Showing the changes to java/pkg/sun/net/www/protocol/http/DigestAuthentication.java (1 of 18352 files). Show all
Unified · Split
| @@ -0,0 +1,513 @@ | ||
| 1 | +/* | |
| 2 | + * Copyright (c) 1997, 2008, Oracle and/or its affiliates. All rights reserved. | |
| 3 | + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | |
| 4 | + * | |
| 5 | + * This code is free software; you can redistribute it and/or modify it | |
| 6 | + * under the terms of the GNU General Public License version 2 only, as | |
| 7 | + * published by the Free Software Foundation. Oracle designates this | |
| 8 | + * particular file as subject to the "Classpath" exception as provided | |
| 9 | + * by Oracle in the LICENSE file that accompanied this code. | |
| 10 | + * | |
| 11 | + * This code is distributed in the hope that it will be useful, but WITHOUT | |
| 12 | + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
| 13 | + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
| 14 | + * version 2 for more details (a copy is included in the LICENSE file that | |
| 15 | + * accompanied this code). | |
| 16 | + * | |
| 17 | + * You should have received a copy of the GNU General Public License version | |
| 18 | + * 2 along with this work; if not, write to the Free Software Foundation, | |
| 19 | + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| 20 | + * | |
| 21 | + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA | |
| 22 | + * or visit www.oracle.com if you need additional information or have any | |
| 23 | + * questions. | |
| 24 | + */ | |
| 25 | + | |
| 26 | +package sun.net.www.protocol.http; | |
| 27 | + | |
| 28 | +import java.io.*; | |
| 29 | +import java.net.URL; | |
| 30 | +import java.net.ProtocolException; | |
| 31 | +import java.net.PasswordAuthentication; | |
| 32 | +import java.util.Arrays; | |
| 33 | +import java.util.StringTokenizer; | |
| 34 | +import java.util.Random; | |
| 35 | + | |
| 36 | +import sun.net.www.HeaderParser; | |
| 37 | +import java.security.MessageDigest; | |
| 38 | +import java.security.NoSuchAlgorithmException; | |
| 39 | +import static sun.net.www.protocol.http.HttpURLConnection.HTTP_CONNECT; | |
| 40 | + | |
| 41 | +/** | |
| 42 | + * DigestAuthentication: Encapsulate an http server authentication using | |
| 43 | + * the "Digest" scheme, as described in RFC2069 and updated in RFC2617 | |
| 44 | + * | |
| 45 | + * @author Bill Foote | |
| 46 | + */ | |
| 47 | + | |
| 48 | +class DigestAuthentication extends AuthenticationInfo { | |
| 49 | + | |
| 50 | + private static final long serialVersionUID = 100L; | |
| 51 | + | |
| 52 | + private String authMethod; | |
| 53 | + | |
| 54 | + // Authentication parameters defined in RFC2617. | |
| 55 | + // One instance of these may be shared among several DigestAuthentication | |
| 56 | + // instances as a result of a single authorization (for multiple domains) | |
| 57 | + | |
| 58 | + static class Parameters implements java.io.Serializable { | |
| 59 | + private static final long serialVersionUID = -3584543755194526252L; | |
| 60 | + | |
| 61 | + private boolean serverQop; // server proposed qop=auth | |
| 62 | + private String opaque; | |
| 63 | + private String cnonce; | |
| 64 | + private String nonce; | |
| 65 | + private String algorithm; | |
| 66 | + private int NCcount=0; | |
| 67 | + | |
| 68 | + // The H(A1) string used for MD5-sess | |
| 69 | + private String cachedHA1; | |
