| /* |
| * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.jgss.krb5; |
| |
| import org.ietf.jgss.*; |
| import sun.security.jgss.*; |
| import sun.security.krb5.*; |
| import java.io.InputStream; |
| import java.io.OutputStream; |
| import java.io.IOException; |
| import java.io.ByteArrayInputStream; |
| import java.security.GeneralSecurityException; |
| import java.security.MessageDigest; |
| |
| /** |
| * This class is a base class for other token definitions that pertain to |
| * per-message GSS-API calls. Conceptually GSS-API has two types of |
| * per-message tokens: WrapToken and MicToken. They differ in the respect |
| * that a WrapToken carries additional plaintext or ciphertext application |
| * data besides just the sequence number and checksum. This class |
| * encapsulates the commonality in the structure of the WrapToken and the |
| * MicToken. This structure can be represented as: |
| * <p> |
| * <pre> |
| * 0..1 TOK_ID Identification field. |
| * 01 01 - Mic token |
| * 02 01 - Wrap token |
| * 2..3 SGN_ALG Checksum algorithm indicator. |
| * 00 00 - DES MAC MD5 |
| * 01 00 - MD2.5 |
| * 02 00 - DES MAC |
| * 04 00 - HMAC SHA1 DES3-KD |
| * 11 00 - RC4-HMAC |
| * 4..5 SEAL_ALG ff ff - none |
| * 00 00 - DES |
| * 02 00 - DES3-KD |
| * 10 00 - RC4-HMAC |
| * 6..7 Filler Contains ff ff |
| * 8..15 SND_SEQ Encrypted sequence number field. |
| * 16..s+15 SGN_CKSUM Checksum of plaintext padded data, |
| * calculated according to algorithm |
| * specified in SGN_ALG field. |
| * s+16..last Data encrypted or plaintext padded data |
| * </pre> |
| * Where "s" indicates the size of the checksum. |
| * <p> |
| * As always, this is preceeded by a GSSHeader. |
| * |
| * @author Mayank Upadhyay |
| * @author Ram Marti |
| * @see sun.security.jgss.GSSHeader |
| */ |
| |
| abstract class MessageToken extends Krb5Token { |
| /* Fields in header minus checksum size */ |
| private static final int TOKEN_NO_CKSUM_SIZE = 16; |
| |
| /** |
| * Filler data as defined in the specification of the Kerberos v5 GSS-API |
| * Mechanism. |
| */ |
| private static final int FILLER = 0xffff; |
| |
| // Signing algorithm values (for the SNG_ALG field) |
| |
| // From RFC 1964 |
| /* Use a DES MAC MD5 checksum */ |
| static final int SGN_ALG_DES_MAC_MD5 = 0x0000; |
| |
| /* Use DES MAC checksum. */ |
| static final int SGN_ALG_DES_MAC = 0x0200; |
| |
| // From draft-raeburn-cat-gssapi-krb5-3des-00 |
| /* Use a HMAC SHA1 DES3 -KD checksum */ |
| static final int SGN_ALG_HMAC_SHA1_DES3_KD = 0x0400; |
| |
| // Sealing algorithm values (for the SEAL_ALG field) |
| |
| // RFC 1964 |
| /** |
| * A value for the SEAL_ALG field that indicates that no encryption was |
| * used. |
| */ |
| static final int SEAL_ALG_NONE = 0xffff; |
| /* Use DES CBC encryption algorithm. */ |
| static final int SEAL_ALG_DES = 0x0000; |
| |
| // From draft-raeburn-cat-gssapi-krb5-3des-00 |
| /** |
| * Use DES3-KD sealing algorithm. (draft-raeburn-cat-gssapi-krb5-3des-00) |
| * This algorithm uses triple-DES with key derivation, with a usage |
| * value KG_USAGE_SEAL. Padding is still to 8-byte multiples, and the |
| * IV for encrypting application data is zero. |
| */ |
| static final int SEAL_ALG_DES3_KD = 0x0200; |
| |
| // draft draft-brezak-win2k-krb-rc4-hmac-04.txt |
| static final int SEAL_ALG_ARCFOUR_HMAC = 0x1000; |
| static final int SGN_ALG_HMAC_MD5_ARCFOUR = 0x1100; |
| |
| private static final int TOKEN_ID_POS = 0; |
| private static final int SIGN_ALG_POS = 2; |
| private static final int SEAL_ALG_POS = 4; |
| |
| private int seqNumber; |
| |
| private boolean confState = true; |
| private boolean initiator = true; |
| |
| private int tokenId = 0; |
| private GSSHeader gssHeader = null; |
