kdc/kdc-tester.c

   1 /*
   2  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kdc_locl.h"
  37 #include "send_to_kdc_plugin.h"
  38
  39 struct perf {
  40     unsigned long as_req;
  41     unsigned long tgs_req;
  42     struct timeval start;
  43     struct timeval stop;
  44     struct perf *next;
  45 } *ptop;
  46
  47 #ifdef SUPPORT_DETACH
  48 int detach_from_console = -1;
  49 #define DETACH_IS_DEFAULT FALSE
  50 #endif
  51
  52 static krb5_kdc_configuration *kdc_config;
  53 static krb5_context kdc_context;
  54
  55 static struct sockaddr_storage sa;
  56 static const char *astr = "0.0.0.0";
  57
  58 static void eval_object(heim_object_t);
  59
  60
  61 /*
  62  *
  63  */
  64
  65 static krb5_error_code
  66 plugin_init(krb5_context context, void **pctx)
  67 {
  68     *pctx = NULL;
  69     return 0;
  70 }
  71
  72 static void
  73 plugin_fini(void *ctx)
  74 {
  75 }
  76
  77 static krb5_error_code
  78 plugin_send_to_kdc(krb5_context context,
  79                    void *ctx,
  80                    krb5_krbhst_info *ho,
  81                    time_t timeout,
  82                    const krb5_data *in,
  83                    krb5_data *out)
  84 {
  85     return KRB5_PLUGIN_NO_HANDLE;
  86 }
  87
  88 static krb5_error_code
  89 plugin_send_to_realm(krb5_context context,
  90                      void *ctx,
  91                      krb5_const_realm realm,
  92                      time_t timeout,
  93                      const krb5_data *in,
  94                      krb5_data *out)
  95 {
  96     int ret;
  97
  98     krb5_kdc_update_time(NULL);
  99
 100     ret = krb5_kdc_process_request(kdc_context, kdc_config,
 101                                    in->data, in->length,
 102                                    out, NULL, astr,
 103                                    (struct sockaddr *)&sa, 0);
 104     if (ret)
 105         krb5_err(kdc_context, 1, ret, "krb5_kdc_process_request");
 106
 107     return 0;
 108 }
 109
 110 static krb5plugin_send_to_kdc_ftable send_to_kdc = {
 111     KRB5_PLUGIN_SEND_TO_KDC_VERSION_2,
 112     plugin_init,
 113     plugin_fini,
 114     plugin_send_to_kdc,
 115     plugin_send_to_realm
 116 };
 117
 118 static void
 119 perf_start(struct perf *perf)
 120 {
 121     memset(perf, 0, sizeof(*perf));
 122
 123     gettimeofday(&perf->start, NULL);
 124     perf->next = ptop;
 125     ptop = perf;
 126 }
 127
 128 static void
 129 perf_stop(struct perf *perf)
 130 {
 131     gettimeofday(&perf->stop, NULL);
 132     ptop = perf->next;
 133
 134     if (ptop) {
 135         ptop->as_req += perf->as_req;
 136         ptop->tgs_req += perf->tgs_req;
 137     }
 138
 139     timevalsub(&perf->stop, &perf->start);
 140     printf("time: %lu.%06lu\n",
 141            (unsigned long)perf->stop.tv_sec,
 142            (unsigned long)perf->stop.tv_usec);
 143
 144 #define USEC_PER_SEC 1000000
 145
 146     if (perf->as_req) {
 147         double as_ps = 0.0;
 148         as_ps = (perf->as_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
 149         printf("as-req/s %.2lf  (total %lu requests)\n", as_ps, perf->as_req);
 150     }
 151
 152     if (perf->tgs_req) {
 153         double tgs_ps = 0.0;
 154         tgs_ps = (perf->tgs_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
 155         printf("tgs-req/s %.2lf (total %lu requests)\n", tgs_ps, perf->tgs_req);
 156     }
 157 }
 158
 159 /*
 160  *
 161  */
 162
 163 static void
 164 eval_repeat(heim_dict_t o)
 165 {
 166     heim_object_t or = heim_dict_get_value(o, HSTR("value"));
 167     heim_number_t n = heim_dict_get_value(o, HSTR("num"));
