3 # Copyright (c) 2011, Secure Endpoints Inc.
6 # Redistribution and use in source and binary forms, with or without
7 # modification, are permitted provided that the following conditions
10 # - Redistributions of source code must retain the above copyright
11 # notice, this list of conditions and the following disclaimer.
13 # - Redistributions in binary form must reproduce the above copyright
14 # notice, this list of conditions and the following disclaimer in
15 # the documentation and/or other materials provided with the
18 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 # FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 # COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23 # INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
24 # (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
25 # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
27 # STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
29 # OF THE POSSIBILITY OF SUCH DAMAGE.
31 env_setup
="@env_setup@"
36 # If there is no useful db support compiled in, disable test
37 # (krb5_kt_get_entry() is tested in another test)
46 kadmin
="${kadmin} -l -r ${R1}"
47 kdc
="${kdc} --addresses=localhost -P $port"
49 cache
="FILE:${objdir}/cache.krb5"
51 kinit
="${kinit} -c $cache ${afs_no_afslog}"
52 klist
="${klist} -c $cache"
53 kgetcred
="${kgetcred} -c $cache"
54 kdestroy
="${kdestroy} -c $cache ${afs_no_unlog}"
56 KRB5_CONFIG
="${objdir}/krb5-canon.conf"
59 testfailed
="echo test failed; ${klist}; exit 1"
68 echo "Creating database"
69 initflags
="init --realm-max-ticket-life=1day --realm-max-renewable-life=1month"
71 ${kadmin} <<EOF || exit 1
75 add -p foo --use-defaults foo@${R1}
76 add -p cross1 --use-defaults krbtgt/${R1}@${R2}
77 add -p cross2 --use-defaults krbtgt/${R2}@${R1}
78 add -p cross3 --use-defaults krbtgt/${R3}@${R1}
79 add -p cross4 --use-defaults krbtgt/${R1}@${R3}
80 add -p cross5 --use-defaults krbtgt/${R3}@${R2}
81 add -p cross6 --use-defaults krbtgt/${R2}@${R3}
82 add -p foo --use-defaults host/t1@${R1}
83 add -p foo --use-defaults host/t2@${R2}
84 add -p foo --use-defaults host/t3@${R3}
85 add -p foo --use-defaults host/t11.test1.h5l.se@${R1}
86 add -p foo --use-defaults host/t12.test1.h5l.se@${R2}
87 add -p foo --use-defaults host/t22.test2.h5l.se@${R2}
88 add -p foo --use-defaults host/t23.test2.h5l.se@${R3}
89 add -p foo --use-defaults host/t33.test3.h5l.se@${R3}
95 echo foo
> ${objdir}/foopassword
97 echo "Starting kdc" ; > messages.log
98 ${kdc} --detach --testing ||
{ echo "kdc failed to start"; cat messages.log
; exit 1; }
102 echo signal killing kdc
104 trap '' EXIT INT TERM
108 trap cleanup EXIT INT TERM
112 echo "Getting client initial tickets";
113 ${kinit} --password-file=${objdir}/foopassword foo@${R1} || \
114 { ec
=1 ; eval "${testfailed}"; }
116 echo "get service tickets (success)"
117 for host in t1 t2 t3 t11 t12 t22 t33
; do
119 ${kgetcred} --name-type=SRV_HST host $host || { ec=1 ; eval "${testfailed}"; }
121 echo "get service tickets (failure)"
124 ${kgetcred} --name-type=SRV_HST host $host 2>/dev/null && { ec=1 ; eval "${testfailed}"; }
128 ${klist} |
grep 'host/t1@$' > /dev
/null ||
129 { ec
=1 ; echo "t1 referral entry not present"; eval "${testfailed}"; }
130 ${klist} |
grep "host/t1@${R1}" > /dev
/null ||
131 { ec
=1 ; echo "canonicalized t1 entry not present"; eval "${testfailed}"; }
132 ${klist} |
