Add KDC-free GSS tests
This commit is contained in:
Roland C. Dowdeswell
committed by
Nico Williams
Nico Williams
parent
a66cb84e70
commit
2e3bb95430
+4
-3
@@ -27,9 +27,10 @@
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
# POSSIBILITY OF SUCH DAMAGE.
|
||||
#
|
||||
#
|
||||
|
||||
RELDIR=tests
|
||||
RELDIR=tests
|
||||
|
||||
!include ../windows/NTMakefile.w32
|
||||
SUBDIRS=gss
|
||||
|
||||
!include ../windows/NTMakefile.w32
|
||||
|
||||
+14
-2
@@ -6,7 +6,7 @@ include $(top_srcdir)/Makefile.am.common
|
||||
|
||||
noinst_DATA = krb5.conf krb5-nodns.conf new_clients_k5.conf mech
|
||||
|
||||
SCRIPT_TESTS = check-basic check-nodns check-gss check-gssmask check-context check-spnego check-negoex
|
||||
SCRIPT_TESTS = check-basic check-nodns check-gss check-gssmask check-context check-spnego check-negoex check-kdc-free
|
||||
|
||||
TESTS = $(SCRIPT_TESTS)
|
||||
|
||||
@@ -58,6 +58,11 @@ check-negoex: check-negoex.in Makefile
|
||||
chmod +x check-negoex.tmp && \
|
||||
mv check-negoex.tmp check-negoex
|
||||
|
||||
check-kdc-free: check-kdc-free.in Makefile
|
||||
$(do_subst) < $(srcdir)/check-kdc-free.in > check-kdc-free.tmp && \
|
||||
chmod +x check-kdc-free.tmp && \
|
||||
mv check-kdc-free.tmp check-kdc-free
|
||||
|
||||
krb5.conf: krb5.conf.in Makefile
|
||||
$(do_subst) < $(srcdir)/krb5.conf.in > krb5.conf.tmp && \
|
||||
mv krb5.conf.tmp krb5.conf
|
||||
@@ -95,7 +100,13 @@ CLEANFILES= \
|
||||
check-gssmask.tmp \
|
||||
check-spnego.tmp \
|
||||
check-context.tmp \
|
||||
check-negoex.tmp
|
||||
check-negoex.tmp \
|
||||
check-kdc-free.tmp \
|
||||
kdc-free.krb5.conf \
|
||||
kdc-free.keytab \
|
||||
kdc-free.ccache \
|
||||
kdc-free-no.keytab \
|
||||
kdc-free-no.ccache
|
||||
|
||||
EXTRA_DIST = \
|
||||
NTMakefile \
|
||||
@@ -106,6 +117,7 @@ EXTRA_DIST = \
|
||||
check-spnego.in \
|
||||
check-context.in \
|
||||
check-negoex.in \
|
||||
check-kdc-free.in \
|
||||
krb5.conf.in \
|
||||
krb5-nodns.conf.in \
|
||||
include-krb5.conf \
|
||||
|
||||
@@ -33,3 +33,79 @@ RELDIR=tests\gss
|
||||
|
||||
!include ../../windows/NTMakefile.w32
|
||||
|
||||
KDCFREE_REALM=TEST.H5L.SE
|
||||
KDCFREE_PASSWORD=kdc-free-test-password
|
||||
KDCFREE_CLIENT=user@$(KDCFREE_REALM)
|
||||
KDCFREE_SERVICE=host/win-gss.test.h5l.se@$(KDCFREE_REALM)
|
||||
KDCFREE_TARGET=host@win-gss.test.h5l.se
|
||||
KDCFREE_CONF=$(OBJ)\kdc-free.krb5.conf
|
||||
KDCFREE_KEYTAB_FILE=$(OBJ)\kdc-free.keytab
|
||||
KDCFREE_CCACHE_FILE=$(OBJ)\kdc-free.ccache
|
||||
KDCFREE_KEYTAB=FILE:$(KDCFREE_KEYTAB_FILE)
|
||||
KDCFREE_CCACHE=FILE:$(KDCFREE_CCACHE_FILE)
|
||||
KDCFREE_NO_KEYTAB_FILE=$(OBJ)\kdc-free-no.keytab
|
||||
KDCFREE_NO_CCACHE_FILE=$(OBJ)\kdc-free-no.ccache
|
||||
KDCFREE_NO_KEYTAB=FILE:$(KDCFREE_NO_KEYTAB_FILE)
|
||||
KDCFREE_NO_CCACHE=FILE:$(KDCFREE_NO_CCACHE_FILE)
|
||||
KDCFREE_TEST_CONTEXT=$(OBJDIR)\lib\gssapi\test_context.exe
|
||||
|
||||
test-kdc-free-conf: prep
|
||||
@if exist "$(KDCFREE_CONF)" $(RM) "$(KDCFREE_CONF)"
|
||||
@$(ECHO) [libdefaults] > $(KDCFREE_CONF)
|
||||
@$(ECHO) default_realm = $(KDCFREE_REALM) >> $(KDCFREE_CONF)
|
||||
@$(ECHO) dns_canonicalize_hostname = false >> $(KDCFREE_CONF)
|
||||
@$(ECHO) [domain_realms] >> $(KDCFREE_CONF)
|
||||
