feat(jdk8): move files to new folder to avoid resources compiled.

jdkSrc/jdk8/sun/security/jgss/wrapper/GSSCredElement.java

@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+package sun.security.jgss.wrapper;
+
+import org.ietf.jgss.*;
+import java.security.Provider;
+import sun.security.jgss.GSSUtil;
+import sun.security.jgss.spi.GSSCredentialSpi;
+import sun.security.jgss.spi.GSSNameSpi;
+
+/**
+ * This class is essentially a wrapper class for the gss_cred_id_t
+ * structure of the native GSS library.
+ * @author Valerie Peng
+ * @since 1.6
+ */
+public class GSSCredElement implements GSSCredentialSpi {
+
+    private int usage;
+    long pCred; // Pointer to the gss_cred_id_t structure
+    private GSSNameElement name = null;
+    private GSSLibStub cStub;
+
+    // Perform the necessary ServicePermission check on this cred
+    void doServicePermCheck() throws GSSException {
+        if (GSSUtil.isKerberosMech(cStub.getMech())) {
+            if (System.getSecurityManager() != null) {
+                if (isInitiatorCredential()) {
+                    String tgsName = Krb5Util.getTGSName(name);
+                    Krb5Util.checkServicePermission(tgsName, "initiate");
+                }
+                if (isAcceptorCredential() &&
+                    name != GSSNameElement.DEF_ACCEPTOR) {
+                    String krbName = name.getKrbName();
+                    Krb5Util.checkServicePermission(krbName, "accept");
+                }
+            }
+        }
+    }
+
+    // Construct delegation cred using the actual context mech and srcName
+    GSSCredElement(long pCredentials, GSSNameElement srcName, Oid mech)
+        throws GSSException {
+        pCred = pCredentials;
+        cStub = GSSLibStub.getInstance(mech);
+        usage = GSSCredential.INITIATE_ONLY;
+        name = srcName;
+    }
+
+    GSSCredElement(GSSNameElement name, int lifetime, int usage,
+                   GSSLibStub stub) throws GSSException {
+        cStub = stub;
+        this.usage = usage;
+
+        if (name != null) { // Could be GSSNameElement.DEF_ACCEPTOR
+            this.name = name;
+            doServicePermCheck();
+            pCred = cStub.acquireCred(this.name.pName, lifetime, usage);
+        } else {
+            pCred = cStub.acquireCred(0, lifetime, usage);
+            this.name = new GSSNameElement(cStub.getCredName(pCred), cStub);
+            doServicePermCheck();
+        }
+    }
+
+    public Provider getProvider() {
+        return SunNativeProvider.INSTANCE;
+    }
+
+    public void dispose() throws GSSException {
+        name = null;
+        if (pCred != 0) {
+            pCred = cStub.releaseCred(pCred);
+        }
+    }
+
+    public GSSNameElement getName() throws GSSException {
+        return (name == GSSNameElement.DEF_ACCEPTOR ?
+            null : name);
+    }
+
+    public int getInitLifetime() throws GSSException {
+        if (isInitiatorCredential()) {
+            return cStub.getCredTime(pCred);
+        } else return 0;
+    }
+
+    public int getAcceptLifetime() throws GSSException {
+        if (isAcceptorCredential()) {
+            return cStub.getCredTime(pCred);
+        } else return 0;
+    }
+
+    public boolean isInitiatorCredential() {
+        return (usage != GSSCredential.ACCEPT_ONLY);
+    }
+
+    public boolean isAcceptorCredential() {
+        return (usage != GSSCredential.INITIATE_ONLY);
+    }
+
+    public Oid getMechanism() {
+        return cStub.getMech();
+    }
+
+    public String toString() {
+        // No hex bytes available for native impl
+        return "N/A";
+    }
+
+    protected void finalize() throws Throwable {
+        dispose();
+    }
+
+    @Override
+    public GSSCredentialSpi impersonate(GSSNameSpi name) throws GSSException {
+        throw new GSSException(GSSException.FAILURE, -1,
+                "Not supported yet");
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/GSSLibStub.java

@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2005, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.jgss.wrapper;
+
+import java.util.Hashtable;
+import org.ietf.jgss.Oid;
+import org.ietf.jgss.GSSName;
+import org.ietf.jgss.ChannelBinding;
+import org.ietf.jgss.MessageProp;
+import org.ietf.jgss.GSSException;
+import sun.security.jgss.GSSUtil;
+
+/**
+ * This class is essentially a JNI calling stub for all wrapper classes.
+ *
+ * @author Valerie Peng
+ * @since 1.6
+ */
+
+class GSSLibStub {
+
+    private Oid mech;
+    private long pMech;
+
+    /**
+     * Initialization routine to dynamically load function pointers.
+     *
+     * @param lib library name to dlopen
+     * @param debug set to true for reporting native debugging info
+     * @return true if succeeded, false otherwise.
