GssApiMechanisms.java

/*
 * Copyright (C) 2018, Thomas Wolf <thomas.wolf@paranor.ch>
 * and other copyright owners as documented in the project's IP log.
 *
 * This program and the accompanying materials are made available
 * under the terms of the Eclipse Distribution License v1.0 which
 * accompanies this distribution, is reproduced below, and is
 * available at http://www.eclipse.org/org/documents/edl-v10.php
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or
 * without modification, are permitted provided that the following
 * conditions are met:
 *
 * - Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *
 * - Redistributions in binary form must reproduce the above
 *   copyright notice, this list of conditions and the following
 *   disclaimer in the documentation and/or other materials provided
 *   with the distribution.
 *
 * - Neither the name of the Eclipse Foundation, Inc. nor the
 *   names of its contributors may be used to endorse or promote
 *   products derived from this software without specific prior
 *   written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
 * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
package org.eclipse.jgit.internal.transport.sshd;

import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.util.Collection;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.concurrent.atomic.AtomicBoolean;

import org.eclipse.jgit.annotations.NonNull;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;

/**
 * Global repository of GSS-API mechanisms that we can use.
 */
public class GssApiMechanisms {

    private GssApiMechanisms() {
        // No instantiation
    }

    /** Prefix to use with {@link GSSName#NT_HOSTBASED_SERVICE}. */
    public static final String GSSAPI_HOST_PREFIX = "host@"; //$NON-NLS-1$

    /** The {@link Oid} of Kerberos 5. */
    public static final Oid KERBEROS_5 = createOid("1.2.840.113554.1.2.2"); //$NON-NLS-1$

    /** SGNEGO is not to be used with ssh. */
    public static final Oid SPNEGO = createOid("1.3.6.1.5.5.2"); //$NON-NLS-1$

    /** Protects {@link #supportedMechanisms}. */
    private static final Object LOCK = new Object();

    /**
     * The {@link AtomicBoolean} is set to {@code true} when the mechanism could
     * be initialized successfully at least once.
     */
    private static Map<Oid, Boolean> supportedMechanisms;

    /**
     * Retrieves an immutable collection of the supported mechanisms.
     *
     * @return the supported mechanisms
     */
    @NonNull
    public static Collection<Oid> getSupportedMechanisms() {
        synchronized (LOCK) {
            if (supportedMechanisms == null) {
                GSSManager manager = GSSManager.getInstance();
                Oid[] mechs = manager.getMechs();
                Map<Oid, Boolean> mechanisms = new LinkedHashMap<>();
                if (mechs != null) {
                    for (Oid oid : mechs) {
                        mechanisms.put(oid, Boolean.FALSE);
                    }
                }
                supportedMechanisms = mechanisms;
            }
            return Collections.unmodifiableSet(supportedMechanisms.keySet());
        }
    }

    /**
     * Report that this mechanism was used successfully.
     *
     * @param mechanism
     *            that worked
     */
    public static void worked(@NonNull Oid mechanism) {
        synchronized (LOCK) {
            supportedMechanisms.put(mechanism, Boolean.TRUE);
        }
    }

    /**
     * Mark the mechanisms as failed.
     *
     * @param mechanism
     *            to mark
     */
    public static void failed(@NonNull Oid mechanism) {
        synchronized (LOCK) {
            Boolean worked = supportedMechanisms.get(mechanism);
            if (worked != null && !worked.booleanValue()) {
                // If it never worked, remove it
                supportedMechanisms.remove(mechanism);
            }
        }
    }

    /**
     * Resolves an {@link InetSocketAddress}.
     *
     * @param remote
     *            to resolve
     * @return the resolved {@link InetAddress}, or {@code null} if unresolved.
     */
    public static InetAddress resolve(@NonNull InetSocketAddress remote) {
        InetAddress address = remote.getAddress();
        if (address == null) {
            try {
                address = InetAddress.getByName(remote.getHostString());
            } catch (UnknownHostException e) {
                return null;
            }
        }
        return address;
    }

    /**
     * Determines a canonical host name for use use with GSS-API.
     *
     * @param remote
     *            to get the host name from
     * @return the canonical host name, if it can be determined, otherwise the
     *         {@link InetSocketAddress#getHostString() unprocessed host name}.
     */
    @NonNull
    public static String getCanonicalName(@NonNull InetSocketAddress remote) {
        InetAddress address = resolve(remote);
        if (address == null) {
            return remote.getHostString();
        }
        return address.getCanonicalHostName();
    }

    /**
     * Creates a {@link GSSContext} for the given mechanism to authenticate with
     * the host given by {@code fqdn}.
     *
     * @param mechanism
     *            {@link Oid} of the mechanism to use
     * @param fqdn
     *            fully qualified domain name of the host to authenticate with
     * @return the context, if the mechanism is available and the context could
     *         be created, or {@code null} otherwise
     */
    public static GSSContext createContext(@NonNull Oid mechanism,
            @NonNull String fqdn) {
        GSSContext context = null;
        try {
            GSSManager manager = GSSManager.getInstance();
            context = manager.createContext(
                    manager.createName(
                            GssApiMechanisms.GSSAPI_HOST_PREFIX + fqdn,
                            GSSName.NT_HOSTBASED_SERVICE),
                    mechanism, null, GSSContext.DEFAULT_LIFETIME);
        } catch (GSSException e) {
            closeContextSilently(context);
            failed(mechanism);
            return null;
        }
        worked(mechanism);
        return context;
    }

    /**
     * Closes (disposes of) a {@link GSSContext} ignoring any
     * {@link GSSException}s.
     *
     * @param context
     *            to dispose
     */
    public static void closeContextSilently(GSSContext context) {
        if (context != null) {
            try {
                context.dispose();
            } catch (GSSException e) {
                // Ignore
            }
        }
    }

    private static Oid createOid(String rep) {
        try {
            return new Oid(rep);
        } catch (GSSException e) {
            // Does not occur
            return null;
        }
    }

}