| 70 | + | |
| 71 | + // Force the HA1 value to be recalculated because the nonce has changed | |
| 72 | + private boolean redoCachedHA1 = true; | |
| 73 | + | |
| 74 | + private static final int cnonceRepeat = 5; | |
| 75 | + | |
| 76 | + private static final int cnoncelen = 40; /* number of characters in cnonce */ | |
| 77 | + | |
| 78 | + private static Random random; | |
| 79 | + | |
| 80 | + static { | |
| 81 | + random = new Random(); | |
| 82 | + } | |
| 83 | + | |
| 84 | + Parameters () { | |
| 85 | + serverQop = false; | |
| 86 | + opaque = null; | |
| 87 | + algorithm = null; | |
| 88 | + cachedHA1 = null; | |
| 89 | + nonce = null; | |
| 90 | + setNewCnonce(); | |
| 91 | + } | |
| 92 | + | |
| 93 | + boolean authQop () { | |
| 94 | + return serverQop; | |
| 95 | + } | |
| 96 | + synchronized void incrementNC() { | |
| 97 | + NCcount ++; | |
| 98 | + } | |
| 99 | + synchronized int getNCCount () { | |
| 100 | + return NCcount; | |
| 101 | + } | |
| 102 | + | |
| 103 | + int cnonce_count = 0; | |
| 104 | + | |
| 105 | + /* each call increments the counter */ | |
| 106 | + synchronized String getCnonce () { | |
| 107 | + if (cnonce_count >= cnonceRepeat) { | |
| 108 | + setNewCnonce(); | |
| 109 | + } | |
| 110 | + cnonce_count++; | |
| 111 | + return cnonce; | |
| 112 | + } | |
| 113 | + synchronized void setNewCnonce () { | |
| 114 | + byte bb[] = new byte [cnoncelen/2]; | |
| 115 | + char cc[] = new char [cnoncelen]; | |
| 116 | + random.nextBytes (bb); | |
| 117 | + for (int i=0; i<(cnoncelen/2); i++) { | |
| 118 | + int x = bb[i] + 128; | |
| 119 | + cc[i*2]= (char) ('A'+ x/16); | |
| 120 | + cc[i*2+1]= (char) ('A'+ x%16); | |
| 121 | + } | |
| 122 | + cnonce = new String (cc, 0, cnoncelen); | |
| 123 | + cnonce_count = 0; | |
| 124 | + redoCachedHA1 = true; | |
| 125 | + } | |
| 126 | + | |
| 127 | + synchronized void setQop (String qop) { | |
| 128 | + if (qop != null) { | |
| 129 | + StringTokenizer st = new StringTokenizer (qop, " "); | |
| 130 | + while (st.hasMoreTokens()) { | |
| 131 | + if (st.nextToken().equalsIgnoreCase ("auth")) { | |
| 132 | + serverQop = true; | |
| 133 | + return; | |
| 134 | + } | |
| 135 | + } | |
| 136 | + } | |
| 137 | + serverQop = false; | |
| 138 | + } | |
| 139 | + | |
| 140 | + synchronized String getOpaque () { return opaque;} | |
| 141 | + synchronized void setOpaque (String s) { opaque=s;} | |
| 142 | + | |
| 143 | + synchronized String getNonce () { return nonce;} | |
| 144 | + | |
| 145 | + synchronized void setNonce (String s) { | |
| 146 | + if (!s.equals(nonce)) { | |
| 147 | + nonce=s; | |
| 148 | + NCcount = 0; | |
| 149 | + redoCachedHA1 = true; | |
| 150 | + } | |
| 151 | + } | |
| 152 | + | |
| 153 | + synchronized String getCachedHA1 () { | |
| 154 | + if (redoCachedHA1) { | |
| 155 | + return null; | |
| 156 | + } else { | |
| 157 | + return cachedHA1; | |
| 158 | + } | |
| 159 | + } | |
| 160 | + | |
| 161 | + synchronized void setCachedHA1 (String s) { | |
| 162 | + cachedHA1=s; | |
| 163 | + redoCachedHA1=false; | |
| 164 | + } | |
| 165 | + | |
| 166 | + synchronized String getAlgorithm () { return algorithm;} | |
| 167 | + synchronized void setAlgorithm (String s) { algorithm=s;} | |
| 168 | + } | |
| 169 | + | |
| 170 | + Parameters params; | |
| 171 | + | |
| 172 | + /** | |
| 173 | + * Create a DigestAuthentication | |
| 174 | + */ | |
| 175 | + public DigestAuthentication(boolean isProxy, URL url, String realm, | |
