summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* Refactor KDC renewable ticket handlingGreg Hudson2013-06-061-5/+63
| | | | | | | | | | | | | | | | | | | | | Create a new helper to compute the renewable lifetime for AS and TGS requests. This has some minor behavior differences: * We only issue a renewable ticket if the renewable lifetime is greater than the normal ticket lifetime. * We give RENEWABLE precedence over RENEWABLE-OK in determining the requested renewable lifetime, instead of sometimes doing the reverse. * We use the client's maximum renewable life for TGS requests if we have looked up its DB entry. * Instead of rejecting requests for renewable tickets (if the client or server principal doesn't allow it, or a TGS request's TGT isn't renewable), issue non-renewable tickets. ticket: 7661 (new)
* Untabify and reindent t_authpkinit.pyGreg Hudson2013-06-031-17/+16
|
* Make empty passwords work via init_creds APIsGreg Hudson2013-05-274-4/+106
| | | | | | | | | | | | | | In the gak_data value used by krb5_get_as_key_password, separate the already-known password from the storage we might have allocated to put it in, so that we no longer use an empty data buffer to determine whether we know the password. This allows empty passwords to work via the API. Remove the kadm5 test which explicitly uses an empty password. Based on a patch from Stef Walter. ticket: 7642
* Fix transited handling for GSSAPI acceptorsGreg Hudson2013-05-211-0/+13
| | | | | | | | | | | | | | | | | | The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. ticket: 7639 target_version: 1.11.3 tags: pullup
* Reduce boilerplate in makefilesGreg Hudson2013-05-1613-39/+2
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Add test case for CVE-2013-1416Tom Yu2013-05-092-0/+16
| | | | ticket: 7635 (new)
* Fix checking unencrypted PKCS12: twiceNalin Dahyabhai2013-05-081-1/+1
| | | | | | The test, as submitted, included a copy/paste error which caused it to test PKINIT using unencrypted PKCS12 bundles twice, and to not test a DIR: location containing unencrypted PEM-formatted keys at all.
* Add various client-authenticating PKINIT testsNalin Dahyabhai2013-04-246-0/+203
| | | | | | | | | | | | | | Add tests for non-anonymous PKINIT: * FILE: with no password * FILE: with a password * DIR: with no password * DIR: with a password * PKCS12: with no password * PKCS12: with a password * PKCS11: with a password, if soft-pkcs11.so is found via ctypes [ghudson@mit.edu: reformatted to 79 columns; removed intermediate success() calls]
* Add a script for [re]generating test PKI credsNalin Dahyabhai2013-04-241-0/+117
| | | | [ghudson@mit.edu: reformatted to limit lines to 79 columns]
* Fix typo in t_credstore.cGreg Hudson2013-04-021-1/+1
| | | | | Correctly check whether the next argument is NULL in the while loop which parses store elements.
* Add gss_import_cred_from client keytab testGreg Hudson2013-04-013-54/+63
| | | | | | | | Modify t_credstore.c to be more flexible and adjust t_gssapi.py accordingly. Add a test to t_client_keytab.py which acquire creds using a programmatically specified client keytab. ticket: 7598
* Fix warnings in tests/gss-threadsGreg Hudson2013-03-293-17/+16
|
* Reformat tests/gss-threadsGreg Hudson2013-03-294-662/+632
|
* Fix typo in ktest_make_sample_auth_packGreg Hudson2013-03-291-1/+1
|
* make dependGreg Hudson2013-03-246-41/+32
|
* Add tests for localauth interfaceGreg Hudson2013-03-093-4/+224
| | | | | | | | Create a test module, program, and script to exercise the krb5_aname_to_localname and krb5_k5userok functions as well as the localauth pluggable interface. ticket: 7583
* Fix dependencies in tests/gssapiNickolai Zeldovich2013-03-031-3/+3
| | | | | | | | | Use $(COMMON_DEPS) instead of $(COMMON_DEPLIBS) for dependencies; the latter appears to be a typo. Fixes build when using "make -j". ticket: 7587 (new) target_version: 1.11.2 tags: pullup
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-272-2/+3
| | | | ticket: 7585
* Add kprop Python testsGreg Hudson2013-02-072-0/+45
| | | | | | Create a K5Realm.kprop_port method so test scripts can invoke kprop usefully, and create a simple Python test script exercising the same kprop functionality as the dejagnu suite's kprop.exp.
