Mercurial > hg > release > icedtea6-1.10

changeset 2585:5b164019304c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Backport Kerberos fixes from b24. 2012-08-31 Andrew John Hughes <ahughes@redhat.com> * Makefile.am: Add patches. * NEWS: Update. * patches/openjdk/6815182-gssapi_spnego_does_not_work_with_server.patch, * patches/openjdk/6979329-ccacheinput_stream_fails_to_read_ticket_cache.patch, * patches/openjdk/7110373-krb5_test_infrastructure.patch: Backported Kerberos fixes from b24.
author Andrew John Hughes <ahughes@redhat.com>
date Fri, 31 Aug 2012 17:42:10 +0100
parents fa657fd33ff2
children bb69c927dd0a
files ChangeLog Makefile.am NEWS patches/openjdk/6815182-gssapi_spnego_does_not_work_with_server.patch patches/openjdk/6979329-ccacheinput_stream_fails_to_read_ticket_cache.patch patches/openjdk/7110373-krb5_test_infrastructure.patch
diffstat 6 files changed, 653 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/ChangeLog	Fri Aug 31 17:07:24 2012 +0100
+++ b/ChangeLog	Fri Aug 31 17:42:10 2012 +0100
@@ -1,3 +1,12 @@
+2012-08-31  Andrew John Hughes  <ahughes@redhat.com>
+
+	* Makefile.am: Add patches.
+	* NEWS: Update.
+	* patches/openjdk/6815182-gssapi_spnego_does_not_work_with_server.patch,
+	* patches/openjdk/6979329-ccacheinput_stream_fails_to_read_ticket_cache.patch,
+	* patches/openjdk/7110373-krb5_test_infrastructure.patch:
+	Backported Kerberos fixes from b24.
+
 2012-08-31  Andrew John Hughes  <ahughes@redhat.com>
 
 	* NEWS: Updated with latest fixes.
--- a/Makefile.am	Fri Aug 31 17:07:24 2012 +0100
+++ b/Makefile.am	Fri Aug 31 17:42:10 2012 +0100
@@ -400,7 +400,10 @@
 	patches/openjdk/7140882-dont-return-booleans-from-methods-returning-pointers.patch \
 	patches/openjdk/remove-mimpure-option-to-gcc.patch \
 	patches/coverage-table.patch \
-	patches/openjdk/7185678-xmenuitem_peer_npe.patch
+	patches/openjdk/7185678-xmenuitem_peer_npe.patch \
+	patches/openjdk/6815182-gssapi_spnego_does_not_work_with_server.patch \
+	patches/openjdk/6979329-ccacheinput_stream_fails_to_read_ticket_cache.patch \
+	patches/openjdk/7110373-krb5_test_infrastructure.patch
 
 if WITH_ALT_HSBUILD
 ICEDTEA_PATCHES += \
--- a/NEWS	Fri Aug 31 17:07:24 2012 +0100
+++ b/NEWS	Fri Aug 31 17:42:10 2012 +0100
@@ -17,6 +17,9 @@
 * OpenJDK
   - S7182135: Impossible to use some editors directly
   - S7185678: java/awt/Menu/NullMenuLabelTest/NullMenuLabelTest.java failed with NPE
+  - S6815182: GSSAPI/SPNEGO does not work with server using MIT Kerberos library
+  - S6979329: CCacheInputStream fails to read ticket cache files from Kerberos 1.8.1
+  - S7110373: krb5 test in openjdk6 without test infrastructure
 
 New in release 1.10.8 (2012-06-12):
 
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/openjdk/6815182-gssapi_spnego_does_not_work_with_server.patch	Fri Aug 31 17:42:10 2012 +0100
@@ -0,0 +1,206 @@
+# HG changeset patch
+# User weijun
+# Date 1236907256 -28800
+# Node ID d4f7664a6c3ca90e09480ccfea4806e44bc9d967
+# Parent  95ac2f7ddad0b8350d5ea3aed7d7d028c44396ba
+6815182: GSSAPI/SPNEGO does not work with server using MIT Kerberos library
+Reviewed-by: valeriep
+
+diff --git a/src/share/classes/sun/security/jgss/spnego/NegTokenInit.java b/src/share/classes/sun/security/jgss/spnego/NegTokenInit.java
+--- openjdk/jdk/src/share/classes/sun/security/jgss/spnego/NegTokenInit.java
++++ openjdk/jdk/src/share/classes/sun/security/jgss/spnego/NegTokenInit.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2005, 2009, Oracle and/or its affiliates. All rights reserved.
