summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* Simplify k5test.py environmentsGreg Hudson2012-12-2022-339/+285
| | | | | | | | | | | | | | The initial k5test.py design, copied from the dejagnu suite, is to create config files and environments for four expected roles: client, server, master, and slave. This approach exaggerates the complexity of the common case, where the configurations don't need to vary, and limits us to having just one slave for kprop/iprop tests. Instead, create just one configuration by default, and add a special_env() method which sets up a differently configured environment for the few test cases which need one. The run_as_*() methods are collapsed into just run(), which accepts an optional argument for the environment returned by special_env().
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-196-17/+27
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Don't return a host referral to the service realmGreg Hudson2012-12-062-0/+22
| | | | | | | | | | A host referral to the same realm we just looked up the principal in is useless at best and confusing to the client at worst. Don't respond with one in the KDC. ticket: 7483 target_version: 1.11 tags: pullup
* Fix quoting issues in LDAP KDB moduleGreg Hudson2012-11-172-18/+18
| | | | | | | | | | | | | | | Modify ldap_filter_correct() to quote special characters for DN strings as well as filters, since it is already used to quote a DN string in krb5_ldap_name_to_policydn() and there's no harm in over-quoting. In krb5_ldap_put_principal(), quote the unparsed principal name for use in DNs we choose. In krb5_ldap_create_password_policy(), use the policy name for the CN of the policy entry instead of the (possibly quoted) first element of the DN. Adapted from a patch by Jim Shi <hanmao_shi@apple.com>. ticket: 7296
* Tests for kinit's detection of a keytab requestBen Kaduk2012-11-161-0/+12
| | | | | | | | | We must check that 'kinit -t keytab' and 'kinit -i' successfully produce tickets, and have the specified warning output. ticket: 7218 tags: pullup target_version: 1.11
* Add automated tests for LDAP KDB moduleGreg Hudson2012-11-153-2/+693
| | | | | | | | | | | | | | Add new tests kdbtest.c and t_kdb.py. Together these exercise most of the code in the LDAP back end. kdbtest is also run against the DB2 module, which is mostly redundant with other tests, but does exercise the lockout logic a little more thoroughly than t_lockout.py can. To test the LDAP back end, we look for slapd and ldapadd binaries in the path. The system slapd is sometimes constrained by AppArmor or the like, which we can typically work around by making a copy of the binary. slapd detaches before listening on its server socket (this got better in 2.4.27 but still isn't perfect), so we unfortunately have to use a one-second sleep in the slapd setup.
* Quiet down two noisy test programsGreg Hudson2012-10-232-4/+0
|
* Remove nroff man pagesBen Kaduk2012-10-161-141/+0
| | | | | | | We generate man pages from RST sources now; they are checked into the tree in src/man/. The gen-manpages directory is no longer needed.
* make dependTom Yu2012-10-151-18/+38
|
* Wait for correct message in t_iprop.pyGreg Hudson2012-10-151-2/+1
| | | | | | | | | The message "Got incremental updates from the master" precedes actually replaying the updates on the slave. Instead look for "Incremental updates:" (the statistics message), which happens just after the updates are replayed. Also, we don't need to import time now that we're not sleeping.
* Eliminate races in t_iprop.pyGreg Hudson2012-10-131-15/+31
| | | | | | | | | | | | | After we start kpropd, read about the initial full dump before making changes on the master. Avoid prodding kpropd for this read (by shifting responsibility for the initial prod to the caller) since kpropd doesn't sleep before its first request. When waiting for sync, note whether we got a full propagation and match that up with our expectations. Use a long polling interval so kpropd doesn't wake up on its own and confuse the test script with an extra incremental update.
* Make t_iprop.py faster and more robustGreg Hudson2012-10-121-22/+42
| | | | | | | | | | | | | | | Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt sleeps and make kpropd do an iprop request immediately. In k5test.py, add prod_kpropd and read_from_kpropd methods to allow test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr output; also allow the test script to specify additional arguments when starting kpropd. In t_iprop.py, start kpropd with -d and, instead of sleeping, read kpropd output until we see an indication that kpropd is in sync with the master. To avoid delays, prod kpropd before waiting for sync and after a completed full prop.
