summaryrefslogtreecommitdiffstats
path: root/src/tests/Makefile.in
Commit message (Collapse)AuthorAgeFilesLines
* Add tests for gic_pwd password changeGreg Hudson2014-03-031-0/+1
| | | | ticket: 7868
* Test bogus KDC-REQsTom Yu2013-12-311-0/+1
| | | | | | | | | | | Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req() and krb5_is_tgs_req(), to make sure that the KDC recovers correctly from failures in decode_krb5_as_req() and decode_krb5_tgs_req(). Also send an encoding that isn't a valid KDC-REQ. ticket: 7811 (new) target_version: 1.12.1 tags: pullup
* Fix up tests directory ignores, deps, cleanupGreg Hudson2013-12-121-2/+2
| | | | | A few test programs didn't make it into .gitignore, OBJS, or EXTRADEPSRCS.
* Add tests for krb5_sname_to_principalGreg Hudson2013-12-121-4/+8
|
* Add tests for different salt combinationsBen Kaduk2013-10-251-0/+1
| | | | | | | | | | | | | Create a principal with a pair of enctypes using different salt types. Confirm that the non-default salt type appears only once in the principal's key list. Also verify that the afs3 salt type is rejected by non-DES enctypes The afs3 salt type is for compatibility with AFS-3 kaservers, which are roughly krb4. As such, it only makes sense for single-DES enctypes. The PBKDF2 and arcfour enctypes correctly reject the key-creation parameters from the afs3 salt, but triple-DES currently does not.
* Remove old master key testsGreg Hudson2013-10-251-1/+1
| | | | | | | | | | | | | | | Remove tests/mkeystash_compat and tests/mk_migr. These are superseded by t_mkey.py, with two exceptions: tests/mk_migr included tests for password history across master key rollovers. Historical keys are encrypted in the kadmin/history key (which is accessed like any other key), so there isn't a specific need to test this unless we implement #1221. tests/mk_migr had provisions for testing master key rollover with the LDAP KDB module. All master key logic used in the LDAP KDB module is shared with the DB2 module in lib/kdb, so there is no specific need to test this combination.
* Add master key rollover tests in k5test frameworkGreg Hudson2013-10-251-0/+1
| | | | | | | | | | | Add a new script t_mkey.py using the k5test framework. Test the fixes for #6507, #7685, and #7686 as well as basic functionality and old-stashfile compatibility. dump.16 was created by running "kdb5_util create -s -P footes" and "kdb5_util dump dumpfile" with krb5 1.6. The key from the resulting stash file was extracted and placed in the struct.pack() call in the new test script.
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-041-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Add hostrealm interface testsGreg Hudson2013-08-151-3/+8
| | | | | | | | | | Create a test module for the hostrealm interface, a harness to call the realm mapping functions and display their results, and a Python script to exercise the functionality of the interface and each module (except the dns module, which we cannot easily test since it relies on TXT records in the public DNS). ticket: 7687
* Combine PKINIT test scriptsGreg Hudson2013-07-181-2/+1
|
* Add a helper for testing PKINIT and responder cbNalin Dahyabhai2013-07-171-4/+9
| | | | ticket: 7680
* Add kadmin support for principals without keysGreg Hudson2013-07-151-0/+1
| | | | | | | | | Add kadmin support for "addprinc -nokey", which creates a principal with no keys, and "purgekeys -all", which deletes all keys from a principal. The KDC was modified by #7630 to support principals without keys. ticket: 7679 (new)
* Add server-side otp preauth pluginNathaniel McCallum2013-07-111-0/+1
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Add test case for CVE-2013-1417Tom Yu2013-07-011-0/+1
| | | | | | ticket: 7670 (new) tags: pullup target_version: 1.11.4
* Add tests for pwqual modules and plugin orderingGreg Hudson2013-06-271-4/+9
| | | | | | | | | | Create a test module for the pwqual interface, and script to exercise the built-in and test modules through kadmin.local. Also create a test harness to display the order of pwqual modules for the current configuration, and use it to test the plugin module ordering guarantees. ticket: 7665
* Make empty passwords work via init_creds APIsGreg Hudson2013-05-271-4/+7
| | | | | | | | | | | | | | In the gak_data value used by krb5_get_as_key_password, separate the already-known password from the storage we might have allocated to put it in, so that we no longer use an empty data buffer to determine whether we know the password. This allows empty passwords to work via the API. Remove the kadm5 test which explicitly uses an empty password. Based on a patch from Stef Walter. ticket: 7642
* Reduce boilerplate in makefilesGreg Hudson2013-05-161-3/+0
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Add test case for CVE-2013-1416Tom Yu2013-05-091-0/+1
| | | | ticket: 7635 (new)
* Add various client-authenticating PKINIT testsNalin Dahyabhai2013-04-241-0/+1
| | | | | | | | | | | | | | Add tests for non-anonymous PKINIT: * FILE: with no password * FILE: with a password * DIR: with no password * DIR: with a password * PKCS12: with no password * PKCS12: with a password * PKCS11: with a password, if soft-pkcs11.so is found via ctypes [ghudson@mit.edu: reformatted to 79 columns; removed intermediate success() calls]
* Add tests for localauth interfaceGreg Hudson2013-03-091-4/+8
| | | | | | | | Create a test module, program, and script to exercise the krb5_aname_to_localname and krb5_k5userok functions as well as the localauth pluggable interface. ticket: 7583
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-271-1/+2
| | | | ticket: 7585
* Add kprop Python testsGreg Hudson2013-02-071-0/+1
| | | | | | Create a K5Realm.kprop_port method so test scripts can invoke kprop usefully, and create a simple Python test script exercising the same kprop functionality as the dejagnu suite's kprop.exp.