+  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+  *
+  * This code is free software; you can redistribute it and/or modify it
+@@ -66,11 +66,11 @@
+     private byte[] mechTypes = null;
+     private Oid[] mechTypeList = null;
+ 
+-    private byte[] reqFlags = null;
++    private BitArray reqFlags = null;
+     private byte[] mechToken = null;
+     private byte[] mechListMIC = null;
+ 
+-    NegTokenInit(byte[] mechTypes, byte[] flags,
++    NegTokenInit(byte[] mechTypes, BitArray flags,
+                 byte[] token, byte[] mechListMIC)
+     {
+         super(NEG_TOKEN_INIT_ID);
+@@ -101,7 +101,7 @@
+             // write context flags with CONTEXT 01
+             if (reqFlags != null) {
+                 DerOutputStream flags = new DerOutputStream();
+-                flags.putBitString(reqFlags);
++                flags.putUnalignedBitString(reqFlags);
+                 initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+                                                 true, (byte) 0x01), flags);
+             }
+@@ -237,7 +237,7 @@
+         return mechTypeList;
+     }
+ 
+-    byte[] getReqFlags() {
++    BitArray getReqFlags() {
+         return reqFlags;
+     }
+ 
+diff --git a/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java b/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
+--- openjdk/jdk/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
++++ openjdk/jdk/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2005, 2009, Oracle and/or its affiliates. All rights reserved.
+  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+  *
+  * This code is free software; you can redistribute it and/or modify it
+@@ -53,13 +53,6 @@
+ 
+     private int state = STATE_NEW;
+ 
+-    private static final int CHECKSUM_DELEG_FLAG    = 1;
+-    private static final int CHECKSUM_MUTUAL_FLAG   = 2;
+-    private static final int CHECKSUM_REPLAY_FLAG   = 4;
+-    private static final int CHECKSUM_SEQUENCE_FLAG = 8;
+-    private static final int CHECKSUM_CONF_FLAG     = 16;
+-    private static final int CHECKSUM_INTEG_FLAG    = 32;
+-
+     /*
+      * Optional features that the application can set and their default
+      * values.
+@@ -700,25 +693,17 @@
+     /**
+      * get the context flags
+      */
+-    private byte[] getContextFlags() {
+-        int flags = 0;
++    private BitArray getContextFlags() {
++        BitArray out = new BitArray(7);
+ 
+-        if (getCredDelegState())
+-            flags |= CHECKSUM_DELEG_FLAG;
+-        if (getMutualAuthState())
+-            flags |= CHECKSUM_MUTUAL_FLAG;
+-        if (getReplayDetState())
+-            flags |= CHECKSUM_REPLAY_FLAG;
+-        if (getSequenceDetState())
+-            flags |= CHECKSUM_SEQUENCE_FLAG;
+-        if (getIntegState())
+-            flags |= CHECKSUM_INTEG_FLAG;
+-        if (getConfState())
+-            flags |= CHECKSUM_CONF_FLAG;
++        if (getCredDelegState()) out.set(0, true);
++        if (getMutualAuthState()) out.set(1, true);
++        if (getReplayDetState()) out.set(2, true);
++        if (getSequenceDetState()) out.set(3, true);
++        if (getConfState()) out.set(5, true);
++        if (getIntegState()) out.set(6, true);
+ 
+-        byte[] temp = new byte[1];
+-        temp[0] = (byte)(flags & 0xff);
+-        return temp;
++        return out;
+     }
+ 
+     private void setContextFlags() {
+diff --git a/test/sun/security/krb5/auto/SpnegoReqFlags.java b/test/sun/security/krb5/auto/SpnegoReqFlags.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/test/sun/security/krb5/auto/SpnegoReqFlags.java
+@@ -0,0 +1,92 @@
++/*
++ * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions. 
