Java SecurityProtocol.SASL_PLAINTEXT属性代码示例

/**
 * @param securityProtocol the securityProtocol
 * @param contextType the contextType, it must be non-null if `securityProtocol` is SASL_*; it is ignored otherwise
 * @param config client config
 * @param listenerName the listenerName if contextType is SERVER or null otherwise
 * @param clientSaslMechanism SASL mechanism if mode is CLIENT, ignored otherwise
 * @param saslHandshakeRequestEnable flag to enable Sasl handshake requests; disabled only for SASL
 *             inter-broker connections with inter-broker protocol version < 0.10
 * @return the configured `ChannelBuilder`
 * @throws IllegalArgumentException if `mode` invariants described above is not maintained
 */
public static ChannelBuilder clientChannelBuilder(SecurityProtocol securityProtocol,
        JaasContext.Type contextType,
        AbstractConfig config,
        ListenerName listenerName,
        String clientSaslMechanism,
        boolean saslHandshakeRequestEnable) {

    if (securityProtocol == SecurityProtocol.SASL_PLAINTEXT || securityProtocol == SecurityProtocol.SASL_SSL) {
        if (contextType == null)
            throw new IllegalArgumentException("`contextType` must be non-null if `securityProtocol` is `" + securityProtocol + "`");
        if (clientSaslMechanism == null)
            throw new IllegalArgumentException("`clientSaslMechanism` must be non-null in client mode if `securityProtocol` is `" + securityProtocol + "`");
    }
    return create(securityProtocol, Mode.CLIENT, contextType, config, listenerName, clientSaslMechanism,
            saslHandshakeRequestEnable, null);
}
 

/**
 * Tests that unsupported version of ApiVersionsRequest before SASL handshake request
 * returns error response and does not result in authentication failure. This test
 * is similar to {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testApiVersionsRequestWithUnsupportedVersion() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send ApiVersionsRequest with unsupported version and validate error response.
    String node = "1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node);
    RequestHeader header = new RequestHeader(ApiKeys.API_VERSIONS.id, Short.MAX_VALUE, "someclient", 1);
    ApiVersionsRequest request = new ApiVersionsRequest.Builder().build();
    selector.send(request.toSend(node, header));
    ByteBuffer responseBuffer = waitForResponse();
    ResponseHeader.parse(responseBuffer);
    ApiVersionsResponse response = ApiVersionsResponse.parse(responseBuffer, (short) 0);
    assertEquals(Errors.UNSUPPORTED_VERSION, response.error());

    // Send ApiVersionsRequest with a supported version. This should succeed.
    sendVersionRequestReceiveResponse(node);

    // Test that client can authenticate successfully
    sendHandshakeRequestReceiveResponse(node);
    authenticateUsingSaslPlainAndCheckConnection(node);
}
 

/**
 * Tests that unsupported version of SASL handshake request returns error
 * response and fails authentication. This test is similar to
 * {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testSaslHandshakeRequestWithUnsupportedVersion() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send ApiVersionsRequest and validate error response.
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    SaslHandshakeRequest request = new SaslHandshakeRequest("PLAIN");
    RequestHeader header = new RequestHeader(ApiKeys.SASL_HANDSHAKE.id, Short.MAX_VALUE, "someclient", 2);
    selector.send(request.toSend(node1, header));
    NetworkTestUtils.waitForChannelClose(selector, node1, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");
}
 

/**
 * Tests that ApiVersionsRequest after Kafka SASL handshake request flow,
 * but prior to actual SASL authentication, results in authentication failure.
 * This is similar to {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testInvalidApiVersionsRequestSequence() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send handshake request followed by ApiVersionsRequest
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    sendHandshakeRequestReceiveResponse(node1);

