ad23636db8
We build variants of kinit and test_acquire_cred that define their own symbols rk_dns_lookup, gethostbyname, gethostbyname2, and getaddrinfo to print a message and abort. For getaddrinfo, we abort only if the caller failed to specify AI_NUMERICHOST; otherwise we use dlsym(RTLD_NEXT, "getaddrinfo") instead. The new test tests/gss/check-nodns is like tests/gss/check-basic, but uses kinit_auditdns and test_acquire_cred_auditdns to verify that no DNS resolution happens. This test should work and be effective on ELF platforms where the getaddrinfo function is implemented by the symbol `getaddrinfo'. On non-ELF platforms it may not be effective -- and on platforms where the getaddrinfo function is implemented by another symbol (like `__getaddrinfo50') it may not work, but we can cross that bridge when we come to it. Verified manually that the test fails, with the expected error message and abort, without `block_dns = yes' in krb5-nodns.conf. No automatic test of the mechanism for now because it might not work on some platforms. XXX check-nodns.in is copypasta of check-basic.in, should factor out the common parts so they don't get out of sync.
56 lines
1.6 KiB
Plaintext
56 lines
1.6 KiB
Plaintext
include @srcdirabs@/include-krb5.conf
|
|
|
|
[libdefaults]
|
|
default_keytab_name = @objdir@/server.keytab
|
|
enable-kx509 = yes
|
|
kx509_store = PEM-FILE:/tmp/cert_%{euid}.pem
|
|
default_realm = TEST.H5L.SE
|
|
kuserok = SYSTEM-K5LOGIN:@srcdir@/../kdc/k5login
|
|
kuserok = USER-K5LOGIN
|
|
kuserok = SIMPLE
|
|
block_dns = yes
|
|
|
|
[realms]
|
|
TEST.H5L.SE = {
|
|
kdc = 127.0.0.1:@port@
|
|
auth_to_local_names = {
|
|
user1 = mapped_user1
|
|
}
|
|
}
|
|
|
|
[kdc]
|
|
enable-digest = true
|
|
allow-anonymous = true
|
|
digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
|
|
strict-nametypes = true
|
|
synthetic_clients = true
|
|
enable_gss_preauth = true
|
|
gss_mechanisms_allowed = sanon-x25519
|
|
enable-pkinit = true
|
|
pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
|
|
pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
|
|
pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
|
|
# pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
|
|
pkinit_mappings_file = @srcdir@/pki-mapping
|
|
pkinit_allow_proxy_certificate = true
|
|
|
|
database = {
|
|
dbname = @objdir@/current-db
|
|
realm = TEST.H5L.SE
|
|
mkey_file = @objdir@/mkey.file
|
|
log_file = @objdir@/current.log
|
|
}
|
|
|
|
[hdb]
|
|
db-dir = @objdir@
|
|
enable_virtual_hostbased_princs = true
|
|
virtual_hostbased_princ_mindots = 1
|
|
virtual_hostbased_princ_maxdots = 3
|
|
same_realm_aliases_are_soft = true
|
|
|
|
[logging]
|
|
kdc = 0-/FILE:@objdir@/messages.log
|
|
default = 0-/FILE:@objdir@/messages.log
|
|
|
|
include @srcdirabs@/missing-krb5.conf
|