++ */
++
++/*
++ * @test
++ * @bug 6815182
++ * @summary GSSAPI/SPNEGO does not work with server using MIT Kerberos library
++ */
++
++import sun.security.jgss.GSSUtil;
++import sun.security.util.BitArray;
++import sun.security.util.DerInputStream;
++import sun.security.util.DerValue;
++
++public class SpnegoReqFlags {
++
++    public static void main(String[] args)
++            throws Exception {
++
++        // Create and start the KDC
++        new OneKDC(null).writeJAASConf();
++        new SpnegoReqFlags().go();
++    }
++
++    void go() throws Exception {
++        Context c = Context.fromJAAS("client");
++        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_SPNEGO_MECH_OID);
++
++        byte[] token = c.doAs(new Action() {
++            @Override
++            public byte[] run(Context me, byte[] input) throws Exception {
++                me.x().requestCredDeleg(true);
++                me.x().requestReplayDet(false);
++                me.x().requestSequenceDet(false);
++                return me.x().initSecContext(new byte[0], 0, 0);
++            }
++        }, null);
++
++        DerValue d = new DerValue(token);   // GSSToken
++        DerInputStream ins = d.data;        // OID + mech token
++        d.data.getDerValue();               // skip OID
++        d = d.data.getDerValue();           // NegTokenInit
++        d = d.data.getDerValue();           // The SEQUENCE inside
++
++        boolean found = false;
++
++        // Go through all fields inside NegTokenInit. The reqFlags field
++        // is optional. It's even not recommended in RFC 4178.
++        while (d.data.available() > 0) {
++            DerValue d2 = d.data.getDerValue();
++            if (d2.isContextSpecific((byte)1)) {
++                found = true;
++                System.out.println("regFlags field located.");
++                BitArray ba = d2.data.getUnalignedBitString();
++                if (ba.length() != 7) {
++                    throw new Exception("reqFlags should contain 7 bits");
++                }
++                if (!ba.get(0)) {
++                    throw new Exception("delegFlag should be true");
++                }
++                if (ba.get(2) || ba.get(3)) {
++                    throw new Exception("replay/sequenceFlag should be false");
++                }
++            }
++        }
++
++        if (!found) {
++            System.out.println("Warning: regFlags field not found, too new?");
++        }
++        c.dispose();
++    }
++}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/openjdk/6979329-ccacheinput_stream_fails_to_read_ticket_cache.patch	Fri Aug 31 17:42:10 2012 +0100
@@ -0,0 +1,326 @@
+# HG changeset patch
+# User weijun
+# Date 1290390238 -28800
+# Node ID b139627f7bc3ef57bf7e4a49490783ab9dbfcd95
+# Parent  d4f7664a6c3ca90e09480ccfea4806e44bc9d967
+6979329: CCacheInputStream fails to read ticket cache files from Kerberos 1.8.1
+Reviewed-by: valeriep
+
+diff --git a/src/share/classes/sun/security/krb5/internal/ccache/CCacheInputStream.java b/src/share/classes/sun/security/krb5/internal/ccache/CCacheInputStream.java
+--- openjdk/jdk/src/share/classes/sun/security/krb5/internal/ccache/CCacheInputStream.java
++++ openjdk/jdk/src/share/classes/sun/security/krb5/internal/ccache/CCacheInputStream.java
+@@ -247,16 +247,16 @@
+         else return null;
+     }
+ 
+-    Ticket readData() throws IOException, RealmException, KrbApErrException, Asn1Exception {
++    byte[] readData() throws IOException {
+         int length;
+         length = read(4);
+-        if (length > 0) {
++        if (length == 0) {
++            return null;
++        } else {
+             byte[] bytes = new byte[length];
+             read(bytes, 0, length);
+-            Ticket ticket = new Ticket(bytes);
+-            return ticket;
++            return bytes;
+         }
+-        else return null;
+     }
+ 
+     boolean[] readFlags() throws IOException {
+@@ -325,6 +325,17 @@
+         }
+         return flags;
+     }
++
++    /**
++     * Reads the next cred in stream.
