RFR 8181461: sun/security/krb5/auto/KdcPolicy.java fails with java.lang.Exception: Does not match

[Sibabrata Sahoo]

Change looks fine to me. But I am not the reviewer yet.

Thanks,
Siba

-----Original Message-----
From: Weijun Wang 
Sent: Tuesday, June 06, 2017 11:23 AM
To: Security Dev OpenJDK
Cc: Gustavo Galimberti; Sibabrata Sahoo
Subject: RFR 8181461: sun/security/krb5/auto/KdcPolicy.java fails with java.lang.Exception: Does not match

Please take a review on this change:

    http://cr.openjdk.java.net/~weijun/8181461/webrev.00/

This is a test bug and the fix is simply:

          // 1. Default policy is tryLast ....
          writeConf(1, 3000, p1, p3);
-        test("a3000c3000c3000|a3000c3000-|a3000c3000c3000-");
+        test("a3000c3000c3000|a3000c3000-|a3000c3000c3000a3000-");

Here, max_retries is 1 and timeout is 3000ms. A is a KDC that never replies, and C is one that usually replies in time.

Here the test client might send out 2 AS_REQs, the initial one and the one with preauth. We should observe these possible results:

(1). C always replies in time:

   1. Initial AS_REQ sent to A, timeout (a3000)
   2. Initial AS_REQ sent to C, succeed (c3000)
   3. AS_REQ with preauth sent to C (try last good), succeed (c3000)

(2). C fails the 1st time:

   1. Initial AS_REQ sent to A, timeout (a3000)
   2. Initial AS_REQ sent to C, timeout (c3000)
   3. Final result is failure (-)

(3). C succeeds for the 1st time but fails later:

   1. Initial AS_REQ sent to A, timeout (a3000)
   2. Initial AS_REQ sent to C, succeed (c3000)
   3. AS_REQ with preauth sent to C (try last good), timeout (c3000)
   4. AS_REQ with preauth sent to A, timeout (a3000)
   5. Final result is failure (-)

The original test code has a bug with case (3), where it assumes #4 above is not sent, this is wrong. AS_REQ with preauth is a new request different from the initial AS_REQ. The order of preference is changed according to the policy (set to tryLast) but all KDCs will still be tried.

Thanks
Max