From c3936f72c35fdc9f95c4c6050d4ca8acf08d06f8 Mon Sep 17 00:00:00 2001 From: Nicolas Williams Date: Mon, 26 Sep 2011 16:16:05 -0500 Subject: [PATCH] Test for hdb-mitdb, including an MIT KDB file. --- tests/kdc/Makefile.am | 15 ++++ tests/kdc/check-hdb-mitdb.in | 117 +++++++++++++++++++++++++++++++ tests/kdc/hdb-mitdb | Bin 0 -> 8192 bytes tests/kdc/hdb-mitdb.kadm5 | Bin 0 -> 8192 bytes tests/kdc/hdb-mitdb.mkey | Bin 0 -> 30 bytes tests/kdc/krb5-hdb-mitdb.conf.in | 59 ++++++++++++++++ 6 files changed, 191 insertions(+) create mode 100644 tests/kdc/check-hdb-mitdb.in create mode 100644 tests/kdc/hdb-mitdb create mode 100644 tests/kdc/hdb-mitdb.kadm5 create mode 100644 tests/kdc/hdb-mitdb.mkey create mode 100644 tests/kdc/krb5-hdb-mitdb.conf.in diff --git a/tests/kdc/Makefile.am b/tests/kdc/Makefile.am index ecf74e5d1..398cb6391 100644 --- a/tests/kdc/Makefile.am +++ b/tests/kdc/Makefile.am @@ -2,6 +2,7 @@ include $(top_srcdir)/Makefile.am.common noinst_DATA = \ krb5.conf \ + krb5-hdb-mitdb.conf.in \ krb5-weak.conf \ krb5-pkinit.conf \ krb5-pkinit-win.conf \ @@ -15,6 +16,7 @@ SCRIPT_TESTS = \ check-des \ check-digest \ check-kadmin \ + check-hdb-mitdb \ check-kdc \ check-kdc-weak \ check-keys \ @@ -63,6 +65,11 @@ check-des: check-des.in Makefile krb5.conf chmod +x check-des.tmp mv check-des.tmp check-des +check-hdb-mitdb: check-hdb-mitdb.in Makefile krb5-hdb-mitdb.conf + $(do_subst) < $(srcdir)/check-hdb-mitdb.in > check-hdb-mitdb.tmp + chmod +x check-hdb-mitdb.tmp + mv check-hdb-mitdb.tmp check-hdb-mitdb + check-kdc: check-kdc.in Makefile $(do_subst) < $(srcdir)/check-kdc.in > check-kdc.tmp chmod +x check-kdc.tmp @@ -120,6 +127,13 @@ krb5.conf: krb5.conf.in Makefile -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5.conf.tmp mv krb5.conf.tmp krb5.conf +krb5-hdb-mitdb.conf: krb5-hdb-mitdb.conf.in Makefile + $(do_subst) \ + -e 's,[@]WEAK[@],false,g' \ + -e 's,[@]dk[@],,g' \ + -e 's,[@]kdc[@],,g' < $(srcdir)/krb5-hdb-mitdb.conf.in > krb5-hdb-mitdb.conf.tmp + mv krb5-hdb-mitdb.conf.tmp krb5-hdb-mitdb.conf + krb5-weak.conf: krb5.conf.in Makefile $(do_subst) \ -e 's,[@]WEAK[@],true,g' \ @@ -196,6 +210,7 @@ EXTRA_DIST = \ check-digest.in \ check-iprop.in \ check-kadmin.in \ + check-hdb-mitdb.in \ check-kdc.in \ check-kdc-weak.in \ check-keys.in \ diff --git a/tests/kdc/check-hdb-mitdb.in b/tests/kdc/check-hdb-mitdb.in new file mode 100644 index 000000000..57c987be9 --- /dev/null +++ b/tests/kdc/check-hdb-mitdb.in @@ -0,0 +1,117 @@ +#!