241 lines
6.4 KiB
Bash
241 lines
6.4 KiB
Bash
#!/bin/sh
|
|
#
|
|
# Copyright (c) 2006 - 2024 Kungliga Tekniska Högskolan
|
|
# (Royal Institute of Technology, Stockholm, Sweden).
|
|
# All rights reserved.
|
|
#
|
|
# Redistribution and use in source and binary forms, with or without
|
|
# modification, are permitted provided that the following conditions
|
|
# are met:
|
|
#
|
|
# 1. Redistributions of source code must retain the above copyright
|
|
# notice, this list of conditions and the following disclaimer.
|
|
#
|
|
# 2. Redistributions in binary form must reproduce the above copyright
|
|
# notice, this list of conditions and the following disclaimer in the
|
|
# documentation and/or other materials provided with the distribution.
|
|
#
|
|
# 3. Neither the name of the Institute nor the names of its contributors
|
|
# may be used to endorse or promote products derived from this software
|
|
# without specific prior written permission.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
# SUCH DAMAGE.
|
|
|
|
#
|
|
# Test current (newer) Heimdal clients against older Heimdal KDC
|
|
#
|
|
|
|
top_builddir="@top_builddir@"
|
|
env_setup="@env_setup@"
|
|
objdir="@objdir@"
|
|
|
|
. ${env_setup}
|
|
|
|
# Skip if older Heimdal is not available
|
|
OLD_HEIMDAL="@OLD_HEIMDAL@"
|
|
if [ -z "$OLD_HEIMDAL" ] || [ ! -d "$OLD_HEIMDAL" ]; then
|
|
echo "Older Heimdal not available (use --with-older-heimdal=PATH), skipping"
|
|
exit 77
|
|
fi
|
|
|
|
# Check for required older Heimdal binaries (for the KDC)
|
|
for prog in kdc kadmin; do
|
|
if [ ! -x "${OLD_HEIMDAL}/libexec/${prog}" ] && [ ! -x "${OLD_HEIMDAL}/sbin/${prog}" ] && [ ! -x "${OLD_HEIMDAL}/bin/${prog}" ]; then
|
|
echo "Older Heimdal ${prog} not found, skipping"
|
|
exit 77
|
|
fi
|
|
done
|
|
|
|
testfailed="echo test failed; cat messages.log; exit 1"
|
|
|
|
R=OLD-TEST.H5L.SE
|
|
|
|
port=@port@
|
|
|
|
# Locate older Heimdal kadmin and kdc
|
|
if [ -x "${OLD_HEIMDAL}/libexec/kdc" ]; then
|
|
old_kdc="${OLD_HEIMDAL}/libexec/kdc"
|
|
elif [ -x "${OLD_HEIMDAL}/sbin/kdc" ]; then
|
|
old_kdc="${OLD_HEIMDAL}/sbin/kdc"
|
|
else
|
|
old_kdc="${OLD_HEIMDAL}/bin/kdc"
|
|
fi
|
|
|
|
if [ -x "${OLD_HEIMDAL}/sbin/kadmin" ]; then
|
|
old_kadmin="${OLD_HEIMDAL}/sbin/kadmin"
|
|
elif [ -x "${OLD_HEIMDAL}/bin/kadmin" ]; then
|
|
old_kadmin="${OLD_HEIMDAL}/bin/kadmin"
|
|
else
|
|
old_kadmin="${OLD_HEIMDAL}/libexec/kadmin"
|
|
fi
|
|
|
|
server=host/datan.test.h5l.se
|
|
cache="FILE:${objdir}/new-cache.krb5"
|
|
olddir="${objdir}/old-heimdal-kdc"
|
|
|
|
# Use current (new) client tools
|
|
kinit="${kinit} -c $cache ${afs_no_afslog}"
|
|
klist="${klist} -c $cache"
|
|
kgetcred="${kgetcred} -c $cache"
|
|
kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
|
|
|
|
# Clean up from previous runs
|
|
rm -rf "${olddir}"
|
|
rm -f "${cache#FILE:}"
|
|
|
|
mkdir -p "${olddir}"
|
|
|
|
> messages.log
|
|
|
|
ec=0
|
|
kdcpid=
|
|
|
|
cleanup() {
|
|
if [ -n "$kdcpid" ]; then
|
|
echo "Killing older KDC (pid $kdcpid)"
|
|
kill $kdcpid 2>/dev/null
|
|
wait $kdcpid 2>/dev/null
|
|
fi
|
|
trap '' EXIT INT TERM
|
|
cat messages.log
|
|
exit $ec
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
#
|
|
# Create krb5.conf for older KDC
|
|
#
|
|
cat > ${objdir}/krb5-old-heimdal.conf <<EOF