| 176 | + String authMethod, PasswordAuthentication pw, | |
| 177 | + Parameters params) { | |
| 178 | + super(isProxy ? PROXY_AUTHENTICATION : SERVER_AUTHENTICATION, | |
| 179 | + AuthScheme.DIGEST, | |
| 180 | + url, | |
| 181 | + realm); | |
| 182 | + this.authMethod = authMethod; | |
| 183 | + this.pw = pw; | |
| 184 | + this.params = params; | |
| 185 | + } | |
| 186 | + | |
| 187 | + public DigestAuthentication(boolean isProxy, String host, int port, String realm, | |
| 188 | + String authMethod, PasswordAuthentication pw, | |
| 189 | + Parameters params) { | |
| 190 | + super(isProxy ? PROXY_AUTHENTICATION : SERVER_AUTHENTICATION, | |
| 191 | + AuthScheme.DIGEST, | |
| 192 | + host, | |
| 193 | + port, | |
| 194 | + realm); | |
| 195 | + this.authMethod = authMethod; | |
| 196 | + this.pw = pw; | |
| 197 | + this.params = params; | |
| 198 | + } | |
| 199 | + | |
| 200 | + /** | |
| 201 | + * @return true if this authentication supports preemptive authorization | |
| 202 | + */ | |
| 203 | + @Override | |
| 204 | + public boolean supportsPreemptiveAuthorization() { | |
| 205 | + return true; | |
| 206 | + } | |
| 207 | + | |
| 208 | + /** | |
| 209 | + * Reclaculates the request-digest and returns it. | |
| 210 | + * | |
| 211 | + * <P> Used in the common case where the requestURI is simply the | |
| 212 | + * abs_path. | |
| 213 | + * | |
| 214 | + * @param url | |
| 215 | + * the URL | |
| 216 | + * | |
| 217 | + * @param method | |
| 218 | + * the HTTP method | |
| 219 | + * | |
| 220 | + * @return the value of the HTTP header this authentication wants set | |
| 221 | + */ | |
| 222 | + @Override | |
| 223 | + public String getHeaderValue(URL url, String method) { | |
| 224 | + return getHeaderValueImpl(url.getFile(), method); | |
| 225 | + } | |
| 226 | + | |
| 227 | + /** | |
| 228 | + * Reclaculates the request-digest and returns it. | |
| 229 | + * | |
| 230 | + * <P> Used when the requestURI is not the abs_path. The exact | |
| 231 | + * requestURI can be passed as a String. | |
| 232 | + * | |
| 233 | + * @param requestURI | |
| 234 | + * the Request-URI from the HTTP request line | |
| 235 | + * | |
| 236 | + * @param method | |
| 237 | + * the HTTP method | |
| 238 | + * | |
| 239 | + * @return the value of the HTTP header this authentication wants set | |
| 240 | + */ | |
| 241 | + String getHeaderValue(String requestURI, String method) { | |
| 242 | + return getHeaderValueImpl(requestURI, method); | |
| 243 | + } | |
| 244 | + | |
| 245 | + /** | |
| 246 | + * Check if the header indicates that the current auth. parameters are stale. | |
| 247 | + * If so, then replace the relevant field with the new value | |
| 248 | + * and return true. Otherwise return false. | |
| 249 | + * returning true means the request can be retried with the same userid/password | |
| 250 | + * returning false means we have to go back to the user to ask for a new | |
| 251 | + * username password. | |
| 252 | + */ | |
| 253 | + @Override | |
| 254 | + public boolean isAuthorizationStale (String header) { | |
| 255 | + HeaderParser p = new HeaderParser (header); | |
| 256 | + String s = p.findValue ("stale"); | |
| 257 | + if (s == null || !s.equals("true")) | |
| 258 | + return false; | |
| 259 | + String newNonce = p.findValue ("nonce"); | |
| 260 | + if (newNonce == null || "".equals(newNonce)) { | |
| 261 | + return false; | |