/bin/sh +# +# Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan +# (Royal Institute of Technology, Stockholm, Sweden). +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the Institute nor the names of its contributors +# may be used to endorse or promote products derived from this software +# without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +top_builddir="@top_builddir@" +env_setup="@env_setup@" +objdir="@objdir@" + +. ${env_setup} + +KRB5_CONFIG="${1-${objdir}/krb5-hdb-mitdb.conf}" +export KRB5_CONFIG + +testfailed="echo test failed; cat messages.log; exit 1" + +# If there is no ldap support compile in, disable test +if ${kdc} --builtin-hdb | grep mit-db > /dev/null ; then + : +else + echo "no MIT KDB support" + exit 77 +fi + +# If there is no useful db support compile in, disable test +${have_db} || exit 77 + +R=TEST.H5L.SE + +port=@port@ + +kadmin="${kadmin} -l -r $R --config-file=${KRB5_CONFIG}" +kdc="${kdc} --addresses=localhost -P $port" + +server=host/datan.test.h5l.se +cache="FILE:${objdir}/cache.krb5" +keytabfile=${objdir}/server.keytab +keytab="FILE:${keytabfile}" + +kinit="${kinit} -c $cache ${afs_no_afslog}" +klist="${klist} -c $cache" +kgetcred="${kgetcred} -c $cache" +kdestroy="${kdestroy} -c $cache ${afs_no_unlog}" + +rm -f ${keytabfile} +rm -f current-db* +rm -f out-* +rm -f mkey.file* + +> messages.log + +echo Database should exist + +${kadmin} ext -k ${keytab} ${server}@${R} || exit 1 + +echo foo > ${objdir}/foopassword + +echo Starting kdc +env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \ +${kdc} & +kdcpid=$! + +sh ${wait_kdc} +if [ "$?" != 0 ] ; then + kill -9 ${kdcpid} + exit 1 +fi + +trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT + +ec=0 + +echo "Getting client initial tickets"; > messages.log +${kinit} --password-file=${objdir}/foopassword foo@$R || \ + { ec=1 ; eval "${testfailed}"; } +echo "Getting tickets"; > messages.log +${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; } +echo "Listing tickets"; > messages.log +${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; } +${test_ap_req} ${server}@${R} ${keytab} ${cache} || \ + { ec=1 ; eval "${testfailed}"; } +${kdestroy} + +echo "killing kdc (${kdcpid})" +sh ${leaks_kill} kdc $kdcpid || exit 1 + +trap "" EXIT + +exit $ec diff --git a/tests/kdc/hdb-mitdb b/tests/kdc/hdb-mitdb new file mode 100644 index 0000000000000000000000000000000000000000..b667c65a9dde09c15bc3598706be5fbc85c9274e GIT binary patch literal 8192 zcmYc?WMyDxU|?Vn01*(Z0HH?7(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R z7!8485(11!{$OHYU{GObU=QGLVDI3t;a1?v;0@sk;X_g~${Y=W(GVC7fzc2c4S~@R zph5_MhTY$Q%t_17cL;F}4$<>4_0bD3X6L$775(L(*G_dFbH3M^V2>jeS?0cwD`e8DT)(}q!&!M@tL(?&CfmE+HxnC zw<;}SU|>*YU|`4wIXWZ1xI{lCu_Q51uOzj&L@&cMN3S@Qe z)G&hM0u)+q54+@^&0FuV`t9OnH%xBYZGZPx&!kw@?Dt}|>W57~N{cM6mV2Ic-!-Z4 zz{v{_s%jkK@6>~ILqaR_orl)@U+zyr7ih11_qfUUan?