* Add more tests for dump and loadGreg Hudson2013-02-041-0/+1
| | | | | | | | Move the existing dump/load tests from t_general.py to a new script t_dump.py. Add additional tests using pre-created dumpfiles, to exercise the -r18, -r13, -b7, and -ov formats. bigredbutton: whitespace
* Remove manual kdc_realm testsGreg Hudson2013-01-111-1/+0
|
* Test KDC host-based referral supportGreg Hudson2013-01-111-1/+6
| | | | | | | Test the KDC host-based referral support in t_referral.py, using a new harness to call krb5_get_credentials with a specified server name type. Also use this new harness for the #7483 regression test, to avoid relying on an undocumented kvno extension.
* Consolidate policy tests into t_policy.pyGreg Hudson2013-01-091-3/+1
| | | | | Create a combined script for policy-related tests, and fold in the existing lockout, password history, and allowed-keysalts tests.
* Don't return a host referral to the service realmGreg Hudson2012-12-061-0/+1
| | | | | | | | | | A host referral to the same realm we just looked up the principal in is useless at best and confusing to the client at worst. Don't respond with one in the KDC. ticket: 7483 target_version: 1.11 tags: pullup
* Add automated tests for LDAP KDB moduleGreg Hudson2012-11-151-2/+7
| | | | | | | | | | | | | | Add new tests kdbtest.c and t_kdb.py. Together these exercise most of the code in the LDAP back end. kdbtest is also run against the DB2 module, which is mostly redundant with other tests, but does exercise the lockout logic a little more thoroughly than t_lockout.py can. To test the LDAP back end, we look for slapd and ldapadd binaries in the path. The system slapd is sometimes constrained by AppArmor or the like, which we can typically work around by making a copy of the binary. slapd detaches before listening on its server socket (this got better in 2.4.27 but still isn't perfect), so we unfortunately have to use a one-second sleep in the slapd setup.
* Import and complete Greg Hudson's iprop testNicolas Williams2012-10-081-0/+1
| | | | ticket: 7374
* Test the inconsistent locking fix and svc unavailNicolas Williams2012-09-121-0/+1
| | | | | | Test the fix for https://bugzilla.redhat.com/show_bug.cgi?id=586032 . Also test that krb5kdc can return svc unavailable
* Regression tests for CVE-2012-1014, CVE-2012-1015Tom Yu2012-08-071-0/+2
| | | | | | ticket: 7231 (new) target_version: 1.10.3 tags: pullup
* Policy extensions + new policy: allowed ks typesNicolas Williams2012-07-301-0/+1
| | | | | | | | | | | | | | | | | This simply adds KADM5_API_VERSION_4 and various fields to the policy structures: - attributes (policy-ish principal attributes) - max_life (max ticket life) - max_renewable_life (max ticket renewable life) - allowed_keysalts (allowed key/salt types) - TL data (future policy extensions) Of these only allowed_keysalts is currently implemented. Some refactoring of TL data handling is also done. ticket: 7223 (new)
* Rename tests/t_cccol.py to t_ccache.pyGreg Hudson2012-07-241-1/+1
| | | | | | | Generalize the ccache collection tests in t_cccol.py to multiple kinds of ccache tests, and rename it to avoid confusion with the lower-level lib/krb5/ccache/t_cccol.py. Move a test from t_general.py into t_ccache.py.