+     */
+    static native boolean init(String lib, boolean debug);
+    private static native long getMechPtr(byte[] oidDerEncoding);
+
+    // Miscellaneous routines
+    static native Oid[] indicateMechs();
+    native Oid[] inquireNamesForMech() throws GSSException;
+
+    // Name related routines
+    native void releaseName(long pName);
+    native long importName(byte[] name, Oid type);
+    native boolean compareName(long pName1, long pName2);
+    native long canonicalizeName(long pName);
+    native byte[] exportName(long pName) throws GSSException;
+    native Object[] displayName(long pName) throws GSSException;
+
+    // Credential related routines
+    native long acquireCred(long pName, int lifetime, int usage)
+                                        throws GSSException;
+    native long releaseCred(long pCred);
+    native long getCredName(long pCred);
+    native int getCredTime(long pCred);
+    native int getCredUsage(long pCred);
+
+    // Context related routines
+    native NativeGSSContext importContext(byte[] interProcToken);
+    native byte[] initContext(long pCred, long targetName, ChannelBinding cb,
+                              byte[] inToken, NativeGSSContext context);
+    native byte[] acceptContext(long pCred, ChannelBinding cb,
+                                byte[] inToken, NativeGSSContext context);
+    native long[] inquireContext(long pContext);
+    native Oid getContextMech(long pContext);
+    native long getContextName(long pContext, boolean isSrc);
+    native int getContextTime(long pContext);
+    native long deleteContext(long pContext);
+    native int wrapSizeLimit(long pContext, int flags, int qop, int outSize);
+    native byte[] exportContext(long pContext);
+    native byte[] getMic(long pContext, int qop, byte[] msg);
+    native void verifyMic(long pContext, byte[] token, byte[] msg,
+                          MessageProp prop) ;
+    native byte[] wrap(long pContext, byte[] msg, MessageProp prop);
+    native byte[] unwrap(long pContext, byte[] msgToken, MessageProp prop);
+
+    private static Hashtable<Oid, GSSLibStub>
+        table = new Hashtable<Oid, GSSLibStub>(5);
+
+    static GSSLibStub getInstance(Oid mech) throws GSSException {
+        GSSLibStub s = table.get(mech);
+        if (s == null) {
+            s = new GSSLibStub(mech);
+            table.put(mech, s);
+        }
+        return s;
+    }
+    private GSSLibStub(Oid mech) throws GSSException {
+        SunNativeProvider.debug("Created GSSLibStub for mech " + mech);
+        this.mech = mech;
+        this.pMech = getMechPtr(mech.getDER());
+    }
+    public boolean equals(Object obj) {
+        if (obj == this) return true;
+        if (!(obj instanceof GSSLibStub)) {
+            return false;
+        }
+        return (mech.equals(((GSSLibStub) obj).getMech()));
+    }
+    public int hashCode() {
+        return mech.hashCode();
+    }
+    Oid getMech() {
+        return mech;
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/GSSNameElement.java

@@ -0,0 +1,295 @@
+/*
+ * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.jgss.wrapper;
+
+import org.ietf.jgss.*;
+import java.security.Provider;
+import java.security.Security;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import sun.security.krb5.Realm;
+import sun.security.jgss.GSSUtil;
+import sun.security.util.ObjectIdentifier;
+import sun.security.util.DerInputStream;
+import sun.security.util.DerOutputStream;
+import sun.security.jgss.GSSUtil;
+import sun.security.jgss.GSSExceptionImpl;
+import sun.security.jgss.spi.GSSNameSpi;
+
+import javax.security.auth.kerberos.ServicePermission;
+
+/**
+ * This class is essentially a wrapper class for the gss_name_t
+ * structure of the native GSS library.
+ * @author Valerie Peng
+ * @since 1.6
+ */
+
+public class GSSNameElement implements GSSNameSpi {
+
+    long pName = 0; // Pointer to the gss_name_t structure
+    private String printableName;
+    private Oid printableType;
+    private GSSLibStub cStub;
+
+    static final GSSNameElement DEF_ACCEPTOR = new GSSNameElement();
+
+    private static Oid getNativeNameType(Oid nameType, GSSLibStub stub) {
+        if (GSSUtil.NT_GSS_KRB5_PRINCIPAL.equals(nameType)) {
+            Oid[] supportedNTs = null;
+            try {
+                supportedNTs = stub.inquireNamesForMech();
+            } catch (GSSException ge) {
+                if (ge.getMajor() == GSSException.BAD_MECH &&
+                    GSSUtil.isSpNegoMech(stub.getMech())) {
+                    // Workaround known Heimdal issue and retry with KRB5
+                    try {
+                        stub = GSSLibStub.getInstance
+                            (GSSUtil.GSS_KRB5_MECH_OID);
+                        supportedNTs = stub.inquireNamesForMech();
+                    } catch (GSSException ge2) {
+                        // Should never happen
+                        SunNativeProvider.debug("Name type list unavailable: " +
+                            ge2.getMajorString());
+                    }
+                } else {
+                    SunNativeProvider.debug("Name type list unavailable: " +
+                        ge.getMajorString());
+                }
+            }
+            if (supportedNTs != null) {
+                for (int i = 0; i < supportedNTs.length; i++) {
+                    if (supportedNTs[i].equals(nameType)) return nameType;
+                }
+                // Special handling the specified name type
+                SunNativeProvider.debug("Override " + nameType +
+                    " with mechanism default(null)");
+                return null; // Use mechanism specific default
+            }
+        }
+        return nameType;
+    }
+
+    private GSSNameElement() {
+        printableName = "<DEFAULT ACCEPTOR>";
+    }
+
+    GSSNameElement(long pNativeName, GSSLibStub stub) throws GSSException {
+        assert(stub != null);
+        if (pNativeName == 0) {
+            throw new GSSException(GSSException.BAD_NAME);
+        }
+        // Note: pNativeName is assumed to be a MN.
+        pName = pNativeName;
+        cStub = stub;
+        setPrintables();
+    }
+
+    GSSNameElement(byte[] nameBytes, Oid nameType, GSSLibStub stub)
+        throws GSSException {
+        assert(stub != null);
+        if (nameBytes == null) {
+            throw new GSSException(GSSException.BAD_NAME);
+        }
+        cStub = stub;
+        byte[] name = nameBytes;
+
+        if (nameType != null) {
+            // Special handling the specified name type if
+            // necessary
+            nameType = getNativeNameType(nameType, stub);
+
+            if (GSSName.NT_EXPORT_NAME.equals(nameType)) {
+                // Need to add back the mech Oid portion (stripped
+                // off by GSSNameImpl class prior to calling this
+                // method) for "NT_EXPORT_NAME"
+                byte[] mechBytes = null;
+                DerOutputStream dout = new DerOutputStream();
+                Oid mech = cStub.getMech();
+                try {
+                    dout.putOID(new ObjectIdentifier(mech.toString()));
+                } catch (IOException e) {
+                    throw new GSSExceptionImpl(GSSException.FAILURE, e);
+                }
+                mechBytes = dout.toByteArray();
+                name = new byte[2 + 2 + mechBytes.length + 4 + nameBytes.length];
+                int pos = 0;
+                name[pos++] = 0x04;
+                name[pos++] = 0x01;
+                name[pos++] = (byte) (mechBytes.length>>>8);
+                name[pos++] = (byte) mechBytes.length;