++     * @return the next cred, null if ticket or second_ticket unparseable.
++     *
++     * Note: MIT krb5 1.8.1 might generate a config entry with server principal
++     * X-CACHECONF:/krb5_ccache_conf_data/fast_avail/krbtgt/REALM@REALM. The
++     * entry is used by KDC to inform the client that it support certain
++     * features. Its ticket is not a valid krb5 ticket and thus this method
++     * returns null.
++     */
+     Credentials readCred(int version) throws IOException,RealmException, KrbApErrException, Asn1Exception {
+         PrincipalName cpname = readPrincipal(version);
+         if (DEBUG)
+@@ -360,17 +371,17 @@
+         if (auData != null) {
+             auData = new AuthorizationData(auDataEntry);
+         }
+-        Ticket ticket = readData();
+-        if (DEBUG) {
+-            System.out.println(">>>DEBUG <CCacheInputStream>");
+-            if (ticket == null) {
+-                System.out.println("///ticket is null");
+-            }
++        byte[] ticketData = readData();
++        byte[] ticketData2 = readData();
++
++        try {
++            return new Credentials(cpname, spname, key, authtime, starttime,
++                endtime, renewTill, skey, tFlags,
++                addrs, auData,
++                ticketData != null ? new Ticket(ticketData) : null,
++                ticketData2 != null ? new Ticket(ticketData2) : null);
++        } catch (Exception e) {     // If any of new Ticket(*) fails.
++            return null;
+         }
+-        Ticket secTicket = readData();
+-        Credentials cred = new Credentials(cpname, spname, key, authtime, starttime,
+-                                           endtime, renewTill, skey, tFlags,
+-                                           addrs, auData, ticket, secTicket);
+-        return cred;
+     }
+ }
+diff --git a/src/share/classes/sun/security/krb5/internal/ccache/FileCredentialsCache.java b/src/share/classes/sun/security/krb5/internal/ccache/FileCredentialsCache.java
+--- openjdk/jdk/src/share/classes/sun/security/krb5/internal/ccache/FileCredentialsCache.java
++++ openjdk/jdk/src/share/classes/sun/security/krb5/internal/ccache/FileCredentialsCache.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+  *
+  * This code is free software; you can redistribute it and/or modify it
+@@ -186,7 +186,10 @@
+         primaryRealm = primaryPrincipal.getRealm();
+         credentialsList = new Vector<Credentials> ();
+         while (cis.available() > 0) {
+-            credentialsList.addElement(cis.readCred(version));
++            Credentials cred = cis.readCred(version);
++            if (cred != null) {
++                credentialsList.addElement(cred);
++            }
+         }
+         cis.close();
+     }
+diff --git a/test/sun/security/krb5/UnknownCCEntry.java b/test/sun/security/krb5/UnknownCCEntry.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/test/sun/security/krb5/UnknownCCEntry.java
+@@ -0,0 +1,219 @@
++/*
++ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++/*
++ * @test
++ * @bug 6979329
++ * @summary CCacheInputStream fails to read ticket cache files from Kerberos 1.8.1
++ */
++
++import java.io.ByteArrayInputStream;
++import java.io.File;
++import java.io.FileOutputStream;
++import sun.security.krb5.internal.ccache.CCacheInputStream;
++import sun.security.krb5.internal.ccache.CredentialsCache;
++