| private MessageTokenHeader tokenHeader = null; |
| private byte[] checksum = null; |
| private byte[] encSeqNumber = null; |
| private byte[] seqNumberData = null; |
| |
| /* cipher instance used by the corresponding GSSContext */ |
| CipherHelper cipherHelper = null; |
| |
| |
| /** |
| * Constructs a MessageToken from a byte array. If there are more bytes |
| * in the array than needed, the extra bytes are simply ignroed. |
| * |
| * @param tokenId the token id that should be contained in this token as |
| * it is read. |
| * @param context the Kerberos context associated with this token |
| * @param tokenBytes the byte array containing the token |
| * @param tokenOffset the offset where the token begins |
| * @param tokenLen the length of the token |
| * @param prop the MessageProp structure in which the properties of the |
| * token should be stored. |
| * @throws GSSException if there is a problem parsing the token |
| */ |
| MessageToken(int tokenId, Krb5Context context, |
| byte[] tokenBytes, int tokenOffset, int tokenLen, |
| MessageProp prop) throws GSSException { |
| this(tokenId, context, |
| new ByteArrayInputStream(tokenBytes, tokenOffset, tokenLen), |
| prop); |
| } |
| |
| /** |
| * Constructs a MessageToken from an InputStream. Bytes will be read on |
| * demand and the thread might block if there are not enough bytes to |
| * complete the token. |
| * |
| * @param tokenId the token id that should be contained in this token as |
| * it is read. |
| * @param context the Kerberos context associated with this token |
| * @param is the InputStream from which to read |
| * @param prop the MessageProp structure in which the properties of the |
| * token should be stored. |
| * @throws GSSException if there is a problem reading from the |
| * InputStream or parsing the token |
| */ |
| MessageToken(int tokenId, Krb5Context context, InputStream is, |
| MessageProp prop) throws GSSException { |
| init(tokenId, context); |
| |
| try { |
| gssHeader = new GSSHeader(is); |
| |
| if (!gssHeader.getOid().equals(OID)) { |
| throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1, |
| getTokenName(tokenId)); |
| } |
| if (!confState) { |
| prop.setPrivacy(false); |
| } |
| |
| tokenHeader = new MessageTokenHeader(is, prop); |
| |
| encSeqNumber = new byte[8]; |
| readFully(is, encSeqNumber); |
| |
| // debug("\n\tRead EncSeq#=" + |
| // getHexBytes(encSeqNumber, encSeqNumber.length)); |
| |
| checksum = new byte[cipherHelper.getChecksumLength()]; |
| readFully(is, checksum); |
| |
| // debug("\n\tRead checksum=" + |
| // getHexBytes(checksum, checksum.length)); |
| // debug("\nLeaving MessageToken.Cons\n"); |
| |
| } catch (IOException e) { |
| throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1, |
| getTokenName(tokenId) + ":" + e.getMessage()); |
| } |
| } |
| |
| /** |
| * Used to obtain the GSSHeader that was at the start of this |
| * token. |
| */ |
| public final GSSHeader getGSSHeader() { |
| return gssHeader; |
| } |
| |
| /** |
| * Used to obtain the token id that was contained in this token. |
| * @return the token id in the token |
| */ |
| public final int getTokenId() { |
| return tokenId; |
| } |
| |
| /** |
| * Used to obtain the encrypted sequence number in this token. |
| * @return the encrypted sequence number in the token |
| */ |
| public final byte[] getEncSeqNumber() { |
| return encSeqNumber; |
| } |
| |
| /** |
| * Used to obtain the checksum that was contained in this token. |
| * @return the checksum in the token |
| */ |
| public final byte[] getChecksum() { |
| return checksum; |
| } |
| |
| /** |
| * Used to determine if this token contains any encrypted data. |
