APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.jgss.krb5

pack-priv abstract Class MessageToken_v2

extends Krb5Token
Class Inheritance
Known Direct Subclasses
sun.security.jgss.krb5.MicToken_v2, sun.security.jgss.krb5.WrapToken_v2
Imports
org.ietf.jgss.GSSException, .MessageProp, java.io.ByteArrayInputStream, .IOException, .InputStream, .OutputStream, java.security.MessageDigest, java.util.Arrays

This class is a base class for new GSS token definitions, as defined in RFC 4121, that pertain to per-message GSS-API calls. Conceptually GSS-API has two types of per-message tokens: WrapToken and MicToken. They differ in the respect that a WrapToken carries additional plaintext or ciphertext application data besides just the sequence number and checksum. This class encapsulates the commonality in the structure of the WrapToken and the MicToken. This structure can be represented as:

Wrap Tokens

    Octet no   Name        Description
   ---------------------------------------------------------------
     0..1     TOK_ID     Identification field.  Tokens emitted by
                         GSS_Wrap() contain the hex value 05 04
                         expressed in big-endian order in this field.
     2        Flags      Attributes field, as described in section
                         4.2.2.
     3        Filler     Contains the hex value FF.
     4..5     EC         Contains the "extra count" field, in big-
                         endian order as described in section 4.2.3.
     6..7     RRC        Contains the "right rotation count" in big
                         endian order, as described in section 4.2.5.
     8..15    SND_SEQ    Sequence number field in clear text,
                         expressed in big-endian order.
     16..last Data       Encrypted data for Wrap tokens with
                         confidentiality, or plaintext data followed
                         by the checksum for Wrap tokens without
                         confidentiality, as described in section
                         4.2.4.
MIC Tokens

    Octet no   Name        Description
    -----------------------------------------------------------------
     0..1     TOK_ID     Identification field.  Tokens emitted by
                         GSS_GetMIC() contain the hex value 04 04
                         expressed in big-endian order in this field.
     2        Flags      Attributes field, as described in section
                         4.2.2.
     3..7     Filler     Contains five octets of hex value FF.
     8..15    SND_SEQ    Sequence number field in clear text,
                         expressed in big-endian order.
     16..last SGN_CKSUM  Checksum of the "to-be-signed" data and
                         octet 0..15, as described in section 4.2.4.

This class is the super class of WrapToken_v2 and MicToken_v2. The token's header (bytes[0..15]) and data (byte[16..]) are saved in tokenHeader and tokenData fields. Since there is no easy way to find out the exact length of a WrapToken_v2 token from any header info, in the case of reading from stream, we read all available() bytes into the token.

All read actions are performed in this super class. On the write part, the super class only write the tokenHeader, and the content writing is inside child classes.

Author
Seema Malkani

Nested and Inner Type Summary

Modifier and TypeClass and Description
pack-priv class
MessageToken_v2.MessageTokenHeader

This inner class represents the initial portion of the message token.

Field Summary

Modifier and TypeField and Description
pack-priv byte[]
pack-priv CipherHelper
protected static final int
CONFOUNDER_SIZE

The size of the random confounder used in a WrapToken.

private boolean
private int
private static final int
private static final int
private static final int
private static final int
private boolean
private boolean
private int
pack-priv static final int
pack-priv static final int
pack-priv static final int
pack-priv static final int
private int
private int
private static final int
private static final int
protected static final int
private static final int
private static final int
protected byte[]
protected int
private MessageToken_v2.MessageTokenHeader
private int
Inherited from sun.security.jgss.krb5.Krb5Token:
AP_REP_IDAP_REQ_IDERR_IDMIC_IDMIC_ID_v2OIDWRAP_IDWRAP_ID_v2

Constructor Summary

AccessConstructor and Description
pack-priv
MessageToken_v2(int
the token id that should be contained in this token as it is read.
tokenId
,
Krb5Context
the Kerberos context associated with this token
context
,
byte[]
the byte array containing the token
tokenBytes
,
int
the offset where the token begins
tokenOffset
,
int
the length of the token
tokenLen
,
MessageProp
the MessageProp structure in which the properties of the token should be stored.
prop
)

Constructs a MessageToken from a byte array.

pack-priv
MessageToken_v2(int
the token id that should be contained in this token as it is read.
tokenId
,
Krb5Context
the Kerberos context associated with this token
context
,
InputStream
the InputStream from which to read
is
,
MessageProp
the MessageProp structure in which the properties of the token should be stored.
prop
)

Constructs a MessageToken from an InputStream.

pack-priv
MessageToken_v2(int
the token id that should be contained in this token
tokenId
,
Krb5Context
the Kerberos context associated with this token
context
)

Constructs an empty MessageToken for the local context to send to the peer.

