Initial test of x-realm TGT w/ kvno 0 and key rollover
NOTE: The test runs and succeeds, but the client seems to be getting a new x-realm TGT after we set the kvno to 0 or remove the kvno from the tickets. This means we're not really testing the TGS paths! So this test is not yet ready.
This commit is contained in:
Nicolas Williams
@@ -47,7 +47,7 @@ TESTS = \
|
||||
|
||||
check_DATA = test_config_strings.out
|
||||
|
||||
check_PROGRAMS = $(TESTS) test_hostname test_ap-req test_canon
|
||||
check_PROGRAMS = $(TESTS) test_hostname test_ap-req test_canon test_set_kvno0
|
||||
|
||||
LDADD = libkrb5.la \
|
||||
$(LIB_hcrypto) \
|
||||
|
||||
179
lib/krb5/test_set_kvno0.c
Normal file
179
lib/krb5/test_set_kvno0.c
Normal file
@@ -0,0 +1,179 @@
|
||||
/*
|
||||
* Copyright (c) 2011, Secure Endpoints Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* - Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
||||
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "krb5_locl.h"
|
||||
#include <err.h>
|
||||
#include <getarg.h>
|
||||
|
||||
#if 0
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <strings.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <krb5.h>
|
||||
#endif
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
krb5_context context;
|
||||
krb5_ccache src_cc = NULL;
|
||||
krb5_ccache dst_cc = NULL;
|
||||
krb5_cc_cursor cursor;
|
||||
krb5_principal me = NULL;
|
||||
krb5_creds cred;
|
||||
const char *during;
|
||||
Ticket t;
|
||||
size_t len;
|
||||
int make_kvno_absent = 0;
|
||||
int opt;
|
||||
|
||||
memset(&cred, 0, sizeof (cred));
|
||||
during = "init_context";
|
||||
ret = krb5_init_context(&context);
|
||||
if (ret) goto err;
|
||||
|
||||
while ((opt = getopt(argc, argv, "c:n")) != -1) {
|
||||
switch (opt) {
|
||||
case 'c':
|
||||
during = "cc_resolve of source ccache";
|
||||
ret = krb5_cc_resolve(context, optarg, &src_cc);
|
||||
if (ret) goto err;
|
||||
break;
|
||||
case 'n':
|
||||
make_kvno_absent++;
|
||||
break;
|
||||
case 'h':
|
||||
default:
|
||||
fprintf(stderr, "Usage: %s [-n] [-c ccache]\n"
|
||||
"\tThis utility edits a ccache, setting all ticket\n"
|
||||
"\tenc_part kvnos to zero or absent (if -n is set).\n",
|
||||
argv[0]);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (!src_cc) {
|
||||
during = "cc_default";
|
||||
ret = krb5_cc_default(context, &src_cc);
|
||||
if (ret) goto err;
|
||||
}
|
||||
|
||||
during = "cc_get_principal";
|
||||
ret = krb5_cc_get_principal(context, src_cc, &me);
|
||||
if (ret) goto err;
|
||||
|
||||
if (optind != argc) {
|
||||
fprintf(stderr, "Usage: %s [-n] [-c ccache]\n"
|
||||
"\tThis utility edits a ccache, setting all ticket\n"
|
||||
"\tenc_part kvnos to zero or absent (if -n is set).\n",
|
||||
argv[0]);
|
||||
return 1;
|
||||
}
|
||||
|
||||
during = "cc_new_unique of temporary ccache";
|
||||
ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, src_cc),
|
||||
NULL, &dst_cc);
|
||||
|
||||
during = "cc_initialize of temporary ccache";
|
||||
ret = krb5_cc_initialize(context, dst_cc, me);
|
||||
if (ret) goto err;
|
||||
|
||||
during = "cc_start_seq_get";
|
||||
ret = krb5_cc_start_seq_get(context, src_cc, &cursor);
|
||||
if (ret) goto err;
|
||||
|
||||
while ((ret = krb5_cc_next_cred(context, src_cc, &cursor, &cred)) == 0) {
|
||||
krb5_data data;
|
||||
|
||||
during = "decode_Ticket";
|
||||
memset(&t, 0, sizeof (t));
|
||||
ret = decode_Ticket(cred.ticket.data, cred.ticket.length, &t, &len);
|
||||
if (ret == ASN1_MISSING_FIELD)
|
||||
continue;
|
||||
if (ret) goto err;
|
||||
if (t.enc_part.kvno) {
|
||||
*t.enc_part.kvno = 0;
|
||||
if (make_kvno_absent) {
|
||||
free(t.enc_part.kvno);
|
||||
t.enc_part.kvno = NULL;
|
||||
}
|
||||
/*
|
||||
* The new Ticket has to need less or same space as before, so
|
||||
* we reuse cred->icket.data.