| * @return true if it contains any encrypted data, false if there is only |
| * plaintext data or if there is no data. |
| */ |
| public final boolean getConfState() { |
| return confState; |
| } |
| |
| /** |
| * Generates the checksum field and the encrypted sequence number |
| * field. The encrypted sequence number uses the 8 bytes of the checksum |
| * as an initial vector in a fixed DesCbc algorithm. |
| * |
| * @param prop the MessageProp structure that determines what sort of |
| * checksum and sealing algorithm should be used. The lower byte |
| * of qop determines the checksum algorithm while the upper byte |
| * determines the signing algorithm. |
| * Checksum values are: |
| * 0 - default (DES_MAC) |
| * 1 - MD5 |
| * 2 - DES_MD5 |
| * 3 - DES_MAC |
| * 4 - HMAC_SHA1 |
| * Sealing values are: |
| * 0 - default (DES) |
| * 1 - DES |
| * 2 - DES3-KD |
| * |
| * @param optionalHeader an optional header that will be processed first |
| * during checksum calculation |
| * |
| * @param data the application data to checksum |
| * @param offset the offset where the data starts |
| * @param len the length of the data |
| * |
| * @param optionalTrailer an optional trailer that will be processed |
| * last during checksum calculation. e.g., padding that should be |
| * appended to the application data |
| * |
| * @throws GSSException if an error occurs in the checksum calculation or |
| * encryption sequence number calculation. |
| */ |
| public void genSignAndSeqNumber(MessageProp prop, |
| byte[] optionalHeader, |
| byte[] data, int offset, int len, |
| byte[] optionalTrailer) |
| throws GSSException { |
| |
| // debug("Inside MessageToken.genSignAndSeqNumber:\n"); |
| |
| int qop = prop.getQOP(); |
| if (qop != 0) { |
| qop = 0; |
| prop.setQOP(qop); |
| } |
| |
| if (!confState) { |
| prop.setPrivacy(false); |
| } |
| |
| // Create a token header with the correct sign and seal algorithm |
| // values. |
| tokenHeader = |
| new MessageTokenHeader(tokenId, prop.getPrivacy(), qop); |
| |
| // Calculate SGN_CKSUM |
| |
| checksum = |
| getChecksum(optionalHeader, data, offset, len, optionalTrailer); |
| |
| // debug("\n\tCalc checksum=" + |
| // getHexBytes(checksum, checksum.length)); |
| |
| // Calculate SND_SEQ |
| |
| seqNumberData = new byte[8]; |
| |
| // When using this RC4 based encryption type, the sequence number is |
| // always sent in big-endian rather than little-endian order. |
| if (cipherHelper.isArcFour()) { |
| writeBigEndian(seqNumber, seqNumberData); |
| } else { |
| // for all other etypes |
| writeLittleEndian(seqNumber, seqNumberData); |
| } |
| if (!initiator) { |
| seqNumberData[4] = (byte)0xff; |
| seqNumberData[5] = (byte)0xff; |
| seqNumberData[6] = (byte)0xff; |
| seqNumberData[7] = (byte)0xff; |
| } |
| |
| encSeqNumber = cipherHelper.encryptSeq(checksum, seqNumberData, 0, 8); |
| |
| // debug("\n\tCalc seqNum=" + |
| // getHexBytes(seqNumberData, seqNumberData.length)); |
| // debug("\n\tCalc encSeqNum=" + |
| // getHexBytes(encSeqNumber, encSeqNumber.length)); |
| } |
| |
| /** |
| * Verifies that the checksum field and sequence number direction bytes |
| * are valid and consistent with the application data. |
| * |
| * @param optionalHeader an optional header that will be processed first |
| * during checksum calculation. |
| * |
| * @param data the application data |
| * @param offset the offset where the data begins |
| * @param len the length of the application data |
| * |
| * @param optionalTrailer an optional trailer that will be processed last |
| * during checksum calculation. e.g., padding that should be appended to |
| * the application data |
| * |
| * @throws GSSException if an error occurs in the checksum calculation or |
