--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/krb5/auto/KdcPolicy.java Tue Sep 12 19:03:39 2017 +0200
@@ -0,0 +1,366 @@
+/*
+ * Copyright (c) 2016, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.*;
+import java.net.DatagramSocket;
+import java.net.ServerSocket;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.Security;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Random;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import javax.security.auth.login.LoginException;
+import sun.security.krb5.Asn1Exception;
+import sun.security.krb5.Config;
+
+/*
+ * @test
+ * @bug 8164656 8181461
+ * @run main/othervm KdcPolicy udp
+ * @run main/othervm KdcPolicy tcp
+ * @summary krb5.kdc.bad.policy test
+ */
+public class KdcPolicy {
+
+ // Is this test on UDP?
+ static boolean udp;
+
+ public static void main(String[] args) throws Exception {
+
+ udp = args[0].equals("udp");
+
+ try {
+ main0();
+ } catch (LoginException le) {
+ Throwable cause = le.getCause();
+ if (cause instanceof Asn1Exception) {
+ System.out.println("Another process sends a packet to " +
+ "this server. Ignored.");
+ return;
+ }
+ throw le;
+ }
+ }
+
+ static DebugMatcher cm = new DebugMatcher();
+
+ static void main0() throws Exception {
+
+ System.setProperty("sun.security.krb5.debug", "true");
+
+ // One real KDC. Must be created before fake KDCs
+ // to read the TestHosts file.
+ OneKDC kdc = new OneKDC(null);
+
+ // Two fake KDCs, d1 and d2 only listen but do not respond.
+
+ if (udp) {
+ try (DatagramSocket d1 = new DatagramSocket();
+ DatagramSocket d2 = new DatagramSocket()) {
+ run(d1.getLocalPort(), d2.getLocalPort(), kdc.getPort());
+ }
+ } else {
+ try (ServerSocket d1 = new ServerSocket(0);
+ ServerSocket d2 = new ServerSocket(0)) {
+ run(d1.getLocalPort(), d2.getLocalPort(), kdc.getPort());
+ }
+ }
+ }
+
+ static void run(int p1, int p2, int p3) throws Exception {
+
+ // cm.kdc() will return a and b for fake KDCs, and c for real KDC.
+ cm.addPort(-1).addPort(p1).addPort(p2).addPort(p3);
+
+ System.setProperty("java.security.krb5.conf", "alternative-krb5.conf");
+
+ // Check default timeout is 30s. Use real KDC only, otherwise too
+ // slow to wait for timeout.
+ writeConf(-1, -1, p3);
+ test("c30000c30000");
+
+ // 1. Default policy is tryLast
+ //Security.setProperty("krb5.kdc.bad.policy", "tryLast");
+
+ // Need a real KDC, otherwise there is no last good.
+ // This test waste 3 seconds waiting for d1 to timeout.
+ // It is possible the real KDC cannot fulfil the request
+ // in 3s, so it might fail (either 1st time or 2nd time).
+ writeConf(1, 3000, p1, p3);
+ test("a3000c3000c3000|a3000c3000-|a3000c3000c3000a3000-");
+
+ // If a test case won't use a real KDC, it can be sped up.
+ writeConf(3, 5, p1, p2);
+ test("a5a5a5b5b5b5-"); // default max_retries == 3
+ test("a5a5a5b5b5b5-"); // all bad means no bad
+
+ // 2. No policy.
+ Security.setProperty("krb5.kdc.bad.policy", "");
+ Config.refresh();
+
+ // This case needs a real KDC, otherwise, all bad means no
+ // bad and we cannot tell the difference. This case waste 3
+ // seconds on d1 to timeout twice. It is possible the real KDC
+ // cannot fulfil the request within 3s, so it might fail
+ // (either 1st time or 2nd time).
