diff --git a/src/share/classes/sun/security/krb5/KdcComm.java b/src/share/classes/sun/security/krb5/KdcComm.java index 721c105d345cbf3ce9dad2d20be55f639bbc7462..a4dbf2903bb09d09687d6e8c47e03fa04d5dd637 100644 --- a/src/share/classes/sun/security/krb5/KdcComm.java +++ b/src/share/classes/sun/security/krb5/KdcComm.java @@ -390,35 +390,27 @@ public final class KdcComm { for (int i=1; i <= retries; i++) { String proto = useTCP?"TCP":"UDP"; - try (NetClient kdcClient = NetClient.getInstance( - proto, kdc, port, timeout)) { - if (DEBUG) { - System.out.println(">>> KDCCommunication: kdc=" + kdc + if (DEBUG) { + System.out.println(">>> KDCCommunication: kdc=" + kdc + " " + proto + ":" + port + ", timeout=" + timeout + ",Attempt =" + i + ", #bytes=" + obuf.length); + } + try (NetClient kdcClient = NetClient.getInstance( + proto, kdc, port, timeout)) { + kdcClient.send(obuf); + ibuf = kdcClient.receive(); + break; + } catch (SocketTimeoutException se) { + if (DEBUG) { + System.out.println ("SocketTimeOutException with " + + "attempt: " + i); } - try { - /* - * Send the data to the kdc. - */ - kdcClient.send(obuf); - /* - * And get a response. - */ - ibuf = kdcClient.receive(); - break; - } catch (SocketTimeoutException se) { - if (DEBUG) { - System.out.println ("SocketTimeOutException with " + - "attempt: " + i); - } - if (i == retries) { - ibuf = null; - throw se; - } + if (i == retries) { + ibuf = null; + throw se; } } } diff --git a/test/sun/security/krb5/auto/KdcPolicy.java b/test/sun/security/krb5/auto/KdcPolicy.java new file mode 100644 index 0000000000000000000000000000000000000000..f4501a5779b2bce2861252756d2e42f7bda041ab --- /dev/null +++ b/test/sun/security/krb5/auto/KdcPolicy.java @@ -0,0 +1,366 @@ +/* + * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +import java.io.*; +import java.net.DatagramSocket; +import java.net.ServerSocket; +import java.nio.file.Files; +import java.nio.file.Paths; +import java.security.Security; +import java.util.ArrayList; +import java.util.List; +import java.util.Random; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import javax.security.auth.login.LoginException; +import sun.security.krb5.Asn1Exception; +import sun.security.krb5.Config; + +/* + * @test + * @bug 8164656 + * @run main/othervm KdcPolicy udp + * @run main/othervm KdcPolicy tcp + * @summary krb5.kdc.bad.policy test + */ +public class KdcPolicy { + + // Is this test on UDP? + static boolean udp; + + public static void main(String[] args) throws Exception { + + udp = args[0].equals("udp"); + + try { + main0(); + } catch (LoginException le) { + Throwable cause = le.getCause(); + if (cause instanceof Asn1Exception) { + System.out.println("Another process sends a packet to " + + "this server. Ignored."); + return; + } + throw le; + } + } + + static DebugMatcher cm = new DebugMatcher(); + + static void main0() throws Exception { + + System.setProperty("sun.security.krb5.debug", "true"); + + // One real KDC. Must be created before fake KDCs + // to read the TestHosts file. + OneKDC kdc = new OneKDC(null); + + // Two fake KDCs, d1 and d2 only listen but do not respond. + + if (udp) { + try (DatagramSocket d1 = new DatagramSocket(); + DatagramSocket d2 = new DatagramSocket()) { + run(d1.getLocalPort(), d2.getLocalPort(), kdc.getPort()); + } + } else { + try (ServerSocket d1 = new ServerSocket(0); + ServerSocket d2 = new ServerSocket(0)) { + run(d1.getLocalPort(), d2.getLocalPort(), kdc.getPort()); + } + } + } + + static void run(int p1, int p2, int p3) throws Exception { + + // cm.kdc() will return a and b for fake KDCs, and c for real KDC. + cm.addPort(-1).addPort(p1).addPort(p2).addPort(p3); + + System.setProperty("java.security.krb5.conf", "alternative-krb5.conf"); + + // Check