| 262 | + } | |
| 263 | + params.setNonce (newNonce); | |
| 264 | + return true; | |
| 265 | + } | |
| 266 | + | |
| 267 | + /** | |
| 268 | + * Set header(s) on the given connection. | |
| 269 | + * @param conn The connection to apply the header(s) to | |
| 270 | + * @param p A source of header values for this connection, if needed. | |
| 271 | + * @param raw Raw header values for this connection, if needed. | |
| 272 | + * @return true if all goes well, false if no headers were set. | |
| 273 | + */ | |
| 274 | + @Override | |
| 275 | + public boolean setHeaders(HttpURLConnection conn, HeaderParser p, String raw) { | |
| 276 | + params.setNonce (p.findValue("nonce")); | |
| 277 | + params.setOpaque (p.findValue("opaque")); | |
| 278 | + params.setQop (p.findValue("qop")); | |
| 279 | + | |
| 280 | + String uri=""; | |
| 281 | + String method; | |
| 282 | + if (type == PROXY_AUTHENTICATION && | |
| 283 | + conn.tunnelState() == HttpURLConnection.TunnelState.SETUP) { | |
| 284 | + uri = HttpURLConnection.connectRequestURI(conn.getURL()); | |
| 285 | + method = HTTP_CONNECT; | |
| 286 | + } else { | |
| 287 | + try { | |
| 288 | + uri = conn.getRequestURI(); | |
| 289 | + } catch (IOException e) {} | |
| 290 | + method = conn.getMethod(); | |
| 291 | + } | |
| 292 | + | |
| 293 | + if (params.nonce == null || authMethod == null || pw == null || realm == null) { | |
| 294 | + return false; | |
| 295 | + } | |
| 296 | + if (authMethod.length() >= 1) { | |
| 297 | + // Method seems to get converted to all lower case elsewhere. | |
| 298 | + // It really does need to start with an upper case letter | |
| 299 | + // here. | |
| 300 | + authMethod = Character.toUpperCase(authMethod.charAt(0)) | |
| 301 | + + authMethod.substring(1).toLowerCase(); | |
| 302 | + } | |
| 303 | + String algorithm = p.findValue("algorithm"); | |
| 304 | + if (algorithm == null || "".equals(algorithm)) { | |
| 305 | + algorithm = "MD5"; // The default, accoriding to rfc2069 | |
| 306 | + } | |
| 307 | + params.setAlgorithm (algorithm); | |
| 308 | + | |
| 309 | + // If authQop is true, then the server is doing RFC2617 and | |
| 310 | + // has offered qop=auth. We do not support any other modes | |
| 311 | + // and if auth is not offered we fallback to the RFC2069 behavior | |
| 312 | + | |
| 313 | + if (params.authQop()) { | |
| 314 | + params.setNewCnonce(); | |
| 315 | + } | |
| 316 | + | |
| 317 | + String value = getHeaderValueImpl (uri, method); | |
| 318 | + if (value != null) { | |
| 319 | + conn.setAuthenticationProperty(getHeaderName(), value); | |
| 320 | + return true; | |
| 321 | + } else { | |
| 322 | + return false; | |
| 323 | + } | |
| 324 | + } | |
| 325 | + | |
| 326 | + /* Calculate the Authorization header field given the request URI | |
| 327 | + * and based on the authorization information in params | |
| 328 | + */ | |
| 329 | + private String getHeaderValueImpl (String uri, String method) { | |
| 330 | + String response; | |
| 331 | + char[] passwd = pw.getPassword(); | |
| 332 | + boolean qop = params.authQop(); | |
| 333 | + String opaque = params.getOpaque(); | |
| 334 | + String cnonce = params.getCnonce (); | |
| 335 | + String nonce = params.getNonce (); | |
| 336 | + String algorithm = params.getAlgorithm (); | |
| 337 | + params.incrementNC (); | |
| 338 | + int nccount = params.getNCCount (); | |
| 339 | + String ncstring=null; | |
