summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
* make dependGreg Hudson2014-07-081-0/+18
|
* Include autoconf.h before system headersGreg Hudson2014-07-0815-51/+13
| | | | | | | | | Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
* Avoid using length fields in socket addressesGreg Hudson2014-07-041-6/+0
| | | | | | | | | | | | Remove code to set or reference the length fields of socket addresses (sa_len/sin_len/sin6_len), since they aren't portable and setting them is not required. Remove autoconf tests for those fields which are no longer used or which were never used. There is one exception: in localaddr.c, we still neeed to reference sa_len for the definition of ifreq_size on platforms which have sa_len. Leave that behind, along with the autoconf test which defines SA_LEN.
* Add tests for invalid GSSAPI per-message tokensGreg Hudson2014-06-263-7/+457
| | | | ticket: 7949
* Add test for KDC client loggingGreg Hudson2014-06-102-0/+24
| | | | | | | Add a test case which performed a TGS request with an expired ticket and checks that the client principal is logged. ticket: 7910
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Always include salt in LDAP KrbKey encodingGreg Hudson2014-06-051-0/+1
| | | | | | | | | | | | | | | | | | | In the LDAP KDB module, ensure that every krb5_key_data we pass to asn1_encode_sequence_of_keys includes a salt type, for compatibility with the decoder in unpatched krb5 1.11 and 1.12. This is not a behavior change by itself; since 1.7 the encoder has always included a KrbKey salt field because it erroneously treats that field as non-optional. (Luckily, the encoded salt always happens to have salt type 0 because krb5_key_data constructors start with zeroed memory.) The next commit will fix the encoder and decoder to properly treat the KrbKey salt field as optional, so we need this change to ensure that our encodings remain compatible. Also fix the ASN.1 tests to set key_data_ver correctly for the sample test key data. ticket: 7919
* Add tests for MS-KKDCP client supportNalin Dahyabhai2014-06-022-0/+220
| | | | | | | | Exercise the MS-KKDCP client support using the test proxy server, for AS, TGS, and kpasswd requests while also checking the certificate verification and name checks. ticket: 7929
* Add a simple KDC proxy test serverNalin Dahyabhai2014-06-027-0/+428
| | | | | | | | This proxy server uses python-paste to run the kdcproxy from https://pypi.python.org/pypi/kdcproxy. It should be used along with the proxy.pem certificate in ../tests/dejagnu/proxy-certs. ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-028-0/+107
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Test that kinit -k -i picks the intended principalBen Kaduk2014-05-221-0/+3
| | | | | | | Prior to ticket 7892 it would use the default host/ principal when no principal was given on the command line. ticket: 7892
* Improve krb5_rd_req decryption failure errorsGreg Hudson2014-05-074-9/+255
| | | | | | | | | | | | | | When krb5_rd_req cannot decrypt a ticket, try to produce the most helpful diagnostic we can, and return an error code which corresponds to the most applicable Kerberos protocol error. Add a trace log containing the error message for ticket decryption failures, in case the application server does not log it. Add new tests to cover krb5_rd_req error messages and adjust existing tests to match the new messages. Also adjust svc_auth_gssapi.c to look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC. ticket: 7232
* Get getopt from unistd.h (not getopt.h) in testsGreg Hudson2014-03-282-2/+1
| | | | | | | | | | | POSIX defines getopt to be declared in unistd.h, and HP-UX (as of version 11.31) does not appear to have getopt.h. In test programs which currently include getopt.h and aren't currently built on Windows, include unistd.h or just assume we will get it via k5-int.h. ticket: 7894 (new) target_version: 1.12.2 tags: pullup
* Improve salt type display in kadmin getprincGreg Hudson2014-03-262-15/+13
| | | | | | | | | | | | | | In krb5_salttype_to_string, output the salt type name we would recognize as input. In the output of getprinc, display the enctype and salt type in a form we would accept--either enctype:salttype if the salt type is not the default, or just the enctype if it is. Update t_mkey.py and t_salt.py to expect the new output format. Update documentation examples to show the new format. ticket: 5958
* Add tests for gic_pwd password changeGreg Hudson2014-03-032-0/+38
| | | | ticket: 7868
* Minimize race conditions in t_iprop.pyGreg Hudson2014-02-261-32/+65
| | | | | | | | | | | | Augment kpropd's debugging output so we can see the starting and ending serial numbers of a sync, and check them in t_iprop.py's wait_for_prop to make sure we're observing the correct sync each time. Try to make sure we only send SIGUSR1 when kpropd is actually sleeping, by waiting for it to print its pre-sleep message to stderr after a full dump and after each sync. This isn't perfect, as there is a short window between printing to stderr and actually sleeping, but we can't do any better until kpropd has a more reliable mechanism for triggering immediate updates.
