kerberos 长连接验证

浅浅的花香味﹌ 2022-08-31 11:18 581阅读 0赞

# 一. 前言 #

## 1.1. 背景 ##

由于kerberos的ticket存在时间周期,当ticket过期会导致服务不可用,  
为避免因为kerberos认证对业务造成不可控影响,所以对这种方式进行验证.

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3poYW5nbG9uZ180NDQ0_size_16_color_FFFFFF_t_70]

## 1.2. 概念 ##

Kerberos ticket 有两种生命周期，ticket timelife (票据生命周期) 和 renewable lifetime (可再生周期)。

1.  当 ticket lifetime 结束时，该 ticket 将不再可用。
2.  如果 renewable lifetime > ticket lifetime ，那么在票据生命周期内都可以其进行续期，直到达到可再生周期的上限。
3.  当时间达到 renewable lifetime 后，ticket lifetime结束后将不能继续续期，续期时将会报错 KDC can’t fulfill requested option while renewing credentials，之后需要重新申请新的 ticket。
4.  在安全性方面，与使用较长的生命周期的票据相比，可再生票据的优点是KDC可以拒绝续期请求(例如，如果发现帐户被破坏，并且可再生票据可能在攻击者手中)。
5.  可再生周期和 keytabs 无关，如果你没有修改 key 和 principal 的关系，keytabs 将不用关心。

例如:

*  ticket\_lifetime = 1d
 *  renew\_lifetime = 7d

1.  在登陆后的24h内可以对ticket进行续期，直到第一次登陆的7天后将不再允许续期。
2.  在24h内如果没有续期，将无法续期。
3.  对 ticket 进行一次续期后，ticket\_lifetime 将恢复到24h。

# 二.环境约束 #

## 2.1. 环境版本信息 ##

1.  操作系统 : Centos 7
2.  kerberos版本: Kerberos V5
3.  jdk版本: 1.8
4.  验证长连接服务 : zookeeper 3.4.8

## 2.2. krb5.conf 配置 ##

[root@master01 ~]# more /etc/krb5.conf
    # Configuration snippets may be placed in this directory as well
    includedir /etc/krb5.conf.d/
    
    [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log
    
    [libdefaults]
     dns_lookup_realm = false
     # 凭证生效的时限，设置为1天。
     ticket_lifetime = 24h
     # 凭证最长可以被延期的时限，一般为7天。当凭证过期之后，对安全认证的服务的后续访问则会失败。
     renew_lifetime = 7d
     # 如果此参数被设置为true，则可以转发票据，这意味着如果具有TGT的用户登陆到远程系统，则KDC可以颁发新的TGT，而不需要用户再次进行身份验证。
     forwardable = true
     rdns = false
     pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
     # 配置默认realm
     default_realm = EXAMPLE.COM
    # default_ccache_name 一定要注释掉!!! 否者hadoop指令会报错:
    # default_ccache_name = KEYRING:persistent:%{uid}
    
    [realms]
     # 域特定的信息，例如域的Kerberos服务器的位置。可能有几个，每个域一个。
     
     # 可以为KDC和管理服务器指定一个端口。如果没有配置，
     # 则KDC使用端口88，管理服务器使用749。
     EXAMPLE.COM = { 
       kdc = master01:88
       admin_server = master01:789
     }
    
    [domain_realm]
     .example.com = EXAMPLE.COM
     example.com = EXAMPLE.COM

## 2.3. 测试凭证清单 ##

*  ZK 服务账号

kadmin.local -q "addprinc -randkey zookeeper/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/zookeeper.keytab zookeeper/master01@EXAMPLE.COM "
    
    
    kadmin.local -q "addprinc -randkey zkcli/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/zkcli.keytab zkcli/master01@EXAMPLE.COM "