| * encryption sequence number calculation. |
| */ |
| public final boolean verifySignAndSeqNumber(byte[] optionalHeader, |
| byte[] data, int offset, int len, |
| byte[] optionalTrailer) |
| throws GSSException { |
| // debug("\tIn verifySign:\n"); |
| |
| // debug("\t\tchecksum: [" + getHexBytes(checksum) + "]\n"); |
| |
| byte[] myChecksum = |
| getChecksum(optionalHeader, data, offset, len, optionalTrailer); |
| |
| // debug("\t\tmychecksum: [" + getHexBytes(myChecksum) +"]\n"); |
| // debug("\t\tchecksum: [" + getHexBytes(checksum) + "]\n"); |
| |
| if (MessageDigest.isEqual(checksum, myChecksum)) { |
| |
| seqNumberData = cipherHelper.decryptSeq( |
| checksum, encSeqNumber, 0, 8); |
| |
| // debug("\t\tencSeqNumber: [" + getHexBytes(encSeqNumber) |
| // + "]\n"); |
| // debug("\t\tseqNumberData: [" + getHexBytes(seqNumberData) |
| // + "]\n"); |
| |
| /* |
| * The token from the initiator has direction bytes 0x00 and |
| * the token from the acceptor has direction bytes 0xff. |
| */ |
| byte directionByte = 0; |
| if (initiator) |
| directionByte = (byte) 0xff; // Received token from acceptor |
| |
| if ((seqNumberData[4] == directionByte) && |
| (seqNumberData[5] == directionByte) && |
| (seqNumberData[6] == directionByte) && |
| (seqNumberData[7] == directionByte)) |
| return true; |
| } |
| |
| return false; |
| |
| } |
| |
| public final int getSequenceNumber() { |
| int sequenceNum = 0; |
| if (cipherHelper.isArcFour()) { |
| sequenceNum = readBigEndian(seqNumberData, 0, 4); |
| } else { |
| sequenceNum = readLittleEndian(seqNumberData, 0, 4); |
| } |
| return sequenceNum; |
| } |
| |
| /** |
| * Computes the checksum based on the algorithm stored in the |
| * tokenHeader. |
| * |
| * @param optionalHeader an optional header that will be processed first |
| * during checksum calculation. |
| * |
| * @param data the application data |
| * @param offset the offset where the data begins |
| * @param len the length of the application data |
| * |
| * @param optionalTrailer an optional trailer that will be processed last |
| * during checksum calculation. e.g., padding that should be appended to |
| * the application data |
| * |
| * @throws GSSException if an error occurs in the checksum calculation. |
| */ |
| private byte[] getChecksum(byte[] optionalHeader, |
| byte[] data, int offset, int len, |
| byte[] optionalTrailer) |
| throws GSSException { |
| |
| // debug("Will do getChecksum:\n"); |
| |
| /* |
| * For checksum calculation the token header bytes i.e., the first 8 |
| * bytes following the GSSHeader, are logically prepended to the |
| * application data to bind the data to this particular token. |
| * |
| * Note: There is no such requirement wrt adding padding to the |
| * application data for checksumming, although the cryptographic |
| * algorithm used might itself apply some padding. |
| */ |
| |
| byte[] tokenHeaderBytes = tokenHeader.getBytes(); |
| byte[] existingHeader = optionalHeader; |
| byte[] checksumDataHeader = tokenHeaderBytes; |
| |
| if (existingHeader != null) { |
| checksumDataHeader = new byte[tokenHeaderBytes.length + |
| existingHeader.length]; |
| System.arraycopy(tokenHeaderBytes, 0, |
| checksumDataHeader, 0, tokenHeaderBytes.length); |
| System.arraycopy(existingHeader, 0, |
| checksumDataHeader, tokenHeaderBytes.length, |
| existingHeader.length); |
| } |
| |
| return cipherHelper.calculateChecksum(tokenHeader.getSignAlg(), |
| checksumDataHeader, optionalTrailer, data, offset, len, tokenId); |
| } |
| |
| |
| /** |
| * Constructs an empty MessageToken for the local context to send to |
| * the peer. It also increments the local sequence number in the |
| * Krb5Context instance it uses after obtaining the object lock for |
