jgit/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/GssApiMechanisms.java

/*
 * Copyright (C) 2018, Thomas Wolf <thomas.wolf@paranor.ch> and others
 *
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Distribution License v. 1.0 which is available at
 * https://www.eclipse.org/org/documents/edl-v10.php.
 *
 * SPDX-License-Identifier: BSD-3-Clause
 */
package org.eclipse.jgit.internal.transport.sshd;

import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.util.Collection;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.concurrent.atomic.AtomicBoolean;

import org.eclipse.jgit.annotations.NonNull;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;

/**
 * Global repository of GSS-API mechanisms that we can use.
 */
public class GssApiMechanisms {

	private GssApiMechanisms() {
		// No instantiation
	}

	/** Prefix to use with {@link GSSName#NT_HOSTBASED_SERVICE}. */
	public static final String GSSAPI_HOST_PREFIX = "host@"; //$NON-NLS-1$

	/** The {@link Oid} of Kerberos 5. */
	public static final Oid KERBEROS_5 = createOid("1.2.840.113554.1.2.2"); //$NON-NLS-1$

	/** SGNEGO is not to be used with ssh. */
	public static final Oid SPNEGO = createOid("1.3.6.1.5.5.2"); //$NON-NLS-1$

	/** Protects {@link #supportedMechanisms}. */
	private static final Object LOCK = new Object();

	/**
	 * The {@link AtomicBoolean} is set to {@code true} when the mechanism could
	 * be initialized successfully at least once.
	 */
	private static Map<Oid, Boolean> supportedMechanisms;

	/**
	 * Retrieves an immutable collection of the supported mechanisms.
	 *
	 * @return the supported mechanisms
	 */
	@NonNull
	public static Collection<Oid> getSupportedMechanisms() {
		synchronized (LOCK) {
			if (supportedMechanisms == null) {
				GSSManager manager = GSSManager.getInstance();
				Oid[] mechs = manager.getMechs();
				Map<Oid, Boolean> mechanisms = new LinkedHashMap<>();
				if (mechs != null) {
					for (Oid oid : mechs) {
						mechanisms.put(oid, Boolean.FALSE);
					}
				}
				supportedMechanisms = mechanisms;
			}
			return Collections.unmodifiableSet(supportedMechanisms.keySet());
		}
	}

	/**
	 * Report that this mechanism was used successfully.
	 *
	 * @param mechanism
	 *            that worked
	 */
	public static void worked(@NonNull Oid mechanism) {
		synchronized (LOCK) {
			supportedMechanisms.put(mechanism, Boolean.TRUE);
		}
	}

	/**
	 * Mark the mechanisms as failed.
	 *
	 * @param mechanism
	 *            to mark
	 */
	public static void failed(@NonNull Oid mechanism) {
		synchronized (LOCK) {
			Boolean worked = supportedMechanisms.get(mechanism);
			if (worked != null && !worked.booleanValue()) {
				// If it never worked, remove it
				supportedMechanisms.remove(mechanism);
			}
		}
	}

	/**
	 * Resolves an {@link InetSocketAddress}.
	 *
	 * @param remote
	 *            to resolve
	 * @return the resolved {@link InetAddress}, or {@code null} if unresolved.
	 */
	public static InetAddress resolve(@NonNull InetSocketAddress remote) {
		InetAddress address = remote.getAddress();
		if (address == null) {
			try {
				address = InetAddress.getByName(remote.getHostString());
			} catch (UnknownHostException e) {
				return null;
			}
		}
		return address;
	}

	/**
	 * Determines a canonical host name for use use with GSS-API.
	 *
	 * @param remote
	 *            to get the host name from
	 * @return the canonical host name, if it can be determined, otherwise the
	 *         {@link InetSocketAddress#getHostString() unprocessed host name}.
	 */
	@NonNull
	public static String getCanonicalName(@NonNull InetSocketAddress remote) {
		InetAddress address = resolve(remote);
		if (address == null) {
			return remote.getHostString();
		}
		return address.getCanonicalHostName();
	}

	/**
	 * Creates a {@link GSSContext} for the given mechanism to authenticate with
	 * the host given by {@code fqdn}.
	 *
	 * @param mechanism
	 *            {@link Oid} of the mechanism to use
	 * @param fqdn
	 *            fully qualified domain name of the host to authenticate with
	 * @return the context, if the mechanism is available and the context could
	 *         be created, or {@code null} otherwise
	 */
	public static GSSContext createContext(@NonNull Oid mechanism,
			@NonNull String fqdn) {
		GSSContext context = null;
		try {
			GSSManager manager = GSSManager.getInstance();
			context = manager.createContext(
					manager.createName(
							GssApiMechanisms.GSSAPI_HOST_PREFIX + fqdn,
							GSSName.NT_HOSTBASED_SERVICE),
					mechanism, null, GSSContext.DEFAULT_LIFETIME);
		} catch (GSSException e) {
			closeContextSilently(context);
			failed(mechanism);
			return null;
		}
		worked(mechanism);
		return context;
	}

	/**
	 * Closes (disposes of) a {@link GSSContext} ignoring any
	 * {@link GSSException}s.
	 *
	 * @param context
	 *            to dispose
	 */
	public static void closeContextSilently(GSSContext context) {
		if (context != null) {
			try {
				context.dispose();
			} catch (GSSException e) {
				// Ignore
			}
		}
	}

	private static Oid createOid(String rep) {
		try {
			return new Oid(rep);
		} catch (GSSException e) {
			// Does not occur
			return null;
		}
	}

}