@$(ECHO) .test.h5l.se = $(KDCFREE_REALM) >> $(KDCFREE_CONF)
|
||||
@$(ECHO) test.h5l.se = $(KDCFREE_REALM) >> $(KDCFREE_CONF)
|
||||
|
||||
test-kdc-free-clean:
|
||||
@if exist "$(KDCFREE_KEYTAB_FILE)" $(RM) "$(KDCFREE_KEYTAB_FILE)"
|
||||
@if exist "$(KDCFREE_CCACHE_FILE)" $(RM) "$(KDCFREE_CCACHE_FILE)"
|
||||
@if exist "$(KDCFREE_NO_KEYTAB_FILE)" $(RM) "$(KDCFREE_NO_KEYTAB_FILE)"
|
||||
@if exist "$(KDCFREE_NO_CCACHE_FILE)" $(RM) "$(KDCFREE_NO_CCACHE_FILE)"
|
||||
|
||||
clean::
|
||||
@if exist "$(KDCFREE_CONF)" $(RM) "$(KDCFREE_CONF)"
|
||||
@if exist "$(KDCFREE_KEYTAB_FILE)" $(RM) "$(KDCFREE_KEYTAB_FILE)"
|
||||
@if exist "$(KDCFREE_CCACHE_FILE)" $(RM) "$(KDCFREE_CCACHE_FILE)"
|
||||
@if exist "$(KDCFREE_NO_KEYTAB_FILE)" $(RM) "$(KDCFREE_NO_KEYTAB_FILE)"
|
||||
@if exist "$(KDCFREE_NO_CCACHE_FILE)" $(RM) "$(KDCFREE_NO_CCACHE_FILE)"
|
||||
|
||||
test-kdc-free-sanon:
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=sanon-x25519 --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=sanon-x25519 --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap --iov $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=spnego --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=spnego --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap --iov $(KDCFREE_TARGET)
|
||||
|
||||
test-kdc-free-aes256-sha1:
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes256-cts-hmac-sha1-96 -w $(KDCFREE_PASSWORD)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes256-cts-hmac-sha1-96
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha1-96 --session-enctype=aes256-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
|
||||
test-kdc-free-aes128-sha1:
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes128-cts-hmac-sha1-96 -w $(KDCFREE_PASSWORD)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes128-cts-hmac-sha1-96
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha1-96 --session-enctype=aes128-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
|
||||
test-kdc-free-aes256-sha2:
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes256-cts-hmac-sha384-192 -w $(KDCFREE_PASSWORD)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes256-cts-hmac-sha384-192
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha384-192 --session-enctype=aes256-cts-hmac-sha384-192 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha384-192 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
|
||||
test-kdc-free-aes128-sha2:
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes128-cts-hmac-sha256-128 -w $(KDCFREE_PASSWORD)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes128-cts-hmac-sha256-128
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha256-128 --session-enctype=aes128-cts-hmac-sha256-128 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha256-128 --mutual-auth --wrapunwrap $(KDCFREE_TARGET)
|
||||
|
||||
test-kdc-free: test-kdc-free-conf test-kdc-free-clean \
|
||||
test-kdc-free-sanon \
|
||||
test-kdc-free-aes256-sha1 \
|
||||
test-kdc-free-aes128-sha1 \
|
||||
test-kdc-free-aes256-sha2 \
|
||||
test-kdc-free-aes128-sha2
|
||||
|
||||
test:: test-kdc-free
|
||||
|
||||
@@ -0,0 +1,126 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (c) 2026 Kungliga Tekniska Högskolan