* Test iprop slave ulog managementGreg Hudson2014-02-201-98/+238
| | | | | | | | | | | | Check the ulog more thoroughly after each operation, including the principal names we expect in each update entry. Verify that the slave ulog contains actual update entries received from master. Add a second slave which receives updates from the first. Test a wider variety of principal operations. Add two additional operations after the full resync to test that incremental updates resume after a full resync (albeit with some lag). ticket: 7855
* Correctly get default realm in kdb5.cGreg Hudson2014-02-111-5/+0
| | | | | | | Call krb5_get_default_realm instead of directly accessing context->default_realm, to remove the requirement that krb5_get_default_realm or krb5_set_default_realm be used before krb5_db_open.
* Test SPNEGO acceptor response to MS krb5 mech OIDGreg Hudson2014-02-051-4/+60
| | | | | | | | | | | | In t_spnego.c, add code to make a SPNEGO request with the erroneous Microsoft OID value and examine the response to make sure that it uses the same OID value as the request did. The token and tmp variables were unused, so rename them to itok and atok for the purpose of the new test code. ticket: 7858 target_version: 1.12.2 tags: pullup
* Add test coverage for gss_pseudo_randomGreg Hudson2014-01-222-6/+192
| | | | | Add a test program which compares gss_pseudo_random outputs against expected values for each enctype.
* Add test for gss_acquire_cred_from rcache featureGreg Hudson2014-01-172-1/+39
|
* Add test for salttype defaultingTom Yu2014-01-061-1/+2
| | | | ticket: 884
* Test bogus KDC-REQsTom Yu2013-12-312-0/+45
| | | | | | | | | | | Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req() and krb5_is_tgs_req(), to make sure that the KDC recovers correctly from failures in decode_krb5_as_req() and decode_krb5_tgs_req(). Also send an encoding that isn't a valid KDC-REQ. ticket: 7811 (new) target_version: 1.12.1 tags: pullup
* Avoid keyctl purge in keyring ccache testsGreg Hudson2013-12-201-8/+12
| | | | | | | | | keyctl purge was added in keyutils 1.5 (released in March 2011). Use keyctl unlink to clean up keys instead, as it is more universal. ticket: 7810 target_version: 1.12.1 tags: pullup
* Use an extended com_err hook in klistGreg Hudson2013-12-203-5/+5
| | | | | | | | | | Add an adapted version of extended_com_err_fn from kinit to klist and use it. In do_ccache(), rely on the ccache type to set a reasonable message if krb5_cc_set_flags() or krb5_cc_get_principal() fails due to a nonexistent or unreadable ccache, and don't confuse the user with the name of the ccache operation that failed. ticket: 7809
* Test SPNEGO error message in t_s4u.pyGreg Hudson2013-12-181-6/+5
| | | | | | | Now that #7045 is fixed, we can check for the correct error message from t_s4u2proxy_krb5 with --spnego. ticket: 7045
* Fix up tests directory ignores, deps, cleanupGreg Hudson2013-12-122-2/+12
| | | | | A few test programs didn't make it into .gitignore, OBJS, or EXTRADEPSRCS.
* Add tests for krb5_sname_to_principalGreg Hudson2013-12-124-4/+196
|
* make dependTom Yu2013-12-102-5/+8
|
* Add another kadmin ACL test for backreferencesGreg Hudson2013-11-211-0/+6
| | | | | | Add a test using backreferences which don't correspond directly to principal components, to verify that *N refers to the Nth wildcard and not the Nth component.
