1 /*

     2  * Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 8038089 8194486

    27  * @summary TLS optional support for Kerberos cipher suites needs to be re-examined

    28  * @library ../../../../java/security/testlibrary/ /test/lib

    29  * @run main jdk.test.lib.FileInstaller TestHosts TestHosts

    30  * @run main/othervm -Djdk.net.hosts.file=TestHosts SSLwithPerms

    31  */

    32 import java.io.*;

    33 import javax.net.ssl.*;

    34 import javax.security.auth.AuthPermission;

    35 import javax.security.auth.kerberos.ServicePermission;

    36 import java.net.SocketPermission;

    37 import java.nio.ByteBuffer;

    38 import java.nio.file.Files;

    39 import java.nio.file.Paths;

    40 import java.security.Principal;

    41 import java.security.Security;

    42 import java.security.SecurityPermission;

    43 import java.util.Collections;

    44 import java.util.Date;

    45 import java.util.List;

    46 import java.util.ArrayList;

    47 import java.util.Locale;

    48 import java.util.PropertyPermission;

    49 

    50 import sun.security.jgss.GSSUtil;

    51 

    52 public class SSLwithPerms {

    53 

    54     static String KRB5_CONF = "krb5.conf";

    55     static String JAAS_CONF = "jaas.conf";

    56     static String REALM = "REALM";

    57     static String KTAB = "ktab";

    58     static String HOST = "host." + REALM.toLowerCase(Locale.US);

    59     static String SERVER = "host/" + HOST;

    60     static String USER = "user";

    61     static char[] PASS = "password".toCharArray();

    62 

    63     public static void main(String[] args) throws Exception {

    64 

    65         Security.setProperty("jdk.tls.disabledAlgorithms", "");

    66         if (args.length == 0) {

    67             KDC kdc = KDC.create(REALM, HOST, 0, true);

    68 

    69             kdc.addPrincipal(USER, PASS);

    70             kdc.addPrincipalRandKey("krbtgt/" + REALM);

    71             kdc.addPrincipalRandKey(SERVER);

    72             KDC.saveConfig(KRB5_CONF, kdc);

    73             kdc.writeKtab(KTAB);

    74 

    75             File f = new File(JAAS_CONF);

    76             FileOutputStream fos = new FileOutputStream(f);

    77             fos.write((

    78                     "ssl {\n" +

    79                             "    com.sun.security.auth.module.Krb5LoginModule required\n" +

    80                             "    principal=\"" + SERVER + "\"\n" +

    81                             "    useKeyTab=true\n" +

    82                             "    keyTab=" + KTAB + "\n" +

    83                             "    isInitiator=false\n" +

    84                             "    storeKey=true;\n};\n"

    85             ).getBytes());

    86             fos.close();

    87 

    88             String hostsFileName = System.getProperty("test.src", ".") + "/TestHosts";

    89 

    90             Proc pc = Proc.create("SSLwithPerms")

    91                     .args("client")

    92                     .inheritIO()

    93                     .prop("java.security.manager", "")

    94                     .prop("java.security.krb5.conf", KRB5_CONF)

    95                     .prop("jdk.net.hosts.file", hostsFileName)

    96                     .prop("javax.net.ssl", "handshake")

    97                     .prop("sun.security.krb5.debug", "true")

    98                     .perm(new SecurityPermission("setProperty.jdk.tls.disabledAlgorithms"))

    99                     .perm(new java.util.PropertyPermission("user.name", "read"))

   100                     .perm(new PropertyPermission("sun.security.krb5.principal", "read"))

   101                     .perm(new FilePermission("port", "read"))

   102                     .perm(new FilePermission(hostsFileName, "read"))

   103                     .perm(new FilePermission(KTAB, "read"))

   104                     .perm(new AuthPermission("modifyPrincipals"))

   105                     .perm(new AuthPermission("modifyPrivateCredentials"))

   106                     .perm(new AuthPermission("doAs"))

   107                     .perm(new SocketPermission("127.0.0.1", "connect"))

   108                     .perm(new ServicePermission("host/host.realm@REALM", "initiate"))

   109                     .start();

   110 

   111             Proc ps = Proc.create("SSLwithPerms")

   112                     .args("server")

   113                     .inheritIO()

   114                     .prop("java.security.manager", "")

   115                     .prop("java.security.krb5.conf", KRB5_CONF)

   116                     .prop("java.security.auth.login.config", JAAS_CONF)

   117                     .prop("jdk.net.hosts.file", hostsFileName)

   118                     .prop("javax.net.ssl", "handshake")

   119                     .prop("sun.security.krb5.debug", "true")

   120                     .perm(new SecurityPermission("setProperty.jdk.tls.disabledAlgorithms"))

   121                     .perm(new AuthPermission("createLoginContext.ssl"))

   122                     .perm(new AuthPermission("doAs"))

