< prev index next >
test/sun/security/krb5/auto/MaxRetries.java
Print this page
rev 12522 : 8077670: sun/security/krb5/auto/MaxRetries.java may fail with BindException
Reviewed-by: chegar
rev 12523 : 8087144: sun/security/krb5/auto/MaxRetries.java fails with Retry count is -1 less
8153146: sun/security/krb5/auto/MaxRetries.java failed with timeout
Reviewed-by: xuelei
*** 27,79 ****
* @compile -XDignore.symbol.file MaxRetries.java
* @run main/othervm/timeout=300 MaxRetries
* @summary support max_retries in krb5.conf
*/
import java.io.*;
import java.net.DatagramSocket;
import java.security.Security;
public class MaxRetries {
public static void main(String[] args)
throws Exception {
System.setProperty("sun.security.krb5.debug", "true");
! new OneKDC(null).writeJAASConf();
! // An idle UDP socket to revent PortUnreachableException
! DatagramSocket ds = new DatagramSocket(33333);
System.setProperty("java.security.krb5.conf", "alternative-krb5.conf");
- // For tryLast
Security.setProperty("krb5.kdc.bad.policy", "trylast");
rewriteMaxRetries(4);
- test1(4000, 6); // 1 1 1 1 2 2
- test1(4000, 2); // 2 2
rewriteMaxRetries(1);
! test1(1000, 3); // 1 2 2
! test1(1000, 2); // 2 2
rewriteMaxRetries(-1);
! test1(5000, 4); // 1 1 2 2
! test1(5000, 2); // 2 2
! // For tryLess
! Security.setProperty("krb5.kdc.bad.policy", "tryless:1," + BadKdc.toReal(5000));
rewriteMaxRetries(4);
! test1(4000, 7); // 1 1 1 1 2 1 2
! test1(4000, 4); // 1 2 1 2
rewriteMaxRetries(1);
! test1(1000, 4); // 1 2 1 2
! test1(1000, 4); // 1 2 1 2
rewriteMaxRetries(-1);
! test1(5000, 5); // 1 1 2 1 2
! test1(5000, 4); // 1 2 1 2
rewriteUdpPrefLimit(-1, -1); // default, no limit
test2("UDP");
rewriteUdpPrefLimit(10, -1); // global rules
--- 27,124 ----
* @compile -XDignore.symbol.file MaxRetries.java
* @run main/othervm/timeout=300 MaxRetries
* @summary support max_retries in krb5.conf
*/
+ import javax.security.auth.login.LoginException;
import java.io.*;
import java.net.DatagramSocket;
import java.security.Security;
public class MaxRetries {
+
+ static int idlePort = -1;
+ static CommMatcher cm = new CommMatcher();
+
public static void main(String[] args)
throws Exception {
System.setProperty("sun.security.krb5.debug", "true");
! OneKDC kdc = new OneKDC(null).writeJAASConf();
! // An idle UDP socket to prevent PortUnreachableException
! DatagramSocket ds = new DatagramSocket();
! idlePort = ds.getLocalPort();
!
! cm.addPort(idlePort);
! cm.addPort(kdc.getPort());
System.setProperty("java.security.krb5.conf", "alternative-krb5.conf");
Security.setProperty("krb5.kdc.bad.policy", "trylast");
+
+ // We always make the real timeout to be 1 second
+ BadKdc.setRatio(0.25f);
rewriteMaxRetries(4);
+ // Explanation: In this case, max_retries=4 and timeout=4s.
+ // For AS-REQ without preauth, we will see 4 4s timeout on kdc#1
+ // ("a4" repeat 4 times), and one 4s timeout on kdc#2 ("b4"). For
+ // AS-REQ with preauth, one 4s timeout on kdc#2 (second "b4").
+ // we tolerate 4 real timeout on kdc#2, so make it "(b4){2,6}".
+ test1("a4a4a4a4b4b4", "a4a4a4a4(b4){2,6}");
+ test1("b4b4", "(b4){2,6}");
+
+ BadKdc.setRatio(1f);
rewriteMaxRetries(1);
! // Explanation: Since max_retries=1 only, we could fail in 1st or 2nd
! // AS-REQ to kdc#2.