default timeout is 30s. Use real KDC only, otherwise too + // slow to wait for timeout. + writeConf(-1, -1, p3); + test("c30000c30000"); + + // 1. Default policy is tryLast + //Security.setProperty("krb5.kdc.bad.policy", "tryLast"); + + // Need a real KDC, otherwise there is no last good. + // This test waste 3 seconds waiting for d1 to timeout. + // It is possible the real KDC cannot fulfil the request + // in 3s, so it might fail (either 1st time or 2nd time). + writeConf(1, 3000, p1, p3); + test("a3000c3000c3000|a3000c3000-|a3000c3000c3000-"); + + // If a test case won't use a real KDC, it can be sped up. + writeConf(3, 5, p1, p2); + test("a5a5a5b5b5b5-"); // default max_retries == 3 + test("a5a5a5b5b5b5-"); // all bad means no bad + + // 2. No policy. + Security.setProperty("krb5.kdc.bad.policy", ""); + Config.refresh(); + + // This case needs a real KDC, otherwise, all bad means no + // bad and we cannot tell the difference. This case waste 3 + // seconds on d1 to timeout twice. It is possible the real KDC + // cannot fulfil the request within 3s, so it might fail + // (either 1st time or 2nd time). + writeConf(1, 3000, p1, p3); + test("a3000c3000a3000c3000|a3000c3000-|a3000c3000a3000c3000-"); + + // 3. tryLess with no argument means tryLess:1,5000 + Security.setProperty("krb5.kdc.bad.policy", "tryLess"); + + // This case will waste 11s. We are checking that the default + // value of 5000 in tryLess is only used if it's less than timeout + // in krb5.conf + writeConf(1, 6000, p1); + test("a6000-"); // timeout in krb5.conf is 6s + test("a5000-"); // tryLess to 5s. This line can be made faster if + // d1 is a read KDC, but we have no existing method + // to start KDC on an existing ServerSocket (port). + + writeConf(-1, 4, p1, p2); + test("a4a4a4b4b4b4-"); // default max_retries == 3 + test("a4b4-"); // tryLess to 1. And since 4 < 5000, use 4. + Config.refresh(); + test("a4a4a4b4b4b4-"); + + writeConf(5, 4, p1, p2); + test("a4a4a4a4a4b4b4b4b4b4-"); // user-provided max_retries == 5 + test("a4b4-"); + Config.refresh(); + test("a4a4a4a4a4b4b4b4b4b4-"); + + // 3. tryLess with arguments + Security.setProperty("krb5.kdc.bad.policy", + "tryLess:2,5"); + + writeConf(-1, 6, p1, p2); + test("a6a6a6b6b6b6-"); // default max_retries == 3 + test("a5a5b5b5-"); // tryLess to 2 + Config.refresh(); + test("a6a6a6b6b6b6-"); + + writeConf(5, 4, p1, p2); + test("a4a4a4a4a4b4b4b4b4b4-"); // user-provided max_retries == 5 + test("a4a4b4b4-"); // tryLess to 2 + Config.refresh(); + test("a4a4a4a4a4b4b4b4b4b4-"); + } + + /** + * Writes a krb5.conf file. + * @param max max_retries, -1 if not set + * @param to kdc_timeout, -1 if not set + * @param ports where KDCs listen on + */ + static void writeConf(int max, int to, int... ports) throws Exception { + + // content of krb5.conf + String conf = ""; + + // Extra settings in [libdefaults] + String inDefaults = ""; + + // Extra settings in [realms] + String inRealm = ""; + + // We will randomly put extra settings only in [libdefaults], + // or in [realms] but with different values in [libdefaults], + // to prove that settings in [realms] override those in [libdefaults]. + Random r = new Random(); + + if (max > 0) { + if (r.nextBoolean()) { + inDefaults += "max_retries = " + max + "\n"; + } else { + inRealm += " max_retries = " + max + "\n"; + inDefaults += "max_retries = " + (max + 1) + "\n"; + } + } + + if (to > 0) { + if (r.nextBoolean()) { + inDefaults += "kdc_timeout = " + to + "\n"; + } else { + inRealm += " kdc_timeout = " + to + "\n"; + inDefaults += "kdc_timeout = " + (to + 1) + "\n"; + } + } + + if (udp) { + if (r.nextBoolean()) { + inDefaults += "udp_preference_limit = 10000\n"; + } else