* Add more tests for dump and loadGreg Hudson2013-02-048-26/+151
| | | | | | | | Move the existing dump/load tests from t_general.py to a new script t_dump.py. Add additional tests using pre-created dumpfiles, to exercise the -r18, -r13, -b7, and -ov formats. bigredbutton: whitespace
* Refactor LDAP DB option parsing codeGreg Hudson2013-01-281-1/+1
| | | | | | | | | | krb5_ldap_open and krb5_ldap_create contain two large, almost identical blocks of DB option processing code. Factor it out into a new function krb5_ldap_parse_db_params in ldap_misc.c, and simplify the factored-out code. Create a helper function to add server entries and use it to simplify krb5_ldap_read_server_params as well as DB option parsing. Since the new DB option helper uses isspace instead of isblank, we no longer require portability goop for isblank.
* Propagate policy changes over iprop via full dumpGreg Hudson2013-01-221-0/+30
| | | | | | | | Since iprop cannot carry policy changes, force a full resync to happen each time a policy change occurs. Based on a patch from Richard Basch <basch@alum.mit.edu>. ticket: 7522
* Verify iprop test results more thoroughlyGreg Hudson2013-01-221-45/+35
| | | | | | | In k5test.py, allow run_kadminl to take an environment argument. In t_iprop.py, perform some queries on the slaves after each propagation to spot-check that it got modifications from master. Use a helper function to check serial numbers for conciseness.
* Fix iprop log reinitializationGreg Hudson2013-01-221-5/+3
| | | | | | | | | | | | | | | | If the master iprop log is reinitialized to serial number 0, slaves will need to take a full dump--but after that happens, we need to know whether the slave has taken that full dump, we we don't offering full dumps indefinitely. So, record a timestamp in kdb_last_time when we reinitialize the log header, and compare the slave timestamp to kdb_last_time whenever it has the current serial number, even if it's 0. Test this by performing a propagation with sno 0 in t_iprop.py and detecting whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from kadmind. ticket: 7550 (new)
* Test multi-value host referral variablesGreg Hudson2013-01-111-5/+5
| | | | | | host_based_services and no_host_referral are allowed to have multiple relations in each place they appear, so alter a couple of the test cases to exercise that.
* Remove manual kdc_realm testsGreg Hudson2013-01-1119-720/+0
|
* Test KDC host-based referral supportGreg Hudson2013-01-114-11/+234
| | | | | | | Test the KDC host-based referral support in t_referral.py, using a new harness to call krb5_get_credentials with a specified server name type. Also use this new harness for the #7483 regression test, to avoid relying on an undocumented kvno extension.
* make dependGreg Hudson2013-01-1011-11/+11
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Test more policy featuresGreg Hudson2013-01-091-0/+77
| | | | | | Add tests to t_policy.py for password quality enforcement, password history (apart from the existing #7099 regression test), and for references to nonexistent policies.
* Consolidate policy tests into t_policy.pyGreg Hudson2013-01-094-77/+48
| | | | | Create a combined script for policy-related tests, and fold in the existing lockout, password history, and allowed-keysalts tests.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-092-4/+2
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Rename ccache configuration macrosZhanna Tsitkov2013-01-091-4/+4
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Fix gss_str_to_oid and gss_oid_to_str edge casesGreg Hudson2013-01-012-2/+228
| | | | | | | | | | | | | Neither function correctly handled OIDs whose second arc exceeds 47 (theoretically possible if the first arc is 2). gss_str_to_oid had additional problems: it used scanf, it didn't consistently protect against read overrun if the input buffer wasn't null-terminated, and it could get confused by + or - characters in the first two arcs. Fix gss_oid_to_str and rewrite gss_str_to_oid. Also add a test program. ticket: 7524 (new)
* Simplify k5test.py environmentsGreg Hudson2012-12-2022-339/+285
| | | | | | | | | | | | | | The initial k5test.py design, copied from the dejagnu suite, is to create config files and environments for four expected roles: client, server, master, and slave. This approach exaggerates the complexity of the common case, where the configurations don't need to vary, and limits us to having just one slave for kprop/iprop tests. Instead, create just one configuration by default, and add a special_env() method which sets up a differently configured environment for the few test cases which need one. The run_as_*() methods are collapsed into just run(), which accepts an optional argument for the environment returned by special_env().