! String actual = test1("a1b1b1", "(a1b1b1|a1b1x|a1b1b1x)");
! if (actual.endsWith("x")) {
! // If 1st attempt fails, all bads are back available
! test1("a1b1b1", "(a1b1b1|a1b1x|a1b1b1x)");
! } else {
! test1("b1b1", "(b1b1|b1x|b1b1x)");
! }
+ BadKdc.setRatio(0.2f);
rewriteMaxRetries(-1);
! test1("a5a5a5b5b5", "a5a5a5(b5){2,4}");
! test1("b5b5", "(b5){2,4}");
! BadKdc.setRatio(0.25f);
! Security.setProperty("krb5.kdc.bad.policy",
! "tryless:1,1000");
rewriteMaxRetries(4);
! test1("a4a4a4a4b4a4b4", "a4a4a4a4(b4){1,3}a4(b4){1,3}");
! test1("a4b4a4b4", "a4(b4){1,3}a4(b4){1,3}");
+ BadKdc.setRatio(1f);
rewriteMaxRetries(1);
! actual = test1("a1b1a1b1", "(a1b1|a1b1x|a1b1a1b1|a1b1a1b1x)");
! if (actual.endsWith("x")) {
! test1("a1b1a1b1", "(a1b1|a1b1x|a1b1a1b1|a1b1a1b1x)");
! } else {
! test1("a1b1a1b1", "(a1b1|a1b1x|a1b1a1b1|a1b1a1b1x)");
! }
+ BadKdc.setRatio(.2f);
rewriteMaxRetries(-1);
! test1("a5a5a5b5a5b5", "a5a5a5(b5){1,2}a5(b5){1,2}");
! test1("a5b5a5b5", "a5(b5){1,2}a5(b5){1,2}");
!
! BadKdc.setRatio(1f);
! rewriteMaxRetries(2);
! if (BadKdc.toReal(2000) > 1000) {
! // Explanation: if timeout is longer than 1s in tryLess,
! // we will see "a1" at 2nd kdc#1 access
! test1("a2a2b2a1b2", "a2a2(b2){1,2}a1(b2){1,2}");
! } else {
! test1("a2a2b2a2b2", "a2a2(b2){1,2}a2(b2){1,2}");
! }
!
! BadKdc.setRatio(1f);
rewriteUdpPrefLimit(-1, -1); // default, no limit
test2("UDP");
rewriteUdpPrefLimit(10, -1); // global rules
*** 88,123 ****
ds.close();
}
/**
* One round of test for max_retries and timeout.
! * @param timeout the expected timeout
! * @param count the expected total try
*/
! private static void test1(int timeout, int count) throws Exception {
! String timeoutTag = "timeout=" + BadKdc.toReal(timeout);
ByteArrayOutputStream bo = new ByteArrayOutputStream();
PrintStream oldout = System.out;
System.setOut(new PrintStream(bo));
Context c = Context.fromJAAS("client");
System.setOut(oldout);
String[] lines = new String(bo.toByteArray()).split("\n");
! System.out.println("----------------- TEST (" + timeout + "," +
! count + ") -----------------");
for (String line: lines) {
! if (line.startsWith(">>> KDCCommunication")) {
System.out.println(line);
! if (line.indexOf(timeoutTag) < 0) {
! throw new Exception("Wrong timeout value" + timeoutTag);
}
- count--;
}
}
! if (count != 0) {
! throw new Exception("Retry count is " + count + " less");
}
}
/**
* One round of test for udp_preference_limit.
* @param proto the expected protocol used
--- 133,188 ----
ds.close();
}
/**
* One round of test for max_retries and timeout.
! *
! * @param exact the expected exact match, where no timeout
! * happens for real KDCs
! * @param relaxed the expected relaxed match, where some timeout
! * could happen for real KDCs
! * @return the actual result
*/
! private static String test1(String exact, String relaxed) throws Exception {
ByteArrayOutputStream bo = new ByteArrayOutputStream();
PrintStream oldout = System.out;
System.setOut(new PrintStream(bo));
+ boolean failed = false;
+ long start = System.nanoTime();
+ try {
Context c = Context.fromJAAS("client");
+ } catch (LoginException e) {
+ failed = true;
+ }
System.setOut(oldout);
String[] lines = new String(bo.toByteArray()).split("\n");
! System.out.println("----------------- TEST (" + exact
! + ") -----------------");
!