   123                     .perm(new FilePermission(hostsFileName, "read"))

   124                     .perm(new FilePermission("port", "write"))

   125                     .perm(new SocketPermission("127.0.0.1", "accept"))

   126                     .perm(new ServicePermission("host/host.realm@REALM", "accept"))

   127                     .start();

   128 

   129             if (pc.waitFor() != 0) {

   130                 throw new Exception();

   131             }

   132             if (ps.waitFor() != 0) {

   133                 throw new Exception();

   134             }

   135         } else if (args[0].equals("client")) {

   136             Context c;

   137             c = Context.fromUserPass(USER, PASS, false);

   138             c.doAs(new JsseClientAction(), null);

   139         } else if (args[0].equals("server")) {

   140             final Context s = Context.fromJAAS("ssl");

   141             s.doAs(new JsseServerAction(), null);

   142         }

   143     }

   144 

   145     private static class JsseClientAction implements Action {

   146         public byte[] run(Context s, byte[] input) throws Exception {

   147             SSLSocketFactory sslsf =

   148                 (SSLSocketFactory) SSLSocketFactory.getDefault();

   149             while (!Files.exists(Paths.get("port"))) {

   150                 Thread.sleep(100);

   151             }

   152             int port = ByteBuffer.allocate(4)

   153                     .put(Files.readAllBytes(Paths.get("port"))).getInt(0);

   154             System.out.println("Connecting " + SERVER + ":" + port);

   155             SSLSocket sslSocket = (SSLSocket) sslsf.createSocket(HOST, port);

   156 

   157             // Enable only a KRB5 cipher suite.

   158             String enabledSuites[] = {"TLS_KRB5_WITH_RC4_128_SHA"};

   159             sslSocket.setEnabledCipherSuites(enabledSuites);

   160 

   161             SSLParameters params = sslSocket.getSSLParameters();

   162             params.setServerNames(Collections.singletonList(new SNIHostName(HOST)));

   163             sslSocket.setSSLParameters(params);

   164 

   165             BufferedReader in = new BufferedReader(new InputStreamReader(

   166                 sslSocket.getInputStream()));

   167             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(

   168                 sslSocket.getOutputStream()));

   169 

   170             String outStr = "Hello There!\n";

   171             out.write(outStr);

   172             out.flush();

   173             System.out.print("Sending " + outStr);

   174 

   175             String inStr = in.readLine();

   176             System.out.println("Received " + inStr);

   177 

   178             String cipherSuiteChosen = sslSocket.getSession().getCipherSuite();

   179             System.out.println("Cipher suite in use: " + cipherSuiteChosen);

   180             Principal self = sslSocket.getSession().getLocalPrincipal();

   181             System.out.println("I am: " + self.toString());

   182             Principal peer = sslSocket.getSession().getPeerPrincipal();

   183             System.out.println("Server is: " + peer.toString());

   184 

   185             sslSocket.close();

   186             return null;

   187         }

   188     }

   189 

   190     private static class JsseServerAction implements Action {

   191         public byte[] run(Context s, byte[] input) throws Exception {

   192             SSLServerSocketFactory sslssf =

   193                 (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();

   194             SSLServerSocket sslServerSocket =

   195                 (SSLServerSocket) sslssf.createServerSocket(0); // any port

   196             int port = sslServerSocket.getLocalPort();

   197             System.out.println("Listening on " + port);

   198 

   199             String enabledSuites[] = {"TLS_KRB5_WITH_RC4_128_SHA"};

   200             sslServerSocket.setEnabledCipherSuites(enabledSuites);

   201 

   202             Files.write(Paths.get("port"), ByteBuffer.allocate(4).putInt(port).array());

   203             System.out.println("Waiting for incoming connection...");

   204 

   205             SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();

   206 

   207             System.out.println("Got connection from client "

   208                 + sslSocket.getInetAddress());

   209 

   210             BufferedReader in = new BufferedReader(new InputStreamReader(

   211                 sslSocket.getInputStream()));

   212             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(

   213                 sslSocket.getOutputStream()));

   214 

   215             String inStr = in.readLine();

   216             System.out.println("Received " + inStr);

   217 

   218             String outStr = inStr + " " + new Date().toString() + "\n";

   219             out.write(outStr);

   220             System.out.println("Sending " + outStr);

   221             out.flush();

   222 

   223             String cipherSuiteChosen =

   224                 sslSocket.getSession().getCipherSuite();

   225             System.out.println("Cipher suite in use: " + cipherSuiteChosen);

   226             Principal self = sslSocket.getSession().getLocalPrincipal();

   227             System.out.println("I am: " + self.toString());

   228             Principal peer = sslSocket.getSession().getPeerPrincipal();

   229             System.out.println("Client is: " + peer.toString());

   230 

   231             sslSocket.close();

   232             return null;

   233         }

   234     }

   235 }