1 /*
   2  * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 /* @test
  25  * @bug 8004502
  26  * @summary Sanity check to ensure that Kerberos cipher suites cannot be
  27  *   negotiated when running on a compact profile that does not include Kerberos
  28  */
  29 
  30 import java.net.*;
  31 import java.util.*;
  32 import javax.net.ssl.*;
  33 
  34 public class NoKerberos {
  35 
  36     static final List<String> KERBEROS_CIPHER_SUITES = Arrays.asList(
  37         "TLS_KRB5_WITH_RC4_128_SHA",
  38         "TLS_KRB5_WITH_RC4_128_MD5",
  39         "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
  40         "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
  41         "TLS_KRB5_WITH_DES_CBC_SHA",
  42         "TLS_KRB5_WITH_DES_CBC_MD5",
  43         "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
  44         "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
  45         "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
  46         "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5"
  47     );
  48 
  49     /**
  50      * Checks that the given array of supported cipher suites does not include
  51      * any Kerberos cipher suites.
  52      */
  53     static void checkNotSupported(String[] supportedSuites) {
  54         for (String suites: supportedSuites) {
  55             if (KERBEROS_CIPHER_SUITES.contains(suites)) {
  56                 throw new RuntimeException("Supported list of cipher suites " +
  57                     " should not include Kerberos cipher suites");
  58             }
  59         }
  60     }
  61 
  62     public static void main(String[] args) throws Exception {
  63         try {
  64             Class.forName("javax.security.auth.kerberos.KerberosPrincipal");
  65             System.out.println("Kerberos is present, nothing to test");
  66             return;
  67         } catch (ClassNotFoundException okay) { }
  68 
  69         // test SSLSocket
  70         try (Socket s = SSLSocketFactory.getDefault().createSocket()) {
  71             SSLSocket sslSocket = (SSLSocket)s;
  72 
  73             checkNotSupported(sslSocket.getSupportedCipherSuites());
  74 
  75             // attempt to enable each of the Kerberos cipher suites
  76             for (String kcs: KERBEROS_CIPHER_SUITES) {
  77                 String[] suites = { kcs };
  78                 try {
  79                     sslSocket.setEnabledCipherSuites(suites);
  80                     throw new RuntimeException("SSLSocket.setEnabledCipherSuitessuites allowed " +
  81                         kcs + " but Kerberos not supported");
  82                 } catch (IllegalArgumentException expected) { }
  83             }
  84         }
  85 
  86         // test SSLServerSocket
  87         try (ServerSocket ss = SSLServerSocketFactory.getDefault().createServerSocket()) {
  88             SSLServerSocket sslSocket = (SSLServerSocket)ss;
  89 
  90             checkNotSupported(sslSocket.getSupportedCipherSuites());
  91 
  92             // attempt to enable each of the Kerberos cipher suites
  93             for (String kcs: KERBEROS_CIPHER_SUITES) {
  94                 String[] suites = { kcs };
  95                 try {
  96                     sslSocket.setEnabledCipherSuites(suites);
  97                     throw new RuntimeException("SSLSocket.setEnabledCipherSuitessuites allowed " +
  98                         kcs + " but Kerberos not supported");
  99                 } catch (IllegalArgumentException expected) { }
 100             }
 101         }
 102     }
 103 }