GssApiMechanisms.java

  1. /*
  2.  * Copyright (C) 2018, Thomas Wolf <thomas.wolf@paranor.ch>
  3.  * and other copyright owners as documented in the project's IP log.
  4.  *
  5.  * This program and the accompanying materials are made available
  6.  * under the terms of the Eclipse Distribution License v1.0 which
  7.  * accompanies this distribution, is reproduced below, and is
  8.  * available at http://www.eclipse.org/org/documents/edl-v10.php
  9.  *
  10.  * All rights reserved.
  11.  *
  12.  * Redistribution and use in source and binary forms, with or
  13.  * without modification, are permitted provided that the following
  14.  * conditions are met:
  15.  *
  16.  * - Redistributions of source code must retain the above copyright
  17.  *   notice, this list of conditions and the following disclaimer.
  18.  *
  19.  * - Redistributions in binary form must reproduce the above
  20.  *   copyright notice, this list of conditions and the following
  21.  *   disclaimer in the documentation and/or other materials provided
  22.  *   with the distribution.
  23.  *
  24.  * - Neither the name of the Eclipse Foundation, Inc. nor the
  25.  *   names of its contributors may be used to endorse or promote
  26.  *   products derived from this software without specific prior
  27.  *   written permission.
  28.  *
  29.  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
  30.  * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
  31.  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  32.  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  33.  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  34.  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  35.  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  36.  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  37.  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  38.  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  39.  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  40.  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  41.  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  42.  */
  43. package org.eclipse.jgit.internal.transport.sshd;

  44. import java.net.InetAddress;
  45. import java.net.InetSocketAddress;
  46. import java.net.UnknownHostException;
  47. import java.util.Collection;
  48. import java.util.Collections;
  49. import java.util.LinkedHashMap;
  50. import java.util.Map;
  51. import java.util.concurrent.atomic.AtomicBoolean;

  52. import org.eclipse.jgit.annotations.NonNull;
  53. import org.ietf.jgss.GSSContext;
  54. import org.ietf.jgss.GSSException;
  55. import org.ietf.jgss.GSSManager;
  56. import org.ietf.jgss.GSSName;
  57. import org.ietf.jgss.Oid;

  58. /**
  59.  * Global repository of GSS-API mechanisms that we can use.
  60.  */
  61. public class GssApiMechanisms {

  62.     private GssApiMechanisms() {
  63.         // No instantiation
  64.     }

  65.     /** Prefix to use with {@link GSSName#NT_HOSTBASED_SERVICE}. */
  66.     public static final String GSSAPI_HOST_PREFIX = "host@"; //$NON-NLS-1$

  67.     /** The {@link Oid} of Kerberos 5. */
  68.     public static final Oid KERBEROS_5 = createOid("1.2.840.113554.1.2.2"); //$NON-NLS-1$

  69.     /** SGNEGO is not to be used with ssh. */
  70.     public static final Oid SPNEGO = createOid("1.3.6.1.5.5.2"); //$NON-NLS-1$

  71.     /** Protects {@link #supportedMechanisms}. */
  72.     private static final Object LOCK = new Object();

  73.     /**
  74.      * The {@link AtomicBoolean} is set to {@code true} when the mechanism could
  75.      * be initialized successfully at least once.
  76.      */
  77.     private static Map<Oid, Boolean> supportedMechanisms;

  78.     /**
  79.      * Retrieves an immutable collection of the supported mechanisms.
  80.      *
  81.      * @return the supported mechanisms
  82.      */
  83.     @NonNull
  84.     public static Collection<Oid> getSupportedMechanisms() {
  85.         synchronized (LOCK) {
  86.             if (supportedMechanisms == null) {
  87.                 GSSManager manager = GSSManager.getInstance();
  88.                 Oid[] mechs = manager.getMechs();
  89.                 Map<Oid, Boolean> mechanisms = new LinkedHashMap<>();
  90.                 if (mechs != null) {
  91.                     for (Oid oid : mechs) {
  92.                         mechanisms.put(oid, Boolean.FALSE);
  93.                     }
  94.                 }
  95.                 supportedMechanisms = mechanisms;
  96.             }
  97.             return Collections.unmodifiableSet(supportedMechanisms.keySet());
  98.         }
  99.     }

