Add a test for potential DNS leaks via symbol interposition.
We build variants of kinit and test_acquire_cred that define their own symbols rk_dns_lookup, gethostbyname, gethostbyname2, and getaddrinfo to print a message and abort. For getaddrinfo, we abort only if the caller failed to specify AI_NUMERICHOST; otherwise we use dlsym(RTLD_NEXT, "getaddrinfo") instead. The new test tests/gss/check-nodns is like tests/gss/check-basic, but uses kinit_auditdns and test_acquire_cred_auditdns to verify that no DNS resolution happens. This test should work and be effective on ELF platforms where the getaddrinfo function is implemented by the symbol `getaddrinfo'. On non-ELF platforms it may not be effective -- and on platforms where the getaddrinfo function is implemented by another symbol (like `__getaddrinfo50') it may not work, but we can cross that bridge when we come to it. Verified manually that the test fails, with the expected error message and abort, without `block_dns = yes' in krb5-nodns.conf. No automatic test of the mechanism for now because it might not work on some platforms. XXX check-nodns.in is copypasta of check-basic.in, should factor out the common parts so they don't get out of sync.
This commit is contained in:
Taylor R Campbell
committed by
Nico Williams
Nico Williams
parent
e2c0d98965
commit
ad23636db8
@@ -4,9 +4,9 @@ include $(top_srcdir)/Makefile.am.common
|
||||
|
||||
.NOTPARALLEL:
|
||||
|
||||
noinst_DATA = krb5.conf new_clients_k5.conf mech
|
||||
noinst_DATA = krb5.conf krb5-nodns.conf new_clients_k5.conf mech
|
||||
|
||||
SCRIPT_TESTS = check-basic check-gss check-gssmask check-context check-spnego check-ntlm check-negoex
|
||||
SCRIPT_TESTS = check-basic check-nodns check-gss check-gssmask check-context check-spnego check-ntlm check-negoex
|
||||
|
||||
TESTS = $(SCRIPT_TESTS)
|
||||
|
||||
@@ -47,6 +47,11 @@ check-basic: check-basic.in Makefile
|
||||
chmod +x check-basic.tmp && \
|
||||
mv check-basic.tmp check-basic
|
||||
|
||||
check-nodns: check-nodns.in Makefile
|
||||
$(do_subst) < $(srcdir)/check-nodns.in > check-nodns.tmp && \
|
||||
chmod +x check-nodns.tmp && \
|
||||
mv check-nodns.tmp check-nodns
|
||||
|
||||
check-ntlm: check-ntlm.in Makefile
|
||||
$(do_subst) < $(srcdir)/check-ntlm.in > check-ntlm.tmp && \
|
||||
chmod +x check-ntlm.tmp && \
|
||||
@@ -61,6 +66,10 @@ krb5.conf: krb5.conf.in Makefile
|
||||
$(do_subst) < $(srcdir)/krb5.conf.in > krb5.conf.tmp && \
|
||||
mv krb5.conf.tmp krb5.conf
|
||||
|
||||
krb5-nodns.conf: krb5-nodns.conf.in Makefile
|
||||
$(do_subst) < $(srcdir)/krb5-nodns.conf.in > krb5-nodns.conf.tmp && \
|
||||
mv krb5-nodns.conf.tmp krb5-nodns.conf
|
||||
|
||||
new_clients_k5.conf: new_clients_k5.conf.in Makefile
|
||||
$(do_subst) < $(srcdir)/new_clients_k5.conf.in > new_clients_k5.conf.tmp && \
|
||||
mv new_clients_k5.conf.tmp new_clients_k5.conf
|
||||
@@ -77,12 +86,14 @@ CLEANFILES= \
|
||||
krb5ccfile-ds \
|
||||
server.keytab \
|
||||
krb5.conf \
|
||||
krb5-nodns.conf \
|
||||
new_clients_k5.conf \
|
||||
mech \
|
||||
current-db* \
|
||||
*.log \
|
||||
tempfile \
|
||||
check-basic.tmp \
|
||||
check-nodns.tmp \
|
||||
check-gss.tmp \
|
||||
check-gssmask.tmp \
|
||||
check-spnego.tmp \
|
||||
@@ -92,6 +103,7 @@ CLEANFILES= \
|
||||
EXTRA_DIST = \
|
||||
NTMakefile \
|
||||
check-basic.in \
|
||||
check-nodns.in \
|
||||
check-gss.in \
|
||||
check-gssmask.in \
|
||||
check-spnego.in \
|
||||
|
||||
219
tests/gss/check-nodns.in
Normal file
219
tests/gss/check-nodns.in
Normal file
@@ -0,0 +1,219 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (c) 2007 Kungliga Tekniska Högskolan
