https://openjdk.java.net/ 
/*
 * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package org.ietf.jgss;

import java.net.InetAddress;
import java.util.Arrays;


This class encapsulates the concept of caller-provided channel
binding information. Channel bindings are used to strengthen the
quality with which peer entity authentication is provided during
context establishment.  They enable the GSS-API callers to bind the
establishment of the security context to relevant characteristics
like addresses or to application specific data.

The caller initiating the security context must determine the
appropriate channel binding values to set in the GSSContext object.
The acceptor must provide an identical binding in order to validate
that received tokens possess correct channel-related characteristics.
 Use of channel bindings is optional in GSS-API. ChannelBinding can be set for the GSSContext using the setChannelBinding method before the first call to 
initSecContext or 
acceptSecContext has been performed. Unless the setChannelBinding
method has been used to set the ChannelBinding for a GSSContext object,
null ChannelBinding will be assumed. 

Conceptually, the GSS-API concatenates the initiator and acceptor
address information, and the application supplied byte array to form an
octet string.  The mechanism calculates a MIC over this octet string and
binds the MIC to the context establishment token emitted by
initSecContext method of the GSSContext
interface.  The same bindings are set by the context acceptor for its
GSSContext object and during processing of the
acceptSecContext method a MIC is calculated in the same
way. The calculated MIC is compared with that found in the token, and if
the MICs differ, accept will throw a GSSException with the major code set to BAD_BINDINGS, and the context will not be established. Some mechanisms may include the actual channel binding data in the token (rather than just a MIC); applications should therefore not use confidential data as channel-binding components.

 Individual mechanisms may impose additional constraints on addresses
 that may appear in channel bindings.  For example, a mechanism may
 verify that the initiator address field of the channel binding
 contains the correct network address of the host system.  Portable
 applications should therefore ensure that they either provide correct
 information for the address fields, or omit setting of the addressing
 information.

Author:Mayank Upadhyay
Since:1.4
/**
 * This class encapsulates the concept of caller-provided channel
 * binding information. Channel bindings are used to strengthen the
 * quality with which peer entity authentication is provided during
 * context establishment.  They enable the GSS-API callers to bind the
 * establishment of the security context to relevant characteristics
 * like addresses or to application specific data.<p>
 *
 * The caller initiating the security context must determine the
 * appropriate channel binding values to set in the GSSContext object.
 * The acceptor must provide an identical binding in order to validate
 * that received tokens possess correct channel-related characteristics.<p>
 *
 * Use of channel bindings is optional in GSS-API. ChannelBinding can be
 * set for the {@link GSSContext GSSContext} using the {@link
 * GSSContext#setChannelBinding(ChannelBinding) setChannelBinding} method
 * before the first call to {@link GSSContext#initSecContext(byte[], int, int)
 * initSecContext} or {@link GSSContext#acceptSecContext(byte[], int, int)
 * acceptSecContext} has been performed.  Unless the <code>setChannelBinding</code>
 * method has been used to set the ChannelBinding for a GSSContext object,
 * <code>null</code> ChannelBinding will be assumed. <p>
 *
 * Conceptually, the GSS-API concatenates the initiator and acceptor
 * address information, and the application supplied byte array to form an
 * octet string.  The mechanism calculates a MIC over this octet string and
 * binds the MIC to the context establishment token emitted by
 * <code>initSecContext</code> method of the <code>GSSContext</code>
 * interface.  The same bindings are set by the context acceptor for its
 * <code>GSSContext</code> object and during processing of the
 * <code>acceptSecContext</code> method a MIC is calculated in the same
 * way. The calculated MIC is compared with that found in the token, and if
 * the MICs differ, accept will throw a <code>GSSException</code> with the
 * major code set to {@link GSSException#BAD_BINDINGS BAD_BINDINGS}, and
 * the context will not be established. Some mechanisms may include the
 * actual channel binding data in the token (rather than just a MIC);
 * applications should therefore not use confidential data as
 * channel-binding components.<p>
 *
 *  Individual mechanisms may impose additional constraints on addresses
 *  that may appear in channel bindings.  For example, a mechanism may
 *  verify that the initiator address field of the channel binding
 *  contains the correct network address of the host system.  Portable
 *  applications should therefore ensure that they either provide correct
 *  information for the address fields, or omit setting of the addressing
 *  information.
 *
 * @author Mayank Upadhyay
 * @since 1.4
 */
public class ChannelBinding {

    private InetAddress initiator;
    private InetAddress acceptor;
    private  byte[] appData;

    
Create a ChannelBinding object with user supplied address information
and data.  null values can be used for any fields which the
application does not want to specify.

