1 /*

     2  * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 8038089

    27  * @summary TLS optional support for Kerberos cipher suites needs to be re-examined

    28  * @library ../../../../java/security/testlibrary/

    29  * @run main/othervm SSLwithPerms

    30  */

    31 import java.io.*;

    32 import javax.net.ssl.*;

    33 import javax.security.auth.AuthPermission;

    34 import javax.security.auth.kerberos.ServicePermission;

    35 import java.net.SocketPermission;

    36 import java.nio.ByteBuffer;

    37 import java.nio.file.Files;

    38 import java.nio.file.Paths;

    39 import java.security.Principal;

    40 import java.security.Security;

    41 import java.security.SecurityPermission;

    42 import java.util.Collections;

    43 import java.util.Date;

    44 import java.util.List;

    45 import java.util.ArrayList;

    46 import java.util.Locale;

    47 import java.util.PropertyPermission;

    48 

    49 import sun.security.jgss.GSSUtil;

    50 

    51 public class SSLwithPerms {

    52 

    53     static String KRB5_CONF = "krb5.conf";

    54     static String JAAS_CONF = "jaas.conf";

    55     static String REALM = "REALM";

    56     static String KTAB = "ktab";

    57     static String HOST = "host." + REALM.toLowerCase(Locale.US);

    58     static String SERVER = "host/" + HOST;

    59     static String USER = "user";

    60     static char[] PASS = "password".toCharArray();

    61 

    62     public static void main(String[] args) throws Exception {

    63 

    64         Security.setProperty("jdk.tls.disabledAlgorithms", "");

    65         if (args.length == 0) {

    66             KDC kdc = KDC.create(REALM, HOST, 0, true);

    67 

    68             kdc.addPrincipal(USER, PASS);

    69             kdc.addPrincipalRandKey("krbtgt/" + REALM);

    70             kdc.addPrincipalRandKey(SERVER);

    71             KDC.saveConfig(KRB5_CONF, kdc);

    72             kdc.writeKtab(KTAB);

    73 

    74             File f = new File(JAAS_CONF);

    75             FileOutputStream fos = new FileOutputStream(f);

    76             fos.write((

    77                     "ssl {\n" +

    78                             "    com.sun.security.auth.module.Krb5LoginModule required\n" +

    79                             "    principal=\"" + SERVER + "\"\n" +

    80                             "    useKeyTab=true\n" +

    81                             "    keyTab=" + KTAB + "\n" +

    82                             "    isInitiator=false\n" +

    83                             "    storeKey=true;\n};\n"

    84             ).getBytes());

    85             fos.close();

    86 

    87             Proc pc = Proc.create("SSLwithPerms")

    88                     .args("client")

    89                     .inheritIO()

    90                     .prop("java.security.manager", "")

    91                     .prop("java.security.krb5.conf", KRB5_CONF)

    92                     .prop("sun.net.spi.nameservice.provider.1", "ns,mock")

    93                     .prop("javax.net.ssl", "handshake")

    94                     .prop("sun.security.krb5.debug", "true")

    95                     .perm(new SecurityPermission("setProperty.jdk.tls.disabledAlgorithms"))

    96                     .perm(new PropertyPermission("sun.security.krb5.principal", "read"))

    97                     .perm(new FilePermission("port", "read"))

    98                     .perm(new FilePermission(KTAB, "read"))

    99                     .perm(new RuntimePermission("accessClassInPackage.sun.net.spi.nameservice"))

   100                     .perm(new AuthPermission("modifyPrincipals"))

   101                     .perm(new AuthPermission("modifyPrivateCredentials"))

   102                     .perm(new AuthPermission("doAs"))

   103                     .perm(new SocketPermission("127.0.0.1", "connect"))

   104                     .perm(new ServicePermission("host/host.realm@REALM", "initiate"))

   105                     .start();

   106 

   107             Proc ps = Proc.create("SSLwithPerms")

   108                     .args("server")

   109                     .inheritIO()

   110                     .prop("java.security.manager", "")

   111                     .prop("java.security.krb5.conf", KRB5_CONF)

   112                     .prop("java.security.auth.login.config", JAAS_CONF)

   113                     .prop("javax.net.ssl", "handshake")

   114                     .prop("sun.security.krb5.debug", "true")

   115                     .perm(new SecurityPermission("setProperty.jdk.tls.disabledAlgorithms"))

   116                     .perm(new AuthPermission("createLoginContext.ssl"))

   117                     .perm(new AuthPermission("doAs"))

   118                     .perm(new FilePermission("port", "write"))

   119                     .perm(new SocketPermission("127.0.0.1", "accept"))