    ApiVersionsRequest request = new ApiVersionsRequest.Builder().build();
    RequestHeader versionsHeader = new RequestHeader(ApiKeys.API_VERSIONS.id,
            request.version(), "someclient", 2);
    selector.send(request.toSend(node1, versionsHeader));
    NetworkTestUtils.waitForChannelClose(selector, node1, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");
}
 

public NioEchoServer(ListenerName listenerName, SecurityProtocol securityProtocol, AbstractConfig config,
        String serverHost, ChannelBuilder channelBuilder) throws Exception {
    super("echoserver");
    setDaemon(true);
    serverSocketChannel = ServerSocketChannel.open();
    serverSocketChannel.configureBlocking(false);
    serverSocketChannel.socket().bind(new InetSocketAddress(serverHost, 0));
    this.port = serverSocketChannel.socket().getLocalPort();
    this.socketChannels = Collections.synchronizedList(new ArrayList<SocketChannel>());
    this.newChannels = Collections.synchronizedList(new ArrayList<SocketChannel>());
    this.credentialCache = new CredentialCache();
    if (securityProtocol == SecurityProtocol.SASL_PLAINTEXT || securityProtocol == SecurityProtocol.SASL_SSL)
        ScramCredentialUtils.createCache(credentialCache, ScramMechanism.mechanismNames());
    if (channelBuilder == null)
        channelBuilder = ChannelBuilders.serverChannelBuilder(listenerName, securityProtocol, config, credentialCache);
    this.selector = new Selector(5000, new Metrics(), new MockTime(), "MetricGroup", channelBuilder);
    acceptorThread = new AcceptorThread();
}
 

/**
 * Tests that unsupported version of ApiVersionsRequest before SASL handshake request
 * returns error response and does not result in authentication failure. This test
 * is similar to {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testApiVersionsRequestWithUnsupportedVersion() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);

    // Send ApiVersionsRequest with unsupported version and validate error response.
    String node = "1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node);
    RequestHeader header = new RequestHeader(ApiKeys.API_VERSIONS.id, Short.MAX_VALUE, "someclient", 1);
    selector.send(new NetworkSend(node, RequestSend.serialize(header, new ApiVersionsRequest().toStruct())));
    ByteBuffer responseBuffer = waitForResponse();
    ResponseHeader.parse(responseBuffer);
    ApiVersionsResponse response = ApiVersionsResponse.parse(responseBuffer);
    assertEquals(Errors.UNSUPPORTED_VERSION.code(), response.errorCode());

    // Send ApiVersionsRequest with a supported version. This should succeed.
    sendVersionRequestReceiveResponse(node);

    // Test that client can authenticate successfully
    sendHandshakeRequestReceiveResponse(node);
    authenticateUsingSaslPlainAndCheckConnection(node);
}
 

/**
 * Tests that unsupported version of SASL handshake request returns error
 * response and fails authentication. This test is similar to
 * {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testSaslHandshakeRequestWithUnsupportedVersion() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);

    // Send ApiVersionsRequest and validate error response.
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    RequestHeader header = new RequestHeader(ApiKeys.SASL_HANDSHAKE.id, Short.MAX_VALUE, "someclient", 2);
    selector.send(new NetworkSend(node1, RequestSend.serialize(header, new SaslHandshakeRequest("PLAIN").toStruct())));
    NetworkTestUtils.waitForChannelClose(selector, node1);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");
}
 

/**
 * Tests that ApiVersionsRequest after Kafka SASL handshake request flow,
 * but prior to actual SASL authentication, results in authentication failure.
 * This is similar to {@link #testUnauthenticatedApiVersionsRequest(SecurityProtocol)}
 * where a non-SASL client is used to send requests that are processed by
 * {@link SaslServerAuthenticator} of the server prior to client authentication.
 */
@Test
public void testInvalidApiVersionsRequestSequence() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);

    // Send handshake request followed by ApiVersionsRequest
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    sendHandshakeRequestReceiveResponse(node1);

    RequestHeader versionsHeader = new RequestHeader(ApiKeys.API_VERSIONS.id, "someclient", 2);
    selector.send(new NetworkSend(node1, RequestSend.serialize(versionsHeader, new ApiVersionsRequest().toStruct())));
    NetworkTestUtils.waitForChannelClose(selector, node1);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");
}
 

