1 /*

     2  * Copyright 2009 Sun Microsystems, Inc.  All Rights Reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

    20  * CA 95054 USA or visit www.sun.com if you need additional information or

    21  * have any questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 6815182

    27  * @summary GSSAPI/SPNEGO does not work with server using MIT Kerberos library

    28  */

    29 

    30 import sun.security.jgss.GSSUtil;

    31 import sun.security.util.BitArray;

    32 import sun.security.util.DerInputStream;

    33 import sun.security.util.DerValue;

    34 

    35 public class SpnegoReqFlags {

    36 

    37     public static void main(String[] args)

    38             throws Exception {

    39 

    40         // Create and start the KDC

    41         new OneKDC(null).writeJAASConf();

    42         new SpnegoReqFlags().go();

    43     }

    44 

    45     void go() throws Exception {

    46         Context c = Context.fromJAAS("client");

    47         c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_SPNEGO_MECH_OID);

    48 

    49         byte[] token = c.doAs(new Action() {

    50             @Override

    51             public byte[] run(Context me, byte[] input) throws Exception {

    52                 me.x().requestCredDeleg(true);

    53                 me.x().requestReplayDet(false);

    54                 me.x().requestSequenceDet(false);

    55                 return me.x().initSecContext(new byte[0], 0, 0);

    56             }

    57         }, null);

    58 

    59         DerValue d = new DerValue(token);   // GSSToken

    60         DerInputStream ins = d.data;        // OID + mech token

    61         d.data.getDerValue();               // skip OID

    62         d = d.data.getDerValue();           // NegTokenInit

    63         d = d.data.getDerValue();           // The SEQUENCE inside

    64 

    65         boolean found = false;

    66 

    67         // Go through all fields inside NegTokenInit. The reqFlags field

    68         // is optional. It's even not recommended in RFC 4178.

    69         while (d.data.available() > 0) {

    70             DerValue d2 = d.data.getDerValue();

    71             if (d2.isContextSpecific((byte)1)) {

    72                 found = true;

    73                 System.out.println("regFlags field located.");

    74                 BitArray ba = d2.data.getUnalignedBitString();

    75                 if (ba.length() != 7) {

    76                     throw new Exception("reqFlags should contain 7 bits");

    77                 }

    78                 if (!ba.get(0)) {

    79                     throw new Exception("delegFlag should be true");

    80                 }

    81                 if (ba.get(2) || ba.get(3)) {

    82                     throw new Exception("replay/sequenceFlag should be false");

    83                 }

    84             }

    85         }

    86 

    87         if (!found) {

    88             System.out.println("Warning: regFlags field not found, too new?");

    89         }

    90         c.dispose();

    91     }

    92 }