+                System.arraycopy(mechBytes, 0, name, pos, mechBytes.length);
+                pos += mechBytes.length;
+                name[pos++] = (byte) (nameBytes.length>>>24);
+                name[pos++] = (byte) (nameBytes.length>>>16);
+                name[pos++] = (byte) (nameBytes.length>>>8);
+                name[pos++] = (byte) nameBytes.length;
+                System.arraycopy(nameBytes, 0, name, pos, nameBytes.length);
+            }
+        }
+        pName = cStub.importName(name, nameType);
+        setPrintables();
+
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null && !Realm.AUTODEDUCEREALM) {
+            String krbName = getKrbName();
+            int atPos = krbName.lastIndexOf('@');
+            if (atPos != -1) {
+                String atRealm = krbName.substring(atPos);
+                // getNativeNameType() can modify NT_GSS_KRB5_PRINCIPAL to null
+                if ((nameType == null
+                            || nameType.equals(GSSUtil.NT_GSS_KRB5_PRINCIPAL))
+                        && new String(nameBytes).endsWith(atRealm)) {
+                    // Created from Kerberos name with realm, no need to check
+                } else {
+                    try {
+                        sm.checkPermission(new ServicePermission(atRealm, "-"));
+                    } catch (SecurityException se) {
+                        // Do not chain the actual exception to hide info
+                        throw new GSSException(GSSException.FAILURE);
+                    }
+                }
+            }
+        }
+
+        SunNativeProvider.debug("Imported " + printableName + " w/ type " +
+                                printableType);
+    }
+
+    private void setPrintables() throws GSSException {
+        Object[] printables = null;
+        printables = cStub.displayName(pName);
+        assert((printables != null) && (printables.length == 2));
+        printableName = (String) printables[0];
+        assert(printableName != null);
+        printableType = (Oid) printables[1];
+        if (printableType == null) {
+            printableType = GSSName.NT_USER_NAME;
+        }
+    }
+
+    // Need to be public for GSSUtil.getSubject()
+    public String getKrbName() throws GSSException {
+        long mName = 0;
+        GSSLibStub stub = cStub;
+        if (!GSSUtil.isKerberosMech(cStub.getMech())) {
+            stub = GSSLibStub.getInstance(GSSUtil.GSS_KRB5_MECH_OID);
+        }
+        mName = stub.canonicalizeName(pName);
+        Object[] printables2 = stub.displayName(mName);
+        stub.releaseName(mName);
+        SunNativeProvider.debug("Got kerberized name: " + printables2[0]);
+        return (String) printables2[0];
+    }
+
+    public Provider getProvider() {
+        return SunNativeProvider.INSTANCE;
+    }
+
+    public boolean equals(GSSNameSpi other) throws GSSException {
+        if (!(other instanceof GSSNameElement)) {
+            return false;
+        }
+        return cStub.compareName(pName, ((GSSNameElement)other).pName);
+    }
+
+    public boolean equals(Object other) {
+        if (!(other instanceof GSSNameElement)) {
+            return false;
+        }
+        try {
+            return equals((GSSNameElement) other);
+        } catch (GSSException ex) {
+            return false;
+        }
+    }
+
+    public int hashCode() {
+        return new Long(pName).hashCode();
+    }
+
+    public byte[] export() throws GSSException {
+        byte[] nameVal = cStub.exportName(pName);
+
+        // Need to strip off the mech Oid portion of the exported
+        // bytes since GSSNameImpl class will subsequently add it.
+        int pos = 0;
+        if ((nameVal[pos++] != 0x04) ||
+            (nameVal[pos++] != 0x01))
+            throw new GSSException(GSSException.BAD_NAME);
+
+        int mechOidLen  = (((0xFF & nameVal[pos++]) << 8) |
+                           (0xFF & nameVal[pos++]));
+        ObjectIdentifier temp = null;
+        try {
+            DerInputStream din = new DerInputStream(nameVal, pos,
+                                                    mechOidLen);
+            temp = new ObjectIdentifier(din);
+        } catch (IOException e) {
+            throw new GSSExceptionImpl(GSSException.BAD_NAME, e);
+        }
+        Oid mech2 = new Oid(temp.toString());
+        assert(mech2.equals(getMechanism()));
+        pos += mechOidLen;
+        int mechPortionLen = (((0xFF & nameVal[pos++]) << 24) |
+                              ((0xFF & nameVal[pos++]) << 16) |
+                              ((0xFF & nameVal[pos++]) << 8) |
+                              (0xFF & nameVal[pos++]));
+        if (mechPortionLen < 0) {
+            throw new GSSException(GSSException.BAD_NAME);
+        }
+        byte[] mechPortion = new byte[mechPortionLen];
+        System.arraycopy(nameVal, pos, mechPortion, 0, mechPortionLen);
+        return mechPortion;
+    }
+
+    public Oid getMechanism() {
+        return cStub.getMech();
+    }
+
+    public String toString() {
+        return printableName;
+    }
+
+    public Oid getStringNameType() {
+        return printableType;
+    }
+
+    public boolean isAnonymousName() {
+        return (GSSName.NT_ANONYMOUS.equals(printableType));
+    }
+
+    public void dispose() {
+        if (pName != 0) {
+            cStub.releaseName(pName);
+            pName = 0;
+        }
+    }
+
+    protected void finalize() throws Throwable {
+        dispose();
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/Krb5Util.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+package sun.security.jgss.wrapper;
+
+import org.ietf.jgss.*;
+import javax.security.auth.kerberos.ServicePermission;
+
+/**
+ * This class is an utility class for Kerberos related stuff.
+ * @author Valerie Peng
+ * @since 1.6
+ */
+class Krb5Util {
+
+    // Return the Kerberos TGS principal name using the domain
+    // of the specified <code>name</code>
+    static String getTGSName(GSSNameElement name)
+        throws GSSException {
+        String krbPrinc = name.getKrbName();
+        int atIndex = krbPrinc.indexOf("@");
+        String realm = krbPrinc.substring(atIndex + 1);
+        StringBuffer buf = new StringBuffer("krbtgt/");
+        buf.append(realm).append('@').append(realm);
+        return buf.toString();
+    }
+
+    // Perform the Service Permission check using the specified
+    // <code>target</code> and <code>action</code>
+    static void checkServicePermission(String target, String action) {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            SunNativeProvider.debug("Checking ServicePermission(" +
+                                    target + ", " + action + ")");
+            ServicePermission perm =
+                new ServicePermission(target, action);
+            sm.checkPermission(perm);
+        }
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/NativeGSSContext.java

@@ -0,0 +1,631 @@
+/*
+ * Copyright (c) 2005, 2009, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.jgss.wrapper;
+
+import org.ietf.jgss.*;
+import java.security.Provider;
+import sun.security.jgss.GSSHeader;
+import sun.security.jgss.GSSUtil;
+import sun.security.jgss.GSSExceptionImpl;
+import sun.security.jgss.spi.*;
+import sun.security.util.DerValue;
+import sun.security.util.ObjectIdentifier;
+import sun.security.jgss.spnego.NegTokenInit;
+import sun.security.jgss.spnego.NegTokenTarg;
+import javax.security.auth.kerberos.DelegationPermission;
+import com.sun.security.jgss.InquireType;
+import java.io.*;
+
+
+/**
+ * This class is essentially a wrapper class for the gss_ctx_id_t
+ * structure of the native GSS library.