*  测试账号

kadmin.local -q "addprinc -randkey test01/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/test01.keytab test01/master01@EXAMPLE.COM "
    
    kadmin.local -q "addprinc -randkey test02/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/test02.keytab test02/master01@EXAMPLE.COM "
    
    kadmin.local -q "addprinc -randkey test03/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/test03.keytab test03/master01@EXAMPLE.COM "
    
    kadmin.local -q "addprinc -randkey test04/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/test04.keytab test04/master01@EXAMPLE.COM "
    
    kadmin.local -q "addprinc -randkey test05/master01@EXAMPLE.COM "
    kadmin.local -q "xst -k /opt/keytab/test05.keytab test05/master01@EXAMPLE.COM "

*  同步keytab文件

scp /opt/keytab/* sysadmin@mac:/opt/keytab/

## 2.3. kerberos服务操作指令 ##

*  启动KDC服务器

# 启用krb5kdc
    systemctl enable krb5kdc 
    
    # 重启
    systemctl restart krb5kdc 
    
    # 启动
    systemctl start krb5kdc 
    
    # 停止
    systemctl stop krb5kdc 
    
    #查看状态
    systemctl status krb5kdc
    
    #设置为开机启动
    systemctl enable krb5kdc.service

*  启动kadmin服务

# 启用kadmin
    systemctl enable kadmin 
    
    # 重启
    systemctl restart kadmin 
    
    # 启动
    systemctl start kadmin 
    
    # 停止
    systemctl stop kadmin 
    
    #查看状态
    systemctl status kadmin
    
    
    #设置为开机启动
    systemctl enable kadmin.service

## 2.3. Krb5LoginModule 参数设置 ##

参数参考:  
https://docs.oracle.com/javase/8/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html

# 三. 结果汇总 #

代码解决方案参考Zookeeper的代码 org.apache.zookeeper.Login .

这里的`createCuratorFrameworkClient`返回的是CuratorFramework客户端, 实际上可以采用匿名模式直接访问/读写 开启kerberos的zookeeper. 不需要通过kerberos认证. 所以可以参考`createCuratorFrameworkClient`的方式去建立客户端 , 如果是长连接的话, 注意要开启ticket的刷新线程 `KerberosClientProxy#startAutoRenew`

## 3.1.1 测试代码 ##

package com.jaas;
    
    import org.apache.curator.framework.CuratorFramework;
    import org.apache.curator.framework.CuratorFrameworkFactory;
    import org.apache.curator.framework.api.ACLProvider;
    import org.apache.curator.retry.ExponentialBackoffRetry;
    import org.apache.zookeeper.ZooDefs;
    import org.apache.zookeeper.ZooDefs.Perms;
    import org.apache.zookeeper.data.ACL;
    import org.apache.zookeeper.data.Id;
    import org.apache.zookeeper.data.Stat;
    
    import java.util.ArrayList;
    import java.util.List;
    import java.util.Set;
    import java.util.concurrent.TimeUnit;
    
    import javax.security.auth.kerberos.KerberosTicket;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    /** * 开启acl之后, 验证zk连接是否正常 * * @author sysadmin */
    public class ZookeeperAclClient { 
    
        private static final Logger logger = LoggerFactory.getLogger(ZookeeperAclClient.class);
    
        public static void main(String[] args) throws Exception { 
            // 设置krb5.conf文件地址
            System.setProperty("java.security.krb5.conf", KerberosOptions.TEST_KRB5_CONF_FILE);
    // System.setProperty("sun.security.krb5.debug", "true");
    
            String zkUserPwd = "admin:azadmin";
    
            ACLProvider aclProvider = new ACLProvider() { 
                private List<ACL> acl;
    
                @Override
                public List<ACL> getDefaultAcl() { 
                    if (acl == null) { 
                        ArrayList<ACL> acl = ZooDefs.Ids.CREATOR_ALL_ACL;
                        acl.clear();
                        acl.add(new ACL(Perms.ALL, new Id("auth", zkUserPwd)));
                        this.acl = acl;
                    }
                    return acl;
                }
    
                @Override
                public List<ACL> getAclForPath(String path) { 
                    return acl;
                }
            };
    
            String scheme = "digest";
            byte[] auth = zkUserPwd.getBytes();
    