Params:
  • initAddr – the address of the context initiator.
null value can be supplied to indicate that the
application does not want to set this value.
  • acceptAddr – the address of the context
acceptor. null value can be supplied to indicate that
the application does not want to set this value.
  • appData – application supplied data to be used as part of the
channel bindings. null value can be supplied to
indicate that the application does not want to set this value.
/**
     * Create a ChannelBinding object with user supplied address information
     * and data.  <code>null</code> values can be used for any fields which the
     * application does not want to specify.
     *
     * @param initAddr the address of the context initiator.
     * <code>null</code> value can be supplied to indicate that the
     * application does not want to set this value.
     * @param acceptAddr the address of the context
     * acceptor. <code>null</code> value can be supplied to indicate that
     * the application does not want to set this value.
     * @param appData application supplied data to be used as part of the
     * channel bindings. <code>null</code> value can be supplied to
     * indicate that the application does not want to set this value.
     */
    public ChannelBinding(InetAddress initAddr, InetAddress acceptAddr,
                        byte[] appData) {

        initiator = initAddr;
        acceptor = acceptAddr;

        if (appData != null) {
            this.appData = new byte[appData.length];
            java.lang.System.arraycopy(appData, 0, this.appData, 0,
                                appData.length);
        }
    }

    
Creates a ChannelBinding object without any addressing information.

Params:
  • appData – application supplied data to be used as part of the
channel bindings.
/**
     * Creates a ChannelBinding object without any addressing information.
     *
     * @param appData application supplied data to be used as part of the
     * channel bindings.
     */
    public ChannelBinding(byte[] appData) {
        this(null, null, appData);
    }

    
Get the initiator's address for this channel binding.

Returns:the initiator's address. null is returned if
the address has not been set.
/**
     * Get the initiator's address for this channel binding.
     *
     * @return the initiator's address. <code>null</code> is returned if
     * the address has not been set.
     */
    public InetAddress getInitiatorAddress() {
        return initiator;
    }

    
Get the acceptor's address for this channel binding.

Returns:the acceptor's address. null is returned if the address has
not been set.
/**
     * Get the acceptor's address for this channel binding.
     *
     * @return the acceptor's address. null is returned if the address has
     * not been set.
     */
    public InetAddress getAcceptorAddress() {
        return acceptor;
    }

    
Get the application specified data for this channel binding.

Returns:the application data being used as part of the
ChannelBinding. null is returned if no application data
has been specified for the channel binding.
/**
     * Get the application specified data for this channel binding.
     *
     * @return the application data being used as part of the
     * ChannelBinding. <code>null</code> is returned if no application data
     * has been specified for the channel binding.
     */
    public byte[] getApplicationData() {

        if (appData == null) {
            return null;
        }

        byte[] retVal = new byte[appData.length];
        System.arraycopy(appData, 0, retVal, 0, appData.length);
        return retVal;
    }

    
Compares two instances of ChannelBinding.

Params:
  • obj – another ChannelBinding to compare this one with
Returns:true if the two ChannelBinding's contain
the same values for the initiator and acceptor addresses and the
application data.
/**
     * Compares two instances of ChannelBinding.
     *
     * @param obj another ChannelBinding to compare this one with
     * @return true if the two ChannelBinding's contain
     * the same values for the initiator and acceptor addresses and the
     * application data.
     */
    public boolean equals(Object obj) {

        if (this == obj)
            return true;

        if (! (obj instanceof ChannelBinding))
            return false;

        ChannelBinding cb = (ChannelBinding) obj;

        if ((initiator != null && cb.initiator == null) ||
            (initiator == null && cb.initiator != null))
            return false;

        if (initiator != null && !initiator.equals(cb.initiator))
            return false;

        if ((acceptor != null && cb.acceptor == null) ||
            (acceptor == null && cb.acceptor != null))
            return false;

        if (acceptor != null && !acceptor.equals(cb.acceptor))
            return false;

        return Arrays.equals(appData, cb.appData);
    }

    
Returns a hashcode value for this ChannelBinding object.

Returns:a hashCode value
/**
     * Returns a hashcode value for this ChannelBinding object.
     *
     * @return a hashCode value
     */
    public int hashCode() {
        if (initiator != null)
            return initiator.hashCode();
        else if (acceptor != null)
            return acceptor.hashCode();
        else if (appData != null)
            return new String(appData).hashCode();
        else
            return 1;
    }
}