From 2e3bb954300312e41a7b82f8008f70f71dcedcb8 Mon Sep 17 00:00:00 2001 From: "Roland C. Dowdeswell" Date: Tue, 19 May 2026 14:14:01 +0100 Subject: [PATCH] Add KDC-free GSS tests --- tests/NTMakefile | 7 +- tests/gss/Makefile.am | 16 ++++- tests/gss/NTMakefile | 76 ++++++++++++++++++++++ tests/gss/check-kdc-free.in | 126 ++++++++++++++++++++++++++++++++++++ 4 files changed, 220 insertions(+), 5 deletions(-) create mode 100644 tests/gss/check-kdc-free.in diff --git a/tests/NTMakefile b/tests/NTMakefile index 8a1698ee2..d5eb13a7c 100644 --- a/tests/NTMakefile +++ b/tests/NTMakefile @@ -27,9 +27,10 @@ # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN # ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. -# +# -RELDIR=tests +RELDIR=tests -!include ../windows/NTMakefile.w32 +SUBDIRS=gss +!include ../windows/NTMakefile.w32 diff --git a/tests/gss/Makefile.am b/tests/gss/Makefile.am index 94f16b8de..a132a95be 100644 --- a/tests/gss/Makefile.am +++ b/tests/gss/Makefile.am @@ -6,7 +6,7 @@ include $(top_srcdir)/Makefile.am.common noinst_DATA = krb5.conf krb5-nodns.conf new_clients_k5.conf mech -SCRIPT_TESTS = check-basic check-nodns check-gss check-gssmask check-context check-spnego check-negoex +SCRIPT_TESTS = check-basic check-nodns check-gss check-gssmask check-context check-spnego check-negoex check-kdc-free TESTS = $(SCRIPT_TESTS) @@ -58,6 +58,11 @@ check-negoex: check-negoex.in Makefile chmod +x check-negoex.tmp && \ mv check-negoex.tmp check-negoex +check-kdc-free: check-kdc-free.in Makefile + $(do_subst) < $(srcdir)/check-kdc-free.in > check-kdc-free.tmp && \ + chmod +x check-kdc-free.tmp && \ + mv check-kdc-free.tmp check-kdc-free + krb5.conf: krb5.conf.in Makefile $(do_subst) < $(srcdir)/krb5.conf.in > krb5.conf.tmp && \ mv krb5.conf.tmp krb5.conf @@ -95,7 +100,13 @@ CLEANFILES= \ check-gssmask.tmp \ check-spnego.tmp \ check-context.tmp \ - check-negoex.tmp + check-negoex.tmp \ + check-kdc-free.tmp \ + kdc-free.krb5.conf \ + kdc-free.keytab \ + kdc-free.ccache \ + kdc-free-no.keytab \ + kdc-free-no.ccache EXTRA_DIST = \ NTMakefile \ @@ -106,6 +117,7 @@ EXTRA_DIST = \ check-spnego.in \ check-context.in \ check-negoex.in \ + check-kdc-free.in \ krb5.conf.in \ krb5-nodns.conf.in \ include-krb5.conf \ diff --git a/tests/gss/NTMakefile b/tests/gss/NTMakefile index c1ca7a246..16ce0bbd6 100644 --- a/tests/gss/NTMakefile +++ b/tests/gss/NTMakefile @@ -33,3 +33,79 @@ RELDIR=tests\gss !include ../../windows/NTMakefile.w32 +KDCFREE_REALM=TEST.H5L.SE +KDCFREE_PASSWORD=kdc-free-test-password +KDCFREE_CLIENT=user@$(KDCFREE_REALM) +KDCFREE_SERVICE=host/win-gss.test.h5l.se@$(KDCFREE_REALM) +KDCFREE_TARGET=host@win-gss.test.h5l.se +KDCFREE_CONF=$(OBJ)\kdc-free.krb5.conf +KDCFREE_KEYTAB_FILE=$(OBJ)\kdc-free.keytab +KDCFREE_CCACHE_FILE=$(OBJ)\kdc-free.ccache +KDCFREE_KEYTAB=FILE:$(KDCFREE_KEYTAB_FILE) +KDCFREE_CCACHE=FILE:$(KDCFREE_CCACHE_FILE) +KDCFREE_NO_KEYTAB_FILE=$(OBJ)\kdc-free-no.keytab +KDCFREE_NO_CCACHE_FILE=$(OBJ)\kdc-free-no.ccache +KDCFREE_NO_KEYTAB=FILE:$(KDCFREE_NO_KEYTAB_FILE) +KDCFREE_NO_CCACHE=FILE:$(KDCFREE_NO_CCACHE_FILE) +KDCFREE_TEST_CONTEXT=$(OBJDIR)\lib\gssapi\test_context.exe + +test-kdc-free-conf: prep + @if exist "$(KDCFREE_CONF)" $(RM) "$(KDCFREE_CONF)" + @$(ECHO) [libdefaults] > $(KDCFREE_CONF) + @$(ECHO) default_realm = $(KDCFREE_REALM) >> $(KDCFREE_CONF) + @$(ECHO) dns_canonicalize_hostname = false >> $(KDCFREE_CONF) + @$(ECHO) [domain_realms] >> $(KDCFREE_CONF) + @$(ECHO) .test.h5l.se = $(KDCFREE_REALM) >> $(KDCFREE_CONF) + @$(ECHO) test.h5l.se = $(KDCFREE_REALM) >> $(KDCFREE_CONF) + +test-kdc-free-clean: + @if exist "$(KDCFREE_KEYTAB_FILE)" $(RM) "$(KDCFREE_KEYTAB_FILE)" + @if exist "$(KDCFREE_CCACHE_FILE)" $(RM) "$(KDCFREE_CCACHE_FILE)" + @if exist "$(KDCFREE_NO_KEYTAB_FILE)" $(RM) "$(KDCFREE_NO_KEYTAB_FILE)" + @if exist "$(KDCFREE_NO_CCACHE_FILE)" $(RM) "$(KDCFREE_NO_CCACHE_FILE)" + +clean:: + @if exist "$(KDCFREE_CONF)" $(RM) "$(KDCFREE_CONF)" + @if exist "$(KDCFREE_KEYTAB_FILE)" $(RM) "$(KDCFREE_KEYTAB_FILE)" + @if exist "$(KDCFREE_CCACHE_FILE)" $(RM) "$(KDCFREE_CCACHE_FILE)" + @if exist "$(KDCFREE_NO_KEYTAB_FILE)" $(RM) "$(KDCFREE_NO_KEYTAB_FILE)" + @if exist "$(KDCFREE_NO_CCACHE_FILE)" $(RM) "$(KDCFREE_NO_CCACHE_FILE)" + +test-kdc-free-sanon: + set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=sanon-x25519 --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=sanon-x25519 --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap --iov $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=spnego --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& set KRB5CCNAME=$(KDCFREE_NO_CCACHE)&& set KRB5_KTNAME=$(KDCFREE_NO_KEYTAB)&& $(KDCFREE_TEST_CONTEXT) --mech-type=spnego --anonymous --ret-mech-type=sanon-x25519 --i-channel-bindings=negoex_sanon_test_h5l_se --a-channel-bindings=negoex_sanon_test_h5l_se --wrapunwrap --iov $(KDCFREE_TARGET) + +test-kdc-free-aes256-sha1: + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes256-cts-hmac-sha1-96 -w $(KDCFREE_PASSWORD) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes256-cts-hmac-sha1-96 + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha1-96 --session-enctype=aes256-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + +test-kdc-free-aes128-sha1: + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes128-cts-hmac-sha1-96 -w $(KDCFREE_PASSWORD) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes128-cts-hmac-sha1-96 + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha1-96 --session-enctype=aes128-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha1-96 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + +test-kdc-free-aes256-sha2: + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes256-cts-hmac-sha384-192 -w $(KDCFREE_PASSWORD) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes256-cts-hmac-sha384-192 + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha384-192 --session-enctype=aes256-cts-hmac-sha384-192 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes256-cts-hmac-sha384-192 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + +test-kdc-free-aes128-sha2: + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\ktutil.exe -k $(KDCFREE_KEYTAB) add -p $(KDCFREE_SERVICE) -V 1 -e aes128-cts-hmac-sha256-128 -w $(KDCFREE_PASSWORD) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(BINDIR)\kimpersonate.exe --ccache=$(KDCFREE_CCACHE) -k $(KDCFREE_KEYTAB) -s $(KDCFREE_SERVICE) -c $(KDCFREE_CLIENT) -t aes128-cts-hmac-sha256-128 + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha256-128 --session-enctype=aes128-cts-hmac-sha256-128 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + set KRB5_CONFIG=$(KDCFREE_CONF)&& $(KDCFREE_TEST_CONTEXT) --client-ccache=$(KDCFREE_CCACHE) --gsskrb5-acceptor-identity=$(KDCFREE_KEYTAB) --no-dns-canonicalize --mech-type=spnego --mech-types=krb5 --ret-mech-type=krb5 --limit-enctype=aes128-cts-hmac-sha256-128 --mutual-auth --wrapunwrap $(KDCFREE_TARGET) + +test-kdc-free: test-kdc-free-conf test-kdc-free-clean \ + test-kdc-free-sanon \ + test-kdc-free-aes256-sha1 \ + test-kdc-free-aes128-sha1 \ + test-kdc-free-aes256-sha2 \ + test-kdc-free-aes128-sha2 + +test:: test-kdc-free diff --git a/tests/gss/check-kdc-free.in b/tests/gss/check-kdc-free.in new file mode 100644 index 000000000..88313c713 --- /dev/null +++ b/tests/gss/check-kdc-free.in @@ -0,0 +1,126 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kungliga Tekniska Högskolan +# (Royal Institute of Technology, Stockholm, Sweden). +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the Institute nor the names of its contributors may +# be used to endorse or promote products derived from this software without +# specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH +# DAMAGE. +# + +top_srcdir="@top_srcdir@" +env_setup="@env_setup@" +objdir="@objdir@" + +. ${env_setup} +. ${top_srcdir}/tests/bin/test-lib.sh + +R=TEST.H5L.SE +password=kdc-free-test-password +client="user@${R}" +service="host/win-gss.test.h5l.se@${R}" +target="host@win-gss.test.h5l.se" + +keytabfile="${objdir}/kdc-free.keytab" +keytab="FILE:${keytabfile}" +cachefile="${objdir}/kdc-free.ccache" +cache="FILE:${cachefile}" +nokeytabfile="${objdir}/kdc-free-no.keytab" +nokeytab="FILE:${nokeytabfile}" +nocachefile="${objdir}/kdc-free-no.ccache" +nocache="FILE:${nocachefile}" + +ktutil="${TESTS_ENVIRONMENT} ../../admin/ktutil" +kimpersonate="${TESTS_ENVIRONMENT} ../../kuser/kimpersonate" +context="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_context" + +KRB5_CONFIG="${objdir}/kdc-free.krb5.conf" +export KRB5_CONFIG + +cat > "${KRB5_CONFIG}" <