            // 构建 CuratorFrameworkFactory.Builder
            // 根据需要自行设置参数.
            CuratorFrameworkFactory.Builder builder = CuratorFrameworkFactory.builder().connectString(KerberosOptions.DEFAULT_ZOOKEEPER_QUORUM)
                    .aclProvider(aclProvider)
                    .authorization(scheme, auth)
                    .retryPolicy(new ExponentialBackoffRetry(KerberosOptions.DEFAULT_ZOOKEEPER_RETRY_BASE_SLEEP,
                            KerberosOptions.DEFAULT_ZOOKEEPER_RETRY_MAXTIME, KerberosOptions.DEFAULT_ZOOKEEPER_RETRY_MAX_SLEEP))
                    .sessionTimeoutMs(KerberosOptions.DEFAULT_ZOOKEEPER_SESSION_TIMEOUT).connectionTimeoutMs(KerberosOptions.DEFAULT_ZOOKEEPER_CONNECTION_TIMEOUT);
    
            KerberosClientProxy kerberosClientProxy = new KerberosClientProxy(KerberosOptions.TEST_PRINCIPAL, KerberosOptions.TEST_KEYTAB_FILE);
            kerberosClientProxy.startAutoRenew();
    
            CuratorFramework curatorClient = kerberosClientProxy.createCuratorFrameworkClient(builder);
    
            long startTime = System.currentTimeMillis();
            while (true) { 
    
                if (null != curatorClient.checkExists().forPath(KerberosOptions.TEST_ZK_DATA_PATH)) { 
                    curatorClient.delete().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                }
                // 以下为测试验证代码.....
                curatorClient.create().forPath(KerberosOptions.TEST_ZK_DATA_PATH, "hello world".getBytes());
                byte[] bs = curatorClient.getData().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                System.out.println("新建的节点,data为: " + new String(bs));
    
                curatorClient.setData().forPath(KerberosOptions.TEST_ZK_DATA_PATH, "hello china".getBytes());
                // 由于是在background模式下获取的data，此时的 bs可能为null
                byte[] bs2 = curatorClient.getData().watched().inBackground().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                if (bs2 == null) { 
                    bs2 = curatorClient.getData().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                }
                System.out.println("新修改的节点,data为: " + new String(bs2 != null ? bs2 : new byte[0]));
    
                curatorClient.delete().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                Stat stat = curatorClient.checkExists().forPath(KerberosOptions.TEST_ZK_DATA_PATH);
                // Stat 就是对zonde所有属性的一个映射， stat=null表示节点不存在！
                System.out.println("删除节点后的状态: " + stat);
    
                Set<KerberosTicket> tickets = kerberosClientProxy.getSubject().getPrivateCredentials(KerberosTicket.class);
                for (KerberosTicket ticket : tickets) { 
                    System.out.println(String.format("client 存活时间: [ %s ] s , AuthTime : [ %s ] , StartTime : [ %s ] , EndTime : [ %s ] ... ",
                            (System.currentTimeMillis() - startTime) / 1000, ticket.getAuthTime(), ticket.getStartTime(), ticket.getEndTime()));
                }
    
                kerberosClientProxy.reLogin();
                TimeUnit.SECONDS.sleep(60);
            }
        }
    
    }

## 3.2. 工具类代码 ##

package com.jaas;
    
    import org.apache.curator.framework.CuratorFramework;
    import org.apache.curator.framework.CuratorFrameworkFactory;
    
    import java.security.Principal;
    import java.security.PrivilegedAction;
    import java.util.Date;
    import java.util.HashMap;
    import java.util.HashSet;
    import java.util.Set;
    import java.util.concurrent.ThreadLocalRandom;
    
    import javax.security.auth.Subject;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.kerberos.KerberosPrincipal;
    import javax.security.auth.kerberos.KerberosTicket;
    import javax.security.auth.login.AppConfigurationEntry;
    import javax.security.auth.login.Configuration;
    import javax.security.auth.login.LoginContext;
    import javax.security.auth.login.LoginException;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    /** * @author sysadmin */
    public class KerberosClientProxy { 
        private static final Logger logger = LoggerFactory.getLogger(KerberosClientProxy.class);
    
        private static final String KERBEROS_LOGIN_CONTEXT_NAME = "Krb5Login";
    
