lib/krb5/test_pknistkdf.c

   1 /*
   2  * Copyright (c) 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of KTH nor the names of its contributors may be
  18  *    used to endorse or promote products derived from this software without
  19  *    specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  22  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  24  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
  25  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  29  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  30  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  31  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
  32
  33 #include "krb5_locl.h"
  34 #include <pkinit_asn1.h>
  35 #include <err.h>
  36 #include <getarg.h>
  37 #include <hex.h>
  38
  39 static int verbose_flag = 0;
  40
  41 struct testcase {
  42     const heim_oid *oid;
  43     krb5_data Z;
  44     const char *client;
  45     const char *server;
  46     krb5_enctype enctype;
  47     krb5_data as_req;
  48     krb5_data pk_as_rep;
  49     krb5_data ticket;
  50
  51     krb5_data key;
  52 } tests[] = {
  53     /* 0 */
  54     {
  55         &asn1_oid_id_pkinit_kdf_ah_sha1, /* AlgorithmIdentifier */
  56         { /* Z */
  57             256,
  58             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  59             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  60             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  61             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  62             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  63             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  64             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  65             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  66             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  67             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  68             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  69             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  70             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  71             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  72             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  73             "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  74         },
  75         "lha@SU.SE", /* client, partyUInfo */
  76         "krbtgt/SU.SE@SU.SE", /* server, partyVInfo */
  77         ETYPE_AES256_CTS_HMAC_SHA1_96, /* enctype */
  78         { /* as_req */
  79             10,
  80             "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA"
  81         },
  82         { /* pk_as_rep */
  83             9,
  84             "\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB"
  85         },
  86         { /* ticket */
  87             55,
  88             "\x61\x35\x30\x33\xa0\x03\x02\x01\x05\xa1\x07\x1b\x05\x53\x55\x2e"
  89             "\x53\x45\xa2\x10\x30\x0e\xa0\x03\x02\x01\x01\xa1\x07\x30\x05\x1b"
  90             "\x03\x6c\x68\x61\xa3\x11\x30\x0f\xa0\x03\x02\x01\x12\xa2\x08\x04"
  91             "\x06\x68\x65\x6a\x68\x65\x6a"
  92         },
  93         { /* key */
  94             32,
  95             "\xc7\x62\x89\xec\x4b\x28\xa6\x91\xff\xce\x80\xbb\xb7\xec\x82\x41"
  96             "\x52\x3f\x99\xb1\x90\xcf\x2d\x34\x8f\x54\xa8\x65\x81\x2c\x32\x73"
  97         }
  98     }
  99 };
 100
 101 #ifdef MAKETICKET
 102 static void
 103 fooTicket(void)
 104 {
 105     krb5_error_code ret;
 106     krb5_data data;
 107     size_t size;
 108     Ticket t;
 109
 110     t.tkt_vno = 5;
 111     t.realm = "SU.SE";
 112     t.sname.name_type = KRB5_NT_PRINCIPAL;
 113     t.sname.name_string.len = 1;
 114     t.sname.name_string.val = ecalloc(1, sizeof(t.sname.name_string.val[0]));
 115     t.sname.name_string.val[0] = estrdup("lha");
 116     t.enc_part.etype = ETYPE_AES256_CTS_HMAC_SHA1_96;
 117     t.enc_part.kvno = NULL;
 118     t.enc_part.cipher.length = 6;
 119     t.enc_part.cipher.data = "hejhej";
 120
 121     ASN1_MALLOC_ENCODE(Ticket, data.data, data.length, &t, &size, ret);
 122     if (ret)
 123         errx(1, "ASN1_MALLOC_ENCODE(Ticket)");
 124