Method Summary

Modifier and TypeMethod and Description
public abstract void
encode(OutputStream
the OutputStream to which this should be written
os
)

Encodes a MessageToken_v2 onto an OutputStream.

protected void
encodeHeader(OutputStream
the OutputStream to which this should be written
os
)

Encodes a MessageTokenHeader onto an OutputStream.

public void
genSignAndSeqNumber(MessageProp
the MessageProp structure
prop
,
byte[]
the application data to checksum
data
,
int
the offset where the data starts
offset
,
int
the length of the data
len
)

Generates the checksum field and the sequence number field.

pack-priv byte[]
getChecksum(byte[]
the application data
data
,
int
the offset where the data begins
offset
,
int
the length of the application data
len
)

Computes the checksum based on the algorithm stored in the tokenHeader.

public final boolean

Returns:

true if it contains any encrypted data, false if there is only plaintext data or if there is no data.
getConfState
()

Used to determine if this token contains any encrypted data.

public final int

Returns:

the key_usage for the token
getKeyUsage
()

Used to obtain the key_usage type for this token.

public final int
protected final byte[]
public final int

Returns:

the token id in the token
getTokenId
()

Used to obtain the token id that was contained in this token.

private void
init(int tokenId, Krb5Context context)

private void
rotate()

Rotate bytes as per the "RRC" (Right Rotation Count) received.

public final boolean
verifySign(byte[]
the application data
data
,
int
the offset where the data begins
offset
,
int
the length of the application data
len
)

Verifies the validity of checksum field

Inherited from sun.security.jgss.krb5.Krb5Token:
getTokenName

Field Detail

checksumback to summary
pack-priv byte[] checksum
cipherHelperback to summary
pack-priv CipherHelper cipherHelper
CONFOUNDER_SIZEback to summary
protected static final int CONFOUNDER_SIZE

The size of the random confounder used in a WrapToken.

confStateback to summary
private boolean confState
ecback to summary
private int ec
FILLERback to summary
private static final int FILLER
FLAG_ACCEPTOR_SUBKEYback to summary
private static final int FLAG_ACCEPTOR_SUBKEY
FLAG_SENDER_IS_ACCEPTORback to summary
private static final int FLAG_SENDER_IS_ACCEPTOR
FLAG_WRAP_CONFIDENTIALback to summary
private static final int FLAG_WRAP_CONFIDENTIAL
have_acceptor_subkeyback to summary
private boolean have_acceptor_subkey
initiatorback to summary
private boolean initiator
key_usageback to summary
private int key_usage
KG_USAGE_ACCEPTOR_SEALback to summary
pack-priv static final int KG_USAGE_ACCEPTOR_SEAL
KG_USAGE_ACCEPTOR_SIGNback to summary
pack-priv static final int KG_USAGE_ACCEPTOR_SIGN
KG_USAGE_INITIATOR_SEALback to summary
pack-priv static final int KG_USAGE_INITIATOR_SEAL
KG_USAGE_INITIATOR_SIGNback to summary
pack-priv static final int KG_USAGE_INITIATOR_SIGN
rrcback to summary
private int rrc
seqNumberback to summary
private int seqNumber
TOKEN_EC_POSback to summary
private static final int TOKEN_EC_POS
TOKEN_FLAG_POSback to summary
private static final int TOKEN_FLAG_POS
TOKEN_HEADER_SIZEback to summary
protected static final int TOKEN_HEADER_SIZE
TOKEN_ID_POSback to summary
private static final int TOKEN_ID_POS
TOKEN_RRC_POSback to summary
private static final int TOKEN_RRC_POS
tokenDataback to summary
protected byte[] tokenData
tokenDataLenback to summary
protected int tokenDataLen
tokenHeaderback to summary
private MessageToken_v2.MessageTokenHeader tokenHeader
tokenIdback to summary
private int tokenId

Constructor Detail

MessageToken_v2back to summary
pack-priv MessageToken_v2(int tokenId, Krb5Context context, byte[] tokenBytes, int tokenOffset, int tokenLen, MessageProp prop) throws GSSException

Constructs a MessageToken from a byte array.

Parameters
tokenId:int

the token id that should be contained in this token as it is read.

context:Krb5Context

the Kerberos context associated with this token

tokenBytes:byte[]

the byte array containing the token

tokenOffset:int

the offset where the token begins

tokenLen:int

the length of the token

prop:MessageProp

the MessageProp structure in which the properties of the token should be stored.

Exceptions
GSSException:
if there is a problem parsing the token
MessageToken_v2back to summary
pack-priv MessageToken_v2(int tokenId, Krb5Context context, InputStream is, MessageProp prop) throws GSSException

Constructs a MessageToken from an InputStream. Bytes will be read on demand and the thread might block if there are not enough bytes to complete the token. Please note there is no accurate way to find out the size of a token, but we try our best to make sure there is enough bytes to construct one.

Parameters
tokenId:int

the token id that should be contained in this token as it is read.

context:Krb5Context

the Kerberos context associated with this token

is:InputStream

the InputStream from which to read

prop:MessageProp

the MessageProp structure in which the properties of the token should be stored.

Exceptions
GSSException:
if there is a problem reading from the InputStream or parsing the token
MessageToken_v2back to summary
pack-priv MessageToken_v2(int tokenId, Krb5Context context) throws GSSException

Constructs an empty MessageToken for the local context to send to the peer. It also increments the local sequence number in the Krb5Context instance it uses after obtaining the object lock for it.