        // LoginThread will sleep until 80% of time from last refresh to
        // ticket's expiry has been reached, at which time it will wake
        // and try to renew the ticket.
        private static final float TICKET_RENEW_WINDOW = 0.80f;
    
        /** * Percentage of random jitter added to the renewal time */
        private static final float TICKET_RENEW_JITTER = 0.05f;
    
    
        // Regardless of TICKET_RENEW_WINDOW setting above and the ticket expiry time,
        // thread will not sleep between refresh attempts any less than 1 minute (60*1000 milliseconds = 1 minute).
        // Change the '1' to e.g. 5, to change this to 5 minutes.
        private static final long MIN_TIME_BEFORE_RELOGIN = 1 * 60 * 1000L;
        public CallbackHandler callbackHandler;
        private Subject subject = null;
        private Thread autoRenewThread = null;
        private LoginContext login = null;
        private String principal = null;
        private String keytabFileFullPath = null;
        // Initialize 'lastLogin' to do a login at first time
        private long lastLogin = currentElapsedTime() - MIN_TIME_BEFORE_RELOGIN;
    
        KerberosClientProxy(String principal, String keytabFileFullPath) throws LoginException { 
            this(principal, keytabFileFullPath, null);
        }
    
        KerberosClientProxy(String principal, String keytabFileFullPath, CallbackHandler callbackHandler) throws LoginException { 
            this.principal = principal;
            this.keytabFileFullPath = keytabFileFullPath;
            this.callbackHandler = callbackHandler;
    
            login = login();
            subject = login.getSubject();
    
            autoRenewThread = new Thread(() -> { 
    
                logger.info("TGT refresh thread started.");
                while (true) {   // renewal thread's main loop. if it exits from here, thread will exit.
                    KerberosTicket tgt = getTGT();
                    long now = currentWallTime();
                    long nextRefresh;
                    Date nextRefreshDate;
                    if (tgt == null) { 
                        nextRefresh = now + MIN_TIME_BEFORE_RELOGIN;
                        nextRefreshDate = new Date(nextRefresh);
                        logger.warn("No TGT found: will try again at {}", nextRefreshDate);
                    } else { 
                        nextRefresh = getRefreshTime(tgt);
                        long expiry = tgt.getEndTime().getTime();
                        Date expiryDate = new Date(expiry);
    
