/*
* Copyright (c) 2009, 2012, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.*;
import java.net.BindException;
import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.security.auth.login.LoginException;
import sun.security.krb5.Asn1Exception;
import sun.security.krb5.Config;
public class BadKdc {
// Matches the krb5 debug output:
// >>> KDCCommunication: kdc=kdc.rabbit.hole UDP:14319, timeout=2000,...
// ^ kdc# ^ timeout
static final Pattern re = Pattern.compile(
">>> KDCCommunication: kdc=kdc.rabbit.hole UDP:(\\d)...., " +
"timeout=(\\d+),");
// Ratio for timeout values of all timeout tests. Not final so that
// each test can choose their own.
static float ratio = 2f;
static void setRatio(float ratio) {
BadKdc.ratio = ratio;
}
static float getRatio() {
return ratio;
}
// Gets real timeout value. This method is called when writing krb5.conf
static int toReal(int from) {
return (int)(from * ratio + .5);
}
// De-ratio a millisecond value to second
static int toSymbolicSec(int from) {
return (int)(from / ratio / 1000f + 0.5);
}
/*
* There are several cases this test fails:
*
* 1. The random selected port is used by another process. No good way to
* prevent this happening, coz krb5.conf must be written before KDC starts.
* There are two different outcomes:
*
* a. Cannot start the KDC. A BindException thrown.
* b. When trying to access a non-existing KDC, a response is received!
* Most likely a Asn1Exception thrown
*
* 2. Even if a KDC is started, and more than 20 seconds pass by, a timeout
* can still happens for the first UDP request. In fact, the KDC did not
* received it at all. This happens on almost all platforms, especially
* solaris-i586 and solaris-x64.
*
* To avoid them:
*
* 1. Catch those exceptions and ignore
*
* 2. a. Make the timeout longer? useless
* b. Read the output carefully, if there is a timeout, it's OK.
* Just make sure the retries times and KDCs are correct.
* This is tough.
* c. Feed the KDC a UDP packet first. The current "solution".
*/
public static void go(String... expected)
throws Exception {
try {
go0(expected);
} catch (BindException be) {
System.out.println("The random port is used by another process");
} catch (LoginException le) {
Throwable cause = le.getCause();
if (cause instanceof Asn1Exception) {
System.out.println("Bad packet possibly from another process");
return;
}
throw le;
}
}
public static void go0(String... expected)
throws Exception {
System.setProperty("sun.security.krb5.debug", "true");
// Idle UDP sockets will trigger a SocketTimeoutException, without it,
// a PortUnreachableException will be thrown.
DatagramSocket d1 = null, d2 = null, d3 = null;
// Make sure KDCs' ports starts with 1 and 2 and 3,
// useful for checking debug output.
int p1 = 10000 + new java.util.Random().nextInt(10000);
int p2 = 20000 + new java.util.Random().nextInt(10000);
int p3 = 30000 + new java.util.Random().nextInt(10000);
FileWriter fw = new FileWriter("alternative-krb5.conf");
fw.write("[libdefaults]\n" +
"default_realm = " + OneKDC.REALM + "\n" +
"kdc_timeout = " + toReal(2000) + "\n");
fw.write("[realms]\n" + OneKDC.REALM + " = {\n" +
"kdc = " + OneKDC.KDCHOST + ":" + p1 + "\n" +
"kdc = " + OneKDC.KDCHOST + ":" + p2 + "\n" +
"kdc = " + OneKDC.KDCHOST + ":" + p3 + "\n" +
"}\n");
fw.close();
System.setProperty("java.security.krb5.conf", "alternative-krb5.conf");
Config.refresh();
// Turn on k3 only
d1 = new DatagramSocket(p1);
d2 = new DatagramSocket(p2);
KDC k3 = on(p3);
test(expected[0]);
test(expected[1]);
Config.refresh();
test(expected[2]);
k3.terminate(); // shutdown k3
d3 = new DatagramSocket(p3);
d2.close();
on(p2); // k2 is on
test(expected[3]);
d1.close();
on(p1); // k1 and k2 is on
test(expected[4]);
d3.close();
}
private static KDC on(int p) throws Exception {
KDC k = new KDC(OneKDC.REALM, OneKDC.KDCHOST, p, true);
k.addPrincipal(OneKDC.USER, OneKDC.PASS);
k.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);
// Feed a packet to newly started KDC to warm it up
System.err.println("-------- IGNORE THIS ERROR MESSAGE --------");
new DatagramSocket().send(
new DatagramPacket("Hello".getBytes(), 5,
InetAddress.getByName(OneKDC.KDCHOST), p));
return k;
}
private static void test(String expected) throws Exception {
ByteArrayOutputStream bo = new ByteArrayOutputStream();
System.out.println("----------------- TEST -----------------");
try {
test0(bo, expected);
} catch (Exception e) {
System.out.println("----------------- ERROR -----------------");
System.out.println(new String(bo.toByteArray()));
System.out.println("--------------- ERROR END ---------------");
throw e;
}
}
/**
* One round of test for max_retries and timeout.
* @param expected the expected kdc# timeout kdc# timeout...
*/
private static void test0(ByteArrayOutputStream bo, String expected)
throws Exception {
PrintStream oldout = System.out;
boolean failed = false;
System.setOut(new PrintStream(bo));
try {
Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false);
} catch (Exception e) {
failed = true;
} finally {
System.setOut(oldout);
}
String[] lines = new String(bo.toByteArray()).split("\n");
StringBuilder sb = new StringBuilder();
for (String line: lines) {
Matcher m = re.matcher(line);
if (m.find()) {
System.out.println(line);
sb.append(m.group(1))
.append(toSymbolicSec(Integer.parseInt(m.group(2))));
}
}
if (failed) sb.append('-');
String output = sb.toString();
System.out.println("Expected: " + expected + ", actual " + output);
if (!output.matches(expected)) {
throw new Exception("Does not match");
}
}
}