/**
 * Tests good path SASL/PLAIN client and server channels using PLAINTEXT transport layer.
 */
@Test
public void testValidSaslPlainOverPlaintext() throws Exception {
    String node = "0";
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));

    server = createEchoServer(securityProtocol);
    createAndCheckClientConnection(securityProtocol, node);
}
 

/**
 * Tests that any invalid data during Kafka SASL handshake request flow
 * or the actual SASL authentication flow result in authentication failure
 * and do not cause any failures in the server.
 */
@Test
public void testInvalidSaslPacket() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send invalid SASL packet after valid handshake request
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    sendHandshakeRequestReceiveResponse(node1);
    Random random = new Random();
    byte[] bytes = new byte[1024];
    random.nextBytes(bytes);
    selector.send(new NetworkSend(node1, ByteBuffer.wrap(bytes)));
    NetworkTestUtils.waitForChannelClose(selector, node1, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");

    // Send invalid SASL packet before handshake request
    String node2 = "invalid2";
    createClientConnection(SecurityProtocol.PLAINTEXT, node2);
    random.nextBytes(bytes);
    selector.send(new NetworkSend(node2, ByteBuffer.wrap(bytes)));
    NetworkTestUtils.waitForChannelClose(selector, node2, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good2");
}
 

/**
 * Tests that packets that are too big during Kafka SASL handshake request flow
 * or the actual SASL authentication flow result in authentication failure
 * and do not cause any failures in the server.
 */
@Test
public void testPacketSizeTooBig() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send SASL packet with large size after valid handshake request
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    sendHandshakeRequestReceiveResponse(node1);
    ByteBuffer buffer = ByteBuffer.allocate(1024);
    buffer.putInt(Integer.MAX_VALUE);
    buffer.put(new byte[buffer.capacity() - 4]);
    buffer.rewind();
    selector.send(new NetworkSend(node1, buffer));
    NetworkTestUtils.waitForChannelClose(selector, node1, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");

    // Send packet with large size before handshake request
    String node2 = "invalid2";
    createClientConnection(SecurityProtocol.PLAINTEXT, node2);
    buffer.clear();
    buffer.putInt(Integer.MAX_VALUE);
    buffer.put(new byte[buffer.capacity() - 4]);
    buffer.rewind();
    selector.send(new NetworkSend(node2, buffer));
    NetworkTestUtils.waitForChannelClose(selector, node2, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good2");
}
 

/**
 * Tests that Kafka requests that are forbidden until successful authentication result
 * in authentication failure and do not cause any failures in the server.
 */
@Test
public void testDisallowedKafkaRequestsBeforeAuthentication() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = createEchoServer(securityProtocol);

    // Send metadata request before Kafka SASL handshake request
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    MetadataRequest metadataRequest1 = new MetadataRequest.Builder(Collections.singletonList("sometopic"),
            true).build();
    RequestHeader metadataRequestHeader1 = new RequestHeader(ApiKeys.METADATA.id, metadataRequest1.version(),
            "someclient", 1);
    selector.send(metadataRequest1.toSend(node1, metadataRequestHeader1));
    NetworkTestUtils.waitForChannelClose(selector, node1, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");

    // Send metadata request after Kafka SASL handshake request
    String node2 = "invalid2";
    createClientConnection(SecurityProtocol.PLAINTEXT, node2);
    sendHandshakeRequestReceiveResponse(node2);
    MetadataRequest metadataRequest2 = new MetadataRequest.Builder(Collections.singletonList("sometopic"), true).build();
    RequestHeader metadataRequestHeader2 = new RequestHeader(ApiKeys.METADATA.id,
            metadataRequest2.version(), "someclient", 2);
    selector.send(metadataRequest2.toSend(node2, metadataRequestHeader2));
    NetworkTestUtils.waitForChannelClose(selector, node2, ChannelState.READY);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good2");
}
 

