summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
* Fix OTP tests with pyrad 2.xGreg Hudson2015-01-041-1/+1
| | | | | | | | | Declare User-Password as having type "octets" instead of "string" or pyrad 2.x will throw a decoding error when retrieving it. ticket: 8053 (new) target_version: 1.13.1 tags: pullup
* Include file ccache name in error messagesNicolas Williams2014-12-154-11/+11
| | | | | | | | | | | | | | | | | | | | | | When a FILE ccache method returns an error, append the filename to the standard message for the code. Remove code to set extended messages in helper functions as they would just be overwritten. Also change the interpretation of errno values. Treat ENAMETOOLONG as KRB5_FCC_NOFILE instead of KRB5_FCC_INTERNAL, since it has an external cause and a name that long can't be opened by normal means. Treat EROFS as KRB5_FCC_PERM. Treat ENOTDIR and ELOOP as KRB5_FCC_NOFILE instead of KRB5_FCC_PERM as both errors imply that the full pathname doesn't exist. Treat EBUSY and ETXTBSY as KRB5_CC_IO instead of KRB5_FCC_PERM as they indicate a conflict rather than a permission issue. [ghudson@mit.edu: renamed set_error to set_errmsg_filename; removed now-inoperative code to set extended messages in helper functions; trimmed changes to interpret_errno; clarified and shortened commit message] ticket: 8052 (new)
* Regression tests for keyless principalsBen Kaduk2014-12-151-0/+17
| | | | | | Confirm that kadmind does not crash when creating/modifying a principal to have no keys, and confirm that no keys are present after a purgekeys -all.
* Add tests for LDAP ticket/policy name misuseGreg Hudson2014-12-151-0/+21
| | | | ticket: 8051
* Fix LDAP tests when sasl.h not foundGreg Hudson2014-12-091-10/+9
| | | | | | | | | | | Do not try to run the SASL EXTERNAL auth test if we could not define a useful interact function. With current libraries the interact function is asked for an authorization name, and the bind fails if it gets an unsuccessful result or if no interaction function is defined. ticket: 8049 (new) target_version: 1.13.1 tags: pullup
* Test err_fmtNicolas Williams2014-12-072-0/+29
| | | | | | | | [ghudson@mit.edu: move tests to new file; stop messing with KRB5CCNAME; use K5Realm.special_env instead of multiple K5Realm objects] ticket: 8047
* Use new error message wrapping APIsNicolas Williams2014-12-071-1/+1
| | | | | | | | | | | | | | Define internal names k5_prendmsg and k5_wrapmsg and use them where we amend error messages. This slightly changes the error message when we fail to construct FAST AP-REQ armor, decrypt a FAST reply, or store credentials in a gic_opts output ccache. Adjust the test suite for the latter of those changes. [ghudson@mit.edu: define and use internal names for brevity; pull in test fix from later commit; expand commit message; fix redundant separators in LDAP messages] ticket: 8046
* Add tests for duplicate detectionBen Kaduk2014-11-211-0/+23
| | | | | There's not an easy way to test for infinite loops other than making the test suite hang, unfortunately.
* Fix input race condition in t_skew.pyGreg Hudson2014-11-051-3/+3
| | | | | | | | | | | | | In two of the kinit tests run by t_skew.py, we expect kinit to exit before reading the password. If we supply a password input for those commands, we can fail with a broken pipe exception if the master process tries to write the password after the slave process exits. Also correctly check the output of the last kinit invocation. ticket: 8034 (new) target_version: 1.13.1 tags: pullup
* Adjust asn1c test vector code for new asn1cGreg Hudson2014-10-311-2/+1
| | | | | | | | | asn1c 0.9.22 added support for representing integers using unsigned types if they have appropriate constraints. This changes the representation of RFC4120's UInt32 type from Integer_t to unsigned long. In make-vectors.c, this means we can use a static initializer for kvno, and that the old method of calling asn_long2INTEGER doesn't work. Adjust make-vectors.c to assume the newer version of asn1c.