* Remove last uses of "possibly-insecure" mktemp(3)Ben Kaduk2013-11-041-0/+9
| | | | | | | | | | | | | | | | | | | | Many libc implementations include notations to the linker to generate warnings upon references to mktemp(3), due to its potential for insecure operation. This has been the case for quite some time, as was noted in RT #6199. Our usage of the function has decreased with time, but has not yet disappeared entirely. This commit removes the last few instances from our tree. kprop's credentials never need to hit the disk, so a MEMORY ccache is sufficient (and does not need randomization). store_master_key_list is explicitly putting keys on disk so as to do an atomic rename of the stash file, but since the stash file should be in a root-only directory, we can just use a fixed name for the temporary file. When using this fixed name, we must detect (and error out) if the temporary file already exists; add a test to confirm that we do so. ticket: 1794
* Add tests for anonymous kadminGreg Hudson2013-10-301-0/+13
|
* Add tests for different salt combinationsBen Kaduk2013-10-252-0/+59
| | | | | | | | | | | | | Create a principal with a pair of enctypes using different salt types. Confirm that the non-default salt type appears only once in the principal's key list. Also verify that the afs3 salt type is rejected by non-DES enctypes The afs3 salt type is for compatibility with AFS-3 kaservers, which are roughly krb4. As such, it only makes sense for single-DES enctypes. The PBKDF2 and arcfour enctypes correctly reject the key-creation parameters from the afs3 salt, but triple-DES currently does not.
* Remove old master key testsGreg Hudson2013-10-2517-1991/+1
| | | | | | | | | | | | | | | Remove tests/mkeystash_compat and tests/mk_migr. These are superseded by t_mkey.py, with two exceptions: tests/mk_migr included tests for password history across master key rollovers. Historical keys are encrypted in the kadmin/history key (which is accessed like any other key), so there isn't a specific need to test this unless we implement #1221. tests/mk_migr had provisions for testing master key rollover with the LDAP KDB module. All master key logic used in the LDAP KDB module is shared with the DB2 module in lib/kdb, so there is no specific need to test this combination.
* Add master key rollover tests in k5test frameworkGreg Hudson2013-10-253-0/+315
| | | | | | | | | | | Add a new script t_mkey.py using the k5test framework. Test the fixes for #6507, #7685, and #7686 as well as basic functionality and old-stashfile compatibility. dump.16 was created by running "kdb5_util create -s -P footes" and "kdb5_util dump dumpfile" with krb5 1.6. The key from the resulting stash file was extracted and placed in the struct.pack() call in the new test script.
* Fix gss_accept_sec_context error tokensGreg Hudson2013-10-143-8/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A GSS krb5 error response contains a KRB-ERROR message, which is required to have a server principal name, although few recipients actually use it. Starting in 1.3, accept_sec_context would fail to encode the error in the GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL case (introduced by #1370) because cred->princ (which became cred->name->princ in 1.8) is unset. This problem got worse in 1.10 because we stopped setting the server field in all cases due to the changes for #6855. In 1.11 the problem got worse again when a misguided change to the mechglue started discarding output tokens when the mechanism returns an error; the mechglue should only do so when it itself causes the error. Fix krb5 gss_accept_sec_context by unconditionally decoding the AP-REQ and using krb5_rd_req_decoded, and then using the requested ticket server in the KRB-ERROR message. Fix the mechglue gss_accept_sec_context by reverting that part of commit 56feee187579905c9101b0cdbdd8c6a850adcfc9. Add a test program which artificially induces a replay cache failure (the easiest failure we can produce which has an associated RFC 4120 error code) and checks that this can be communicated back to the initiator via an error token. ticket: 1445 target_version: 1.12 tags: pullup
* Add missing entries to tests/gssapi Makefile.inGreg Hudson2013-10-142-17/+59
| | | | | | Some test sources files, objects, or programs were missing from SRCS, OBJS, all, check-pytests, or clean. t_oid was also out of order in a couple of places.