| 340 | + | |
| 341 | + if (nccount != -1) { | |
| 342 | + ncstring = Integer.toHexString (nccount).toLowerCase(); | |
| 343 | + int len = ncstring.length(); | |
| 344 | + if (len < 8) | |
| 345 | + ncstring = zeroPad [len] + ncstring; | |
| 346 | + } | |
| 347 | + | |
| 348 | + try { | |
| 349 | + response = computeDigest(true, pw.getUserName(),passwd,realm, | |
| 350 | + method, uri, nonce, cnonce, ncstring); | |
| 351 | + } catch (NoSuchAlgorithmException ex) { | |
| 352 | + return null; | |
| 353 | + } | |
| 354 | + | |
| 355 | + String ncfield = "\""; | |
| 356 | + if (qop) { | |
| 357 | + ncfield = "\", nc=" + ncstring; | |
| 358 | + } | |
| 359 | + | |
| 360 | + String value = authMethod | |
| 361 | + + " username=\"" + pw.getUserName() | |
| 362 | + + "\", realm=\"" + realm | |
| 363 | + + "\", nonce=\"" + nonce | |
| 364 | + + ncfield | |
| 365 | + + ", uri=\"" + uri | |
| 366 | + + "\", response=\"" + response | |
| 367 | + + "\", algorithm=\"" + algorithm; | |
| 368 | + if (opaque != null) { | |
| 369 | + value = value + "\", opaque=\"" + opaque; | |
| 370 | + } | |
| 371 | + if (cnonce != null) { | |
| 372 | + value = value + "\", cnonce=\"" + cnonce; | |
| 373 | + } | |
| 374 | + if (qop) { | |
| 375 | + value = value + "\", qop=\"auth"; | |
| 376 | + } | |
| 377 | + value = value + "\""; | |
| 378 | + return value; | |
| 379 | + } | |
| 380 | + | |
| 381 | + public void checkResponse (String header, String method, URL url) | |
| 382 | + throws IOException { | |
| 383 | + checkResponse (header, method, url.getFile()); | |
| 384 | + } | |
| 385 | + | |
| 386 | + public void checkResponse (String header, String method, String uri) | |
| 387 | + throws IOException { | |
| 388 | + char[] passwd = pw.getPassword(); | |
| 389 | + String username = pw.getUserName(); | |
| 390 | + boolean qop = params.authQop(); | |
| 391 | + String opaque = params.getOpaque(); | |
| 392 | + String cnonce = params.cnonce; | |
| 393 | + String nonce = params.getNonce (); | |
| 394 | + String algorithm = params.getAlgorithm (); | |
| 395 | + int nccount = params.getNCCount (); | |
| 396 | + String ncstring=null; | |
| 397 | + | |
| 398 | + if (header == null) { | |
| 399 | + throw new ProtocolException ("No authentication information in response"); | |
| 400 | + } | |
| 401 | + | |
| 402 | + if (nccount != -1) { | |
| 403 | + ncstring = Integer.toHexString (nccount).toUpperCase(); | |
| 404 | + int len = ncstring.length(); | |
| 405 | + if (len < 8) | |
| 406 | + ncstring = zeroPad [len] + ncstring; | |
| 407 | + } | |
| 408 | + try { | |
| 409 | + String expected = computeDigest(false, username,passwd,realm, | |
| 410 | + method, uri, nonce, cnonce, ncstring); | |
| 411 | + HeaderParser p = new HeaderParser (header); | |
| 412 | + String rspauth = p.findValue ("rspauth"); | |
| 413 | + if (rspauth == null) { | |
| 414 | + throw new ProtocolException ("No digest in response"); | |
| 415 | + } | |
| 416 | + if (!rspauth.equals (expected)) { | |
| 417 | + throw new ProtocolException ("Response digest invalid"); | |
| 418 | + } | |
| 419 | + /* Check if there is a nextnonce field */ | |
| 420 | + String nextnonce = p.findValue ("nextnonce"); | |
| 421 | + if (nextnonce != null && ! "".equals(nextnonce)) { | |
| 422 | + params.setNonce (nextnonce); | |
| 423 | + } | |
| 424 | + | |
| 425 | + } catch (NoSuchAlgorithmException ex) { | |