 168     int i, num;
 169     struct perf perf;
 170
 171     perf_start(&perf);
 172
 173     heim_assert(or != NULL, "value missing");
 174     heim_assert(n != NULL, "num missing");
 175
 176     num = heim_number_get_int(n);
 177     heim_assert(num >= 0, "num >= 0");
 178
 179     for (i = 0; i < num; i++)
 180         eval_object(or);
 181
 182     perf_stop(&perf);
 183 }
 184
 185 /*
 186  *
 187  */
 188
 189 static krb5_error_code
 190 copy_keytab(krb5_context context, krb5_keytab from, krb5_keytab to)
 191 {
 192     krb5_keytab_entry entry;
 193     krb5_kt_cursor cursor;
 194     krb5_error_code ret;
 195
 196     ret = krb5_kt_start_seq_get(context, from, &cursor);
 197     if (ret)
 198         return ret;
 199     while((ret = krb5_kt_next_entry(context, from, &entry, &cursor)) == 0){
 200         krb5_kt_add_entry(context, to, &entry);
 201         krb5_kt_free_entry(context, &entry);
 202     }
 203     return krb5_kt_end_seq_get(context, from, &cursor);
 204 }
 205
 206 /*
 207  *
 208  */
 209
 210 static void
 211 eval_kinit(heim_dict_t o)
 212 {
 213     heim_string_t user, password, keytab, fast_armor_cc, pk_user_id, ccache;
 214     krb5_get_init_creds_opt *opt;
 215     krb5_init_creds_context ctx;
 216     krb5_principal client;
 217     krb5_keytab ktmem = NULL;
 218     krb5_ccache fast_cc = NULL;
 219     krb5_error_code ret;
 220
 221     if (ptop)
 222         ptop->as_req++;
 223
 224     user = heim_dict_get_value(o, HSTR("client"));
 225     if (user == NULL)
 226         krb5_errx(kdc_context, 1, "no client");
 227
 228     password = heim_dict_get_value(o, HSTR("password"));
 229     keytab = heim_dict_get_value(o, HSTR("keytab"));
 230     pk_user_id = heim_dict_get_value(o, HSTR("pkinit-user-cert-id"));
 231     if (password == NULL && keytab == NULL && pk_user_id == NULL)
 232         krb5_errx(kdc_context, 1, "password, keytab, nor PKINIT user cert ID");
 233
 234     ccache = heim_dict_get_value(o, HSTR("ccache"));
 235
 236     ret = krb5_parse_name(kdc_context, heim_string_get_utf8(user), &client);
 237     if (ret)
 238         krb5_err(kdc_context, 1, ret, "krb5_unparse_name");
 239
 240     /* PKINIT parts */
 241     ret = krb5_get_init_creds_opt_alloc (kdc_context, &opt);
 242     if (ret)
 243         krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_alloc");
 244
 245     if (pk_user_id) {
 246         heim_bool_t rsaobj = heim_dict_get_value(o, HSTR("pkinit-use-rsa"));
 247         int use_rsa = rsaobj ? heim_bool_val(rsaobj) : 0;
 248
 249         ret = krb5_get_init_creds_opt_set_pkinit(kdc_context, opt,
 250                                                  client,
 251                                                  heim_string_get_utf8(pk_user_id),
 252                                                  NULL, NULL, NULL,
 253                                                  use_rsa ? 2 : 0,
 254                                                  NULL, NULL, NULL);
 255         if (ret)
 256             krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
 257     }
 258
 259     ret = krb5_init_creds_init(kdc_context, client, NULL, NULL, 0, opt, &ctx);
 260     if (ret)
 261         krb5_err(kdc_context, 1, ret, "krb5_init_creds_init");
 262
 263     fast_armor_cc = heim_dict_get_value(o, HSTR("fast-armor-cc"));
 264     if (fast_armor_cc) {
 265
 266         ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(fast_armor_cc), &fast_cc);
 267         if (ret)
 268             krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 269