   120                     .perm(new ServicePermission("host/host.realm@REALM", "accept"))

   121                     .start();

   122 

   123             if (pc.waitFor() != 0) {

   124                 throw new Exception();

   125             }

   126             if (ps.waitFor() != 0) {

   127                 throw new Exception();

   128             }

   129         } else if (args[0].equals("client")) {

   130             Context c;

   131             c = Context.fromUserPass(USER, PASS, false);

   132             c.doAs(new JsseClientAction(), null);

   133         } else if (args[0].equals("server")) {

   134             final Context s = Context.fromJAAS("ssl");

   135             s.doAs(new JsseServerAction(), null);

   136         }

   137     }

   138 

   139     private static class JsseClientAction implements Action {

   140         public byte[] run(Context s, byte[] input) throws Exception {

   141             SSLSocketFactory sslsf =

   142                 (SSLSocketFactory) SSLSocketFactory.getDefault();

   143             while (!Files.exists(Paths.get("port"))) {

   144                 Thread.sleep(100);

   145             }

   146             int port = ByteBuffer.allocate(4)

   147                     .put(Files.readAllBytes(Paths.get("port"))).getInt(0);

   148             System.out.println("Connecting " + SERVER + ":" + port);

   149             SSLSocket sslSocket = (SSLSocket) sslsf.createSocket(HOST, port);

   150 

   151             // Enable only a KRB5 cipher suite.

   152             String enabledSuites[] = {"TLS_KRB5_WITH_RC4_128_SHA"};

   153             sslSocket.setEnabledCipherSuites(enabledSuites);

   154 

   155             SSLParameters params = sslSocket.getSSLParameters();

   156             params.setServerNames(Collections.singletonList(new SNIHostName(HOST)));

   157             sslSocket.setSSLParameters(params);

   158 

   159             BufferedReader in = new BufferedReader(new InputStreamReader(

   160                 sslSocket.getInputStream()));

   161             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(

   162                 sslSocket.getOutputStream()));

   163 

   164             String outStr = "Hello There!\n";

   165             out.write(outStr);

   166             out.flush();

   167             System.out.print("Sending " + outStr);

   168 

   169             String inStr = in.readLine();

   170             System.out.println("Received " + inStr);

   171 

   172             String cipherSuiteChosen = sslSocket.getSession().getCipherSuite();

   173             System.out.println("Cipher suite in use: " + cipherSuiteChosen);

   174             Principal self = sslSocket.getSession().getLocalPrincipal();

   175             System.out.println("I am: " + self.toString());

   176             Principal peer = sslSocket.getSession().getPeerPrincipal();

   177             System.out.println("Server is: " + peer.toString());

   178 

   179             sslSocket.close();

   180             return null;

   181         }

   182     }

   183 

   184     private static class JsseServerAction implements Action {

   185         public byte[] run(Context s, byte[] input) throws Exception {

   186             SSLServerSocketFactory sslssf =

   187                 (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();

   188             SSLServerSocket sslServerSocket =

   189                 (SSLServerSocket) sslssf.createServerSocket(0); // any port

   190             int port = sslServerSocket.getLocalPort();

   191             System.out.println("Listening on " + port);

   192 

   193             String enabledSuites[] = {"TLS_KRB5_WITH_RC4_128_SHA"};

   194             sslServerSocket.setEnabledCipherSuites(enabledSuites);

   195 

   196             Files.write(Paths.get("port"), ByteBuffer.allocate(4).putInt(port).array());

   197             System.out.println("Waiting for incoming connection...");

   198 

   199             SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();

   200 

   201             System.out.println("Got connection from client "

   202                 + sslSocket.getInetAddress());

   203 

   204             BufferedReader in = new BufferedReader(new InputStreamReader(

   205                 sslSocket.getInputStream()));

   206             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(

   207                 sslSocket.getOutputStream()));

   208 

   209             String inStr = in.readLine();

   210             System.out.println("Received " + inStr);

   211 

   212             String outStr = inStr + " " + new Date().toString() + "\n";

   213             out.write(outStr);

   214             System.out.println("Sending " + outStr);

   215             out.flush();

   216 

   217             String cipherSuiteChosen =

   218                 sslSocket.getSession().getCipherSuite();

   219             System.out.println("Cipher suite in use: " + cipherSuiteChosen);

   220             Principal self = sslSocket.getSession().getLocalPrincipal();

   221             System.out.println("I am: " + self.toString());

   222             Principal peer = sslSocket.getSession().getPeerPrincipal();

   223             System.out.println("Client is: " + peer.toString());

   224 

   225             sslSocket.close();

   226             return null;

   227         }

   228     }

   229 }