++public class UnknownCCEntry {
++    public static void main(String[] args) throws Exception {
++        // This is a ccache file generated on a test machine:
++        // Default principal: dummy@MAX.LOCAL
++        // Valid starting     Expires            Service principal
++        // 08/24/10 10:37:28  08/25/10 10:37:28  krbtgt/MAX.LOCAL@MAX.LOCAL
++        // Flags: FI, Etype (skey, tkt): AES-128 CTS mode with 96-bit SHA-1
++        //        HMAC, AES-256 CTS mode with 96-bit SHA-1 HMAC
++        byte[] krb5cc = {
++            (byte)0x05, (byte)0x04, (byte)0x00, (byte)0x0C,
++            (byte)0x00, (byte)0x01, (byte)0x00, (byte)0x08,
++            (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFA,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x01,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x01,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x09,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x05, (byte)0x64, (byte)0x75, (byte)0x6D,
++            (byte)0x6D, (byte)0x79, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x01, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x01, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x09, (byte)0x4D, (byte)0x41,
++            (byte)0x58, (byte)0x2E, (byte)0x4C, (byte)0x4F,
++            (byte)0x43, (byte)0x41, (byte)0x4C, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x05, (byte)0x64,
++            (byte)0x75, (byte)0x6D, (byte)0x6D, (byte)0x79,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x02,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x09,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x06, (byte)0x6B, (byte)0x72, (byte)0x62,
++            (byte)0x74, (byte)0x67, (byte)0x74, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x09, (byte)0x4D,
++            (byte)0x41, (byte)0x58, (byte)0x2E, (byte)0x4C,
++            (byte)0x4F, (byte)0x43, (byte)0x41, (byte)0x4C,
++            (byte)0x00, (byte)0x11, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x10, (byte)0x92, (byte)0x1D,
++            (byte)0x1A, (byte)0x0C, (byte)0x7F, (byte)0xB8,
++            (byte)0x01, (byte)0x2E, (byte)0xC9, (byte)0xF5,
++            (byte)0x7B, (byte)0x92, (byte)0x81, (byte)0xCA,
++            (byte)0x49, (byte)0xC5, (byte)0x4C, (byte)0x73,
++            (byte)0x30, (byte)0x68, (byte)0x4C, (byte)0x73,
++            (byte)0x30, (byte)0x68, (byte)0x4C, (byte)0x74,
++            (byte)0x81, (byte)0xE8, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x40,
++            (byte)0x41, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x01, (byte)0x29, (byte)0x61,
++            (byte)0x82, (byte)0x01, (byte)0x25, (byte)0x30,
++            (byte)0x82, (byte)0x01, (byte)0x21, (byte)0xA0,
++            (byte)0x03, (byte)0x02, (byte)0x01, (byte)0x05,
++            (byte)0xA1, (byte)0x0B, (byte)0x1B, (byte)0x09,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0xA2, (byte)0x1E, (byte)0x30,
++            (byte)0x1C, (byte)0xA0, (byte)0x03, (byte)0x02,
++            (byte)0x01, (byte)0x00, (byte)0xA1, (byte)0x15,
++            (byte)0x30, (byte)0x13, (byte)0x1B, (byte)0x06,
++            (byte)0x6B, (byte)0x72, (byte)0x62, (byte)0x74,
++            (byte)0x67, (byte)0x74, (byte)0x1B, (byte)0x09,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0xA3, (byte)0x81, (byte)0xEC,
++            (byte)0x30, (byte)0x81, (byte)0xE9, (byte)0xA0,