* Fix slow kprop dejagnu testGreg Hudson2012-10-102-5/+3
| | | | | | | | | Fix kpropd -S -t to actually exit after processing one connection (it was breaking out of the switch statement, not the while loop). Use the -t when invoking kpropd from the dejagnu test framework; previously it was unnecessary because kpropd -S -d exited after one connection. Clear up some confusion in the kprop.exp comments about whether kpropd is expected to exit.
* De-conditionalize Camellia codeGreg Hudson2012-10-091-26/+24
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
* Remove iprop dejagnu testGreg Hudson2012-10-081-236/+0
| | | | | | | Both the Python and dejagnu iprop tests are slow since they use sleeps to give kpropd time to do its work (although we can fix this with some work). Since the Python tests cover the same ground as the dejagnu tests, we don't need both.
* Import and complete Greg Hudson's iprop testNicolas Williams2012-10-082-0/+140
| | | | ticket: 7374
* Fix t_s4u2proxy_krb5 cleanupGreg Hudson2012-09-241-1/+3
| | | | | | | Unlike most GSS test programs, t_s4u2proxy_krb5 uses a cleanup handler, so we have to be careful to initialize everything we clean up--particularly service2_name, which is initialized after a possible goto. Also, remember to release acceptor_name.
* Resolve verifier cred in accept_sec_contextGreg Hudson2012-09-212-20/+19
| | | | | | | | | If the verifier cred handle is of type GSS_C_BOTH, we need to resolve the initiator part of it in order to create a s4u2proxy delegated credential handle. (If it's of type GSS_C_ACCEPT, kg_resolve_cred won't do anything beyond locking and validating the credential.) ticket: 7356
* Add tests for gss_inquire_mechs_for_nameGreg Hudson2012-09-175-10/+92
|
* Avoid multiply defining OIDs in tests/gssapiTom Yu2012-09-141-6/+6
| | | | | | Declarations of gss_OID_desc mech_krb5, etc. in tests/gssapi/common.h can result in multiple definitions when the test programs are linked. Prefix the declarations with "extern" to prevent this.
* Tidy up GSSAPI test programsGreg Hudson2012-09-1321-2186/+937
| | | | | | | | Factor out some common functions used by multiple test programs. Use a common argument format for importing names (p:princname, h:hostbasedname, or u:username) and adjust the Python tests to match it. Use more consistent conventions in test programs and fix some coding style issues. Normalize how the test programs are built.
* Test the inconsistent locking fix and svc unavailNicolas Williams2012-09-122-0/+40
| | | | | | Test the fix for https://bugzilla.redhat.com/show_bug.cgi?id=586032 . Also test that krb5kdc can return svc unavailable
* Add tests for GSS cred export and importGreg Hudson2012-09-113-4/+272
| | | | ticket: 7354
* Add asn1c test vectors for alg-agility typesGreg Hudson2012-09-064-2/+404
| | | | | | | | | For the test-vectors target in tests/asn.1, add ASN.1 modules from RFC 4556 and draft-ietf-krb-wg-pkinit-alg-agility-06.txt, and output test encodings for PrincipalName, KRB5PrincipalName, OtherInfo, and PkinitSuppPubInfo. In the alg-agility module, AuthPack and DHRepInfo are renamed, as asn1c otherwise rejects them as conflicting with the RFC 4556 definitions.
* Run "make depend"Tom Yu2012-08-232-0/+11
|
* Fix minor Makefile.in typos for make dependTom Yu2012-08-231-1/+1
| | | | | Fix minor typos in lib/krb5/krb/Makefile.in and tests/gssapi/Makefile.in so that "make depend" will work.