|
||||
*/
|
||||
during = "encode_Ticket";
|
||||
ASN1_MALLOC_ENCODE(Ticket, data.data, data.length, &t, &len, ret);
|
||||
if (ret) {
|
||||
free_Ticket(&t);
|
||||
goto err;
|
||||
}
|
||||
krb5_data_free(&cred.ticket);
|
||||
cred.ticket = data;
|
||||
}
|
||||
free_Ticket(&t);
|
||||
during = "cc_store_cred";
|
||||
ret = krb5_cc_store_cred(context, dst_cc, &cred);
|
||||
if (ret) goto err;
|
||||
krb5_free_cred_contents(context, &cred);
|
||||
memset(&cred, 0, sizeof (cred));
|
||||
}
|
||||
during = "cc_next_cred";
|
||||
if (ret != KRB5_CC_END) goto err;
|
||||
|
||||
during = "cc_end_seq_get";
|
||||
ret = krb5_cc_end_seq_get(context, src_cc, &cursor);
|
||||
if (ret) goto err;
|
||||
|
||||
during = "cc_move";
|
||||
ret = krb5_cc_move(context, dst_cc, src_cc);
|
||||
if (ret) goto err;
|
||||
dst_cc = NULL;
|
||||
|
||||
during = "cc_switch";
|
||||
ret = krb5_cc_switch(context, src_cc);
|
||||
if (ret) goto err;
|
||||
|
||||
err:
|
||||
(void) krb5_free_principal(context, me);
|
||||
if (src_cc)
|
||||
(void) krb5_cc_close(context, src_cc);
|
||||
if (dst_cc)
|
||||
(void) krb5_cc_destroy(context, dst_cc);
|
||||
if (ret) {
|
||||
fprintf(stderr, "Failed while doing %s (%d)\n", during, ret);
|
||||
ret = 1;
|
||||
}
|
||||
return (ret);
|
||||
}
|
||||
|
||||
@@ -30,6 +30,7 @@ kpasswdd="${TESTS_ENVIRONMENT} ${top_builddir}/kpasswd/kpasswdd"
|
||||
kswitch="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kcc kswitch"
|
||||
ktutil="${TESTS_ENVIRONMENT} ${top_builddir}/admin/ktutil"
|
||||
gsstool="${TESTS_ENVIRONMENT} ${top_builddir}/lib/gssapi/gsstool"
|
||||
test_set_kvno0="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_set_kvno0"
|
||||
|
||||
# regression test tools
|
||||
test_ap_req="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_ap-req"
|
||||
|
||||
@@ -77,6 +77,7 @@ kgetcred="${kgetcred} -c $cache"
|
||||
kgetcred_imp="${kgetcred} -c $cache --out-cache=${ocache}"
|
||||
kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
|
||||
kimpersonate="${kimpersonate} -k ${keytab} --ccache=${ocache}"
|
||||
test_set_kvno0="${test_set_kvno0} -c $cache -n"
|
||||
|
||||
rm -f ${keytabfile}
|
||||
rm -f current-db*
|
||||
@@ -244,6 +245,33 @@ for a in $enctypes; do
|
||||
done
|
||||
${kdestroy}
|
||||
|
||||
echo "Trying x-realm TGT with kvno 0 case";
|
||||
${kinit} --password-file=${objdir}/foopassword foo@$R ||
|
||||
{ ec=1 ; eval "${testfailed}"; }
|
||||
${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
|
||||
echo "Getting cross realm tickets"; > messages.log
|
||||
${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
|
||||
${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
|
||||
echo "Getting service ticket"; > messages.log
|
||||
${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
|
||||
${klist} -v
|
||||
${kdestroy}
|
||||
|
||||
echo "Trying x-realm TGT with kvno 0 case with key rollover";
|
||||
${kinit} --password-file=${objdir}/foopassword foo@$R ||
|
||||
{ ec=1 ; eval "${testfailed}"; }
|
||||
${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
|
||||
echo "Getting cross realm tickets"; > messages.log
|
||||
${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
|
||||
echo "Rolling over cross realm keys"; > messages.log
|
||||
${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
|
||||
${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
|
||||
${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
|
||||
echo "Getting service ticket"; > messages.log
|
||||
${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
|
||||
${klist} -v
|
||||
${kdestroy}
|
||||
|
||||
echo "try all permutations"; > messages.log
|
||||
for a in $enctypes; do
|
||||
echo "Getting client initial tickets ($a)"; > messages.log
|
||||
|
||||
Reference in New Issue
Block a user