grep 'host/t2@$' > /dev
/null ||
133 { ec
=1 ; echo "t2 referral entry not present"; eval "${testfailed}"; }
134 ${klist} |
grep "host/t2@${R2}" > /dev
/null ||
135 { ec
=1 ; echo "canonicalized t2 entry not present"; eval "${testfailed}"; }
136 ${klist} |
grep 'host/t3@$' > /dev
/null ||
137 { ec
=1 ; echo "t3 referral entry not present"; eval "${testfailed}"; }
138 ${klist} |
grep "host/t3@${R3}" > /dev
/null ||
139 { ec
=1 ; echo "canonicalized t3 entry not present"; eval "${testfailed}"; }
140 ${klist} |
grep 'host/t11@$' > /dev
/null ||
141 { ec
=1 ; echo "t11 referral entry not present"; eval "${testfailed}"; }
142 ${klist} |
grep "host/t11.test1.h5l.se@${R1}" > /dev
/null ||
143 { ec
=1 ; echo "canonicalized t11 entry not present"; eval "${testfailed}"; }
144 ${klist} |
grep 'host/t12@$' > /dev
/null ||
145 { ec
=1 ; echo "t12 referral entry not present"; eval "${testfailed}"; }
146 ${klist} |
grep "host/t12.test1.h5l.se@${R2}" > /dev
/null ||
147 { ec
=1 ; echo "canonicalized t12 entry not present"; eval "${testfailed}"; }
148 ${klist} |
grep 'host/t22@$' > /dev
/null ||
149 { ec
=1 ; echo "t22 referral entry not present"; eval "${testfailed}"; }
150 ${klist} |
grep "host/t22.test2.h5l.se@${R2}" > /dev
/null ||
151 { ec
=1 ; echo "canonicalized t22 entry not present"; eval "${testfailed}"; }
152 ${klist} |
grep 'host/t33@$' > /dev
/null ||
153 { ec
=1 ; echo "t33 referral entry not present"; eval "${testfailed}"; }
154 ${klist} |
grep "host/t33.test3.h5l.se@${R3}" > /dev
/null ||
155 { ec
=1 ; echo "canonicalized t33 entry not present"; eval "${testfailed}"; }
162 # This may not be portable. It'd be nice to be able to set more of the
163 # resolver configuration via the environment!
164 LOCALDOMAIN
=test1.h5l.se
166 KRB5_CONFIG
="${objdir}/krb5-canon2.conf"
169 echo "Getting client initial tickets (round 2)";
170 ${kinit} --password-file=${objdir}/foopassword foo@${R1} || \
171 { ec
=1 ; eval "${testfailed}"; }
173 echo "get service tickets (success)"
174 for host in t1 t2 t3 t11
; do
176 ${kgetcred} --name-type=SRV_HST host $host || { ec=1 ; eval "${testfailed}"; }
178 echo "get service tickets (failure)"
179 for host in t12 t22 t23 t33
; do
181 ${kgetcred} --name-type=SRV_HST
host $host 2> /dev
/null
&&
182 { ec
=1 ; eval "${testfailed}"; }
186 ${klist} |
grep 'host/t1@$' > /dev
/null ||
187 { ec
=1 ; echo "t1 referral entry not present"; eval "${testfailed}"; }
188 ${klist} |
grep "host/t1@${R1}" > /dev
/null ||
189 { ec
=1 ; echo "canonicalized t1 entry not present"; eval "${testfailed}"; }
190 ${klist} |
grep 'host/t2@$' > /dev
/null ||
191 { ec
=1 ; echo "t2 referral entry not present"; eval "${testfailed}"; }
192 ${klist} |
grep "host/t2@${R2}" > /dev
/null ||
193 { ec
=1 ; echo "canonicalized t2 entry not present"; eval "${testfailed}"; }
194 ${klist} |
grep 'host/t3@$' > /dev
/null ||
195 { ec
=1 ; echo "t3 referral entry not present"; eval "${testfailed}"; }
196 ${klist} |
grep "host/t3@${R3}" > /dev
/null ||
197 { ec
=1 ; echo "canonicalized t3 entry not present"; eval "${testfailed}"; }
198 ${klist} |
grep 'host/t11@$' > /dev
/null ||
199 { ec
=1 ; echo "t11 referral entry not present"; eval "${testfailed}"; }
200 ${klist} |
grep "host/t11.test1.h5l.se@${R1}" > /dev
/null ||
201 { ec
=1 ; echo "canonicalized t11 entry not present"; eval "${testfailed}"; }
208 echo "killing kdc (${kdcpid})"
209 sh
${leaks_kill} kdc
$kdcpid ||
exit 1