|
||||
# (Royal Institute of Technology, Stockholm, Sweden).
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
#
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in the
|
||||
# documentation and/or other materials provided with the distribution.
|
||||
#
|
||||
# 3. Neither the name of the Institute nor the names of its contributors
|
||||
# may be used to endorse or promote products derived from this software
|
||||
# without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
# SUCH DAMAGE.
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
|
||||
env_setup="@env_setup@"
|
||||
srcdir="@srcdir@"
|
||||
objdir="@objdir@"
|
||||
|
||||
. ${env_setup}
|
||||
|
||||
# If there is no useful db support compiled in, disable test
|
||||
../db/have-db || exit 77
|
||||
|
||||
R=TEST.H5L.SE
|
||||
|
||||
port=@port@
|
||||
|
||||
keytabfile=${objdir}/server.keytab
|
||||
keytab="FILE:${keytabfile}"
|
||||
nokeytab="FILE:no-such-keytab"
|
||||
cache="FILE:krb5ccfile"
|
||||
cache2="FILE:krb5ccfile2"
|
||||
nocache="FILE:no-such-cache"
|
||||
|
||||
kadmin="${kadmin} -l -r $R"
|
||||
kdc="${kdc} --addresses=127.0.0.1 -P $port"
|
||||
|
||||
acquire_cred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_acquire_cred_auditdns"
|
||||
test_kcred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_kcred"
|
||||
test_add_store_cred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_add_store_cred"
|
||||
|
||||
KRB5_CONFIG="${objdir}/krb5-nodns.conf"
|
||||
export KRB5_CONFIG
|
||||
|
||||
KRB5_KTNAME="${keytab}"
|
||||
export KRB5_KTNAME
|
||||
KRB5CCNAME="${cache}"
|
||||
export KRB5CCNAME
|
||||
|
||||
rm -f ${keytabfile}
|
||||
rm -f current-db*
|
||||
rm -f out-*
|
||||
rm -f mkey.file*
|
||||
|
||||
> messages.log
|
||||
|
||||
echo Creating database
|
||||
${kadmin} \
|
||||
init \
|
||||
--realm-max-ticket-life=1day \
|
||||
--realm-max-renewable-life=1month \
|
||||
${R} || exit 1
|
||||
|
||||
echo upw > ${objdir}/foopassword
|
||||
|
||||
${kadmin} add -p upw --use-defaults user@${R} || exit 1
|
||||
${kadmin} add -p upw --use-defaults another@${R} || exit 1
|
||||
${kadmin} add -p p1 --use-defaults host/host.test.h5l.se@${R} || exit 1
|
||||
${kadmin} ext -k ${keytab} host/host.test.h5l.se@${R} || exit 1
|
||||
|
||||
echo "Doing database check"
|
||||
${kadmin} check ${R} || exit 1
|
||||
|
||||
echo Starting kdc
|
||||
${kdc} --detach --testing || { echo "kdc failed to start"; cat messages.log; exit 1; }
|
||||
kdcpid=`getpid kdc`
|
||||
|
||||
trap "kill -9 ${kdcpid}; echo signal killing kdc; cat messages.log; exit 1;" EXIT
|
||||
|
||||
exitcode=0
|
||||
|
||||
echo "initial ticket"
|
||||
${kinit_auditdns} -c ${cache} --password-file=${objdir}/foopassword user@${R} || exitcode=1
|
||||
|
||||
echo "copy ccache with gss_store_cred"
|
||||
# Note we test that the ccache used for storing is token-expanded
|
||||
${test_add_store_cred} --default --overwrite --env ${cache} "${cache2}%{null}" || exit 1
|
||||
${klist} -c ${cache2} || exit 1
|
||||
|
||||
echo "keytab"
|
||||
${acquire_cred} \
|
||||
--acquire-type=accept \
|
||||
--acquire-name=host@host.test.h5l.se || exit 1
|
||||
|
||||
echo "keytab w/ short-form name and name canon rules"
|
||||
${acquire_cred} \
|
||||
--acquire-type=accept \
|
||||
--acquire-name=host@host || exit 1
|
||||
|
||||
echo "keytab w/o name"
|
||||
${acquire_cred} \
|
||||
--acquire-type=accept || exit 1
|
||||
|
||||
echo "keytab w/ wrong name"
|
||||
${acquire_cred} \
|
||||
--acquire-type=accept --kerberos \
|
||||
--acquire-name=host@host2.test.h5l.se 2>/dev/null && exit 1
|
||||
|
||||
echo "init using keytab"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--acquire-type=initiate \
|
||||
--acquire-name=host@host.test.h5l.se > /dev/null || exit 1
|
||||
|
||||
echo "init using keytab (loop 10)"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--acquire-type=initiate \
|
||||
--loops=10 \
|
||||
--acquire-name=host@host.test.h5l.se > /dev/null || exit 1
|
||||
|
||||