++            (byte)0x03, (byte)0x02, (byte)0x01, (byte)0x12,
++            (byte)0xA1, (byte)0x03, (byte)0x02, (byte)0x01,
++            (byte)0x01, (byte)0xA2, (byte)0x81, (byte)0xDC,
++            (byte)0x04, (byte)0x81, (byte)0xD9, (byte)0xFB,
++            (byte)0x4B, (byte)0xD2, (byte)0x55, (byte)0x33,
++            (byte)0xA8, (byte)0x1A, (byte)0xE6, (byte)0xB5,
++            (byte)0x3D, (byte)0x67, (byte)0x46, (byte)0x69,
++            (byte)0x6F, (byte)0x0A, (byte)0x64, (byte)0xE7,
++            (byte)0x3D, (byte)0xEF, (byte)0x22, (byte)0xBE,
++            (byte)0x81, (byte)0x32, (byte)0xF3, (byte)0x72,
++            (byte)0xB4, (byte)0x50, (byte)0xE3, (byte)0xC3,
++            (byte)0xDB, (byte)0xE5, (byte)0x38, (byte)0x3C,
++            (byte)0x60, (byte)0xC8, (byte)0x08, (byte)0x53,
++            (byte)0x44, (byte)0x6F, (byte)0xDF, (byte)0x55,
++            (byte)0x67, (byte)0x32, (byte)0x02, (byte)0xDD,
++            (byte)0x6B, (byte)0xFB, (byte)0x23, (byte)0x1A,
++            (byte)0x88, (byte)0x71, (byte)0xE0, (byte)0xF8,
++            (byte)0xBB, (byte)0x51, (byte)0x1E, (byte)0x76,
++            (byte)0xC9, (byte)0x1F, (byte)0x45, (byte)0x9B,
++            (byte)0xA0, (byte)0xA5, (byte)0x61, (byte)0x45,
++            (byte)0x9E, (byte)0x65, (byte)0xB8, (byte)0xD6,
++            (byte)0x0E, (byte)0x3C, (byte)0xD9, (byte)0x56,
++            (byte)0xD6, (byte)0xA6, (byte)0xDD, (byte)0x36,
++            (byte)0x21, (byte)0x25, (byte)0x0E, (byte)0xE6,
++            (byte)0xAD, (byte)0xA0, (byte)0x3A, (byte)0x9B,
++            (byte)0x21, (byte)0x87, (byte)0xE2, (byte)0xAF,
++            (byte)0x3A, (byte)0xEF, (byte)0x75, (byte)0x85,
++            (byte)0xA8, (byte)0xD7, (byte)0xE5, (byte)0x46,
++            (byte)0xD8, (byte)0x5C, (byte)0x17, (byte)0x4E,
++            (byte)0x64, (byte)0x51, (byte)0xDB, (byte)0x38,
++            (byte)0x8E, (byte)0x6B, (byte)0x02, (byte)0x05,
++            (byte)0x46, (byte)0x77, (byte)0xD0, (byte)0x75,
++            (byte)0x8A, (byte)0xE0, (byte)0x42, (byte)0x5E,
++            (byte)0x8D, (byte)0x49, (byte)0x86, (byte)0xDE,
++            (byte)0x6C, (byte)0xBC, (byte)0xAF, (byte)0x10,
++            (byte)0x9A, (byte)0x97, (byte)0x64, (byte)0xA6,
++            (byte)0xBD, (byte)0xDB, (byte)0x01, (byte)0x40,
++            (byte)0xA9, (byte)0x3D, (byte)0x74, (byte)0x99,
++            (byte)0xDC, (byte)0x63, (byte)0x34, (byte)0x40,
++            (byte)0x31, (byte)0x57, (byte)0xC7, (byte)0x70,
++            (byte)0x9F, (byte)0xCE, (byte)0xC6, (byte)0x7B,
++            (byte)0x00, (byte)0x5B, (byte)0x02, (byte)0x5C,
++            (byte)0xC7, (byte)0x81, (byte)0x40, (byte)0x4D,
++            (byte)0xA7, (byte)0xB1, (byte)0xD2, (byte)0xEA,
++            (byte)0x8E, (byte)0xEC, (byte)0xA0, (byte)0xB3,
++            (byte)0x03, (byte)0x29, (byte)0xB8, (byte)0x44,
++            (byte)0xD7, (byte)0xA1, (byte)0x2B, (byte)0x37,
++            (byte)0x9D, (byte)0x19, (byte)0x11, (byte)0x1D,
++            (byte)0x58, (byte)0xE8, (byte)0x06, (byte)0xE7,
++            (byte)0x06, (byte)0xE3, (byte)0xF7, (byte)0xEF,
++            (byte)0x05, (byte)0xA9, (byte)0x05, (byte)0x93,
++            (byte)0x42, (byte)0x94, (byte)0x5A, (byte)0xD6,
++            (byte)0xA0, (byte)0x24, (byte)0x3A, (byte)0x52,
++            (byte)0x92, (byte)0xA3, (byte)0x79, (byte)0x98,
++            (byte)0x3C, (byte)0x68, (byte)0x55, (byte)0x1B,
