| /* |
| * Copyright (c) 2019, Red Hat, Inc. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.krb5.internal; |
| |
| import java.io.IOException; |
| import sun.security.krb5.Asn1Exception; |
| import sun.security.krb5.internal.util.KerberosFlags; |
| import sun.security.util.DerOutputStream; |
| import sun.security.util.DerValue; |
| |
| /** |
| * Implements the ASN.1 PA-PAC-OPTIONS type. |
| * |
| * <pre>{@code |
| * PA-PAC-OPTIONS ::= SEQUENCE { |
| * KerberosFlags |
| * -- Claims (0) |
| * -- Branch Aware (1) |
| * -- Forward to Full DC (2) |
| * } |
| * Note: KerberosFlags ::= BIT STRING (SIZE (32..MAX)) |
| * -- minimum number of bits shall be sent, but no fewer than 32 |
| * |
| * PA-PAC-OPTIONS ::= KerberosFlags |
| * -- resource-based constrained delegation (3) |
| * }</pre> |
| * |
| * This definition reflects MS-KILE (section 2.2.10) |
| * and MS-SFU (section 2.2.5). |
| */ |
| |
| public class PaPacOptions { |
| |
| private static final int CLAIMS = 0; |
| private static final int BRANCH_AWARE = 1; |
| private static final int FORWARD_TO_FULL_DC = 2; |
| private static final int RESOURCE_BASED_CONSTRAINED_DELEGATION = 3; |
| |
| private KerberosFlags flags; |
| |
| public PaPacOptions() { |
| this.flags = new KerberosFlags(Krb5.AP_OPTS_MAX + 1); |
| } |
| |
| /** |
| * Constructs a PA-PAC-OPTIONS object from a DER encoding. |
| * @param encoding the ASN.1 encoded input |
| * @throws Asn1Exception if invalid DER |
| * @throws IOException if there is an error reading the DER value |
| */ |
| public PaPacOptions(DerValue encoding) throws Asn1Exception, IOException { |
| if (encoding.getTag() != DerValue.tag_Sequence) { |
| throw new Asn1Exception(Krb5.ASN1_BAD_ID); |
| } |
| |
| DerValue der = encoding.getData().getDerValue(); |
| if ((der.getTag() & 0x1F) == 0x00) { |
| flags = new KDCOptions( |
| der.getData().getDerValue()); |
| } else { |
| throw new Asn1Exception(Krb5.ASN1_BAD_ID); |
| } |
| } |
| |
| /** |
| * Setter for the claims flag |
| * @param value whether the claims flag is set or not |
| * @return the same PaPacOptions instance |
| */ |
| public PaPacOptions setClaims(boolean value) { |
| flags.set(CLAIMS, value); |
| return this; |
| } |
| |
| /** |
| * Getter for the claims flag |
| * @return the claims flag value |
| */ |
| public boolean getClaims() { |
| return flags.get(CLAIMS); |
| } |
| |
| /** |
| * Setter for the branch-aware flag |
| * @param value whether the branch-aware flag is set or not |
| * @return the same PaPacOptions instance |
| */ |
| public PaPacOptions setBranchAware(boolean value) { |
| flags.set(BRANCH_AWARE, value); |
| return this; |
| } |
| |
| /** |
| * Getter for the branch-aware flag |
| * @return the branch-aware flag value |
| */ |
| public boolean getBranchAware() { |
| return flags.get(BRANCH_AWARE); |
| } |
| |
| /** |
| * Setter for the forward-to-full-DC flag |
| * @param value whether the forward-to-full-DC flag is set or not |
| * @return the same PaPacOptions instance |
| */ |
| public PaPacOptions setForwardToFullDC(boolean value) { |
| flags.set(FORWARD_TO_FULL_DC, value); |
| return this; |
| } |
| |
| /** |
| * Getter for the forward-to-full-DC flag |
| * @return the forward-to-full-DC flag value |
| */ |
| public boolean getForwardToFullDC() { |
| return flags.get(FORWARD_TO_FULL_DC); |
| } |
| |
| /** |
| * Setter for the resource-based-constrained-delegation flag |
| * @param value whether the resource-based-constrained-delegation |
| * is set or not |
| * @return the same PaPacOptions instance |
| */ |
| public PaPacOptions setResourceBasedConstrainedDelegation(boolean value) { |
| flags.set(RESOURCE_BASED_CONSTRAINED_DELEGATION, value); |
| return this; |
| } |
| |
| /** |
| * Getter for the resource-based-constrained-delegation flag |
| * @return the resource-based-constrained-delegation flag value |
| */ |
| public boolean getResourceBasedConstrainedDelegation() { |
| return flags.get(RESOURCE_BASED_CONSTRAINED_DELEGATION); |
| } |
| |
| /** |
| * Encodes this PaPacOptions instance. |
| * @return an ASN.1 encoded PaPacOptions byte array |
| * @throws IOException if an I/O error occurs while encoding this |
| * PaPacOptions instance |
| */ |
| public byte[] asn1Encode() throws IOException { |
| byte[] bytes = null; |
| try(DerOutputStream temp = new DerOutputStream()) { |
| temp.write( |
| DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x00), |
| flags.asn1Encode()); |
| bytes = temp.toByteArray(); |
| } |
| try(DerOutputStream temp = new DerOutputStream()) { |
| temp.write(DerValue.tag_Sequence, bytes); |
| return temp.toByteArray(); |
| } |
| } |
| |
| @Override |
| public String toString() { |
| return flags.toString(); |
| } |
| } |