* Add test for kinit output ccache errorGreg Hudson2014-10-221-0/+6
| | | | ticket: 8028
* Add tests for klist -sGreg Hudson2014-10-131-0/+17
|
* Add test case for -keepold mkey re-encryptionGreg Hudson2014-09-051-3/+11
| | | | ticket: 7995
* Add test case for randkey mkvno updateGreg Hudson2014-08-211-0/+6
| | | | ticket: 7994
* Add regression test for LDAP key fencepost bugGreg Hudson2014-08-071-0/+11
| | | | ticket: 7980
* Fix KDC race in t_unlockiter.pyTom Yu2014-08-061-2/+3
| | | | | | | | | | | The second KDC startup in t_unlockiter.py could race with the garbage-collected shutdown of the first, causing the second one to fail to bind the listening port. Avoid the situation by setting start_kdc=False, because there doesn't need to be a KDC running for these tests anyway. Also use create_user=False and create_host=False, because those principals aren't necessary either. ticket: 7977
* Correct includes for unlockiter.cTom Yu2014-08-041-1/+3
| | | | | | | | | | Some platforms (e.g., Solaris) need a declaration of memset() for the FD_ZERO() macro to work, contrary to POSIX standards. Add an inclusion of <string.h> to accommodate them. Also add <sys/time.h>, possibly needed by some older platforms, and remove a spurious inclusion of <sys/socket.h>. ticket: 7977
* Tests for unlocked iterationTom Yu2014-08-023-1/+297
| | | | ticket: 7977
* Add flag word to KDB iteration APIsTom Yu2014-08-021-1/+1
| | | | | ticket: 7977 (new) subject: Enable unlocked KDB iteration
* Add kiprop/<master-hostname> during KDB creationNeng Xue2014-08-012-14/+1
| | | | | | | | | | | To reduce the number of steps in the deployment of iprop, create the kiprop/hostname principal for the master KDC during KDB creation. Adjust tests to match the new behavior. [ghudson@mit.edu: clarified commit message; avoided applying kadmin flags/lifetime to kiprop principal] ticket: 7979 (new)
* Add SPNEGO renegotiation test caseGreg Hudson2014-07-211-6/+24
| | | | | | Modify t_spnego.c to force a renegotiation in the SPNEGO exchange, by making the initiator propose IAKERB while the acceptor supports only krb5.
* Add tests for LDAP SASL supportGreg Hudson2014-07-191-1/+65
| | | | | | | | In t_kdb.py, add a test case for EXTERNAL, and a test case for DIGEST-MD5 if we built with the SASL header file and found the core schema file. ticket: 7944
* Rename --with-proxy-tls-impl to --with-tls-implGreg Hudson2014-07-191-3/+2
| | | | | | | | Make the configure option for TLS implementation more generic, in case we use the k5tls module for something other than KDC proxy support. Rename all of the associated symbols for consistency. ticket: 7929
* Improve indentation of t_otp.pyMichael Mattioli2014-07-151-7/+8
| | | | | | | | | Move the RADIUS attribute dictionary text to a global variable defined at indent level 0, so that we don't go back to indent level 0 in the middle of the RadiusDaemon class definition. [ghudson@mit.edu: clarified commit message, moved comment, changed variable name]
* Fix invalid test strings in t_oid.cLukas Slebodnik2014-07-121-1/+1
| | | | | | | A missing comma caused two invalid strings to be concatenated. The resulting string was still invalid so the tests passed. [ghudson@mit.edu: clarified commit message]
* make dependGreg Hudson2014-07-081-0/+18
|
* Include autoconf.h before system headersGreg Hudson2014-07-0815-51/+13
| | | | | | | | | Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
* Avoid using length fields in socket addressesGreg Hudson2014-07-041-6/+0
| | | | | | | | | | | | Remove code to set or reference the length fields of socket addresses (sa_len/sin_len/sin6_len), since they aren't portable and setting them is not required. Remove autoconf tests for those fields which are no longer used or which were never used. There is one exception: in localaddr.c, we still neeed to reference sa_len for the definition of ifreq_size on platforms which have sa_len. Leave that behind, along with the autoconf test which defines SA_LEN.
* Add tests for invalid GSSAPI per-message tokensGreg Hudson2014-06-263-7/+457
| | | | ticket: 7949
* Add test for KDC client loggingGreg Hudson2014-06-102-0/+24
| | | | | | | Add a test case which performed a TGS request with an expired ticket and checks that the client principal is logged. ticket: 7910
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Always include salt in LDAP KrbKey encodingGreg Hudson2014-06-051-0/+1
| | | | | | | | | | | | | | | | | | | In the LDAP KDB module, ensure that every krb5_key_data we pass to asn1_encode_sequence_of_keys includes a salt type, for compatibility with the decoder in unpatched krb5 1.11 and 1.12. This is not a behavior change by itself; since 1.7 the encoder has always included a KrbKey salt field because it erroneously treats that field as non-optional. (Luckily, the encoded salt always happens to have salt type 0 because krb5_key_data constructors start with zeroed memory.) The next commit will fix the encoder and decoder to properly treat the KrbKey salt field as optional, so we need this change to ensure that our encodings remain compatible. Also fix the ASN.1 tests to set key_data_ver correctly for the sample test key data. ticket: 7919
* Add tests for MS-KKDCP client supportNalin Dahyabhai2014-06-022-0/+220
| | | | | | | | Exercise the MS-KKDCP client support using the test proxy server, for AS, TGS, and kpasswd requests while also checking the certificate verification and name checks. ticket: 7929
* Add a simple KDC proxy test serverNalin Dahyabhai2014-06-027-0/+428