++            (byte)0x6A, (byte)0xC5, (byte)0x83, (byte)0x89,
++            (byte)0x5A, (byte)0x79, (byte)0x5C, (byte)0x52,
++            (byte)0xBA, (byte)0xB8, (byte)0xF7, (byte)0x72,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x01,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x01,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x09,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x05, (byte)0x64, (byte)0x75, (byte)0x6D,
++            (byte)0x6D, (byte)0x79, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x03, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x0C, (byte)0x58, (byte)0x2D,
++            (byte)0x43, (byte)0x41, (byte)0x43, (byte)0x48,
++            (byte)0x45, (byte)0x43, (byte)0x4F, (byte)0x4E,
++            (byte)0x46, (byte)0x3A, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x15, (byte)0x6B, (byte)0x72,
++            (byte)0x62, (byte)0x35, (byte)0x5F, (byte)0x63,
++            (byte)0x63, (byte)0x61, (byte)0x63, (byte)0x68,
++            (byte)0x65, (byte)0x5F, (byte)0x63, (byte)0x6F,
++            (byte)0x6E, (byte)0x66, (byte)0x5F, (byte)0x64,
++            (byte)0x61, (byte)0x74, (byte)0x61, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x0A, (byte)0x66,
++            (byte)0x61, (byte)0x73, (byte)0x74, (byte)0x5F,
++            (byte)0x61, (byte)0x76, (byte)0x61, (byte)0x69,
++            (byte)0x6C, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x1A, (byte)0x6B, (byte)0x72, (byte)0x62,
++            (byte)0x74, (byte)0x67, (byte)0x74, (byte)0x2F,
++            (byte)0x4D, (byte)0x41, (byte)0x58, (byte)0x2E,
++            (byte)0x4C, (byte)0x4F, (byte)0x43, (byte)0x41,
++            (byte)0x4C, (byte)0x40, (byte)0x4D, (byte)0x41,
++            (byte)0x58, (byte)0x2E, (byte)0x4C, (byte)0x4F,
++            (byte)0x43, (byte)0x41, (byte)0x4C, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00, (byte)0x03, (byte)0x79, (byte)0x65,
++            (byte)0x73, (byte)0x00, (byte)0x00, (byte)0x00,
++            (byte)0x00,
++        };
++
++        File f = File.createTempFile("ccache", "cc", new File("."));
++        FileOutputStream fout = new FileOutputStream(f);
++        fout.write(krb5cc);
++        fout.close();
++
++        CredentialsCache cc = CredentialsCache.getInstance(f.getPath());
++        if (!cc.getDefaultCreds().getServicePrincipal().getNameStrings()[0]
++                .equals("krbtgt")) {
++            throw new Exception("No TGT found");
++        }
++    }
++}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/openjdk/7110373-krb5_test_infrastructure.patch	Fri Aug 31 17:42:10 2012 +0100
@@ -0,0 +1,105 @@
+# HG changeset patch
+# User weijun
+# Date 1320967836 -28800
+# Node ID 458d97ab05549a01a19690d8ab41998c5cf5efd1
+# Parent  b58af78ac79cf403ff4e099567a3ac09327ff2f9
+7110373: krb5 test in openjdk6 without test infrastructure
+Reviewed-by: mullan
+
+diff --git a/test/sun/security/krb5/auto/SpnegoReqFlags.java b/test/sun/security/krb5/auto/SpnegoReqFlags.java
+deleted file mode 100644
+--- openjdk/jdk/test/sun/security/krb5/auto/SpnegoReqFlags.java
++++ /dev/null
+@@ -1,92 +0,0 @@
+-/*
+- * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
+- * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+- *
+- * This code is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License version 2 only, as
+- * published by the Free Software Foundation.