+ * @author Valerie Peng
+ * @since 1.6
+ */
+class NativeGSSContext implements GSSContextSpi {
+
+    private static final int GSS_C_DELEG_FLAG = 1;
+    private static final int GSS_C_MUTUAL_FLAG = 2;
+    private static final int GSS_C_REPLAY_FLAG = 4;
+    private static final int GSS_C_SEQUENCE_FLAG = 8;
+    private static final int GSS_C_CONF_FLAG = 16;
+    private static final int GSS_C_INTEG_FLAG = 32;
+    private static final int GSS_C_ANON_FLAG = 64;
+    private static final int GSS_C_PROT_READY_FLAG = 128;
+    private static final int GSS_C_TRANS_FLAG = 256;
+
+    private static final int NUM_OF_INQUIRE_VALUES = 6;
+
+    private long pContext = 0; // Pointer to the gss_ctx_id_t structure
+    private GSSNameElement srcName;
+    private GSSNameElement targetName;
+    private GSSCredElement cred;
+    private boolean isInitiator;
+    private boolean isEstablished;
+    private Oid actualMech; // Assigned during context establishment
+
+    private ChannelBinding cb;
+    private GSSCredElement delegatedCred;
+    private int flags;
+    private int lifetime = GSSCredential.DEFAULT_LIFETIME;
+    private final GSSLibStub cStub;
+
+    private boolean skipDelegPermCheck;
+    private boolean skipServicePermCheck;
+
+    // Retrieve the (preferred) mech out of SPNEGO tokens, i.e.
+    // NegTokenInit & NegTokenTarg
+    private static Oid getMechFromSpNegoToken(byte[] token,
+                                              boolean isInitiator)
+        throws GSSException {
+        Oid mech = null;
+        if (isInitiator) {
+            GSSHeader header = null;
+            try {
+                header = new GSSHeader(new ByteArrayInputStream(token));
+            } catch (IOException ioe) {
+                throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+            }
+            int negTokenLen = header.getMechTokenLength();
+            byte[] negToken = new byte[negTokenLen];
+            System.arraycopy(token, token.length-negTokenLen,
+                             negToken, 0, negToken.length);
+
+            NegTokenInit ntok = new NegTokenInit(negToken);
+            if (ntok.getMechToken() != null) {
+                Oid[] mechList = ntok.getMechTypeList();
+                mech = mechList[0];
+            }
+        } else {
+            NegTokenTarg ntok = new NegTokenTarg(token);
+            mech = ntok.getSupportedMech();
+        }
+        return mech;
+    }
+
+    // Perform the Service permission check
+    private void doServicePermCheck() throws GSSException {
+        if (System.getSecurityManager() != null) {
+            String action = (isInitiator? "initiate" : "accept");
+            // Need to check Service permission for accessing
+            // initiator cred for SPNEGO during context establishment
+            if (GSSUtil.isSpNegoMech(cStub.getMech()) && isInitiator
+                && !isEstablished) {
+                if (srcName == null) {
+                    // Check by creating default initiator KRB5 cred
+                    GSSCredElement tempCred =
+                        new GSSCredElement(null, lifetime,
+                                           GSSCredential.INITIATE_ONLY,
+                                           GSSLibStub.getInstance(GSSUtil.GSS_KRB5_MECH_OID));
+                    tempCred.dispose();
+                } else {
+                    String tgsName = Krb5Util.getTGSName(srcName);
+                    Krb5Util.checkServicePermission(tgsName, action);
+                }
+            }
+            String targetStr = targetName.getKrbName();
+            Krb5Util.checkServicePermission(targetStr, action);
+            skipServicePermCheck = true;
+        }
+    }
+
+    // Perform the Delegation permission check
+    private void doDelegPermCheck() throws GSSException {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            String targetStr = targetName.getKrbName();
+            String tgsStr = Krb5Util.getTGSName(targetName);
+            StringBuffer buf = new StringBuffer("\"");
+            buf.append(targetStr).append("\" \"");
+            buf.append(tgsStr).append('\"');
+            String krbPrincPair = buf.toString();
+            SunNativeProvider.debug("Checking DelegationPermission (" +
+                                    krbPrincPair + ")");
+            DelegationPermission perm =
+                new DelegationPermission(krbPrincPair);
+            sm.checkPermission(perm);
+            skipDelegPermCheck = true;
+        }
+    }
+
+    private byte[] retrieveToken(InputStream is, int mechTokenLen)
+        throws GSSException {
+        try {
+            byte[] result = null;
+            if (mechTokenLen != -1) {
+                // Need to add back the GSS header for a complete GSS token
+                SunNativeProvider.debug("Precomputed mechToken length: " +
+                                         mechTokenLen);
+                GSSHeader gssHeader = new GSSHeader
+                    (new ObjectIdentifier(cStub.getMech().toString()),
+                     mechTokenLen);
+                ByteArrayOutputStream baos = new ByteArrayOutputStream(600);
+
+                byte[] mechToken = new byte[mechTokenLen];
+                int len = is.read(mechToken);
+                assert(mechTokenLen == len);
+                gssHeader.encode(baos);
+                baos.write(mechToken);
+                result = baos.toByteArray();
+            } else {
+                // Must be unparsed GSS token or SPNEGO's NegTokenTarg token
+                assert(mechTokenLen == -1);
+                DerValue dv = new DerValue(is);
+                result = dv.toByteArray();
+            }
+            SunNativeProvider.debug("Complete Token length: " +
+                                    result.length);
+            return result;
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+
+    // Constructor for context initiator
+    NativeGSSContext(GSSNameElement peer, GSSCredElement myCred,
+                     int time, GSSLibStub stub) throws GSSException {
+        if (peer == null) {
+            throw new GSSException(GSSException.FAILURE, 1, "null peer");
+        }
+        cStub = stub;
+        cred = myCred;
+        targetName = peer;
+        isInitiator = true;
+        lifetime = time;
+
+        if (GSSUtil.isKerberosMech(cStub.getMech())) {
+            doServicePermCheck();
+            if (cred == null) {
+                cred = new GSSCredElement(null, lifetime,
+                                          GSSCredential.INITIATE_ONLY, cStub);
+            }
+            srcName = cred.getName();
+        }
+    }
+
+    // Constructor for context acceptor
+    NativeGSSContext(GSSCredElement myCred, GSSLibStub stub)
+        throws GSSException {
+        cStub = stub;
+        cred = myCred;
+
+        if (cred != null) targetName = cred.getName();
+
+        isInitiator = false;
+        // Defer Service permission check for default acceptor cred
+        // to acceptSecContext()
+        if (GSSUtil.isKerberosMech(cStub.getMech()) && targetName != null) {
+            doServicePermCheck();
+        }
+
+        // srcName and potentially targetName (when myCred is null)
+        // will be set in GSSLibStub.acceptContext(...)