| | | | | | | | This proxy server uses python-paste to run the kdcproxy from https://pypi.python.org/pypi/kdcproxy. It should be used along with the proxy.pem certificate in ../tests/dejagnu/proxy-certs. ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-028-0/+107
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Test that kinit -k -i picks the intended principalBen Kaduk2014-05-221-0/+3
| | | | | | | Prior to ticket 7892 it would use the default host/ principal when no principal was given on the command line. ticket: 7892
* Improve krb5_rd_req decryption failure errorsGreg Hudson2014-05-074-9/+255
| | | | | | | | | | | | | | When krb5_rd_req cannot decrypt a ticket, try to produce the most helpful diagnostic we can, and return an error code which corresponds to the most applicable Kerberos protocol error. Add a trace log containing the error message for ticket decryption failures, in case the application server does not log it. Add new tests to cover krb5_rd_req error messages and adjust existing tests to match the new messages. Also adjust svc_auth_gssapi.c to look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC. ticket: 7232
* Get getopt from unistd.h (not getopt.h) in testsGreg Hudson2014-03-282-2/+1
| | | | | | | | | | | POSIX defines getopt to be declared in unistd.h, and HP-UX (as of version 11.31) does not appear to have getopt.h. In test programs which currently include getopt.h and aren't currently built on Windows, include unistd.h or just assume we will get it via k5-int.h. ticket: 7894 (new) target_version: 1.12.2 tags: pullup
* Improve salt type display in kadmin getprincGreg Hudson2014-03-262-15/+13
| | | | | | | | | | | | | | In krb5_salttype_to_string, output the salt type name we would recognize as input. In the output of getprinc, display the enctype and salt type in a form we would accept--either enctype:salttype if the salt type is not the default, or just the enctype if it is. Update t_mkey.py and t_salt.py to expect the new output format. Update documentation examples to show the new format. ticket: 5958
* Add tests for gic_pwd password changeGreg Hudson2014-03-032-0/+38
| | | | ticket: 7868
* Minimize race conditions in t_iprop.pyGreg Hudson2014-02-261-32/+65
| | | | | | | | | | | | Augment kpropd's debugging output so we can see the starting and ending serial numbers of a sync, and check them in t_iprop.py's wait_for_prop to make sure we're observing the correct sync each time. Try to make sure we only send SIGUSR1 when kpropd is actually sleeping, by waiting for it to print its pre-sleep message to stderr after a full dump and after each sync. This isn't perfect, as there is a short window between printing to stderr and actually sleeping, but we can't do any better until kpropd has a more reliable mechanism for triggering immediate updates.
* Test iprop slave ulog managementGreg Hudson2014-02-201-98/+238
| | | | | | | | | | | | Check the ulog more thoroughly after each operation, including the principal names we expect in each update entry. Verify that the slave ulog contains actual update entries received from master. Add a second slave which receives updates from the first. Test a wider variety of principal operations. Add two additional operations after the full resync to test that incremental updates resume after a full resync (albeit with some lag). ticket: 7855
* Correctly get default realm in kdb5.cGreg Hudson2014-02-111-5/+0
| | | | | | | Call krb5_get_default_realm instead of directly accessing context->default_realm, to remove the requirement that krb5_get_default_realm or krb5_set_default_realm be used before krb5_db_open.
* Test SPNEGO acceptor response to MS krb5 mech OIDGreg Hudson2014-02-051-4/+60
| | | | | | | | | | | | In t_spnego.c, add code to make a SPNEGO request with the erroneous Microsoft OID value and examine the response to make sure that it uses the same OID value as the request did. The token and tmp variables were unused, so rename them to itok and atok for the purpose of the new test code. ticket: 7858 target_version: 1.12.2 tags: pullup
* Add test coverage for gss_pseudo_randomGreg Hudson2014-01-222-6/+192
| | | | | Add a test program which compares gss_pseudo_random outputs against expected values for each enctype.
* Add test for gss_acquire_cred_from rcache featureGreg Hudson2014-01-172-1/+39
|
* Add test for salttype defaultingTom Yu2014-01-061-1/+2
| | | | ticket: 884
* Test bogus KDC-REQsTom Yu2013-12-312-0/+45
| | | | | | | | | | | Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req() and krb5_is_tgs_req(), to make sure that the KDC recovers correctly from failures in decode_krb5_as_req() and decode_krb5_tgs_req(). Also send an encoding that isn't a valid KDC-REQ. ticket: 7811 (new) target_version: 1.12.1 tags: pullup
* Avoid keyctl purge in keyring ccache testsGreg Hudson2013-12-201-8/+12
| | | | | | | | | keyctl purge was added in keyutils 1.5 (released in March 2011). Use keyctl unlink to clean up keys instead, as it is more universal. ticket: 7810 target_version: 1.12.1 tags: pullup
* Use an extended com_err hook in klistGreg Hudson2013-12-203-5/+5
| | | | | | | | | | Add an adapted version of extended_com_err_fn from kinit to klist and use it. In do_ccache(), rely on the ccache type to set a reasonable message if krb5_cc_set_flags() or krb5_cc_get_principal() fails due to a nonexistent or unreadable ccache, and don't confuse the user with the name of the ccache operation that failed. ticket: 7809
generated by cgit (git 2.34.1) at 2026-02-18 07:44:48 +0000