* Add ASN.1 support for OTPGreg Hudson2012-08-2313-26/+1834
| | | | | | | Add encoders and decoders for the OTP-TOKENINFO, PA-OTP-CHALLENGE, PA-OTP-REQUEST, and PA-OTP-ENC-REQUEST types from RFC 6560. For more thorough testing, add support for generating test encodings using asn1c for sample objects (currently only for the OTP types).
* Silence a gcc warning in t_export_nameGreg Hudson2012-08-121-1/+1
| | | | | | gcc warnings that nametype may be used uninitialized, presumably failing to deduce that usage() never returns. Initialize nametype to make it build.
* Add test coverage for gss_export_nameGreg Hudson2012-08-113-5/+191
| | | | | Exercise gss_export_name and importing of exported name tokens in t_gssapi.py.
* Fix nitpicky bugs in t_inq_credGreg Hudson2012-08-111-6/+6
|
* Add tests for gss_inquire_credGreg Hudson2012-08-103-3/+221
| | | | | | | | | Now that we're doing a kind of deferred credential acquisition for krb5, the behavior of gss_inquire_cred is a bit more subtle because (per RFC 2743 section 2.1.4) we have to choose a credential cache or acceptor name sooner than we would otherwise do so. Add a C program to invoke gss_acquire_cred/gss_inquire_cred and some Python tests using it.
* Regression tests for CVE-2012-1014, CVE-2012-1015Tom Yu2012-08-073-0/+71
| | | | | | ticket: 7231 (new) target_version: 1.10.3 tags: pullup
* Policy extensions + new policy: allowed ks typesNicolas Williams2012-07-304-1/+111
| | | | | | | | | | | | | | | | | This simply adds KADM5_API_VERSION_4 and various fields to the policy structures: - attributes (policy-ish principal attributes) - max_life (max ticket life) - max_renewable_life (max ticket renewable life) - allowed_keysalts (allowed key/salt types) - TL data (future policy extensions) Of these only allowed_keysalts is currently implemented. Some refactoring of TL data handling is also done. ticket: 7223 (new)
* Add default_ccache_name profile variableGreg Hudson2012-07-241-0/+11
| | | | | | | Like default_keytab_name and default_client_keytab_name, default_ccache_name is subject to parameter expansion. ticket: 7220 (new)
* Rename tests/t_cccol.py to t_ccache.pyGreg Hudson2012-07-243-12/+11
| | | | | | | Generalize the ccache collection tests in t_cccol.py to multiple kinds of ccache tests, and rename it to avoid confusion with the lower-level lib/krb5/ccache/t_cccol.py. Move a test from t_general.py into t_ccache.py.
* Add token expansion for keytab namesGreg Hudson2012-07-241-0/+16
| | | | | | | Make the default_keytab_name and default_client_keytab_name variables subject to parameter expansion. ticket: 7219 (new)
* Add basic test for credstore extentionsSimo Sorce2012-07-203-3/+175
|
* Add kinit/klist -i options to use client keytabGreg Hudson2012-07-161-0/+8
| | | | | | | | | In combination with -k, -i will cause kinit or klist to use the default client keytab instead of the default acceptor keytab. This gives an easy way to figure out what default client keytab name is in use and to get credentials using it. ticket: 7216 (new)
* Always recreate acl files during dejagnu testsTom Yu2012-07-112-11/+7
| | | | | | | | | | | | | The dejagnu tests create some persistent acl files containing hostname-derived principal names. These can get out of date if the host has changed names since the last time the dejagnu tests were run, causing failures (notably in iprop.exp). To avoid this problem, change the dejagnu tests to always create new acl files for each test run. ticket: 7200 (new) tags: pullup target_version: 1.10.3
* Automatically create DIR ccache directoriesGreg Hudson2012-07-112-2/+0
| | | | | | | | If the directory for a DIR ccache doesn't exist yet, try to create it (but not its parents) with mode 700. Exercise this in test scripts by not pre-creating directories. ticket: 7196 (new)
* Enable all localizations in main functionsBen Kaduk2012-07-062-4/+5