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-196-17/+27
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Don't return a host referral to the service realmGreg Hudson2012-12-062-0/+22
| | | | | | | | | | A host referral to the same realm we just looked up the principal in is useless at best and confusing to the client at worst. Don't respond with one in the KDC. ticket: 7483 target_version: 1.11 tags: pullup
* Fix quoting issues in LDAP KDB moduleGreg Hudson2012-11-172-18/+18
| | | | | | | | | | | | | | | Modify ldap_filter_correct() to quote special characters for DN strings as well as filters, since it is already used to quote a DN string in krb5_ldap_name_to_policydn() and there's no harm in over-quoting. In krb5_ldap_put_principal(), quote the unparsed principal name for use in DNs we choose. In krb5_ldap_create_password_policy(), use the policy name for the CN of the policy entry instead of the (possibly quoted) first element of the DN. Adapted from a patch by Jim Shi <hanmao_shi@apple.com>. ticket: 7296
* Tests for kinit's detection of a keytab requestBen Kaduk2012-11-161-0/+12
| | | | | | | | | We must check that 'kinit -t keytab' and 'kinit -i' successfully produce tickets, and have the specified warning output. ticket: 7218 tags: pullup target_version: 1.11
* Add automated tests for LDAP KDB moduleGreg Hudson2012-11-153-2/+693
| | | | | | | | | | | | | | Add new tests kdbtest.c and t_kdb.py. Together these exercise most of the code in the LDAP back end. kdbtest is also run against the DB2 module, which is mostly redundant with other tests, but does exercise the lockout logic a little more thoroughly than t_lockout.py can. To test the LDAP back end, we look for slapd and ldapadd binaries in the path. The system slapd is sometimes constrained by AppArmor or the like, which we can typically work around by making a copy of the binary. slapd detaches before listening on its server socket (this got better in 2.4.27 but still isn't perfect), so we unfortunately have to use a one-second sleep in the slapd setup.
* Quiet down two noisy test programsGreg Hudson2012-10-232-4/+0
|
* Remove nroff man pagesBen Kaduk2012-10-161-141/+0
| | | | | | | We generate man pages from RST sources now; they are checked into the tree in src/man/. The gen-manpages directory is no longer needed.
* make dependTom Yu2012-10-151-18/+38
|
* Wait for correct message in t_iprop.pyGreg Hudson2012-10-151-2/+1
| | | | | | | | | The message "Got incremental updates from the master" precedes actually replaying the updates on the slave. Instead look for "Incremental updates:" (the statistics message), which happens just after the updates are replayed. Also, we don't need to import time now that we're not sleeping.
* Eliminate races in t_iprop.pyGreg Hudson2012-10-131-15/+31
| | | | | | | | | | | | | After we start kpropd, read about the initial full dump before making changes on the master. Avoid prodding kpropd for this read (by shifting responsibility for the initial prod to the caller) since kpropd doesn't sleep before its first request. When waiting for sync, note whether we got a full propagation and match that up with our expectations. Use a long polling interval so kpropd doesn't wake up on its own and confuse the test script with an extra incremental update.
* Make t_iprop.py faster and more robustGreg Hudson2012-10-121-22/+42
| | | | | | | | | | | | | | | Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt sleeps and make kpropd do an iprop request immediately. In k5test.py, add prod_kpropd and read_from_kpropd methods to allow test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr output; also allow the test script to specify additional arguments when starting kpropd. In t_iprop.py, start kpropd with -d and, instead of sleeping, read kpropd output until we see an indication that kpropd is in sync with the master. To avoid delays, prod kpropd before waiting for sync and after a completed full prop.
* Fix slow kprop dejagnu testGreg Hudson2012-10-102-5/+3
| | | | | | | | | Fix kpropd -S -t to actually exit after processing one connection (it was breaking out of the switch statement, not the while loop). Use the -t when invoking kpropd from the dejagnu test framework; previously it was unnecessary because kpropd -S -d exited after one connection. Clear up some confusion in the kprop.exp comments about whether kpropd is expected to exit.
* De-conditionalize Camellia codeGreg Hudson2012-10-091-26/+24
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
* Remove iprop dejagnu testGreg Hudson2012-10-081-236/+0
| | | | | | | Both the Python and dejagnu iprop tests are slow since they use sleeps to give kpropd time to do its work (although we can fix this with some work). Since the Python tests cover the same ground as the dejagnu tests, we don't need both.
* Import and complete Greg Hudson's iprop testNicolas Williams2012-10-082-0/+140
| | | | ticket: 7374
* Fix t_s4u2proxy_krb5 cleanupGreg Hudson2012-09-241-1/+3
| | | | | | | Unlike most GSS test programs, t_s4u2proxy_krb5 uses a cleanup handler, so we have to be careful to initialize everything we clean up--particularly service2_name, which is initialized after a possible goto. Also, remember to release acceptor_name.
generated by cgit (git 2.34.1) at 2024-06-23 21:19:11 +0000