+    }
+
+    // Constructor for imported context
+    NativeGSSContext(long pCtxt, GSSLibStub stub) throws GSSException {
+        assert(pContext != 0);
+        pContext = pCtxt;
+        cStub = stub;
+
+        // Set everything except cred, cb, delegatedCred
+        long[] info = cStub.inquireContext(pContext);
+        if (info.length != NUM_OF_INQUIRE_VALUES) {
+            throw new RuntimeException("Bug w/ GSSLibStub.inquireContext()");
+        }
+        srcName = new GSSNameElement(info[0], cStub);
+        targetName = new GSSNameElement(info[1], cStub);
+        isInitiator = (info[2] != 0);
+        isEstablished = (info[3] != 0);
+        flags = (int) info[4];
+        lifetime = (int) info[5];
+
+        // Do Service Permission check when importing SPNEGO context
+        // just to be safe
+        Oid mech = cStub.getMech();
+        if (GSSUtil.isSpNegoMech(mech) || GSSUtil.isKerberosMech(mech)) {
+            doServicePermCheck();
+        }
+    }
+
+    public Provider getProvider() {
+        return SunNativeProvider.INSTANCE;
+    }
+
+    public byte[] initSecContext(InputStream is, int mechTokenLen)
+        throws GSSException {
+        byte[] outToken = null;
+        if ((!isEstablished) && (isInitiator)) {
+            byte[] inToken = null;
+            // Ignore the specified input stream on the first call
+            if (pContext != 0) {
+                inToken = retrieveToken(is, mechTokenLen);
+                SunNativeProvider.debug("initSecContext=> inToken len=" +
+                    inToken.length);
+            }
+
+            if (!getCredDelegState()) skipDelegPermCheck = true;
+
+            if (GSSUtil.isKerberosMech(cStub.getMech()) && !skipDelegPermCheck) {
+                doDelegPermCheck();
+            }
+
+            long pCred = (cred == null? 0 : cred.pCred);
+            outToken = cStub.initContext(pCred, targetName.pName,
+                                         cb, inToken, this);
+            SunNativeProvider.debug("initSecContext=> outToken len=" +
+                (outToken == null ? 0 : outToken.length));
+
+            // Only inspect the token when the permission check
+            // has not been performed
+            if (GSSUtil.isSpNegoMech(cStub.getMech()) && outToken != null) {
+                // WORKAROUND for SEAM bug#6287358
+                actualMech = getMechFromSpNegoToken(outToken, true);
+
+                if (GSSUtil.isKerberosMech(actualMech)) {
+                    if (!skipServicePermCheck) doServicePermCheck();
+                    if (!skipDelegPermCheck) doDelegPermCheck();
+                }
+            }
+
+            if (isEstablished) {
+                if (srcName == null) {
+                    srcName = new GSSNameElement
+                        (cStub.getContextName(pContext, true), cStub);
+                }
+                if (cred == null) {
+                    cred = new GSSCredElement(srcName, lifetime,
+                                              GSSCredential.INITIATE_ONLY,
+                                              cStub);
+                }
+            }
+        }
+        return outToken;
+    }
+
+    public byte[] acceptSecContext(InputStream is, int mechTokenLen)
+        throws GSSException {
+        byte[] outToken = null;
+        if ((!isEstablished) && (!isInitiator)) {
+            byte[] inToken = retrieveToken(is, mechTokenLen);
+            SunNativeProvider.debug("acceptSecContext=> inToken len=" +
+                                    inToken.length);
+            long pCred = (cred == null? 0 : cred.pCred);
+            outToken = cStub.acceptContext(pCred, cb, inToken, this);
+            SunNativeProvider.debug("acceptSecContext=> outToken len=" +
+                                    (outToken == null? 0 : outToken.length));
+
+            if (targetName == null) {
+                targetName = new GSSNameElement
+                    (cStub.getContextName(pContext, false), cStub);
+                // Replace the current default acceptor cred now that
+                // the context acceptor name is available
+                if (cred != null) cred.dispose();
+                cred = new GSSCredElement(targetName, lifetime,
+                                          GSSCredential.ACCEPT_ONLY, cStub);
+            }
+
+            // Only inspect token when the permission check has not
+            // been performed
+            if (GSSUtil.isSpNegoMech(cStub.getMech()) &&
+                (outToken != null) && !skipServicePermCheck) {
+                if (GSSUtil.isKerberosMech(getMechFromSpNegoToken
+                                           (outToken, false))) {
+                    doServicePermCheck();
+                }
+            }
+        }
+        return outToken;
+    }
+
+    public boolean isEstablished() {
+        return isEstablished;
+    }
+
+    public void dispose() throws GSSException {
+        srcName = null;
+        targetName = null;
+        cred = null;
+        delegatedCred = null;
+        if (pContext != 0) {
+            pContext = cStub.deleteContext(pContext);
+            pContext = 0;
+        }
+    }
+
+    public int getWrapSizeLimit(int qop, boolean confReq,
+                                int maxTokenSize)
+        throws GSSException {
+        return cStub.wrapSizeLimit(pContext, (confReq? 1:0), qop,
+                                   maxTokenSize);
+    }
+
+    public byte[] wrap(byte[] inBuf, int offset, int len,
+                       MessageProp msgProp) throws GSSException {
+        byte[] data = inBuf;
+        if ((offset != 0) || (len != inBuf.length)) {
+            data = new byte[len];
+            System.arraycopy(inBuf, offset, data, 0, len);
+        }
+        return cStub.wrap(pContext, data, msgProp);
+    }
+    public void wrap(byte inBuf[], int offset, int len,
+                     OutputStream os, MessageProp msgProp)
+        throws GSSException {
+        try {
+        byte[] result = wrap(inBuf, offset, len, msgProp);
+        os.write(result);
