RFR 6722928: Support SSPI as a native GSS-API provider

Nico Williams Nico.Williams at twosigma.com
Thu Dec 6 21:33:25 UTC 2018


Looking at how to fix the incorrect isMN() implementation...  The lowest cost
route to fixing that would start with this sort of change:

    diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java b/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java
    index e1e89059c5..7939005652 100644
    --- a/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java
    +++ b/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java
    @@ -125,6 +125,7 @@ public class GSSNameImpl implements GSSName {
     
         private String printableName = null;
         private Oid printableNameType = null;
    +    private boolean isMechName;
     
         private HashMap<Oid, GSSNameSpi> elements = null;
         private GSSNameSpi mechElement = null;
    @@ -142,6 +143,7 @@ public class GSSNameImpl implements GSSName {
             this.mechElement = mechElement;
             elements = new HashMap<Oid, GSSNameSpi>(1);
             elements.put(mechElement.getMechanism(), this.mechElement);
    +        this.isMechName = mechElement.getMechanism() != null;
         }
     
         GSSNameImpl(GSSManagerImpl gssManager,
    @@ -179,6 +181,7 @@ public class GSSNameImpl implements GSSName {
             this.gssManager = gssManager;
             this.elements =
                     new HashMap<Oid, GSSNameSpi>(gssManager.getMechs().length);
    +        this.isMechName = appNameType.equals(NT_EXPORT_NAME) && mech != null;
     
             if (appName instanceof String) {
                 this.appNameStr = (String) appName;
    @@ -198,15 +201,17 @@ public class GSSNameImpl implements GSSName {
     
             this.appNameType = appNameType;
     
    -        mechElement = getElement(mech);
    +        if (mech != NULL) {
    +            mechElement = getElement(mech);
     
    -        /*
    -         * printableName will be null if appName was in a byte[] or if
    -         * appName was in a String but appNameType was null.
    -         */
    -        if (printableName == null) {
    -            printableName = mechElement.toString();
    -            printableNameType = mechElement.getStringNameType();
    +            /*
    +             * printableName will be null if appName was in a byte[] or if
    +             * appName was in a String but appNameType was null.
    +             */
    +            if (printableName == null) {
    +                printableName = mechElement.toString();
    +                printableNameType = mechElement.getStringNameType();
    +            }
             }
     
             /*
    @@ -215,7 +220,8 @@ public class GSSNameImpl implements GSSName {
              *   appNameType (could be null)
              *   printableName
              *   printableNameType
    -         *   mechElement (which also exists in the hashmap of elements)
    +         *   mechElement (could be null, if not then it is also in the hashmap
    +         *                of elements)
              */
         }
     
    @@ -464,7 +470,7 @@ public class GSSNameImpl implements GSSName {
         }
     
         public boolean isMN() {
    -        return true; // Since always canonicalized for some mech
    +        return isMechName;
         }
     
         public synchronized GSSNameSpi getElement(Oid mechOid)


I've not attempted to build this, much less test it.  There may be other
changes needed elsewhere (bet on it).

Nico
-- 



More information about the security-dev mailing list