* Add control over session key enctype negotiationNicolas Williams2012-06-061-0/+1
| | | | | | | | | | | | | | | | | | | Adds a principal string attribute named "session_enctypes" which can specify what enctypes the principal supports for session keys. (For what it's worth, this actually allows one to list des-cbc-md5 as a supported session key enctype, though obviously this hardly matters now.) Add a [realms] section parameter for specifying whether to assume that principals (which lack the session_enctypes attribute) support des-cbc-crc for session keys. This allows those who still need to use allow_weak_crypto=true, for whatever reason, to start reducing the number of tickets issued with des-cbc-crc session keys to clients which still give des-cbc-crc preference in their default_tgs_enctypes list. [ghudson@mit.edu: Miscellaneous edits, cleanups, and fixes; refactored test script; documented session_enctypes attribute]
* Add kadmin ACL enforcement testsGreg Hudson2012-04-261-0/+1
| | | | | | | | | Add a Python script to test the enforcement of kadm5.acl specifications, including wildcards and restrictions. ticket: 7097 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25828 dc483132-0cff-0310-8789-dd5450dbe970
* Try all history keys to decrypt password historyGreg Hudson2012-04-241-1/+5
| | | | | | | | | | | | | A database created prior to 1.3 will have multiple password history keys, and kadmin prior to 1.8 won't necessarily choose the first one. So if there are multiple keys, we have to try them all. If none of the keys can decrypt a password history entry, don't fail the password change operation; it's not worth it without positive evidence of password reuse. ticket: 7099 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25819 dc483132-0cff-0310-8789-dd5450dbe970
* Add keytab kinit test casesGreg Hudson2012-04-191-0/+1
| | | | | | | | | | Create a test script for keytab-related tests. Move the kvno wrapping test there from t_general.py, and augment it to better match what's in standalone.exp. Add tests for kinit with keytab, including kinit with the most-preferred enctype missing from the keytab (which currently fails). git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25815 dc483132-0cff-0310-8789-dd5450dbe970
* Add clock skew testsGreg Hudson2012-04-171-0/+1
| | | | | | | Add a KDC option (-T) to run with a time offset, and use that to test kdc_timesync behavior. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25807 dc483132-0cff-0310-8789-dd5450dbe970
* Clean up more stuff in make cleanGreg Hudson2011-11-041-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25437 dc483132-0cff-0310-8789-dd5450dbe970
* Get rid of fake-installGreg Hudson2011-11-041-1/+1
| | | | | | | | | Instead, use $(BUILDTOP)/plugins as the plugin base for tests. For each real plugin module, create a link in the parent directory if we're doing a shared-library build--so built KDB modules can be found in plugins/kdb, preauth modules in plugins/preauth, etc.. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25436 dc483132-0cff-0310-8789-dd5450dbe970
* Add cross-realm tests to python test frameworkGreg Hudson2011-11-031-0/+1
| | | | | | | | Add a cross_realms function to k5test.py to generate several linked realms. Add a test script t_crossrealm.py to exercise six different cross-realm scenarios. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25429 dc483132-0cff-0310-8789-dd5450dbe970
* Revert r25288 because it can remove parts of the source treeTom Yu2011-09-291-11/+3
| | | | | | | Also, disable kdc_realm test until it works correctly on an uninstalled build and when built outside of the source tree. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25289 dc483132-0cff-0310-8789-dd5450dbe970
* Allow kdc_realm test run in case when the build and source directories are ↵Zhanna Tsitkov2011-09-291-2/+8
| | | | | | different git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25288 dc483132-0cff-0310-8789-dd5450dbe970
* Include Domain Realm Referrals (per ↵Zhanna Tsitkov2011-09-291-0/+2
| | | | | | http://k5wiki.kerberos.org/wiki/Projects/domain_realm_referrals project) test suite into "make check" git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25284 dc483132-0cff-0310-8789-dd5450dbe970
* Add kadmin functionality for string attributesGreg Hudson2011-09-211-0/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25215 dc483132-0cff-0310-8789-dd5450dbe970
* Add ccache collection support to toolsGreg Hudson2011-09-051-0/+1
| | | | | | | | | | | | | | | | * "kdestroy -A" destroys all caches in collection. * "kinit princ" searches the collection for a matching cache and overwrites it, or creates a new cache in the collection, if the type of the default cache is collection-enabled. The chosen cache also becomes the primary cache for the collection. * "klist -l" lists (in summary form) the caches in the collection. * "klist -A" lists the content of all of the caches in the collection. * "kswitch -c cache" (new command) makes cache the primary cache. * "kswitch -p princ" makes the cache for princ the primary cache. ticket: 6956 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25157 dc483132-0cff-0310-8789-dd5450dbe970
* Make principal renaming work in libkadm5srv by converting to explicitGreg Hudson2011-01-251-0/+1
| | | | | | | | | | | salts as necessary. Add a principal rename command to the client. (The RPC infrastructure was already present.) Adapted from patches submitted by mdw@umich.edu and lha@apple.com. ticket: 6323 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24604 dc483132-0cff-0310-8789-dd5450dbe970
* Fix a regression in the client-side ticket renewal code where KDCGreg Hudson2010-12-141-0/+1
| | | | | | | | | | | | options were not folded into the renewal request (most notably, the KDC_OPT_RENEWABLE flag), so we didn't request renewable renewed tickets. Add a simple test case for ticket renewal. ticket: 6838 tags: pullups target_version: 1.9 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24566 dc483132-0cff-0310-8789-dd5450dbe970
* Test for key rollover for TGT, including purging old keysTom Yu2010-12-031-0/+1
| | | | | | | | ticket: 1219 target_version: 1.9 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24555 dc483132-0cff-0310-8789-dd5450dbe970
* WhitespaceGreg Hudson2010-09-301-2/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24393 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2024-05-09 17:06:00 +0000