+ writeConf(1, 3000, p1, p3);
+ test("a3000c3000a3000c3000|a3000c3000-|a3000c3000a3000c3000-");
+
+ // 3. tryLess with no argument means tryLess:1,5000
+ Security.setProperty("krb5.kdc.bad.policy", "tryLess");
+
+ // This case will waste 11s. We are checking that the default
+ // value of 5000 in tryLess is only used if it's less than timeout
+ // in krb5.conf
+ writeConf(1, 6000, p1);
+ test("a6000-"); // timeout in krb5.conf is 6s
+ test("a5000-"); // tryLess to 5s. This line can be made faster if
+ // d1 is a read KDC, but we have no existing method
+ // to start KDC on an existing ServerSocket (port).
+
+ writeConf(-1, 4, p1, p2);
+ test("a4a4a4b4b4b4-"); // default max_retries == 3
+ test("a4b4-"); // tryLess to 1. And since 4 < 5000, use 4.
+ Config.refresh();
+ test("a4a4a4b4b4b4-");
+
+ writeConf(5, 4, p1, p2);
+ test("a4a4a4a4a4b4b4b4b4b4-"); // user-provided max_retries == 5
+ test("a4b4-");
+ Config.refresh();
+ test("a4a4a4a4a4b4b4b4b4b4-");
+
+ // 3. tryLess with arguments
+ Security.setProperty("krb5.kdc.bad.policy",
+ "tryLess:2,5");
+
+ writeConf(-1, 6, p1, p2);
+ test("a6a6a6b6b6b6-"); // default max_retries == 3
+ test("a5a5b5b5-"); // tryLess to 2
+ Config.refresh();
+ test("a6a6a6b6b6b6-");
+
+ writeConf(5, 4, p1, p2);
+ test("a4a4a4a4a4b4b4b4b4b4-"); // user-provided max_retries == 5
+ test("a4a4b4b4-"); // tryLess to 2
+ Config.refresh();
+ test("a4a4a4a4a4b4b4b4b4b4-");
+ }
+
+ /**
+ * Writes a krb5.conf file.
+ * @param max max_retries, -1 if not set
+ * @param to kdc_timeout, -1 if not set
+ * @param ports where KDCs listen on
+ */
+ static void writeConf(int max, int to, int... ports) throws Exception {
+
+ // content of krb5.conf
+ String conf = "";
+
+ // Extra settings in [libdefaults]
+ String inDefaults = "";
+
+ // Extra settings in [realms]
+ String inRealm = "";
+
+ // We will randomly put extra settings only in [libdefaults],
+ // or in [realms] but with different values in [libdefaults],
+ // to prove that settings in [realms] override those in [libdefaults].
+ Random r = new Random();
+
+ if (max > 0) {
+ if (r.nextBoolean()) {
+ inDefaults += "max_retries = " + max + "\n";
+ } else {
+ inRealm += " max_retries = " + max + "\n";
+ inDefaults += "max_retries = " + (max + 1) + "\n";
+ }
+ }
+
+ if (to > 0) {
+ if (r.nextBoolean()) {
+ inDefaults += "kdc_timeout = " + to + "\n";
+ } else {
+ inRealm += " kdc_timeout = " + to + "\n";
+ inDefaults += "kdc_timeout = " + (to + 1) + "\n";
+ }
+ }
+
+ if (udp) {
+ if (r.nextBoolean()) {
+ inDefaults += "udp_preference_limit = 10000\n";
+ } else if (r.nextBoolean()) {
+ inRealm += " udp_preference_limit = 10000\n";
+ inDefaults += "udp_preference_limit = 1\n";
+ } // else no settings means UDP
+ } else {
+ if (r.nextBoolean()) {
+ inDefaults += "udp_preference_limit = 1\n";
+ } else {
+ inRealm += " udp_preference_limit = 1\n";
+ inDefaults += "udp_preference_limit = 10000\n";
+ }
+ }
+
+ conf = "[libdefaults]\n" +
+ "default_realm = " + OneKDC.REALM + "\n" +
+ inDefaults +
+ "\n" +
+ "[realms]\n" +
+ OneKDC.REALM + " = {\n";
+
+ for (int port : ports) {
+ conf += " kdc = " + OneKDC.KDCHOST + ":" + port + "\n" +