| 426 | + throw new ProtocolException ("Unsupported algorithm in response"); | |
| 427 | + } | |
| 428 | + } | |
| 429 | + | |
| 430 | + private String computeDigest( | |
| 431 | + boolean isRequest, String userName, char[] password, | |
| 432 | + String realm, String connMethod, | |
| 433 | + String requestURI, String nonceString, | |
| 434 | + String cnonce, String ncValue | |
| 435 | + ) throws NoSuchAlgorithmException | |
| 436 | + { | |
| 437 | + | |
| 438 | + String A1, HashA1; | |
| 439 | + String algorithm = params.getAlgorithm (); | |
| 440 | + boolean md5sess = algorithm.equalsIgnoreCase ("MD5-sess"); | |
| 441 | + | |
| 442 | + MessageDigest md = MessageDigest.getInstance(md5sess?"MD5":algorithm); | |
| 443 | + | |
| 444 | + if (md5sess) { | |
| 445 | + if ((HashA1 = params.getCachedHA1 ()) == null) { | |
| 446 | + String s = userName + ":" + realm + ":"; | |
| 447 | + String s1 = encode (s, password, md); | |
| 448 | + A1 = s1 + ":" + nonceString + ":" + cnonce; | |
| 449 | + HashA1 = encode(A1, null, md); | |
| 450 | + params.setCachedHA1 (HashA1); | |
| 451 | + } | |
| 452 | + } else { | |
| 453 | + A1 = userName + ":" + realm + ":"; | |
| 454 | + HashA1 = encode(A1, password, md); | |
| 455 | + } | |
| 456 | + | |
| 457 | + String A2; | |
| 458 | + if (isRequest) { | |
| 459 | + A2 = connMethod + ":" + requestURI; | |
| 460 | + } else { | |
| 461 | + A2 = ":" + requestURI; | |
| 462 | + } | |
| 463 | + String HashA2 = encode(A2, null, md); | |
| 464 | + String combo, finalHash; | |
| 465 | + | |
| 466 | + if (params.authQop()) { /* RRC2617 when qop=auth */ | |
| 467 | + combo = HashA1+ ":" + nonceString + ":" + ncValue + ":" + | |
| 468 | + cnonce + ":auth:" +HashA2; | |
| 469 | + | |
| 470 | + } else { /* for compatibility with RFC2069 */ | |
| 471 | + combo = HashA1 + ":" + | |
| 472 | + nonceString + ":" + | |
| 473 | + HashA2; | |
| 474 | + } | |
| 475 | + finalHash = encode(combo, null, md); | |
| 476 | + return finalHash; | |
| 477 | + } | |
| 478 | + | |
| 479 | + private final static char charArray[] = { | |
| 480 | + '0', '1', '2', '3', '4', '5', '6', '7', | |
| 481 | + '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' | |
| 482 | + }; | |
| 483 | + | |
| 484 | + private final static String zeroPad[] = { | |
| 485 | + // 0 1 2 3 4 5 6 7 | |
| 486 | + "00000000", "0000000", "000000", "00000", "0000", "000", "00", "0" | |
| 487 | + }; | |
| 488 | + | |
| 489 | + private String encode(String src, char[] passwd, MessageDigest md) { | |
| 490 | + try { | |
| 491 | + md.update(src.getBytes("ISO-8859-1")); | |
| 492 | + } catch (java.io.UnsupportedEncodingException uee) { | |
| 493 | + assert false; | |
| 494 | + } | |
| 495 | + if (passwd != null) { | |
| 496 | + byte[] passwdBytes = new byte[passwd.length]; | |
| 497 | + for (int i=0; i<passwd.length; i++) | |
| 498 | + passwdBytes[i] = (byte)passwd[i]; | |
| 499 | + md.update(passwdBytes); | |
| 500 | + Arrays.fill(passwdBytes, (byte)0x00); | |
| 501 | + } | |
| 502 | + byte[] digest = md.digest(); | |
| 503 | + | |
| 504 | + StringBuffer res = new StringBuffer(digest.length * 2); | |
| 505 | + for (int i = 0; i < digest.length; i++) { | |
| 506 | + int hashchar = ((digest[i] >>> 4) & 0xf); | |
| 507 | + res.append(charArray[hashchar]); | |
| 508 | + hashchar = (digest[i] & 0xf); | |
| 509 | + res.append(charArray[hashchar]); | |
| 510 | + } | |
| 511 | + return res.toString(); | |
| 512 | + } | |
| 513 | +} | |