  100.     /**
  101.      * Report that this mechanism was used successfully.
  102.      *
  103.      * @param mechanism
  104.      *            that worked
  105.      */
  106.     public static void worked(@NonNull Oid mechanism) {
  107.         synchronized (LOCK) {
  108.             supportedMechanisms.put(mechanism, Boolean.TRUE);
  109.         }
  110.     }

  111.     /**
  112.      * Mark the mechanisms as failed.
  113.      *
  114.      * @param mechanism
  115.      *            to mark
  116.      */
  117.     public static void failed(@NonNull Oid mechanism) {
  118.         synchronized (LOCK) {
  119.             Boolean worked = supportedMechanisms.get(mechanism);
  120.             if (worked != null && !worked.booleanValue()) {
  121.                 // If it never worked, remove it
  122.                 supportedMechanisms.remove(mechanism);
  123.             }
  124.         }
  125.     }

  126.     /**
  127.      * Resolves an {@link InetSocketAddress}.
  128.      *
  129.      * @param remote
  130.      *            to resolve
  131.      * @return the resolved {@link InetAddress}, or {@code null} if unresolved.
  132.      */
  133.     public static InetAddress resolve(@NonNull InetSocketAddress remote) {
  134.         InetAddress address = remote.getAddress();
  135.         if (address == null) {
  136.             try {
  137.                 address = InetAddress.getByName(remote.getHostString());
  138.             } catch (UnknownHostException e) {
  139.                 return null;
  140.             }
  141.         }
  142.         return address;
  143.     }

  144.     /**
  145.      * Determines a canonical host name for use use with GSS-API.
  146.      *
  147.      * @param remote
  148.      *            to get the host name from
  149.      * @return the canonical host name, if it can be determined, otherwise the
  150.      *         {@link InetSocketAddress#getHostString() unprocessed host name}.
  151.      */
  152.     @NonNull
  153.     public static String getCanonicalName(@NonNull InetSocketAddress remote) {
  154.         InetAddress address = resolve(remote);
  155.         if (address == null) {
  156.             return remote.getHostString();
  157.         }
  158.         return address.getCanonicalHostName();
  159.     }

  160.     /**
  161.      * Creates a {@link GSSContext} for the given mechanism to authenticate with
  162.      * the host given by {@code fqdn}.
  163.      *
  164.      * @param mechanism
  165.      *            {@link Oid} of the mechanism to use
  166.      * @param fqdn
  167.      *            fully qualified domain name of the host to authenticate with
  168.      * @return the context, if the mechanism is available and the context could
  169.      *         be created, or {@code null} otherwise
  170.      */
  171.     public static GSSContext createContext(@NonNull Oid mechanism,
  172.             @NonNull String fqdn) {
  173.         GSSContext context = null;
  174.         try {
  175.             GSSManager manager = GSSManager.getInstance();
  176.             context = manager.createContext(
  177.                     manager.createName(
  178.                             GssApiMechanisms.GSSAPI_HOST_PREFIX + fqdn,
  179.                             GSSName.NT_HOSTBASED_SERVICE),
  180.                     mechanism, null, GSSContext.DEFAULT_LIFETIME);
  181.         } catch (GSSException e) {
  182.             closeContextSilently(context);
  183.             failed(mechanism);
  184.             return null;
  185.         }
  186.         worked(mechanism);
  187.         return context;
  188.     }

  189.     /**
  190.      * Closes (disposes of) a {@link GSSContext} ignoring any
  191.      * {@link GSSException}s.
  192.      *
  193.      * @param context
  194.      *            to dispose
  195.      */
  196.     public static void closeContextSilently(GSSContext context) {
  197.         if (context != null) {
  198.             try {
  199.                 context.dispose();
  200.             } catch (GSSException e) {
  201.                 // Ignore
  202.             }
  203.         }
  204.     }

  205.     private static Oid createOid(String rep) {
  206.         try {
  207.             return new Oid(rep);
  208.         } catch (GSSException e) {
  209.             // Does not occur
  210.             return null;
  211.         }
  212.     }

  213. }