                        // determine how long to sleep from looking at ticket's expiry.
                        // We should not allow the ticket to expire, but we should take into consideration
                        // MIN_TIME_BEFORE_RELOGIN. Will not sleep less than MIN_TIME_BEFORE_RELOGIN, unless doing so
                        // would cause ticket expiration.
                        if ((nextRefresh > expiry) || ((now + MIN_TIME_BEFORE_RELOGIN) > expiry)) { 
                            // expiry is before next scheduled refresh).
                            nextRefresh = now;
                        } else { 
                            if (nextRefresh < (now + MIN_TIME_BEFORE_RELOGIN)) { 
                                // next scheduled refresh is sooner than (now + MIN_TIME_BEFORE_LOGIN).
                                Date until = new Date(nextRefresh);
                                Date newuntil = new Date(now + MIN_TIME_BEFORE_RELOGIN);
                                logger.warn(String.format("TGT refresh thread time adjusted from : {%s} to : {%s} since "
                                                + "the former is sooner than the minimum refresh interval ("
                                                + "{%s} seconds) from now.", until,
                                        newuntil,
                                        (MIN_TIME_BEFORE_RELOGIN / 1000)));
                            }
                            nextRefresh = Math.max(nextRefresh, now + MIN_TIME_BEFORE_RELOGIN);
                        }
                        nextRefreshDate = new Date(nextRefresh);
                        if (nextRefresh > expiry) { 
                            logger.error(
                                    "next refresh: {} is later than expiry {}."
                                            + " This may indicate a clock skew problem."
                                            + " Check that this host and the KDC's "
                                            + "hosts' clocks are in sync. Exiting refresh thread.",
                                    nextRefreshDate,
                                    expiryDate);
                            return;
                        }
                    }
                    if (now == nextRefresh) { 
                        logger.info("refreshing now because expiry is before next scheduled refresh time.");
                    } else if (now < nextRefresh) { 
                        Date until = new Date(nextRefresh);
                        logger.info("TGT refresh sleeping until: {}", until);
                        try { 
                            Thread.sleep(nextRefresh - now);
                        } catch (InterruptedException ie) { 
                            logger.warn("TGT renewal thread has been interrupted and will exit.");
                            break;
                        }
                    } else { 
                        logger.error(
                                "nextRefresh:{} is in the past: exiting refresh thread. Check"
                                        + " clock sync between this host and KDC - (KDC's clock is likely ahead of this host)."
                                        + " Manual intervention will be required for this client to successfully authenticate."
                                        + " Exiting refresh thread.",
                                nextRefreshDate);
                        break;
                    }
                    try { 
                        int retry = 1;
                        while (retry >= 0) { 
                            try { 
                                reLogin();
                                break;
                            } catch (LoginException le) { 
                                if (retry > 0) { 
                                    --retry;
                                    // sleep for 10 seconds.
                                    try { 
                                        Thread.sleep(10 * 1000);
                                    } catch (InterruptedException e) { 
                                        logger.error("Interrupted during login retry after LoginException:", le);
                                        throw le;
                                    }
                                } else { 
                                    logger.error("Could not refresh TGT for principal: {}.", principal, le);
                                }
                            }
                        }
                    } catch (LoginException le) { 
                        logger.error("Failed to refresh TGT: refresh thread exiting now.", le);
                        break;
                    }
                }
            });
            autoRenewThread.setDaemon(true);
        }
        private Configuration getConfiguration() { 
            return new Configuration() { 
                @Override
                public AppConfigurationEntry[] getAppConfigurationEntry(String name) { 
                    HashMap<String, Object> options = new HashMap<String, Object>(16) { 
                        { 
                            put("useTicketCache", "false");
                            put("renewTGT", "false");
                            put("useKeyTab", "true");
                            //Krb5 in GSS API needs to be refreshed so it does not throw the error
                            //Specified version of key is not available
                            put("refreshKrb5Config", "true");
                            put("storeKey", "true");
                            put("doNotPrompt", "true");
                            put("isInitiator", "true");
                            put("principal", principal);
                            put("keyTab", keytabFileFullPath);
                        }
                    };
    
                    return new AppConfigurationEntry[]{ new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
                            AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options)};
                }
            };
        }
    
        private LoginContext login() throws LoginException { 
            Set<Principal> principalSet = new HashSet<>(1);
            principalSet.add(new KerberosPrincipal(this.principal));
            Subject sub = new Subject(false, principalSet, new HashSet<>(), new HashSet<>());
    
            LoginContext login = new LoginContext(KERBEROS_LOGIN_CONTEXT_NAME, sub, callbackHandler, getConfiguration());
            login.login();
            logger.info("{} successfully logged in.", principal);
            return login;
        }
    
        public void startAutoRenew() { 
            autoRenewThread.start();
        }
    
        public Subject getSubject() { 
            return subject;
        }
    
        public String getPrincipal() { 
            return principal;
        }
    
        public void shutdown() { 
            if ((autoRenewThread != null) && (autoRenewThread.isAlive())) { 
                autoRenewThread.interrupt();
                try { 
                    autoRenewThread.join();
                } catch (InterruptedException e) { 
                    logger.warn("error while waiting for Login thread to shutdown.", e);
                }
            }
        }
    