@Test
public void testJaasConfigurationForListener() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "PLAIN");
    saslServerConfigs.put(SaslConfigs.SASL_ENABLED_MECHANISMS, Arrays.asList("PLAIN"));

    TestJaasConfig staticJaasConfig = new TestJaasConfig();

    Map<String, Object> globalServerOptions = new HashMap<>();
    globalServerOptions.put("user_global1", "gsecret1");
    globalServerOptions.put("user_global2", "gsecret2");
    staticJaasConfig.createOrUpdateEntry(TestJaasConfig.LOGIN_CONTEXT_SERVER, PlainLoginModule.class.getName(),
            globalServerOptions);

    Map<String, Object> clientListenerServerOptions = new HashMap<>();
    clientListenerServerOptions.put("user_client1", "csecret1");
    clientListenerServerOptions.put("user_client2", "csecret2");
    String clientJaasEntryName = "client." + TestJaasConfig.LOGIN_CONTEXT_SERVER;
    staticJaasConfig.createOrUpdateEntry(clientJaasEntryName, PlainLoginModule.class.getName(), clientListenerServerOptions);
    Configuration.setConfiguration(staticJaasConfig);

    // Listener-specific credentials
    server = createEchoServer(new ListenerName("client"), securityProtocol);
    saslClientConfigs.put(SaslConfigs.SASL_JAAS_CONFIG,
            TestJaasConfig.jaasConfigProperty("PLAIN", "client1", "csecret1"));
    createAndCheckClientConnection(securityProtocol, "1");
    saslClientConfigs.put(SaslConfigs.SASL_JAAS_CONFIG,
            TestJaasConfig.jaasConfigProperty("PLAIN", "global1", "gsecret1"));
    createAndCheckClientConnectionFailure(securityProtocol, "2");
    server.close();

    // Global credentials as there is no listener-specific JAAS entry
    server = createEchoServer(new ListenerName("other"), securityProtocol);
    saslClientConfigs.put(SaslConfigs.SASL_JAAS_CONFIG,
            TestJaasConfig.jaasConfigProperty("PLAIN", "global1", "gsecret1"));
    createAndCheckClientConnection(securityProtocol, "3");
    saslClientConfigs.put(SaslConfigs.SASL_JAAS_CONFIG,
            TestJaasConfig.jaasConfigProperty("PLAIN", "client1", "csecret1"));
    createAndCheckClientConnectionFailure(securityProtocol, "4");
}
 

/**
 * Tests good path SASL/PLAIN client and server channels using PLAINTEXT transport layer.
 */
@Test
public void testValidSaslPlainOverPlaintext() throws Exception {
    String node = "0";
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));

    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);
    createAndCheckClientConnection(securityProtocol, node);
}
 

/**
 * Tests that any invalid data during Kafka SASL handshake request flow
 * or the actual SASL authentication flow result in authentication failure
 * and do not cause any failures in the server.
 */
@Test
public void testInvalidSaslPacket() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_PLAINTEXT;
    configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);

    // Send invalid SASL packet after valid handshake request
    String node1 = "invalid1";
    createClientConnection(SecurityProtocol.PLAINTEXT, node1);
    sendHandshakeRequestReceiveResponse(node1);
    Random random = new Random();
    byte[] bytes = new byte[1024];
    random.nextBytes(bytes);
    selector.send(new NetworkSend(node1, ByteBuffer.wrap(bytes)));
    NetworkTestUtils.waitForChannelClose(selector, node1);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good1");

    // Send invalid SASL packet before handshake request
    String node2 = "invalid2";
    createClientConnection(SecurityProtocol.PLAINTEXT, node2);
    random.nextBytes(bytes);
    selector.send(new NetworkSend(node2, ByteBuffer.wrap(bytes)));
    NetworkTestUtils.waitForChannelClose(selector, node2);
    selector.close();

    // Test good connection still works
    createAndCheckClientConnection(securityProtocol, "good2");
}