| * it. |
| * |
| * @param tokenId the token id that should be contained in this token |
| * @param context the Kerberos context associated with this token |
| */ |
| MessageToken(int tokenId, Krb5Context context) throws GSSException { |
| /* |
| debug("\n============================"); |
| debug("\nMySessionKey=" + |
| getHexBytes(context.getMySessionKey().getBytes())); |
| debug("\nPeerSessionKey=" + |
| getHexBytes(context.getPeerSessionKey().getBytes())); |
| debug("\n============================\n"); |
| */ |
| init(tokenId, context); |
| this.seqNumber = context.incrementMySequenceNumber(); |
| } |
| |
| private void init(int tokenId, Krb5Context context) throws GSSException { |
| this.tokenId = tokenId; |
| // Just for consistency check in Wrap |
| this.confState = context.getConfState(); |
| |
| this.initiator = context.isInitiator(); |
| |
| this.cipherHelper = context.getCipherHelper(null); |
| // debug("In MessageToken.Cons"); |
| } |
| |
| /** |
| * Encodes a GSSHeader and this token onto an OutputStream. |
| * |
| * @param os the OutputStream to which this should be written |
| * @throws GSSException if an error occurs while writing to the OutputStream |
| */ |
| public void encode(OutputStream os) throws IOException, GSSException { |
| gssHeader = new GSSHeader(OID, getKrb5TokenSize()); |
| gssHeader.encode(os); |
| tokenHeader.encode(os); |
| // debug("Writing seqNumber: " + getHexBytes(encSeqNumber)); |
| os.write(encSeqNumber); |
| // debug("Writing checksum: " + getHexBytes(checksum)); |
| os.write(checksum); |
| } |
| |
| /** |
| * Obtains the size of this token. Note that this excludes the size of |
| * the GSSHeader. |
| * @return token size |
| */ |
| protected int getKrb5TokenSize() throws GSSException { |
| return getTokenSize(); |
| } |
| |
| protected final int getTokenSize() throws GSSException { |
| return TOKEN_NO_CKSUM_SIZE + cipherHelper.getChecksumLength(); |
| } |
| |
| protected static final int getTokenSize(CipherHelper ch) |
| throws GSSException { |
| return TOKEN_NO_CKSUM_SIZE + ch.getChecksumLength(); |
| } |
| |
| /** |
| * Obtains the conext key that is associated with this token. |
| * @return the context key |
| */ |
| /* |
| public final byte[] getContextKey() { |
| return contextKey; |
| } |
| */ |
| |
| /** |
| * Obtains the encryption algorithm that should be used in this token |
| * given the state of confidentiality the application requested. |
| * Requested qop must be consistent with negotiated session key. |
| * @param confRequested true if the application desired confidentiality |
| * on this token, false otherwise |
| * @param qop the qop requested by the application |
| * @throws GSSException if qop is incompatible with the negotiated |
| * session key |
| */ |
| protected abstract int getSealAlg(boolean confRequested, int qop) |
| throws GSSException; |
| |
| // ******************************************* // |
| // I N N E R C L A S S E S F O L L O W |
| // ******************************************* // |
| |
| /** |
| * This inner class represents the initial portion of the message token |
| * and contains information about the checksum and encryption algorithms |
| * that are in use. It constitutes the first 8 bytes of the |
| * message token: |
| * <pre> |
| * 0..1 TOK_ID Identification field. |
| * 01 01 - Mic token |
| * 02 01 - Wrap token |
| * 2..3 SGN_ALG Checksum algorithm indicator. |
| * 00 00 - DES MAC MD5 |
| * 01 00 - MD2.5 |
| * 02 00 - DES MAC |
| * 04 00 - HMAC SHA1 DES3-KD |
| * 11 00 - RC4-HMAC |
| * 4..5 SEAL_ALG ff ff - none |
| * 00 00 - DES |
| * 02 00 - DES3-KD |
| * 10 00 - RC4-HMAC |
| * 6..7 Filler Contains ff ff |
| * </pre> |
| */ |
| class MessageTokenHeader { |