+ inRealm;
+ }
+
+ conf += "}\n";
+
+ Files.write(Paths.get("alternative-krb5.conf"), conf.getBytes());
+ Config.refresh();
+ }
+
+ /**
+ * One call of krb5 login. As long as the result matches one of expected,
+ * the test is considered as success. The grammar of expected is
+ *
+ * kdc#, timeout, kdc#, timeout, ..., optional "-" for failure
+ */
+ static void test(String... expected) throws Exception {
+
+ System.out.println("------------------TEST----------------------");
+ PrintStream oldOut = System.out;
+ boolean failed = false;
+ ByteArrayOutputStream bo = new ByteArrayOutputStream();
+ System.setOut(new PrintStream(bo));
+ try {
+ Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false);
+ } catch (Exception e) {
+ failed = true;
+ } finally {
+ System.setOut(oldOut);
+ }
+
+ String[] lines = new String(bo.toByteArray()).split("\n");
+ StringBuilder sb = new StringBuilder();
+ for (String line: lines) {
+ if (cm.match(line)) {
+ if (udp != cm.isUDP()) {
+ sb.append("x");
+ }
+ sb.append(cm.kdc()).append(cm.timeout());
+ }
+ }
+ if (failed) sb.append('-');
+
+ String output = sb.toString();
+
+ boolean found = false;
+ for (String ex : expected) {
+ if (output.matches(ex)) {
+ System.out.println("Expected: " + ex + ", actual " + output);
+ found = true;
+ break;
+ }
+ }
+
+ if (!found) {
+ System.out.println("--------------- ERROR START -------------");
+ System.out.println(new String(bo.toByteArray()));
+ System.out.println("--------------- ERROR END ---------------");
+ throw new Exception("Does not match. Output is " + output);
+ }
+ }
+
+ /**
+ * A helper class to match the krb5 debug output:
+ * >>> KDCCommunication: kdc=host UDP:11555, timeout=200,Attempt =1, #bytes=138
+ *
+ * Example:
+ * DebugMatcher cm = new DebugMatcher();
+ * cm.addPort(12345).addPort(11555);
+ * for (String line : debugOutput) {
+ * if (cm.match(line)) {
+ * System.out.printf("%c%d\n", cm.kdc(), cm.timeout());
+ * // shows b200 for the example above
+ * }
+ * }
+ */
+ static class DebugMatcher {
+
+ static final Pattern re = Pattern.compile(
+ ">>> KDCCommunication: kdc=\\S+ (TCP|UDP):(\\d+), " +
+ "timeout=(\\d+),Attempt\\s*=(\\d+)");
+
+ List<Integer> kdcPorts = new ArrayList<>();
+ Matcher matcher;
+
+ /**
+ * Add KDC ports one by one. See {@link #kdc()}.
+ */
+ DebugMatcher addPort(int port) {
+ if (port > 0) {
+ kdcPorts.add(port);
+ } else {
+ kdcPorts.clear();
+ }
+ return this;
+ }
+
+ /**
+ * When a line matches the ">>> KDCCommunication:" pattern. After a
+ * match, the getters below can be called on this match.
+ */
+ boolean match(String line) {
+ matcher = re.matcher(line);
+ return matcher.find();
+ }
+
+ /**
+ * Protocol of this match, "UDP" or "TCP".
+ */
+ boolean isUDP() {
+ return matcher.group(1).equals("UDP");
+ }
+
+ /**
+ * KDC for this match, "a" for the one 1st added bt addPort(), "b"
+ * for second, etc. Undefined for not added.
+ */
+ char kdc() {
+ int port = Integer.parseInt(matcher.group(2));
+ return (char) (kdcPorts.indexOf(port) + 'a');
+ }
+
+ /**
+ * Timeout value for this match.
+ */
+ int timeout() {
+ return Integer.parseInt(matcher.group(3));
+ }
+ }
+}