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+    public int wrap(byte[] inBuf, int inOffset, int len, byte[] outBuf,
+                    int outOffset, MessageProp msgProp)
+        throws GSSException {
+        byte[] result = wrap(inBuf, inOffset, len, msgProp);
+        System.arraycopy(result, 0, outBuf, outOffset, result.length);
+        return result.length;
+    }
+    public void wrap(InputStream inStream, OutputStream outStream,
+                     MessageProp msgProp) throws GSSException {
+        try {
+            byte[] data = new byte[inStream.available()];
+            int length = inStream.read(data);
+            byte[] token = wrap(data, 0, length, msgProp);
+            outStream.write(token);
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+
+    public byte[] unwrap(byte[] inBuf, int offset, int len,
+                         MessageProp msgProp)
+        throws GSSException {
+        if ((offset != 0) || (len != inBuf.length)) {
+            byte[] temp = new byte[len];
+            System.arraycopy(inBuf, offset, temp, 0, len);
+            return cStub.unwrap(pContext, temp, msgProp);
+        } else {
+            return cStub.unwrap(pContext, inBuf, msgProp);
+        }
+    }
+    public int unwrap(byte[] inBuf, int inOffset, int len,
+                      byte[] outBuf, int outOffset,
+                      MessageProp msgProp) throws GSSException {
+        byte[] result = null;
+        if ((inOffset != 0) || (len != inBuf.length)) {
+            byte[] temp = new byte[len];
+            System.arraycopy(inBuf, inOffset, temp, 0, len);
+            result = cStub.unwrap(pContext, temp, msgProp);
+        } else {
+            result = cStub.unwrap(pContext, inBuf, msgProp);
+        }
+        System.arraycopy(result, 0, outBuf, outOffset, result.length);
+        return result.length;
+    }
+    public void unwrap(InputStream inStream, OutputStream outStream,
+                       MessageProp msgProp) throws GSSException {
+        try {
+            byte[] wrapped = new byte[inStream.available()];
+            int wLength = inStream.read(wrapped);
+            byte[] data = unwrap(wrapped, 0, wLength, msgProp);
+            outStream.write(data);
+            outStream.flush();
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+
+    public int unwrap(InputStream inStream,
+                      byte[] outBuf, int outOffset,
+                      MessageProp msgProp) throws GSSException {
+        byte[] wrapped = null;
+        int wLength = 0;
+        try {
+            wrapped = new byte[inStream.available()];
+            wLength = inStream.read(wrapped);
+            byte[] result = unwrap(wrapped, 0, wLength, msgProp);
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+        byte[] result = unwrap(wrapped, 0, wLength, msgProp);
+        System.arraycopy(result, 0, outBuf, outOffset, result.length);
+        return result.length;
+    }
+
+    public byte[] getMIC(byte[] in, int offset, int len,
+                         MessageProp msgProp) throws GSSException {
+        int qop = (msgProp == null? 0:msgProp.getQOP());
+        byte[] inMsg = in;
+        if ((offset != 0) || (len != in.length)) {
+            inMsg = new byte[len];
+            System.arraycopy(in, offset, inMsg, 0, len);
+        }
+        return cStub.getMic(pContext, qop, inMsg);
+    }
+
+    public void getMIC(InputStream inStream, OutputStream outStream,
+                       MessageProp msgProp) throws GSSException {
+        try {
+            int length = 0;
+            byte[] msg = new byte[inStream.available()];
+            length = inStream.read(msg);
+
+            byte[] msgToken = getMIC(msg, 0, length, msgProp);
+            if ((msgToken != null) && msgToken.length != 0) {
+                outStream.write(msgToken);
+            }
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+
+    public void verifyMIC(byte[] inToken, int tOffset, int tLen,
+                          byte[] inMsg, int mOffset, int mLen,
+                          MessageProp msgProp) throws GSSException {
+        byte[] token = inToken;
+        byte[] msg = inMsg;
+        if ((tOffset != 0) || (tLen != inToken.length)) {
+            token = new byte[tLen];
+            System.arraycopy(inToken, tOffset, token, 0, tLen);
+        }
+        if ((mOffset != 0) || (mLen != inMsg.length)) {
+            msg = new byte[mLen];
+            System.arraycopy(inMsg, mOffset, msg, 0, mLen);
+        }
+        cStub.verifyMic(pContext, token, msg, msgProp);
+    }
+
+    public void verifyMIC(InputStream tokStream, InputStream msgStream,
+                          MessageProp msgProp) throws GSSException {
+        try {
+            byte[] msg = new byte[msgStream.available()];
+            int mLength = msgStream.read(msg);
+            byte[] tok = new byte[tokStream.available()];
+            int tLength = tokStream.read(tok);
+            verifyMIC(tok, 0, tLength, msg, 0, mLength, msgProp);
+        } catch (IOException ioe) {
+            throw new GSSExceptionImpl(GSSException.FAILURE, ioe);
+        }
+    }
+
+    public byte[] export() throws GSSException {
+        byte[] result = cStub.exportContext(pContext);
+        pContext = 0;
+        return result;
+    }
+
+    private void changeFlags(int flagMask, boolean isEnable) {
+        if (isInitiator && pContext == 0) {
+            if (isEnable) {
+                flags |= flagMask;
+            } else {
+                flags &= ~flagMask;
+            }
+        }
+    }
+    public void requestMutualAuth(boolean state) throws GSSException {
+        changeFlags(GSS_C_MUTUAL_FLAG, state);
+    }
+    public void requestReplayDet(boolean state) throws GSSException {
+        changeFlags(GSS_C_REPLAY_FLAG, state);
+    }
+    public void requestSequenceDet(boolean state) throws GSSException {
+        changeFlags(GSS_C_SEQUENCE_FLAG, state);
+    }
+    public void requestCredDeleg(boolean state) throws GSSException {
+        changeFlags(GSS_C_DELEG_FLAG, state);
+    }
