0N/A/*
2362N/A * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage com.sun.security.sasl;
0N/A
0N/Aimport javax.security.sasl.SaslException;
0N/Aimport javax.security.sasl.Sasl;
0N/A
0N/A// For HMAC_MD5
0N/Aimport java.security.NoSuchAlgorithmException;
0N/Aimport java.security.MessageDigest;
0N/A
0N/Aimport java.util.logging.Logger;
0N/A
0N/A/**
0N/A * Base class for implementing CRAM-MD5 client and server mechanisms.
0N/A *
0N/A * @author Vincent Ryan
0N/A * @author Rosanna Lee
0N/A */
0N/Aabstract class CramMD5Base {
0N/A protected boolean completed = false;
0N/A protected boolean aborted = false;
0N/A protected byte[] pw;
0N/A
0N/A protected CramMD5Base() {
0N/A initLogger();
0N/A }
0N/A
0N/A /**
0N/A * Retrieves this mechanism's name.
0N/A *
0N/A * @return The string "CRAM-MD5".
0N/A */
0N/A public String getMechanismName() {
0N/A return "CRAM-MD5";
0N/A }
0N/A
0N/A /**
0N/A * Determines whether this mechanism has completed.
0N/A * CRAM-MD5 completes after processing one challenge from the server.
0N/A *
0N/A * @return true if has completed; false otherwise;
0N/A */
0N/A public boolean isComplete() {
0N/A return completed;
0N/A }
0N/A
0N/A /**
0N/A * Unwraps the incoming buffer. CRAM-MD5 supports no security layer.
0N/A *
0N/A * @throws SaslException If attempt to use this method.
0N/A */
0N/A public byte[] unwrap(byte[] incoming, int offset, int len)
0N/A throws SaslException {
0N/A if (completed) {
0N/A throw new IllegalStateException(
0N/A "CRAM-MD5 supports neither integrity nor privacy");
0N/A } else {
0N/A throw new IllegalStateException(
0N/A "CRAM-MD5 authentication not completed");
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Wraps the outgoing buffer. CRAM-MD5 supports no security layer.
0N/A *
0N/A * @throws SaslException If attempt to use this method.
0N/A */
0N/A public byte[] wrap(byte[] outgoing, int offset, int len) throws SaslException {
0N/A if (completed) {
0N/A throw new IllegalStateException(
0N/A "CRAM-MD5 supports neither integrity nor privacy");
0N/A } else {
0N/A throw new IllegalStateException(
0N/A "CRAM-MD5 authentication not completed");
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Retrieves the negotiated property.
0N/A * This method can be called only after the authentication exchange has
0N/A * completed (i.e., when <tt>isComplete()</tt> returns true); otherwise, a
0N/A * <tt>SaslException</tt> is thrown.
0N/A *
0N/A * @return value of property; only QOP is applicable to CRAM-MD5.
0N/A * @exception IllegalStateException if this authentication exchange has not completed
0N/A */
0N/A public Object getNegotiatedProperty(String propName) {
0N/A if (completed) {
0N/A if (propName.equals(Sasl.QOP)) {
0N/A return "auth";
0N/A } else {
0N/A return null;
0N/A }
0N/A } else {
0N/A throw new IllegalStateException(
0N/A "CRAM-MD5 authentication not completed");
0N/A }
0N/A }
0N/A
0N/A public void dispose() throws SaslException {
0N/A clearPassword();
0N/A }
0N/A
0N/A protected void clearPassword() {
0N/A if (pw != null) {
0N/A // zero out password
0N/A for (int i = 0; i < pw.length; i++) {
0N/A pw[i] = (byte)0;
0N/A }
0N/A pw = null;
0N/A }
0N/A }
0N/A
0N/A protected void finalize() {
0N/A clearPassword();
0N/A }
0N/A
0N/A static private final int MD5_BLOCKSIZE = 64;
0N/A /**
0N/A * Hashes its input arguments according to HMAC-MD5 (RFC 2104)
0N/A * and returns the resulting digest in its ASCII representation.
0N/A *
0N/A * HMAC-MD5 function is described as follows:
0N/A *
0N/A * MD5(key XOR opad, MD5(key XOR ipad, text))
0N/A *
0N/A * where key is an n byte key
0N/A * ipad is the byte 0x36 repeated 64 times
0N/A * opad is the byte 0x5c repeated 64 times
0N/A * text is the data to be protected
0N/A */
0N/A final static String HMAC_MD5(byte[] key, byte[] text)
0N/A throws NoSuchAlgorithmException {
0N/A
0N/A MessageDigest md5 = MessageDigest.getInstance("MD5");
0N/A
0N/A /* digest the key if longer than 64 bytes */
0N/A if (key.length > 64) {
0N/A key = md5.digest(key);
0N/A }
0N/A
0N/A byte[] ipad = new byte[MD5_BLOCKSIZE]; /* inner padding */
0N/A byte[] opad = new byte[MD5_BLOCKSIZE]; /* outer padding */
0N/A byte[] digest;
0N/A int i;
0N/A
0N/A /* store key in pads */
0N/A for (i = 0; i < MD5_BLOCKSIZE; i++) {
0N/A for ( ; i < key.length; i++) {
0N/A ipad[i] = key[i];
0N/A opad[i] = key[i];
0N/A }
0N/A ipad[i] = 0x00;
0N/A opad[i] = 0x00;
0N/A }
0N/A
0N/A /* XOR key with pads */
0N/A for (i = 0; i < MD5_BLOCKSIZE; i++) {
0N/A ipad[i] ^= 0x36;
0N/A opad[i] ^= 0x5c;
0N/A }
0N/A
0N/A /* inner MD5 */
0N/A md5.update(ipad);
0N/A md5.update(text);
0N/A digest = md5.digest();
0N/A
0N/A /* outer MD5 */
0N/A md5.update(opad);
0N/A md5.update(digest);
0N/A digest = md5.digest();
0N/A
0N/A // Get character representation of digest
0N/A StringBuffer digestString = new StringBuffer();
0N/A
0N/A for (i = 0; i < digest.length; i++) {
0N/A if ((digest[i] & 0x000000ff) < 0x10) {
0N/A digestString.append("0" +
0N/A Integer.toHexString(digest[i] & 0x000000ff));
0N/A } else {
0N/A digestString.append(
0N/A Integer.toHexString(digest[i] & 0x000000ff));
0N/A }
0N/A }
0N/A
0N/A return (digestString.toString());
0N/A }
0N/A
0N/A /**
0N/A * Sets logger field.
0N/A */
0N/A private static synchronized void initLogger() {
0N/A if (logger == null) {
0N/A logger = Logger.getLogger(SASL_LOGGER_NAME);
0N/A }
0N/A }
0N/A /**
0N/A * Logger for debug messages
0N/A */
0N/A private static final String SASL_LOGGER_NAME = "javax.security.sasl";
0N/A protected static Logger logger; // set in initLogger(); lazily loads logger
0N/A}