 270         ret = krb5_init_creds_set_fast_ccache(kdc_context, ctx, fast_cc);
 271         if (ret)
 272             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_fast_ccache");
 273     }
 274
 275     if (password) {
 276         ret = krb5_init_creds_set_password(kdc_context, ctx,
 277                                            heim_string_get_utf8(password));
 278         if (ret)
 279             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_password");
 280     }
 281     if (keytab) {
 282         krb5_keytab kt = NULL;
 283
 284         ret = krb5_kt_resolve(kdc_context, heim_string_get_utf8(keytab), &kt);
 285         if (ret)
 286             krb5_err(kdc_context, 1, ret, "krb5_kt_resolve");
 287
 288         ret = krb5_kt_resolve(kdc_context, "MEMORY:keytab", &ktmem);
 289         if (ret)
 290             krb5_err(kdc_context, 1, ret, "krb5_kt_resolve(MEMORY)");
 291
 292         ret = copy_keytab(kdc_context, kt, ktmem);
 293         if (ret)
 294             krb5_err(kdc_context, 1, ret, "copy_keytab");
 295
 296         krb5_kt_close(kdc_context, kt);
 297
 298         ret = krb5_init_creds_set_keytab(kdc_context, ctx, ktmem);
 299         if (ret)
 300             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_keytab");
 301     }
 302
 303     ret = krb5_init_creds_get(kdc_context, ctx);
 304     if (ret)
 305         krb5_err(kdc_context, 1, ret, "krb5_init_creds_get");
 306
 307     if (ccache) {
 308         const char *name = heim_string_get_utf8(ccache);
 309         krb5_creds cred;
 310         krb5_ccache cc;
 311
 312         ret = krb5_init_creds_get_creds(kdc_context, ctx, &cred);
 313         if (ret)
 314             krb5_err(kdc_context, 1, ret, "krb5_init_creds_get_creds");
 315
 316         ret = krb5_cc_resolve(kdc_context, name, &cc);
 317         if (ret)
 318             krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 319
 320         krb5_init_creds_store(kdc_context, ctx, cc);
 321
 322         ret = krb5_cc_close(kdc_context, cc);
 323         if (ret)
 324             krb5_err(kdc_context, 1, ret, "krb5_cc_close");
 325
 326         krb5_free_cred_contents(kdc_context, &cred);
 327     }
 328
 329     krb5_init_creds_free(kdc_context, ctx);
 330
 331     if (ktmem)
 332         krb5_kt_close(kdc_context, ktmem);
 333     if (fast_cc)
 334         krb5_cc_close(kdc_context, fast_cc);
 335 }
 336
 337 /*
 338  *
 339  */
 340
 341 static void
 342 eval_kgetcred(heim_dict_t o)
 343 {
 344     heim_string_t server, ccache;
 345     krb5_get_creds_opt opt;
 346     heim_bool_t nostore;
 347     krb5_error_code ret;
 348     krb5_ccache cc = NULL;
 349     krb5_principal s;
 350     krb5_creds *out = NULL;
 351
 352     if (ptop)
 353         ptop->tgs_req++;
 354
 355     server = heim_dict_get_value(o, HSTR("server"));
 356     if (server == NULL)
 357         krb5_errx(kdc_context, 1, "no server");
 358
 359     ccache = heim_dict_get_value(o, HSTR("ccache"));
 360     if (ccache == NULL)
 361         krb5_errx(kdc_context, 1, "no ccache");
 362
 363     nostore = heim_dict_get_value(o, HSTR("nostore"));
 364     if (nostore == NULL)
 365         nostore = heim_bool_create(1);
 366
 367     ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(ccache), &cc);
 368     if (ret)
 369         krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 370
 371     ret = krb5_parse_name(kdc_context, heim_string_get_utf8(server), &s);
 372     if (ret)
 373         krb5_err(kdc_context, 1, ret, "krb5_parse_name");
 374
 375     ret = krb5_get_creds_opt_alloc(kdc_context, &opt);
 376     if (ret)
