 72 + ", received " + rep.encKDCRepPart.flags.get(i)); 73 } 74 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 75 } 76 } 77 78 // Reply to a renewable request should be renewable, but if request does 79 // not contain renewable, KDC is free to issue a renewable ticket (for 80 // example, if ticket_lifetime is too big). 81 if (req.reqBody.kdcOptions.get(KDCOptions.RENEWABLE) && 82 !rep.encKDCRepPart.flags.get(KDCOptions.RENEWABLE)) { 83 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 84 } 85 86 if ((req.reqBody.from == null) || req.reqBody.from.isZero()) { 87 // verify this is allowed 88 if ((rep.encKDCRepPart.starttime != null) && 89 !rep.encKDCRepPart.starttime.inClockSkew()) { 90 rep.encKDCRepPart.key.destroy(); 91 throw new KrbApErrException(Krb5.KRB_AP_ERR_SKEW); 92 } 93 } 94 95 if ((req.reqBody.from != null) && !req.reqBody.from.isZero()) { 96 // verify this is allowed 97 if ((rep.encKDCRepPart.starttime != null) && 98 !req.reqBody.from.equals(rep.encKDCRepPart.starttime)) { 99 rep.encKDCRepPart.key.destroy(); 100 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 101 } 102 } 103 104 if (!req.reqBody.till.isZero() && 105 rep.encKDCRepPart.endtime.greaterThan(req.reqBody.till)) { 106 rep.encKDCRepPart.key.destroy(); 107 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 108 } 109 110 if (req.reqBody.kdcOptions.get(KDCOptions.RENEWABLE)) { 111 if (req.reqBody.rtime != null && !req.reqBody.rtime.isZero()) { 112 // verify this is required 113 if ((rep.encKDCRepPart.renewTill == null) || 114 rep.encKDCRepPart.renewTill.greaterThan(req.reqBody.rtime) 115 ) { 116 rep.encKDCRepPart.key.destroy(); 117 throw new KrbApErrException(Krb5.KRB_AP_ERR_MODIFIED); 118 } 119 } 120 } 121 } 122 }