(pBWFHGa6Nvz`8%()&uWpXc2;T!X-Ec`W`M5QM2;IUWuD$&l|GewT|8UWrnjk%SmdN_I+vc`(E_?m1G*vi~=X_S|)Wa2(@*fbPvLoJJ z>dq>$z8CV7Ho1h>?aPb&I>9S-i;((W%VQh&cFYp$-Mo;2L4tvS;WNm)&~PbDN~$Cy zSR`Pk^Vj4}beZMPN_emha*#s13aoXj-Cz0GBNCOzQOc~JQFl5qLQ$DgO) znG`nD^ynwfuMuA=!w{jebKCn|Gv@abGu4}P?^d|i%IeIy zO)M6CD6MtYIVbb!qO0nix!3a;`0O)&?E2lvVf@Z^)rSdpRe#KuXJBBs4DvyCQBp~I zi9S-bhL#LKittr&pfHwaAYcp=gA7B~qXxf}r1<2b)Wnj^{5%wEKqVfeNO&4_XHCcA zbBkYdtvr0w?n{%D(7oz+9fB(|jvwA;^X=(2t+RGhG|wzw&BV-_mJ_~{GJ8Xxaj(b_nnQ3vVa|P=DOG3-_$2>SaayxOsyAfGwd&IPiXsfHfeU|mj!~Z Wn`)L{>`*@Y)st)5fkn|$PZ$6StaiHq literal 0 HcmV?d00001 diff --git a/tests/kdc/hdb-mitdb.kadm5 b/tests/kdc/hdb-mitdb.kadm5 new file mode 100644 index 0000000000000000000000000000000000000000..5128b719f0d18af2936d964b83088aa9114e0b9e GIT binary patch literal 8192 zcmYc?WMyDxU|?Vn01*(Z0HH?7(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R z7!8485(11!{$OHYU=TqW2|$t@WsZixXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J MhQMeD4A~F>0PD5@^8f$< literal 0 HcmV?d00001 diff --git a/tests/kdc/hdb-mitdb.mkey b/tests/kdc/hdb-mitdb.mkey new file mode 100644 index 0000000000000000000000000000000000000000..b2ac1538fef69433d90c593cd6d722e007b6b6d3 GIT binary patch literal 30 mcmWe&kYHe7SZ!Elm@O)n*!-{UukaD}hO0k5a#UT@)B*sCmkVwH literal 0 HcmV?d00001 diff --git a/tests/kdc/krb5-hdb-mitdb.conf.in b/tests/kdc/krb5-hdb-mitdb.conf.in new file mode 100644 index 000000000..219218322 --- /dev/null +++ b/tests/kdc/krb5-hdb-mitdb.conf.in @@ -0,0 +1,59 @@ +[libdefaults] + default_realm = TEST.H5L.SE TEST2.H5L.SE + no-addresses = TRUE + allow_weak_crypto = @WEAK@ + +[appdefaults] + pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt + reconnect-min = 2s + reconnect-backoff = 2s + reconnect-max = 10s + +[realms] + TEST.H5L.SE = { + kdc = localhost:@port@ + admin_server = localhost:@admport@ + kpasswd_server = localhost:@pwport@ + } + +[domain_realm] + .test.h5l.se = TEST.H5L.SE + localhost = TEST.H5L.SE + +[kdc] + enable-digest = true + allow-anonymous = true + digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2 + + enable-http = true + + enable-pkinit = true + pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key + pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt + pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt +# pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl + pkinit_mappings_file = @srcdir@/pki-mapping + pkinit_allow_proxy_certificate = true + + database = { + label = { + dbname = mit-db:@objdir@/hdb-mitdb + realm = TEST.H5L.SE + mkey_file = @objdir@/hdb-mitdb.mkey + acl_file = @srcdir@/heimdal.acl + log_file = @objdir@/current@kdc@.log + } + } + + signal_socket = @objdir@/signal + iprop-stats = @objdir@/iprop-stats + iprop-acl = @srcdir@/iprop-acl + +[logging] + kdc = 0-/FILE:@objdir@/messages.log + default = 0-/FILE:@objdir@/messages.log + +[kadmin] + save-password = true + @dk@ +