1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
# Copyright (C) 2011 by the Massachusetts Institute of Technology.
# All rights reserved.
# Export of this software from the United States of America may
# require a specific license from the United States Government.
# It is the responsibility of any person or organization contemplating
# export to obtain such a license before exporting.
#
# WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
# distribute this software and its documentation for any purpose and
# without fee is hereby granted, provided that the above copyright
# notice appear in all copies and that both that copyright notice and
# this permission notice appear in supporting documentation, and that
# the name of M.I.T. not be used in advertising or publicity pertaining
# to distribution of the software without specific, written prior
# permission. Furthermore if you modify this software you must label
# your software as modified software and not distribute it in such a
# fashion that it might be confused with the original M.I.T. software.
# M.I.T. makes no representations about the suitability of
# this software for any purpose. It is provided "as is" without express
# or implied warranty.
#!/usr/bin/python
from k5test import *
realm = K5Realm(create_host=False)
keyctl = which('keyctl')
out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1)
test_keyring = (keyctl is not None and
'Unknown credential cache type' not in out)
# Test kdestroy and klist of a non-existent ccache.
realm.run([kdestroy])
output = realm.run([klist], expected_code=1)
if ' not found' not in output:
fail('Expected error message not seen in klist output')
realm.addprinc('alice', password('alice'))
realm.addprinc('bob', password('bob'))
realm.addprinc('carol', password('carol'))
def collection_test(realm, ccname):
realm.env['KRB5CCNAME'] = ccname
realm.kinit('alice', password('alice'))
output = realm.run([klist])
if 'Default principal: alice@' not in output:
fail('Initial kinit failed to get credentials for alice.')
realm.run([kdestroy])
output = realm.run([klist], expected_code=1)
if ' not found' not in output:
fail('Initial kdestroy failed to destroy primary cache.')
output = realm.run([klist, '-l'], expected_code=1)
if not output.endswith('---\n') or output.count('\n') != 2:
fail('Initial kdestroy failed to empty cache collection.')
realm.kinit('alice', password('alice'))
realm.kinit('carol', password('carol'))
output = realm.run([klist, '-l'])
if '---\ncarol@' not in output or '\nalice@' not in output:
fail('klist -l did not show expected output after two kinits.')
realm.kinit('alice', password('alice'))
output = realm.run([klist, '-l'])
if '---\nalice@' not in output or output.count('\n') != 4:
fail('klist -l did not show expected output after re-kinit for alice.')
realm.kinit('bob', password('bob'))
output = realm.run([klist, '-A'])
if 'bob@' not in output.splitlines()[1] or 'alice@' not in output or \
'carol' not in output or output.count('Default principal:') != 3:
fail('klist -A did not show expected output after kinit for bob.')
realm.run([kswitch, '-p', 'carol'])
output = realm.run([klist, '-l'])
if '---\ncarol@' not in output or output.count('\n') != 5:
fail('klist -l did not show expected output after kswitch to carol.')
realm.run([kdestroy])
output = realm.run([klist, '-l'])
if 'carol@' in output or 'bob@' not in output or output.count('\n') != 4:
fail('kdestroy failed to remove only primary ccache.')
realm.run([kdestroy, '-A'])
output = realm.run([klist, '-l'], expected_code=1)
if not output.endswith('---\n') or output.count('\n') != 2:
fail('kdestroy -a failed to empty cache collection.')
collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc'))
if test_keyring:
def cleanup_keyring(anchor, name):
out = realm.run(['keyctl', 'list', anchor])
if ('keyring: ' + name + '\n') in out:
keyid = realm.run(['keyctl', 'search', anchor, 'keyring', name])
realm.run(['keyctl', 'unlink', keyid.strip(), anchor])
# Use realm.testdir as the collection name to avoid conflicts with
# other build trees.
cname = realm.testdir
col_ringname = '_krb_' + cname
cleanup_keyring('@s', col_ringname)
collection_test(realm, 'KEYRING:session:' + cname)
cleanup_keyring('@s', col_ringname)
# Test legacy keyring cache linkage.
realm.env['KRB5CCNAME'] = 'KEYRING:' + cname
realm.run([kdestroy, '-A'])
realm.kinit(realm.user_princ, password('user'))
out = realm.run([klist, '-l'])
if 'KEYRING:legacy:' + cname + ':' + cname not in out:
fail('Wrong initial primary name in keyring legacy collection')
# Make sure this cache is linked to the session keyring.
id = realm.run([keyctl, 'search', '@s', 'keyring', cname])
out = realm.run([keyctl, 'list', id.strip()])
if 'user: __krb5_princ__' not in out:
fail('Legacy cache not linked into session keyring')
# Remove the collection keyring. When the collection is
# reinitialized, the legacy cache should reappear inside it
# automatically as the primary cache.
cleanup_keyring('@s', col_ringname)
out = realm.run([klist])
if realm.user_princ not in out:
fail('Cannot see legacy cache after removing collection')
coll_id = realm.run([keyctl, 'search', '@s', 'keyring', '_krb_' + cname])
out = realm.run([keyctl, 'list', coll_id.strip()])
if (id.strip() + ':') not in out:
fail('Legacy cache did not reappear in collection after klist')
# Destroy the cache and check that it is unlinked from the session keyring.
realm.run([kdestroy])
realm.run([keyctl, 'search', '@s', 'keyring', cname], expected_code=1)
cleanup_keyring('@s', col_ringname)
# Test parameter expansion in default_ccache_name
realm.stop()
conf = {'libdefaults': {'default_ccache_name': 'testdir/%{null}abc%{uid}'}}
realm = K5Realm(krb5_conf=conf, create_kdb=False)
del realm.env['KRB5CCNAME']
uidstr = str(os.getuid())
out = realm.run([klist], expected_code=1)
if 'testdir/abc%s' % uidstr not in out:
fail('Wrong ccache in klist')
success('Credential cache tests')
|