 377         krb5_err(kdc_context, 1, ret, "krb5_get_creds_opt_alloc");
 378
 379     if (heim_bool_val(nostore))
 380         krb5_get_creds_opt_add_options(kdc_context, opt, KRB5_GC_NO_STORE);
 381
 382     ret = krb5_get_creds(kdc_context, opt, cc, s, &out);
 383     if (ret)
 384         krb5_err(kdc_context, 1, ret, "krb5_get_creds");
 385
 386     krb5_free_creds(kdc_context, out);
 387     krb5_free_principal(kdc_context, s);
 388     krb5_get_creds_opt_free(kdc_context, opt);
 389     krb5_cc_close(kdc_context, cc);
 390 }
 391
 392
 393 /*
 394  *
 395  */
 396
 397 static void
 398 eval_kdestroy(heim_dict_t o)
 399 {
 400     heim_string_t ccache = heim_dict_get_value(o, HSTR("ccache"));;
 401     krb5_error_code ret;
 402     const char *name;
 403     krb5_ccache cc;
 404
 405     heim_assert(ccache != NULL, "ccache_missing");
 406
 407     name = heim_string_get_utf8(ccache);
 408
 409     ret = krb5_cc_resolve(kdc_context, name, &cc);
 410     if (ret)
 411         krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 412
 413     krb5_cc_destroy(kdc_context, cc);
 414 }
 415
 416
 417 /*
 418  *
 419  */
 420
 421 static void
 422 eval_array_element(heim_object_t o, void *ptr, int *stop)
 423 {
 424     eval_object(o);
 425 }
 426
 427 static void
 428 eval_object(heim_object_t o)
 429 {
 430     heim_tid_t t = heim_get_tid(o);
 431
 432     if (t == heim_array_get_type_id()) {
 433         heim_array_iterate_f(o, NULL, eval_array_element);
 434     } else if (t == heim_dict_get_type_id()) {
 435         const char *op = heim_dict_get_value(o, HSTR("op"));
 436
 437         heim_assert(op != NULL, "op missing");
 438
 439         if (strcmp(op, "repeat") == 0) {
 440             eval_repeat(o);
 441         } else if (strcmp(op, "kinit") == 0) {
 442             eval_kinit(o);
 443         } else if (strcmp(op, "kgetcred") == 0) {
 444             eval_kgetcred(o);
 445         } else if (strcmp(op, "kdestroy") == 0) {
 446             eval_kdestroy(o);
 447         } else {
 448             errx(1, "unsupported ops %s", op);
 449         }
 450
 451     } else
 452         errx(1, "unsupported");
 453 }
 454
 455
 456 int
 457 main(int argc, char **argv)
 458 {
 459     krb5_error_code ret;
 460     int optidx = 0;
 461
 462     setprogname(argv[0]);
 463
 464     ret = krb5_init_context(&kdc_context);
 465     if (ret == KRB5_CONFIG_BADFORMAT)
 466         errx (1, "krb5_init_context failed to parse configuration file");
 467     else if (ret)
 468         errx (1, "krb5_init_context failed: %d", ret);
 469
 470     ret = krb5_kt_register(kdc_context, &hdb_get_kt_ops);
 471     if (ret)
 472         errx (1, "krb5_kt_register(HDB) failed: %d", ret);
 473
 474     kdc_config = configure(kdc_context, argc, argv, &optidx);
 475
 476     argc -= optidx;
 477     argv += optidx;
 478
 479     if (argc == 0)
 480         errx(1, "missing operations");
 481
 482     krb5_plugin_register(kdc_context, PLUGIN_TYPE_DATA,
 483                          KRB5_PLUGIN_SEND_TO_KDC, &send_to_kdc);
 484
 485     {
 486         void *buf;
 487         size_t size;
 488         heim_object_t o;
 489
 490         if (rk_undumpdata(argv[0], &buf, &size))
 491             errx(1, "undumpdata: %s", argv[0]);
 492
 493         o = heim_json_create_with_bytes(buf, size, 10, 0, NULL);
 494         free(buf);
 495         if (o == NULL)
 496             errx(1, "heim_json");
 497
 498         /*
 499          * do the work here
 500          */
 501
 502         eval_object(o);
 503
 504         heim_release(o);
 505     }
 506
 507     krb5_free_context(kdc_context);
 508     return 0;
 509 }