 125     rk_dumpdata("foo", data.data, data.length);
 126     free(data.data);
 127 }
 128 #endif
 129
 130 static void
 131 test_dh2key(krb5_context context, int i, struct testcase *c)
 132 {
 133     krb5_error_code ret;
 134     krb5_keyblock key;
 135     krb5_principal client, server;
 136     Ticket ticket;
 137     AlgorithmIdentifier ai;
 138     size_t size;
 139
 140     memset(&ticket, 0, sizeof(&ticket));
 141
 142     ai.algorithm = *c->oid;
 143     ai.parameters = NULL;
 144
 145     ret = decode_Ticket(c->ticket.data, c->ticket.length, &ticket, &size);
 146     if (ret)
 147         krb5_errx(context, 1, "decode ticket: %d", ret);
 148
 149     ret = krb5_parse_name(context, c->client, &client);
 150     if (ret)
 151         krb5_err(context, 1, ret, "parse_name: %s", c->client);
 152     ret = krb5_parse_name(context, c->server, &server);
 153     if (ret)
 154         krb5_err(context, 1, ret, "parse_name: %s", c->server);
 155
 156     if (verbose_flag) {
 157         char *str;
 158         hex_encode(c->Z.data, c->Z.length, &str);
 159         printf("Z: %s\n", str);
 160         free(str);
 161         printf("client: %s\n", c->client);
 162         printf("server: %s\n", c->server);
 163         printf("enctype: %d\n", (int)c->enctype);
 164         hex_encode(c->as_req.data, c->as_req.length, &str);
 165         printf("as-req: %s\n", str);
 166         free(str);
 167         hex_encode(c->pk_as_rep.data, c->pk_as_rep.length, &str);
 168         printf("pk-as-rep: %s\n", str);
 169         free(str);
 170         hex_encode(c->ticket.data, c->ticket.length, &str);
 171         printf("ticket: %s\n", str);
 172         free(str);
 173     }
 174
 175     ret = _krb5_pk_kdf(context,
 176                        &ai,
 177                        c->Z.data,
 178                        c->Z.length,
 179                        client,
 180                        server,
 181                        c->enctype,
 182                        &c->as_req,
 183                        &c->pk_as_rep,
 184                        &ticket,
 185                        &key);
 186     krb5_free_principal(context, client);
 187     krb5_free_principal(context, server);
 188     if (ret)
 189         krb5_err(context, 1, ret, "_krb5_pk_kdf: %d", i);
 190
 191     if (verbose_flag) {
 192         char *str;
 193         hex_encode(key.keyvalue.data, key.keyvalue.length, &str);
 194         printf("key: %s\n", str);
 195         free(str);
 196     }
 197
 198     if (key.keyvalue.length != c->key.length ||
 199         memcmp(key.keyvalue.data, c->key.data, c->key.length) != 0)
 200         krb5_errx(context, 1, "resulting key wrong: %d", i);
 201
 202     krb5_free_keyblock_contents(context, &key);
 203     free_Ticket(&ticket);
 204 }
 205
 206
 207
 208
 209 static int version_flag = 0;
 210 static int help_flag    = 0;
 211
 212 static struct getargs args[] = {
 213     {"verbose", 0,      arg_flag,       &verbose_flag,
 214      "verbose output", NULL },
 215     {"version", 0,      arg_flag,       &version_flag,
 216      "print version", NULL },
 217     {"help",    0,      arg_flag,       &help_flag,
 218      NULL, NULL }
 219 };
 220
 221 static void
 222 usage (int ret)
 223 {
 224     arg_printusage (args,
 225                     sizeof(args)/sizeof(*args),
 226                     NULL,
 227                     "");
 228     exit (ret);
 229 }
 230
 231
 232 int
 233 main(int argc, char **argv)
 234 {
 235     krb5_context context;
 236     krb5_error_code ret;
 237     int i, optidx = 0;
 238
 239     setprogname(argv[0]);
 240
 241     if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 242         usage(1);
 243
 244     if (help_flag)
 245         usage (0);
 246
 247     if(version_flag){
 248         print_version(NULL);
 249         exit(0);
 250     }
 251
 252     argc -= optidx;
 253     argv += optidx;
 254
 255 #ifdef MAKETICKET
 256     fooTicket();
 257 #endif
 258
 259     ret = krb5_init_context(&context);
 260     if (ret)
 261         errx (1, "krb5_init_context failed: %d", ret);
 262
 263     for (i = 0; i < sizeof(tests)/sizeof(tests[0]); i++)
 264         test_dh2key(context, i, &tests[i]);
 265
 266     krb5_free_context(context);
 267
 268     return 0;
 269 }