+    public void requestAnonymity(boolean state) throws GSSException {
+        changeFlags(GSS_C_ANON_FLAG, state);
+    }
+    public void requestConf(boolean state) throws GSSException {
+        changeFlags(GSS_C_CONF_FLAG, state);
+    }
+    public void requestInteg(boolean state) throws GSSException {
+        changeFlags(GSS_C_INTEG_FLAG, state);
+    }
+    public void requestDelegPolicy(boolean state) throws GSSException {
+        // Not supported, ignore
+    }
+    public void requestLifetime(int lifetime) throws GSSException {
+        if (isInitiator && pContext == 0) {
+            this.lifetime = lifetime;
+        }
+    }
+    public void setChannelBinding(ChannelBinding cb) throws GSSException {
+        if (pContext == 0) {
+            this.cb = cb;
+        }
+    }
+
+    private boolean checkFlags(int flagMask) {
+        return ((flags & flagMask) != 0);
+    }
+    public boolean getCredDelegState() {
+        return checkFlags(GSS_C_DELEG_FLAG);
+    }
+    public boolean getMutualAuthState() {
+        return checkFlags(GSS_C_MUTUAL_FLAG);
+    }
+    public boolean getReplayDetState() {
+        return checkFlags(GSS_C_REPLAY_FLAG);
+    }
+    public boolean getSequenceDetState() {
+        return checkFlags(GSS_C_SEQUENCE_FLAG);
+    }
+    public boolean getAnonymityState() {
+        return checkFlags(GSS_C_ANON_FLAG);
+    }
+    public boolean isTransferable() throws GSSException {
+        return checkFlags(GSS_C_TRANS_FLAG);
+    }
+    public boolean isProtReady() {
+        return checkFlags(GSS_C_PROT_READY_FLAG);
+    }
+    public boolean getConfState() {
+        return checkFlags(GSS_C_CONF_FLAG);
+    }
+    public boolean getIntegState() {
+        return checkFlags(GSS_C_INTEG_FLAG);
+    }
+    public boolean getDelegPolicyState() {
+        return false;
+    }
+    public int getLifetime() {
+        return cStub.getContextTime(pContext);
+    }
+    public GSSNameSpi getSrcName() throws GSSException {
+        return srcName;
+    }
+    public GSSNameSpi getTargName() throws GSSException {
+        return targetName;
+    }
+    public Oid getMech() throws GSSException {
+        if (isEstablished && actualMech != null) {
+            return actualMech;
+        } else {
+            return cStub.getMech();
+        }
+    }
+    public GSSCredentialSpi getDelegCred() throws GSSException {
+        return delegatedCred;
+    }
+    public boolean isInitiator() {
+        return isInitiator;
+    }
+
+    protected void finalize() throws Throwable {
+        dispose();
+    }
+
+    public Object inquireSecContext(InquireType type)
+            throws GSSException {
+        throw new GSSException(GSSException.UNAVAILABLE, -1,
+                "Inquire type not supported.");
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/NativeGSSFactory.java

@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.jgss.wrapper;
+
+import java.io.UnsupportedEncodingException;
+import java.security.Provider;
+import java.util.Vector;
+import org.ietf.jgss.*;
+import sun.security.jgss.GSSUtil;
+import sun.security.jgss.GSSCaller;
+import sun.security.jgss.GSSExceptionImpl;
+import sun.security.jgss.spi.*;
+
+/**
+ * JGSS plugin for generic mechanisms provided through native GSS framework.
+ *
+ * @author Valerie Peng
+ */
+
+public final class NativeGSSFactory implements MechanismFactory {
+
+    GSSLibStub cStub = null;
+    private final GSSCaller caller;
+
+    private GSSCredElement getCredFromSubject(GSSNameElement name,
+                                              boolean initiate)
+        throws GSSException {
+        Oid mech = cStub.getMech();
+        Vector<GSSCredElement> creds = GSSUtil.searchSubject
+            (name, mech, initiate, GSSCredElement.class);
+
+        // If Subject is present but no native creds available
+        if (creds != null && creds.isEmpty()) {
+            if (GSSUtil.useSubjectCredsOnly(caller)) {
+                throw new GSSException(GSSException.NO_CRED);
+            }
+        }
+
+        GSSCredElement result = ((creds == null || creds.isEmpty()) ?
+                                 null : creds.firstElement());
+        // Force permission check before returning the cred to caller
+        if (result != null) {
+            result.doServicePermCheck();
+        }
+        return result;
+    }
+
+    public NativeGSSFactory(GSSCaller caller) {
+        this.caller = caller;
+        // Have to call setMech(Oid) explicitly before calling other
+        // methods. Otherwise, NPE may be thrown unexpectantly
+    }
+
+    public void setMech(Oid mech) throws GSSException {
+        cStub = GSSLibStub.getInstance(mech);
+    }
+
+    public GSSNameSpi getNameElement(String nameStr, Oid nameType)
+        throws GSSException {
+        try {
+            byte[] nameBytes =
+                (nameStr == null ? null : nameStr.getBytes("UTF-8"));
+            return new GSSNameElement(nameBytes, nameType, cStub);
+        } catch (UnsupportedEncodingException uee) {
+            // Shouldn't happen
+            throw new GSSExceptionImpl(GSSException.FAILURE, uee);
+        }
+    }
+
+    public GSSNameSpi getNameElement(byte[] name, Oid nameType)
+        throws GSSException {
+        return new GSSNameElement(name, nameType, cStub);
+    }
+
+    public GSSCredentialSpi getCredentialElement(GSSNameSpi name,
+                                                 int initLifetime,
+                                                 int acceptLifetime,
+                                                 int usage)
+        throws GSSException {
+        GSSNameElement nname = null;
+        if (name != null && !(name instanceof GSSNameElement)) {
+            nname = (GSSNameElement)
+                getNameElement(name.toString(), name.getStringNameType());
+        } else nname = (GSSNameElement) name;
+
+        if (usage == GSSCredential.INITIATE_AND_ACCEPT) {
+            // Force separate acqusition of cred element since
+            // MIT's impl does not correctly report NO_CRED error.