        // c.f. org.apache.hadoop.security.UserGroupInformation.
        private long getRefreshTime(KerberosTicket tgt) { 
            long start = tgt.getStartTime().getTime();
            long expires = tgt.getEndTime().getTime();
            logger.info("TGT valid starting at: {}", tgt.getStartTime().toString());
            logger.info("TGT expires: {}", tgt.getEndTime().toString());
            long proposedRefresh = start + (long) ((expires - start)
                    * (TICKET_RENEW_WINDOW + (TICKET_RENEW_JITTER
                    * ThreadLocalRandom.current().nextDouble())));
            if (proposedRefresh > expires) { 
                // proposedRefresh is too far in the future: it's after ticket expires: simply return now.
                return currentWallTime();
            } else { 
                return proposedRefresh;
            }
        }
    
        private synchronized KerberosTicket getTGT() { 
            Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
            for (KerberosTicket ticket : tickets) { 
                KerberosPrincipal client = ticket.getClient();
                if (client.getName().equals(principal)) { 
                    logger.debug("Client principal is \"{}\".", ticket.getClient().getName());
                    logger.debug("Server principal is \"{}\".", ticket.getServer().getName());
                    return ticket;
                }
            }
            return null;
        }
    
        private boolean hasSufficientTimeElapsed() { 
            long now = currentElapsedTime();
            if (now - getLastLogin() < MIN_TIME_BEFORE_RELOGIN) { 
                logger.warn("Not attempting to re-login since the last re-login was "
                                + "attempted less than {} seconds before.",
                        (MIN_TIME_BEFORE_RELOGIN / 1000));
                return false;
            }
            // register most recent relogin attempt
            setLastLogin(now);
            return true;
        }
    
        /** * Get the time of the last login. * * @return the number of milliseconds since the beginning of time. */
        private long getLastLogin() { 
            return lastLogin;
        }
    
        /** * Set the last login time. * * @param time the number of milliseconds since the beginning of time */
        private void setLastLogin(long time) { 
            lastLogin = time;
        }
    
        /** * Returns login object * * @return login */
        private LoginContext getLogin() { 
            return login;
        }
    
        /** * Set the login object */
        private void setLogin(LoginContext login) { 
            this.login = login;
        }
    
        /** * Re-login a principal. This method assumes that {@link #KerberosClientProxy(String, String)} has happened already. * * @throws javax.security.auth.login.LoginException on a failure */
        // c.f. HADOOP-6559
        public synchronized void reLogin() throws LoginException { 
            LoginContext login = getLogin();
            if (login == null) { 
                throw new LoginException("login must be done first");
            }
            if (!hasSufficientTimeElapsed()) { 
                return;
            }
            logger.debug("Initiating logout for {}", principal);
            synchronized (KerberosClientProxy.class) { 
                //clear up the kerberos state. But the tokens are not cleared! As per
                //the Java kerberos login module code, only the kerberos credentials
                //are cleared
                login.logout();
                //login and also update the subject field of this instance to
                //have the new credentials (pass it to the LoginContext constructor)
    
                login = new LoginContext(KERBEROS_LOGIN_CONTEXT_NAME, getSubject(),callbackHandler,getConfiguration());
                logger.debug("Initiating re-login for {}", principal);
                login.login();
                setLogin(login);
            }
        }
    
    
        public synchronized  CuratorFramework createCuratorFrameworkClient(CuratorFrameworkFactory.Builder builder) { 
            return Subject.doAs(getSubject(), (PrivilegedAction<CuratorFramework>) () -> { 
                try { 
                    CuratorFramework client = builder.build();
                    client.start();
                    logger.info("Start blocking connection ZK .... ");
                    client.blockUntilConnected();
                    logger.info("Connection to ZK succeeded .... ");
                    return client;
                } catch (Exception e) { 
                    e.printStackTrace();
                }
                return null;
            });
        }
    
        /** * Returns time in milliseconds as does System.currentTimeMillis(), * but uses elapsed time from an arbitrary epoch more like System.nanoTime(). * The difference is that if somebody changes the system clock, * currentElapsedTime will change but nanoTime won't. On the other hand, * all of ZK assumes that time is measured in milliseconds. * * @return The time in milliseconds from some arbitrary point in time. */
        public long currentElapsedTime() { 
            return System.nanoTime() / 1000000;
        }
    
        /** * Explicitly returns system dependent current wall time. * * @return Current time in msec. */
        public long currentWallTime() { 
            return System.currentTimeMillis();
        }
    
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3poYW5nbG9uZ180NDQ0_size_16_color_FFFFFF_t_70]: /images/20220829/2ba0d8608e7d466b8d998ec5b3fb2a6d.png