echo "init using keytab (loop 10, target)"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--acquire-type=initiate \
|
||||
--loops=10 \
|
||||
--target=host@host.test.h5l.se \
|
||||
--acquire-name=host@host.test.h5l.se > /dev/null || exit 1
|
||||
|
||||
echo "init using keytab (loop 10, kerberos)"
|
||||
${acquire_cred} \
|
||||
--acquire-type=initiate \
|
||||
--loops=10 \
|
||||
--kerberos \
|
||||
--acquire-name=host@host.test.h5l.se > /dev/null || exit 1
|
||||
|
||||
echo "init using keytab (loop 10, target, kerberos)"
|
||||
${acquire_cred} \
|
||||
--acquire-type=initiate \
|
||||
--loops=10 \
|
||||
--kerberos \
|
||||
--target=host@host.test.h5l.se \
|
||||
--acquire-name=host@host.test.h5l.se > /dev/null || exit 1
|
||||
|
||||
echo "init using existing cc"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--name-type=user-name \
|
||||
--acquire-type=initiate \
|
||||
--acquire-name=user || exit 1
|
||||
|
||||
KRB5CCNAME=${nocache}
|
||||
|
||||
echo "fail init using existing cc"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--name-type=user-name \
|
||||
--acquire-type=initiate \
|
||||
--acquire-name=user 2>/dev/null && exit 1
|
||||
|
||||
echo "use gss_krb5_ccache_name for user"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--name-type=user-name \
|
||||
--ccache=${cache} \
|
||||
--acquire-type=initiate \
|
||||
--acquire-name=user >/dev/null || exit 1
|
||||
|
||||
KRB5CCNAME=${cache}
|
||||
KRB5_KTNAME=${nokeytab}
|
||||
|
||||
echo "kcred"
|
||||
${test_kcred} || exit 1
|
||||
|
||||
${kdestroy} -c ${cache}
|
||||
|
||||
KRB5_KTNAME="${keytab}"
|
||||
|
||||
echo "init using keytab"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--acquire-type=initiate \
|
||||
--acquire-name=host@host.test.h5l.se 2>/dev/null || exit 1
|
||||
|
||||
echo "init using keytab (ccache)"
|
||||
${acquire_cred} \
|
||||
--kerberos \
|
||||
--acquire-type=initiate \
|
||||
--ccache=${cache} \
|
||||
--acquire-name=host@host.test.h5l.se 2>/dev/null || exit 1
|
||||
|
||||
trap "" EXIT
|
||||
|
||||
echo "killing kdc (${kdcpid})"
|
||||
kill ${kdcpid} 2> /dev/null
|
||||
|
||||
exit $exitcode
|
||||
55
tests/gss/krb5-nodns.conf.in
Normal file
55
tests/gss/krb5-nodns.conf.in
Normal file
@@ -0,0 +1,55 @@
|
||||
include @srcdirabs@/include-krb5.conf
|
||||
|
||||
[libdefaults]
|
||||
default_keytab_name = @objdir@/server.keytab
|
||||
enable-kx509 = yes
|
||||
kx509_store = PEM-FILE:/tmp/cert_%{euid}.pem
|
||||
default_realm = TEST.H5L.SE
|
||||
kuserok = SYSTEM-K5LOGIN:@srcdir@/../kdc/k5login
|
||||
kuserok = USER-K5LOGIN
|
||||
kuserok = SIMPLE
|
||||
block_dns = yes
|
||||
|
||||
[realms]
|
||||
TEST.H5L.SE = {
|
||||
kdc = 127.0.0.1:@port@
|
||||
auth_to_local_names = {
|
||||
user1 = mapped_user1
|
||||
}
|
||||
}
|
||||
|
||||
[kdc]
|
||||
enable-digest = true
|
||||
allow-anonymous = true
|
||||
digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
|
||||
strict-nametypes = true
|
||||
synthetic_clients = true
|
||||
enable_gss_preauth = true
|
||||
gss_mechanisms_allowed = sanon-x25519
|
||||
enable-pkinit = true
|
||||
pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
|
||||
pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
|
||||
pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
|
||||
# pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
|
||||
pkinit_mappings_file = @srcdir@/pki-mapping
|
||||
pkinit_allow_proxy_certificate = true
|
||||
|
||||
database = {
|
||||
dbname = @objdir@/current-db
|
||||
realm = TEST.H5L.SE
|
||||
mkey_file = @objdir@/mkey.file
|
||||
log_file = @objdir@/current.log
|
||||
}
|
||||
|
||||
[hdb]
|
||||
db-dir = @objdir@
|
||||
enable_virtual_hostbased_princs = true
|
||||
virtual_hostbased_princ_mindots = 1
|
||||
virtual_hostbased_princ_maxdots = 3
|
||||
same_realm_aliases_are_soft = true
|
||||
|
||||
[logging]
|
||||
kdc = 0-/FILE:@objdir@/messages.log
|
||||
default = 0-/FILE:@objdir@/messages.log
|
||||
|
||||
include @srcdirabs@/missing-krb5.conf
|
||||
Reference in New Issue
Block a user