+            usage = GSSCredential.INITIATE_ONLY;
+        }
+
+        GSSCredElement credElement =
+            getCredFromSubject(nname, (usage == GSSCredential.INITIATE_ONLY));
+
+        if (credElement == null) {
+            // No cred in the Subject
+            if (usage == GSSCredential.INITIATE_ONLY) {
+                credElement = new GSSCredElement(nname, initLifetime,
+                                                 usage, cStub);
+            } else if (usage == GSSCredential.ACCEPT_ONLY) {
+                if (nname == null) {
+                    nname = GSSNameElement.DEF_ACCEPTOR;
+                }
+                credElement = new GSSCredElement(nname, acceptLifetime,
+                                                 usage, cStub);
+            } else {
+                throw new GSSException(GSSException.FAILURE, -1,
+                                       "Unknown usage mode requested");
+            }
+        }
+        return credElement;
+    }
+
+    public GSSContextSpi getMechanismContext(GSSNameSpi peer,
+                                             GSSCredentialSpi myCred,
+                                             int lifetime)
+        throws GSSException {
+        if (peer == null) {
+            throw new GSSException(GSSException.BAD_NAME);
+        } else if (!(peer instanceof GSSNameElement)) {
+            peer = (GSSNameElement)
+                getNameElement(peer.toString(), peer.getStringNameType());
+        }
+        if (myCred == null) {
+            myCred = getCredFromSubject(null, true);
+        } else if (!(myCred instanceof GSSCredElement)) {
+            throw new GSSException(GSSException.NO_CRED);
+        }
+        return new NativeGSSContext((GSSNameElement) peer,
+                                     (GSSCredElement) myCred,
+                                     lifetime, cStub);
+    }
+
+    public GSSContextSpi getMechanismContext(GSSCredentialSpi myCred)
+        throws GSSException {
+        if (myCred == null) {
+            myCred = getCredFromSubject(null, false);
+        } else if (!(myCred instanceof GSSCredElement)) {
+            throw new GSSException(GSSException.NO_CRED);
+        }
+        return new NativeGSSContext((GSSCredElement) myCred, cStub);
+    }
+
+    public GSSContextSpi getMechanismContext(byte[] exportedContext)
+        throws GSSException {
+        return cStub.importContext(exportedContext);
+    }
+
+    public final Oid getMechanismOid() {
+        return cStub.getMech();
+    }
+
+    public Provider getProvider() {
+        return SunNativeProvider.INSTANCE;
+    }
+
+    public Oid[] getNameTypes() throws GSSException {
+        return cStub.inquireNamesForMech();
+    }
+}

jdkSrc/jdk8/sun/security/jgss/wrapper/SunNativeProvider.java

@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2005, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.jgss.wrapper;
+
+import java.util.HashMap;
+import java.security.Provider;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import org.ietf.jgss.Oid;
+import sun.security.action.PutAllAction;
+
+/**
+ * Defines the Sun NativeGSS provider for plugging in the
+ * native GSS mechanisms to Java GSS.
+ *
+ * List of supported mechanisms depends on the local
+ * machine configuration.
+ *
+ * @author Yu-Ching Valerie Peng
+ */
+
+public final class SunNativeProvider extends Provider {
+
+    private static final long serialVersionUID = -238911724858694204L;
+
+    private static final String NAME = "SunNativeGSS";
+    private static final String INFO = "Sun Native GSS provider";
+    private static final String MF_CLASS =
+        "sun.security.jgss.wrapper.NativeGSSFactory";
+    private static final String LIB_PROP = "sun.security.jgss.lib";
+    private static final String DEBUG_PROP = "sun.security.nativegss.debug";
+    private static HashMap<String, String> MECH_MAP;
+    static final Provider INSTANCE = new SunNativeProvider();
+    static boolean DEBUG;
+    static void debug(String message) {
+        if (DEBUG) {
+            if (message == null) {
+                throw new NullPointerException();
+            }
+            System.out.println(NAME + ": " + message);
+        }
+    }
+
+    static {
+        MECH_MAP =
+            AccessController.doPrivileged(
+                new PrivilegedAction<HashMap<String, String>>() {
+                    public HashMap<String, String> run() {
+                        DEBUG = Boolean.parseBoolean
+                            (System.getProperty(DEBUG_PROP));
+                        try {
+                            System.loadLibrary("j2gss");
+                        } catch (Error err) {
+                            debug("No j2gss library found!");
+                            if (DEBUG) err.printStackTrace();
+                            return null;
+                        }
+                        String gssLibs[];
+                        String defaultLib = System.getProperty(LIB_PROP);
+                        if (defaultLib == null || defaultLib.trim().equals("")) {
+                            String osname = System.getProperty("os.name");
+                            if (osname.startsWith("SunOS")) {
+                                gssLibs = new String[]{ "libgss.so" };
+                            } else if (osname.startsWith("Linux")) {
+                                gssLibs = new String[]{
+                                    "libgssapi.so",
+                                    "libgssapi_krb5.so",
+                                    "libgssapi_krb5.so.2",
+                                };
+                            } else if (osname.contains("OS X")) {
+                                gssLibs = new String[]{
+                                    "libgssapi_krb5.dylib",
+                                    "/usr/lib/sasl2/libgssapiv2.2.so",
+                               };
+                            } else if (osname.contains("Windows")) {
+                                // Full path needed, DLL is in jre/bin
+                                gssLibs = new String[]{ System.getProperty("java.home")
+                                        + "\\bin\\sspi_bridge.dll" };
+                            } else {
+                                gssLibs = new String[0];
+                            }
+                        } else {
+                            gssLibs = new String[]{ defaultLib };
+                        }
+                        for (String libName: gssLibs) {
+                            if (GSSLibStub.init(libName, DEBUG)) {
+                                debug("Loaded GSS library: " + libName);
+                                Oid[] mechs = GSSLibStub.indicateMechs();
+                                HashMap<String,String> map = new HashMap<>();
+                                for (int i = 0; i < mechs.length; i++) {
+                                    debug("Native MF for " + mechs[i]);
+                                    map.put("GssApiMechanism." + mechs[i],
+                                            MF_CLASS);
+                                }
+                                return map;
+                            }
+                        }
+                        return null;
+                    }
+                });
+    }
+
+    public SunNativeProvider() {
+        /* We are the Sun NativeGSS provider */
+        super(NAME, 1.8d, INFO);
+
+        if (MECH_MAP != null) {
+            AccessController.doPrivileged(new PutAllAction(this, MECH_MAP));
+        }
+    }
+}