/* * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ /* *  (C) Copyright IBM Corp. 1999 All Rights Reserved. *  Copyright 1997 The Open Group Research Institute.  All rights reserved. */ package sun.security.krb5; import java.util.Arrays;import sun.security.util.*;import sun.security.krb5.internal.*;import sun.security.krb5.internal.crypto.*;import java.io.IOException;import java.math.BigInteger; /** * This class encapsulates the concept of a Kerberos checksum. */public class Checksum {     private int cksumType;    private byte[] checksum;     // ----------------------------------------------+-------------+-----------    //                      Checksum type            |sumtype      |checksum    //                                               |value        | size    // ----------------------------------------------+-------------+-----------    public static final int CKSUMTYPE_NULL          = 0;               // 0    public static final int CKSUMTYPE_CRC32         = 1;               // 4    public static final int CKSUMTYPE_RSA_MD4       = 2;               // 16    public static final int CKSUMTYPE_RSA_MD4_DES   = 3;               // 24    public static final int CKSUMTYPE_DES_MAC       = 4;               // 16    public static final int CKSUMTYPE_DES_MAC_K     = 5;               // 8    public static final int CKSUMTYPE_RSA_MD4_DES_K = 6;               // 16    public static final int CKSUMTYPE_RSA_MD5       = 7;               // 16    public static final int CKSUMTYPE_RSA_MD5_DES   = 8;               // 24      // draft-ietf-krb-wg-crypto-07.txt    public static final int CKSUMTYPE_HMAC_SHA1_DES3_KD = 12;          // 20     // draft-raeburn-krb-rijndael-krb-07.txt    public static final int CKSUMTYPE_HMAC_SHA1_96_AES128 = 15;        // 96    public static final int CKSUMTYPE_HMAC_SHA1_96_AES256 = 16;        // 96     // draft-brezak-win2k-krb-rc4-hmac-04.txt    public static final int CKSUMTYPE_HMAC_MD5_ARCFOUR = -138;     static int CKSUMTYPE_DEFAULT;    static int SAFECKSUMTYPE_DEFAULT;     private static boolean DEBUG = Krb5.DEBUG;    static {        String temp = null;        Config cfg = null;        try {            cfg = Config.getInstance();            temp = cfg.getDefault("default_checksum", "libdefaults");            if (temp != null)                {                    CKSUMTYPE_DEFAULT = cfg.getType(temp);                } else {                    /*                     * If the default checksum is not                     * specified in the configuration we                     * set it to RSA_MD5. We follow the MIT and                     * SEAM implementation.                     */                    CKSUMTYPE_DEFAULT = CKSUMTYPE_RSA_MD5;                }        } catch (Exception exc) {            if (DEBUG) {                System.out.println("Exception in getting default checksum "+                                   "value from the configuration " +                                   "Setting default checksum to be RSA-MD5");                exc.printStackTrace();            }            CKSUMTYPE_DEFAULT = CKSUMTYPE_RSA_MD5;        }          try {            temp = cfg.getDefault("safe_checksum_type", "libdefaults");            if (temp != null)                {                    SAFECKSUMTYPE_DEFAULT = cfg.getType(temp);                } else {                    SAFECKSUMTYPE_DEFAULT = CKSUMTYPE_RSA_MD5_DES;                }        } catch (Exception exc) {            if (DEBUG) {                System.out.println("Exception in getting safe default " +                                   "checksum value " +                                   "from the configuration Setting  " +                                   "safe default checksum to be RSA-MD5");                exc.printStackTrace();            }            SAFECKSUMTYPE_DEFAULT = CKSUMTYPE_RSA_MD5_DES;        }    }     /**     * Constructs a new Checksum using the raw data and type.     * @data the byte array of checksum.     * @new_cksumType the type of checksum.     *     */         // used in InitialToken    public Checksum(byte[] data, int new_cksumType) {        cksumType = new_cksumType;        checksum = data;    }     /**     * Constructs a new Checksum by calculating the checksum over the data     * using specified checksum type.     * @new_cksumType the type of checksum.     * @data the data that needs to be performed a checksum calculation on.     */    public Checksum(int new_cksumType, byte[] data)        throws KdcErrException, KrbCryptoException {         cksumType = new_cksumType;        CksumType cksumEngine = CksumType.getInstance(cksumType);        if (!cksumEngine.isSafe()) {            checksum = cksumEngine.calculateChecksum(data, data.length);        } else {            throw new KdcErrException(Krb5.KRB_AP_ERR_INAPP_CKSUM);        }    }     /**     * Constructs a new Checksum by calculating the keyed checksum     * over the data using specified checksum type.     * @new_cksumType the type of checksum.     * @data the data that needs to be performed a checksum calculation on.     */         // KrbSafe, KrbTgsReq    public Checksum(int new_cksumType, byte[] data,                        EncryptionKey key, int usage)        throws KdcErrException, KrbApErrException, KrbCryptoException {        cksumType = new_cksumType;        CksumType cksumEngine = CksumType.getInstance(cksumType);        if (!cksumEngine.isSafe())            throw new KrbApErrException(Krb5.KRB_AP_ERR_INAPP_CKSUM);        checksum =            cksumEngine.calculateKeyedChecksum(data,                data.length,                key.getBytes(),                usage);    }     /**     * Verifies the keyed checksum over the data passed in.     */    public boolean verifyKeyedChecksum(byte[] data, EncryptionKey key,                                        int usage)        throws KdcErrException, KrbApErrException, KrbCryptoException {        CksumType cksumEngine = CksumType.getInstance(cksumType);        if (!cksumEngine.isSafe())            throw new KrbApErrException(Krb5.KRB_AP_ERR_INAPP_CKSUM);        return cksumEngine.verifyKeyedChecksum(data,                                               data.length,                                               key.getBytes(),                                               checksum,            usage);    }     /*    public Checksum(byte[] data) throws KdcErrException, KrbCryptoException {        this(Checksum.CKSUMTYPE_DEFAULT, data);    }    */     boolean isEqual(Checksum cksum) throws KdcErrException {        if (cksumType != cksum.cksumType)            return false;        CksumType cksumEngine = CksumType.getInstance(cksumType);        return cksumEngine.isChecksumEqual(checksum, cksum.checksum);    }     /**     * Constructs an instance of Checksum from an ASN.1 encoded representation.     * @param encoding a single DER-encoded value.     * @exception Asn1Exception if an error occurs while decoding an ASN1     * encoded data.     * @exception IOException if an I/O error occurs while reading encoded data.     *     */    private Checksum(DerValue encoding) throws Asn1Exception, IOException {        DerValue der;        if (encoding.getTag() != DerValue.tag_Sequence) {            throw new Asn1Exception(Krb5.ASN1_BAD_ID);        }        der = encoding.getData().getDerValue();        if ((der.getTag() & (byte)0x1F) == (byte)0x00) {            cksumType = der.getData().getBigInteger().intValue();        }        else            throw new Asn1Exception(Krb5.ASN1_BAD_ID);        der = encoding.getData().getDerValue();        if ((der.getTag() & (byte)0x1F) == (byte)0x01) {            checksum = der.getData().getOctetString();        }        else            throw new Asn1Exception(Krb5.ASN1_BAD_ID);        if (encoding.getData().available() > 0) {            throw new Asn1Exception(Krb5.ASN1_BAD_ID);        }    }     /**     * Encodes a Checksum object.     * <xmp>     * Checksum    ::= SEQUENCE {     *         cksumtype   [0] Int32,     *         checksum    [1] OCTET STRING     * }     * </xmp>     *     * <p>     * This definition reflects the Network Working Group RFC 4120     * specification available at     * <a href="http://www.ietf.org/rfc/rfc4120.txt">     * http://www.ietf.org/rfc/rfc4120.txt</a>.     * @return byte array of enocded Checksum.     * @exception Asn1Exception if an error occurs while decoding an     * ASN1 encoded data.     * @exception IOException if an I/O error occurs while reading     * encoded data.     *     */    public byte[] asn1Encode() throws Asn1Exception, IOException {        DerOutputStream bytes = new DerOutputStream();        DerOutputStream temp = new DerOutputStream();        temp.putInteger(BigInteger.valueOf(cksumType));        bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT,                                       true, (byte)0x00), temp);        temp = new DerOutputStream();        temp.putOctetString(checksum);        bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT,                                       true, (byte)0x01), temp);        temp = new DerOutputStream();        temp.write(DerValue.tag_Sequence, bytes);        return temp.toByteArray();    }      /**     * Parse (unmarshal) a checksum object from a DER input stream.  This form     * parsing might be used when expanding a value which is part of     * a constructed sequence and uses explicitly tagged type.     *     * @exception Asn1Exception if an error occurs while decoding an     * ASN1 encoded data.     * @exception IOException if an I/O error occurs while reading     * encoded data.     * @param data the Der input stream value, which contains one or more     * marshaled value.     * @param explicitTag tag number.     * @param optional indicates if this data field is optional     * @return an instance of Checksum.     *     */    public static Checksum parse(DerInputStream data,                                 byte explicitTag, boolean optional)        throws Asn1Exception, IOException {         if ((optional) &&            (((byte)data.peekByte() & (byte)0x1F) != explicitTag)) {            return null;        }        DerValue der = data.getDerValue();        if (explicitTag != (der.getTag() & (byte)0x1F))  {            throw new Asn1Exception(Krb5.ASN1_BAD_ID);        } else {            DerValue subDer = der.getData().getDerValue();            return new Checksum(subDer);        }    }     /**     * Returns the raw bytes of the checksum, not in ASN.1 encoded form.     */    public final byte[] getBytes() {        return checksum;    }     public final int getType() {        return cksumType;    }     @Override public boolean equals(Object obj) {        if (this == obj) {            return true;        }        if (!(obj instanceof Checksum)) {            return false;        }         try {            return isEqual((Checksum)obj);        } catch (KdcErrException kee) {            return false;        }    }     @Override public int hashCode() {        int result = 17;        result = 37 * result + cksumType;        if (checksum != null) {            result = 37 * result + Arrays.hashCode(checksum);        }        return result;    }}