1 /*

     2  * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 7110803 8170732

    27  * @summary SASL service for multiple hostnames

    28  * @compile -XDignore.symbol.file SaslBasic.java

    29  * @run main/othervm SaslBasic bound auth-int

    30  * @run main/othervm SaslBasic unbound auth-conf

    31  * @run main/othervm SaslBasic bound auth

    32  */

    33 import java.io.IOException;

    34 import java.util.Arrays;

    35 import java.util.HashMap;

    36 import javax.security.auth.callback.Callback;

    37 import javax.security.auth.callback.CallbackHandler;

    38 import javax.security.auth.callback.UnsupportedCallbackException;

    39 import javax.security.sasl.*;

    40 

    41 // The basic krb5 test skeleton you can copy from

    42 public class SaslBasic {

    43 

    44     public static void main(String[] args) throws Exception {

    45 

    46         boolean bound = args[0].equals("bound");

    47         String name = "host." + OneKDC.REALM_LOWER_CASE;

    48 

    49         new OneKDC(null).writeJAASConf();

    50         System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

    51 

    52         HashMap clntprops = new HashMap();

    53         clntprops.put(Sasl.QOP, args[1]);

    54         SaslClient sc = Sasl.createSaslClient(

    55                 new String[]{"GSSAPI"}, null, "server",

    56                 name, clntprops, null);

    57 

    58         final HashMap srvprops = new HashMap();

    59         srvprops.put(Sasl.QOP, "auth,auth-int,auth-conf");

    60         SaslServer ss = Sasl.createSaslServer("GSSAPI", "server",

    61                 bound? name: null, srvprops,

    62                 new CallbackHandler() {

    63                     public void handle(Callback[] callbacks)

    64                             throws IOException, UnsupportedCallbackException {

    65                         for (Callback cb : callbacks) {

    66                             if (cb instanceof RealmCallback) {

    67                                 ((RealmCallback) cb).setText(OneKDC.REALM);

    68                             } else if (cb instanceof AuthorizeCallback) {

    69                                 ((AuthorizeCallback) cb).setAuthorized(true);

    70                             }

    71                         }

    72                     }

    73                 });

    74 

    75         byte[] token = new byte[0];

    76         byte[] lastClientToken = null;

    77         while (!sc.isComplete() || !ss.isComplete()) {

    78             if (!sc.isComplete()) {

    79                 token = sc.evaluateChallenge(token);

    80                 lastClientToken = token;

    81             }

    82             if (!ss.isComplete()) {

    83                 token = ss.evaluateResponse(token);

    84             }

    85         }

    86         if (!bound) {

    87             String boundName = (String)ss.getNegotiatedProperty(

    88                     Sasl.BOUND_SERVER_NAME);

    89             if (!boundName.equals(name)) {

    90                 throw new Exception("Wrong bound server name");

    91             }

    92         }

    93         Object key = ss.getNegotiatedProperty(

    94                 "com.sun.security.jgss.inquiretype.krb5_get_session_key");

    95         if (key == null) {

    96             throw new Exception("Extended negotiated property not read");

    97         }

    98 

    99         if (args[1].equals("auth")) {

   100             // 8170732. These are the maximum size bytes after jgss/krb5 wrap.

   101             if (lastClientToken[17] != 0 || lastClientToken[18] != 0

   102                     || lastClientToken[19] != 0) {

   103                 throw new Exception("maximum size for auth must be 0");

   104             }

   105         } else {

   106             byte[] hello = "hello".getBytes();

   107             token = sc.wrap(hello, 0, hello.length);

   108             token = ss.unwrap(token, 0, token.length);

   109             if (!Arrays.equals(hello, token)) {

   110                 throw new Exception("Message altered");

   111             }

   112         }

   113     }

   114 }