| | | | | | | | | | | | | | | Bite the bullet and pass LC_ALL to setlocale() instead of just LC_MESSAGES. Calls to setlocale() itself were introduced in fabbf9e443459e8c0161c84563690ed70c7f6a61 for ticket 6918, but only for LC_MESSAGES since only localized strings were needed and that was the most conservative option. However, klist, kadmin, and kinit (and perhaps others) would benefit from localized formats for times (i.e., LC_TIME). If potentially localized data is being sent on the wire, that is a bug that should be fixed. No such bugs are found with the current test suite, so we are comfortable enabling LC_ALL at this time. ticket: 7192
* Pass empty string instead of NULL to printf-likeBen Kaduk2012-07-031-1/+1
|
* Remove unused variableBen Kaduk2012-07-031-2/+0
|
* Minor cleanups relating to size_t being unsignedBen Kaduk2012-07-031-1/+1
| | | | | | | | | | | In order to use -1 as a sentinel value, we should explicitly cast to make it clear what we are doing. It might be better to use a less convoluted sentinel value such as SIZE_T_MAX, though. Additionally, since size_t is unsigned and at least as wide as an int, a loop with int index variable that compares against a size_t for its termination check could become an infinite loop. Make the loop index size_t for consistency.
* Add client keytab initiation supportGreg Hudson2012-07-025-2/+292
| | | | | | | | | Support acquiring GSSAPI krb5 credentials by fetching initial credentials using the client keytab. Credentials obtained this way will be stored in the default ccache or collection, and will be refreshed when they are halfway to expiring. ticket: 7189 (new)
* Add krb5_kt_client_default APIGreg Hudson2012-07-021-2/+14
| | | | | | | | | | | | | | | | The default client keytab is intended to be used to automatically acquire initial credentials for client applications. The current hardcoded default is a placeholder, and will likely change before 1.11. Add test framework settings to ensure that a system default client keytab doesn't interfere with tests, and to allow tests to be written to deliberately use the default client keytab. Add documentation about keytabs to the concepts section of the RST docs, and describe the default client keytab there. ticket: 7188 (new)
* Try harder to make keytab-based AS requests workGreg Hudson2012-07-011-3/+4
| | | | | | | | | | | | | | | | | | | When making a keytab-based AS request, a client has to choose between sending its reply key enctype preference list (the enctypes it has in the keytab) and its session key enctype preference list (all of the enctypes it supports). Heimdal and MIT krb5 1.11 clients send the reply key preference list. If this list doesn't overlap with the server principal keys (say, because the krbtgt principal has only a DES key), then the AS request will fail. Try to make this work by making the KDC optimistically pick the first permitted enctype in the request as the session key, even though it can't be certain that other KDCs in the realm support that enctype. Make sure to exercise this case in t_keytab.py by doing a multipass keytab kinit test. ticket: 7190 (new)
* Restore some spaces in trvalTom Yu2012-06-254-790/+790
| | | | | | This is a cosmetic change to reintroduce some space characters that cff6ea939f061d17a5742a04b8eeb2905c1813dc removed, e.g. between the tag and the length or short value.
* Eliminate trailing whitespace in trval outputGreg Hudson2012-06-225-1254/+1259
| | | | | | | | Modify the trval output slightly so that the reference trval output files don't containing trailing whitespace, to make them friendlier to our git hooks. (The pkinit and ldap trval reference files now contain a leading blank line, which isn't very elegant, but avoiding that requires too much Makefile.in complexity.) Also correct a typo.
* Fail from gss_acquire_cred if we have no credsGreg Hudson2012-06-151-0/+7
| | | | | | | | If a caller tries to acquire krb5 initiator creds with no desired name and we have no credentials in the cache collection, fail from gss_acquire_cred intead of deferring until gss_init_sec_context. ticket: 7160
generated by cgit (git 2.34.1) at 2025-09-27 07:31:57 +0000