oysteikt/heimdal
0
0
Fork 0
Code Issues 4 Pull Requests Releases Activity

Add a test for potential DNS leaks via symbol interposition.

Browse Source 
We build variants of kinit and test_acquire_cred that define their
own symbols rk_dns_lookup, gethostbyname, gethostbyname2, and
getaddrinfo to print a message and abort.  For getaddrinfo, we abort
only if the caller failed to specify AI_NUMERICHOST; otherwise we use
dlsym(RTLD_NEXT, "getaddrinfo") instead.

The new test tests/gss/check-nodns is like tests/gss/check-basic, but
uses kinit_auditdns and test_acquire_cred_auditdns to verify that no
DNS resolution happens.

This test should work and be effective on ELF platforms where the
getaddrinfo function is implemented by the symbol `getaddrinfo'.  On
non-ELF platforms it may not be effective -- and on platforms where
the getaddrinfo function is implemented by another symbol (like
`__getaddrinfo50') it may not work, but we can cross that bridge when
we come to it.

Verified manually that the test fails, with the expected error
message and abort, without `block_dns = yes' in krb5-nodns.conf.  No
automatic test of the mechanism for now because it might not work on
some platforms.

XXX check-nodns.in is copypasta of check-basic.in, should factor out
the common parts so they don't get out of sync.
This commit is contained in:
Taylor R Campbell
2024-01-07 21:44:29 +00:00
committed by Nico Williams
parent e2c0d98965
commit ad23636db8
8 changed files with 411 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/bin/setup-env.in
+1
View File
@@ -38,6 +38,7 @@ kdigest="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kdigest"
kgetcred="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kgetcred"
kimpersonate="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kimpersonate"
kinit="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kinit"
kinit_auditdns="${TESTS_ENVIRONMENT} ${top_builddir}/appl/test/kinit_auditdns"
klist="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/heimtools klist"
kpasswd="${TESTS_ENVIRONMENT} ${top_builddir}/kpasswd/kpasswd"
kpasswdd="${TESTS_ENVIRONMENT} ${top_builddir}/kpasswd/kpasswdd"