if (r.nextBoolean()) { + inRealm += " udp_preference_limit = 10000\n"; + inDefaults += "udp_preference_limit = 1\n"; + } // else no settings means UDP + } else { + if (r.nextBoolean()) { + inDefaults += "udp_preference_limit = 1\n"; + } else { + inRealm += " udp_preference_limit = 1\n"; + inDefaults += "udp_preference_limit = 10000\n"; + } + } + + conf = "[libdefaults]\n" + + "default_realm = " + OneKDC.REALM + "\n" + + inDefaults + + "\n" + + "[realms]\n" + + OneKDC.REALM + " = {\n"; + + for (int port : ports) { + conf += " kdc = " + OneKDC.KDCHOST + ":" + port + "\n" + + inRealm; + } + + conf += "}\n"; + + Files.write(Paths.get("alternative-krb5.conf"), conf.getBytes()); + Config.refresh(); + } + + /** + * One call of krb5 login. As long as the result matches one of expected, + * the test is considered as success. The grammar of expected is + * + * kdc#, timeout, kdc#, timeout, ..., optional "-" for failure + */ + static void test(String... expected) throws Exception { + + System.out.println("------------------TEST----------------------"); + PrintStream oldOut = System.out; + boolean failed = false; + ByteArrayOutputStream bo = new ByteArrayOutputStream(); + System.setOut(new PrintStream(bo)); + try { + Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false); + } catch (Exception e) { + failed = true; + } finally { + System.setOut(oldOut); + } + + String[] lines = new String(bo.toByteArray()).split("\n"); + StringBuilder sb = new StringBuilder(); + for (String line: lines) { + if (cm.match(line)) { + if (udp != cm.isUDP()) { + sb.append("x"); + } + sb.append(cm.kdc()).append(cm.timeout()); + } + } + if (failed) sb.append('-'); + + String output = sb.toString(); + + boolean found = false; + for (String ex : expected) { + if (output.matches(ex)) { + System.out.println("Expected: " + ex + ", actual " + output); + found = true; + break; + } + } + + if (!found) { + System.out.println("--------------- ERROR START -------------"); + System.out.println(new String(bo.toByteArray())); + System.out.println("--------------- ERROR END ---------------"); + throw new Exception("Does not match. Output is " + output); + } + } + + /** + * A helper class to match the krb5 debug output: + * >>> KDCCommunication: kdc=host UDP:11555, timeout=200,Attempt =1, #bytes=138 + * + * Example: + * DebugMatcher cm = new DebugMatcher(); + * cm.addPort(12345).addPort(11555); + * for (String line : debugOutput) { + * if (cm.match(line)) { + * System.out.printf("%c%d\n", cm.kdc(), cm.timeout()); + * // shows b200 for the example above + * } + * } + */ + static class DebugMatcher { + + static final Pattern re = Pattern.compile( + ">>> KDCCommunication: kdc=\\S+ (TCP|UDP):(\\d+), " + + "timeout=(\\d+),Attempt\\s*=(\\d+)"); + + List kdcPorts = new ArrayList<>(); + Matcher matcher; + + /** + * Add KDC ports one by one. See {@link #kdc()}. + */ + DebugMatcher addPort(int port) { + if (port > 0) { + kdcPorts.add(port); + } else { + kdcPorts.clear(); + } + return this; + } + + /** + * When a line matches the ">>> KDCCommunication:" pattern. After a + * match, the getters below can be called on this match. + */ + boolean match(String line) { + matcher = re.matcher(line); + return matcher.find(); + } + + /** + * Protocol of this match, "UDP" or "TCP". + */ + boolean isUDP() { + return matcher.group(1).equals("UDP"); + } + + /** + * KDC for this match, "a" for the one 1st added bt addPort(), "b" + * for second, etc. Undefined for not added. + */ + char kdc() { + int port = Integer.parseInt(matcher.group(2)); + return (char) (kdcPorts.indexOf(port) + 'a'); + } + + /** + * Timeout value for this match. + */ + int timeout() { + return Integer.parseInt(matcher.group(3)); + } + } +}