+- *
+- * This code is distributed in the hope that it will be useful, but WITHOUT
+- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+- * version 2 for more details (a copy is included in the LICENSE file that
+- * accompanied this code).
+- *
+- * You should have received a copy of the GNU General Public License version
+- * 2 along with this work; if not, write to the Free Software Foundation,
+- * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+- *
+- * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+- * or visit www.oracle.com if you need additional information or have any
+- * questions. 
+- */
+-
+-/*
+- * @test
+- * @bug 6815182
+- * @summary GSSAPI/SPNEGO does not work with server using MIT Kerberos library
+- */
+-
+-import sun.security.jgss.GSSUtil;
+-import sun.security.util.BitArray;
+-import sun.security.util.DerInputStream;
+-import sun.security.util.DerValue;
+-
+-public class SpnegoReqFlags {
+-
+-    public static void main(String[] args)
+-            throws Exception {
+-
+-        // Create and start the KDC
+-        new OneKDC(null).writeJAASConf();
+-        new SpnegoReqFlags().go();
+-    }
+-
+-    void go() throws Exception {
+-        Context c = Context.fromJAAS("client");
+-        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_SPNEGO_MECH_OID);
+-
+-        byte[] token = c.doAs(new Action() {
+-            @Override
+-            public byte[] run(Context me, byte[] input) throws Exception {
+-                me.x().requestCredDeleg(true);
+-                me.x().requestReplayDet(false);
+-                me.x().requestSequenceDet(false);
+-                return me.x().initSecContext(new byte[0], 0, 0);
+-            }
+-        }, null);
+-
+-        DerValue d = new DerValue(token);   // GSSToken
+-        DerInputStream ins = d.data;        // OID + mech token
+-        d.data.getDerValue();               // skip OID
+-        d = d.data.getDerValue();           // NegTokenInit
+-        d = d.data.getDerValue();           // The SEQUENCE inside
+-
+-        boolean found = false;
+-
+-        // Go through all fields inside NegTokenInit. The reqFlags field
+-        // is optional. It's even not recommended in RFC 4178.
+-        while (d.data.available() > 0) {
+-            DerValue d2 = d.data.getDerValue();
+-            if (d2.isContextSpecific((byte)1)) {
+-                found = true;
+-                System.out.println("regFlags field located.");
+-                BitArray ba = d2.data.getUnalignedBitString();
+-                if (ba.length() != 7) {
+-                    throw new Exception("reqFlags should contain 7 bits");
+-                }
+-                if (!ba.get(0)) {
+-                    throw new Exception("delegFlag should be true");
+-                }
+-                if (ba.get(2) || ba.get(3)) {
+-                    throw new Exception("replay/sequenceFlag should be false");
+-                }
+-            }
+-        }
+-
+-        if (!found) {
+-            System.out.println("Warning: regFlags field not found, too new?");
+-        }
+-        c.dispose();
+-    }
+-}