Parameters
tokenId:int

the token id that should be contained in this token

context:Krb5Context

the Kerberos context associated with this token

Method Detail

encodeback to summary
public abstract void encode(OutputStream os) throws IOException

Encodes a MessageToken_v2 onto an OutputStream.

Parameters
os:OutputStream

the OutputStream to which this should be written

Exceptions
IOException:
is an error occurs while encoding the token
encodeHeaderback to summary
protected void encodeHeader(OutputStream os) throws IOException

Encodes a MessageTokenHeader onto an OutputStream.

Parameters
os:OutputStream

the OutputStream to which this should be written

Exceptions
IOException:
is an error occurs while writing to the OutputStream
genSignAndSeqNumberback to summary
public void genSignAndSeqNumber(MessageProp prop, byte[] data, int offset, int len) throws GSSException

Generates the checksum field and the sequence number field.

Parameters
prop:MessageProp

the MessageProp structure

data:byte[]

the application data to checksum

offset:int

the offset where the data starts

len:int

the length of the data

Exceptions
GSSException:
if an error occurs in the checksum calculation or sequence number calculation.
getChecksumback to summary
pack-priv byte[] getChecksum(byte[] data, int offset, int len) throws GSSException

Computes the checksum based on the algorithm stored in the tokenHeader.

Parameters
data:byte[]

the application data

offset:int

the offset where the data begins

len:int

the length of the application data

Exceptions
GSSException:
if an error occurs in the checksum calculation.
getConfStateback to summary
public final boolean getConfState()

Used to determine if this token contains any encrypted data.

Returns:boolean

true if it contains any encrypted data, false if there is only plaintext data or if there is no data.

getKeyUsageback to summary
public final int getKeyUsage()

Used to obtain the key_usage type for this token.

Returns:int

the key_usage for the token

getSequenceNumberback to summary
public final int getSequenceNumber()
getTokenHeaderback to summary
protected final byte[] getTokenHeader()
getTokenIdback to summary
public final int getTokenId()

Used to obtain the token id that was contained in this token.

Returns:int

the token id in the token

initback to summary
private void init(int tokenId, Krb5Context context) throws GSSException
rotateback to summary
private void rotate()

Rotate bytes as per the "RRC" (Right Rotation Count) received. Our implementation does not do any rotates when sending, only when receiving, we rotate left as per the RRC count, to revert it.

verifySignback to summary
public final boolean verifySign(byte[] data, int offset, int len) throws GSSException

Verifies the validity of checksum field

Parameters
data:byte[]

the application data

offset:int

the offset where the data begins

len:int

the length of the application data

Exceptions
GSSException:
if an error occurs in the checksum calculation
sun.security.jgss.krb5 back to summary

pack-priv Class MessageToken_v2.MessageTokenHeader

extends Object
Class Inheritance

This inner class represents the initial portion of the message token. It constitutes the first 16 bytes of the message token.

Field Summary

Modifier and TypeField and Description
private final byte[]
private final int

Constructor Summary

AccessConstructor and Description
public
MessageTokenHeader(int tokenId, boolean conf)

public
MessageTokenHeader(InputStream
the InputStream to read from
is
,
MessageProp
the MessageProp to populate
prop
,
int tokId)

Reads a MessageTokenHeader from an InputStream and sets the appropriate confidentiality and quality of protection values in a MessageProp structure.

Method Summary

Modifier and TypeMethod and Description
public final void
encode(OutputStream
the OutputStream to write to
os
)

Encodes this MessageTokenHeader onto an OutputStream

public final byte[]

Returns:

8 bytes that form this header
getBytes
()

Returns the bytes of this header.

public final int

Returns:

the token id
getTokenId
()

Returns the token id for the message token.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

bytesback to summary
private final byte[] bytes
tokenIdback to summary
private final int tokenId

Constructor Detail

MessageTokenHeaderback to summary
public MessageTokenHeader(int tokenId, boolean conf) throws GSSException
MessageTokenHeaderback to summary
public MessageTokenHeader(InputStream is, MessageProp prop, int tokId) throws IOException, GSSException

Reads a MessageTokenHeader from an InputStream and sets the appropriate confidentiality and quality of protection values in a MessageProp structure.

Parameters
is:InputStream

the InputStream to read from

prop:MessageProp

the MessageProp to populate

Exceptions
IOException:
is an error occurs while reading from the InputStream

Method Detail

encodeback to summary
public final void encode(OutputStream os) throws IOException

Encodes this MessageTokenHeader onto an OutputStream

Parameters
os:OutputStream

the OutputStream to write to

Exceptions
IOException:
is an error occurs while writing
getBytesback to summary
public final byte[] getBytes()

Returns the bytes of this header.

Returns:byte[]

8 bytes that form this header

getTokenIdback to summary
public final int getTokenId()

Returns the token id for the message token.

Returns:int

the token id

See Also
sun.security.jgss.krb5.Krb5Token#MIC_ID_v2, sun.security.jgss.krb5.Krb5Token#WRAP_ID_v2