|
|
[libdefaults]
|
|
default_realm = ${R}
|
|
dns_lookup_realm = false
|
|
dns_lookup_kdc = false
|
|
ticket_lifetime = 24h
|
|
forwardable = true
|
|
|
|
[realms]
|
|
${R} = {
|
|
kdc = localhost:${port}
|
|
}
|
|
|
|
[domain_realm]
|
|
.old-test.h5l.se = ${R}
|
|
old-test.h5l.se = ${R}
|
|
|
|
[kdc]
|
|
database = {
|
|
dbname = ${olddir}/heimdal
|
|
realm = ${R}
|
|
mkey_file = ${olddir}/mkey.file
|
|
log_file = ${olddir}/log
|
|
}
|
|
|
|
[logging]
|
|
kdc = FILE:${objdir}/messages.log
|
|
default = FILE:${objdir}/messages.log
|
|
EOF
|
|
|
|
KRB5_CONFIG="${objdir}/krb5-old-heimdal.conf"
|
|
export KRB5_CONFIG
|
|
|
|
#
|
|
# Create database using older kadmin
|
|
#
|
|
echo "Creating database with older Heimdal kadmin"
|
|
${old_kadmin} -l -r ${R} <<EOF || { echo "Failed to create database"; exit 1; }
|
|
init --realm-max-ticket-life=1day --realm-max-renewable-life=1month ${R}
|
|
add -p foo --use-defaults foo@${R}
|
|
add -p foo --use-defaults ${server}@${R}
|
|
EOF
|
|
|
|
echo foo > ${objdir}/foopassword
|
|
echo bar > ${objdir}/barpassword
|
|
|
|
#
|
|
# Start older KDC
|
|
#
|
|
echo "Starting older Heimdal KDC"
|
|
${old_kdc} --addresses=localhost -P ${port} --detach || \
|
|
{ echo "Older KDC failed to start"; cat messages.log; exit 1; }
|
|
|
|
# Find the KDC pid - older Heimdal may use different pid file locations
|
|
sleep 1
|
|
if [ -f "${olddir}/kdc.pid" ]; then
|
|
kdcpid=$(cat "${olddir}/kdc.pid")
|
|
elif [ -f "${HEIM_PIDFILE_DIR}/kdc.pid" ]; then
|
|
kdcpid=$(cat "${HEIM_PIDFILE_DIR}/kdc.pid")
|
|
elif [ -f "${HEIM_PIDFILE_DIR}/lt-kdc.pid" ]; then
|
|
kdcpid=$(cat "${HEIM_PIDFILE_DIR}/lt-kdc.pid")
|
|
else
|
|
# Try to find by process
|
|
kdcpid=$(pgrep -f "${old_kdc}.*${port}" | head -1)
|
|
fi
|
|
|
|
if [ -z "$kdcpid" ]; then
|
|
echo "Could not determine KDC pid, continuing anyway"
|
|
else
|
|
echo "Older KDC running with PID $kdcpid"
|
|
fi
|
|
|
|
# Wait for KDC to be ready
|
|
sleep 2
|
|
|
|
#
|
|
# Test 1: Password authentication with current kinit
|
|
#
|
|
echo ""
|
|
echo "=== Test 1: Current Heimdal kinit with password against older KDC ==="
|
|
|
|
${kinit} --password-file=${objdir}/foopassword foo@${R} || \
|
|
{ ec=1; eval "${testfailed}"; }
|
|
|
|
echo "Verifying ticket"
|
|
${klist} || { ec=1; eval "${testfailed}"; }
|
|
${klist} | grep "krbtgt/${R}@${R}" > /dev/null || \
|
|
{ ec=1; echo "No TGT found"; eval "${testfailed}"; }
|
|
|
|
echo "Test 1 PASSED"
|
|
|
|
#
|
|
# Test 2: Get service ticket with current kgetcred
|
|
#
|
|
echo ""
|
|
echo "=== Test 2: Current Heimdal kgetcred against older KDC ==="
|
|
|
|
${kgetcred} ${server}@${R} || { ec=1; eval "${testfailed}"; }
|
|
${klist} | grep "${server}@${R}" > /dev/null || \
|
|
{ ec=1; echo "No service ticket found"; eval "${testfailed}"; }
|
|
|
|
echo "Test 2 PASSED"
|
|
|
|
#
|
|
# Test 3: Wrong password should fail
|
|
#
|
|
echo ""
|
|
echo "=== Test 3: Current kinit with wrong password should fail ==="
|
|
|
|
${kinit} --password-file=${objdir}/barpassword foo@${R} 2>/dev/null && \
|
|
{ ec=1; echo "kinit with wrong password should have failed"; eval "${testfailed}"; }
|
|
|
|
echo "Test 3 PASSED"
|
|
|
|
#
|
|
# Clean up
|
|
#
|
|
${kdestroy} 2>/dev/null
|
|
|
|
echo ""
|
|
echo "All tests passed!"
|
|
ec=0
|
|
exit 0
|