|
||||
# (Royal Institute of Technology, Stockholm, Sweden).
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
#
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in the
|
||||
# documentation and/or other materials provided with the distribution.
|
||||
#
|
||||
# 3. Neither the name of the Institute nor the names of its contributors may
|
||||
# be used to endorse or promote products derived from this software without
|
||||
# specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
|
||||
# DAMAGE.
|
||||
#
|
||||
|
||||
top_srcdir="@top_srcdir@"
|
||||
env_setup="@env_setup@"
|
||||
objdir="@objdir@"
|
||||
|
||||
. ${env_setup}
|
||||
. ${top_srcdir}/tests/bin/test-lib.sh
|
||||
|
||||
R=TEST.H5L.SE
|
||||
password=kdc-free-test-password
|
||||
client="user@${R}"
|
||||
service="host/win-gss.test.h5l.se@${R}"
|
||||
target="host@win-gss.test.h5l.se"
|
||||
|
||||
keytabfile="${objdir}/kdc-free.keytab"
|
||||
keytab="FILE:${keytabfile}"
|
||||
cachefile="${objdir}/kdc-free.ccache"
|
||||
cache="FILE:${cachefile}"
|
||||
nokeytabfile="${objdir}/kdc-free-no.keytab"
|
||||
nokeytab="FILE:${nokeytabfile}"
|
||||
nocachefile="${objdir}/kdc-free-no.ccache"
|
||||
nocache="FILE:${nocachefile}"
|
||||
|
||||
ktutil="${TESTS_ENVIRONMENT} ../../admin/ktutil"
|
||||
kimpersonate="${TESTS_ENVIRONMENT} ../../kuser/kimpersonate"
|
||||
context="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_context"
|
||||
|
||||
KRB5_CONFIG="${objdir}/kdc-free.krb5.conf"
|
||||
export KRB5_CONFIG
|
||||
|
||||
cat > "${KRB5_CONFIG}" <<EOF
|
||||
[libdefaults]
|
||||
default_realm = ${R}
|
||||
dns_canonicalize_hostname = false
|
||||
[domain_realms]
|
||||
.test.h5l.se = ${R}
|
||||
test.h5l.se = ${R}
|
||||
EOF
|
||||
|
||||
rm -f "${keytabfile}" "${cachefile}" "${nokeytabfile}" "${nocachefile}"
|
||||
|
||||
test_init
|
||||
|
||||
test_section "KDC-free GSS SAnon-X25519"
|
||||
for mech in sanon-x25519 sanon-x25519iov spnego spnegoiov; do
|
||||
iov=""
|
||||
if [ "$mech" = "sanon-x25519iov" ] ; then
|
||||
mech="sanon-x25519"
|
||||
iov="--iov"
|
||||
fi
|
||||
if [ "$mech" = "spnegoiov" ] ; then
|
||||
mech="spnego"
|
||||
iov="--iov"
|
||||
fi
|
||||
|
||||
test_section "KDC-free GSS ${mech} SAnon-X25519 ${iov}"
|
||||
test_run env KRB5CCNAME="${nocache}" KRB5_KTNAME="${nokeytab}" \
|
||||
${context} --mech-type=${mech} --anonymous \
|
||||
--ret-mech-type=sanon-x25519 \
|
||||
--i-channel-bindings=negoex_sanon_test_h5l_se \
|
||||
--a-channel-bindings=negoex_sanon_test_h5l_se \
|
||||
--wrapunwrap ${iov} "${target}"
|
||||
done
|
||||
|
||||
for enctype in \
|
||||
aes256-cts-hmac-sha1-96 \
|
||||
aes128-cts-hmac-sha1-96 \
|
||||
aes256-cts-hmac-sha384-192 \
|
||||
aes128-cts-hmac-sha256-128
|
||||
do
|
||||
rm -f "${cachefile}"
|
||||
|
||||
test_section "KDC-free GSS krb5 with ${enctype}"
|
||||
test_run ${ktutil} -k "${keytab}" add -p "${service}" -V 1 \
|
||||
-e "${enctype}" -w "${password}" &&
|
||||
test_run ${kimpersonate} --ccache="${cache}" -k "${keytab}" \
|
||||
-s "${service}" -c "${client}" -t "${enctype}" &&
|
||||
test_run ${context} --client-ccache="${cache}" \
|
||||
--gsskrb5-acceptor-identity="${keytab}" \
|
||||
--no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 \
|
||||
--limit-enctype="${enctype}" \
|
||||
--session-enctype="${enctype}" --mutual-auth --wrapunwrap \
|
||||
"${target}"
|
||||
|
||||
test_section "KDC-free GSS SPNEGO with ${enctype}"
|
||||
test_run ${context} --client-ccache="${cache}" \
|
||||
--gsskrb5-acceptor-identity="${keytab}" \
|
||||
--no-dns-canonicalize --mech-type=spnego --mech-types=krb5 \
|
||||
--limit-enctype="${enctype}" \
|
||||
--ret-mech-type=krb5 --mutual-auth --wrapunwrap "${target}"
|
||||
done
|
||||
|
||||
test_finish
|
||||
Reference in New Issue
Block a user