! // Result, a series of timeout + kdc#
! StringBuilder sb = new StringBuilder();
for (String line: lines) {
! if (cm.match(line)) {
System.out.println(line);
! sb.append(cm.kdc()).append(cm.timeout());
}
}
+ if (failed) {
+ sb.append("x");
}
! System.out.println("Time: " + (System.nanoTime() - start) / 1000000000d);
! String actual = sb.toString();
! System.out.println("Actual: " + actual);
! if (actual.equals(exact)) {
! System.out.println("Exact match: " + exact);
! } else if (actual.matches(relaxed)) {
! System.out.println("!!!! Tolerant match: " + relaxed);
! } else {
! throw new Exception("Match neither " + exact + " nor " + relaxed);
}
+ return actual;
}
/**
* One round of test for udp_preference_limit.
* @param proto the expected protocol used
*** 131,145 ****
int count = 2;
String[] lines = new String(bo.toByteArray()).split("\n");
System.out.println("----------------- TEST -----------------");
for (String line: lines) {
! if (line.startsWith(">>> KDCCommunication")) {
System.out.println(line);
count--;
! if (line.indexOf(proto) < 0) {
! throw new Exception("Wrong timeout value");
}
}
}
if (count != 0) {
throw new Exception("Retry count is " + count + " less");
--- 196,210 ----
int count = 2;
String[] lines = new String(bo.toByteArray()).split("\n");
System.out.println("----------------- TEST -----------------");
for (String line: lines) {
! if (cm.match(line)) {
System.out.println(line);
count--;
! if (!cm.protocol().equals(proto)) {
! throw new Exception("Wrong protocol value");
}
}
}
if (count != 0) {
throw new Exception("Retry count is " + count + " less");
*** 158,167 ****
--- 223,233 ----
if (s == null) {
break;
}
if (s.startsWith("[realms]")) {
// Reconfig global setting
+ fw.write("kdc_timeout = 5000\n");
if (global != -1) {
fw.write("udp_preference_limit = " + global + "\n");
}
} else if (s.trim().startsWith("kdc = ")) {
if (realm != -1) {
*** 176,186 ****
sun.security.krb5.Config.refresh();
}
/**
* Set max_retries and timeout value for realm. The global value is always
! * 2 and 5000.
* @param value max_retries and timeout/1000 for a realm, -1 means none.
*/
private static void rewriteMaxRetries(int value) throws Exception {
BufferedReader fr = new BufferedReader(new FileReader(OneKDC.KRB5_CONF));
FileWriter fw = new FileWriter("alternative-krb5.conf");
--- 242,253 ----
sun.security.krb5.Config.refresh();
}
/**
* Set max_retries and timeout value for realm. The global value is always
! * 3 and 5000.
! *
* @param value max_retries and timeout/1000 for a realm, -1 means none.
*/
private static void rewriteMaxRetries(int value) throws Exception {
BufferedReader fr = new BufferedReader(new FileReader(OneKDC.KRB5_CONF));
FileWriter fw = new FileWriter("alternative-krb5.conf");
*** 189,208 ****
if (s == null) {
break;
}
if (s.startsWith("[realms]")) {
// Reconfig global setting
! fw.write("max_retries = 2\n");
fw.write("kdc_timeout = " + BadKdc.toReal(5000) + "\n");
} else if (s.trim().startsWith("kdc = ")) {
if (value != -1) {
// Reconfig for realm
fw.write(" max_retries = " + value + "\n");
fw.write(" kdc_timeout = " + BadKdc.toReal(value*1000) + "\n");
}
// Add a bad KDC as the first candidate
! fw.write(" kdc = localhost:33333\n");
}
fw.write(s + "\n");
}
fr.close();
fw.close();
--- 256,275 ----
if (s == null) {
break;
}
if (s.startsWith("[realms]")) {
// Reconfig global setting
! fw.write("max_retries = 3\n");
fw.write("kdc_timeout = " + BadKdc.toReal(5000) + "\n");
} else if (s.trim().startsWith("kdc = ")) {
if (value != -1) {
// Reconfig for realm
fw.write(" max_retries = " + value + "\n");
fw.write(" kdc_timeout = " + BadKdc.toReal(value*1000) + "\n");
}
// Add a bad KDC as the first candidate
! fw.write(" kdc = localhost:" + idlePort + "\n");
}
fw.write(s + "\n");
}
fr.close();
fw.close();
< prev index next >