* Fix GSSAPI krb5 cred ccache importGreg Hudson2013-10-145-17/+26
| | | | | | | | | | | | | | json_to_ccache was incorrectly indexing the JSON array when restoring a memory ccache. Fix it. Add test coverage for a multi-cred ccache by exporting/importing the synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move export_import_cred from t_export_cred.c to common.c to facilitate this. Make a note in t_export_cred.py that this case is covered in t_s4u.py. ticket: 7706 target_version: 1.11.4
* Perform complete referrals in t_referral.pyGreg Hudson2013-10-091-31/+44
| | | | | | | | | | | | | | t_referral.py was written to exercise KDC host referral logic, and did not actually create the target realm, instead just looking at the error message from gcred to determine whether the KDC returned a referral or not. It's only a small amount of additional work to actually set up the target realm and check that the client code successfully retrieves the referral, so do that instead. Since the referral and non-referral outcomes aren't all that similar any more, split test() into testref() and testfail(). Get rid of the message argument, since it wouldn't be output in most cases where we get an unexpected result.
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-044-0/+213
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Conditionally test KEYRING ccache typeGreg Hudson2013-10-021-41/+87
| | | | | | | | | | | | | | | | | | | If the keyctl command is found and klist recognizes the KEYRING credential cache type, then run several tests against keyring ccaches: the collection test program in lib/krb5/ccache, the command-line collection tests in tests/t_ccache.py, and some new tests to verify legacy session cache behavior. Much of the Python code in t_ccache.py is moved into a new function named "collection_test" so we can run it once against a DIR collection and once against a KEYRING collection. Also: fix a memory leak in the collection test program; add a test for iteration when the default cache name is a subsidiary name; use a process keyring ccache in t_cc.c to avoid leaving behind empty collections in the session keyring after each test run. Adapted from a patch by simo@redhat.com. ticket: 7711
* Add "which" function to k5testGreg Hudson2013-09-281-9/+0
| | | | | Add a utility function in k5test.py to look for a command in the executable path, and remove it from t_kdb.py.
* Add GSSAPI IOV MIC functionsGreg Hudson2013-09-181-0/+89
| | | | | | | | | | | | | Add gss_get_mic_iov, gss_get_mic_iov_length, and gss_verify_mic_iov functions, which work similarly to the corresponding IOV wrap functions. Add a new buffer type GSS_IOV_BUFFER_TYPE_MIC_TOKEN for the destination buffer. Most of the internal code for this was already present, and just needed to be fixed up and adjusted to use the new buffer type for the MIC token. ticket: 7705 (new)
* Use gss_release_iov_buffer in t_iov.cGreg Hudson2013-09-061-20/+7
|
* Add tests for GSS IOV and AEAD interfacesGreg Hudson2013-09-064-6/+486
| | | | | | Add a new test program t_iov.c which tests various combinations of wrapping and unwrapping using the IOV and AEAD interfaces. Run it with and without SPNEGO in each enctype configuration.
* Factor out context establishment in GSS testsGreg Hudson2013-09-0612-271/+134
| | | | | | Add a new helper to common.c which runs gss_init_sec_context and gss_accept_sec_context in a loop, and use it in test programs instead of the open-coded one-token or two-token exchanges.
* Make it possible to renew aliased service ticketsGreg Hudson2013-08-291-0/+8
| | | | | | | | | We always allow aliases in the service principal when processing AS-REQs and TGS-REQs. If the ticket we issued is presented back to us in a TGS-REQ as a header ticket for renewal or similar, we should allow aliases when looking up its key to decode the AP-REQ. ticket: 7699 (new)
* Add test for alias to local TGSGreg Hudson2013-08-281-0/+17
|
* Add tests for service aliases using LDAP moduleGreg Hudson2013-08-281-8/+34
|
* Add hostrealm interface testsGreg Hudson2013-08-153-3/+235
| | | | | | | | | | Create a test module for the hostrealm interface, a harness to call the realm mapping functions and display their results, and a Python script to exercise the functionality of the interface and each module (except the dns module, which we cannot easily test since it relies on TXT records in the public DNS). ticket: 7687
generated by cgit (git 2.34.1) at 2025-09-26 19:32:20 +0000