| |
| private int tokenId; |
| private int signAlg; |
| private int sealAlg; |
| |
| private byte[] bytes = new byte[8]; |
| |
| /** |
| * Constructs a MessageTokenHeader for the specified token type with |
| * appropriate checksum and encryption algorithms fields. |
| * |
| * @param tokenId the token id for this mesage token |
| * @param conf true if confidentiality will be resuested with this |
| * message token, false otherwise. |
| * @param qop the value of the quality of protection that will be |
| * desired. |
| */ |
| public MessageTokenHeader(int tokenId, boolean conf, int qop) |
| throws GSSException { |
| |
| this.tokenId = tokenId; |
| |
| signAlg = MessageToken.this.getSgnAlg(qop); |
| |
| sealAlg = MessageToken.this.getSealAlg(conf, qop); |
| |
| bytes[0] = (byte) (tokenId >>> 8); |
| bytes[1] = (byte) (tokenId); |
| |
| bytes[2] = (byte) (signAlg >>> 8); |
| bytes[3] = (byte) (signAlg); |
| |
| bytes[4] = (byte) (sealAlg >>> 8); |
| bytes[5] = (byte) (sealAlg); |
| |
| bytes[6] = (byte) (MessageToken.FILLER >>> 8); |
| bytes[7] = (byte) (MessageToken.FILLER); |
| } |
| |
| /** |
| * Constructs a MessageTokenHeader by reading it from an InputStream |
| * and sets the appropriate confidentiality and quality of protection |
| * values in a MessageProp structure. |
| * |
| * @param is the InputStream to read from |
| * @param prop the MessageProp to populate |
| * @throws IOException is an error occurs while reading from the |
| * InputStream |
| */ |
| public MessageTokenHeader(InputStream is, MessageProp prop) |
| throws IOException { |
| readFully(is, bytes); |
| tokenId = readInt(bytes, TOKEN_ID_POS); |
| signAlg = readInt(bytes, SIGN_ALG_POS); |
| sealAlg = readInt(bytes, SEAL_ALG_POS); |
| // debug("\nMessageTokenHeader read tokenId=" + |
| // getHexBytes(bytes) + "\n"); |
| // XXX compare to FILLER |
| int temp = readInt(bytes, SEAL_ALG_POS + 2); |
| |
| // debug("SIGN_ALG=" + signAlg); |
| |
| switch (sealAlg) { |
| case SEAL_ALG_DES: |
| case SEAL_ALG_DES3_KD: |
| case SEAL_ALG_ARCFOUR_HMAC: |
| prop.setPrivacy(true); |
| break; |
| |
| default: |
| prop.setPrivacy(false); |
| } |
| |
| prop.setQOP(0); // default |
| } |
| |
| /** |
| * Encodes this MessageTokenHeader onto an OutputStream |
| * @param os the OutputStream to write to |
| * @throws IOException is an error occurs while writing |
| */ |
| public final void encode(OutputStream os) throws IOException { |
| os.write(bytes); |
| } |
| |
| |
| /** |
| * Returns the token id for the message token. |
| * @return the token id |
| * @see sun.security.jgss.krb5.Krb5Token#MIC_ID |
| * @see sun.security.jgss.krb5.Krb5Token#WRAP_ID |
| */ |
| public final int getTokenId() { |
| return tokenId; |
| } |
| |
| /** |
| * Returns the sign algorithm for the message token. |
| * @return the sign algorithm |
| * @see sun.security.jgss.krb5.MessageToken#SIGN_DES_MAC |
| * @see sun.security.jgss.krb5.MessageToken#SIGN_DES_MAC_MD5 |
| */ |
| public final int getSignAlg() { |
| return signAlg; |
| } |
| |
| /** |
| * Returns the seal algorithm for the message token. |
| * @return the seal algorithm |
| * @see sun.security.jgss.krb5.MessageToken#SEAL_ALG_DES |
| * @see sun.security.jgss.krb5.MessageToken#SEAL_ALG_NONE |
| */ |
| public final int getSealAlg() { |
| return sealAlg; |
| } |
| |
| /** |
| * Returns the bytes of this header. |
| * @return 8 bytes that form this header |
| */ |
| public final byte[] getBytes() { |
| return bytes; |
| } |
| } // end of class MessageTokenHeader |
| |
| |
| /** |
| * Determine signing algorithm based on QOP. |
| */ |
| protected int getSgnAlg(int qop) throws GSSException { |
| // QOP ignored |
| return cipherHelper.getSgnAlg(); |
| } |
| } |
