3 # Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
4 # (Royal Institute of Technology, Stockholm, Sweden).
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
11 # 1. Redistributions of source code must retain the above copyright
12 # notice, this list of conditions and the following disclaimer.
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
18 # 3. Neither the name of the Institute nor the names of its contributors
19 # may be used to endorse or promote products derived from this software
20 # without specific prior written permission.
22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 # ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 top_builddir
="@top_builddir@"
35 env_setup
="@env_setup@"
39 testfailed
="echo test failed; cat messages.log; exit 1"
43 # If there is no useful db support compiled in, disable test
50 kadmin
="${kadmin} -l -r $R"
51 kdc
="${kdc} --addresses=localhost -P $port"
53 server
=host
/datan.
test.h5l.se
54 cache
="FILE:${objdir}/cache.krb5"
55 ocache
="FILE:${objdir}/ocache.krb5"
56 keytabfile
=${objdir}/server.keytab
57 keytab
="FILE:${keytabfile}"
59 kinit
="${kinit} -c $cache ${afs_no_afslog}"
60 klist
="${klist} -c $cache"
61 kdigest
="${kdigest} --ccache=$cache"
64 userpassword
=digestpassword
68 KRB5_CONFIG
="${objdir}/krb5.conf"
78 echo Creating database
79 ${kadmin} <<EOF || exit 1
80 init --realm-max-ticket-life=1day --realm-max-renewable-life=1month ${R}
81 add -p $userpassword --use-defaults ${username}@${R}
82 add -p $password --use-defaults ${server}@${R}
83 add -p kaka --use-defaults digest/${R}@${R}
84 modify --attributes=+allow-digest ${server}@${R}
85 ext -k ${keytab} ${server}@${R}
89 echo $password > ${objdir}/foopassword
91 echo "Starting kdc" ; > messages.log
92 env
${HEIM_MALLOC_DEBUG} ${kdc} --detach --testing ||
93 { echo "kdc failed to start"; cat messages.log
; exit 1; }
97 echo signal killing kdc
103 trap cleanup EXIT INT TERM
107 echo "Getting digest server tickets"
108 ${kinit} --password-file=${objdir}/foopassword ${server}@
$R || exitcode
=1
109 ${kdigest} digest-server-init \
110 --kerberos-realm=${R} \
111 --type=CHAP
> /dev
/null || exitcode
=1
115 NTLM_ACCEPTOR_CCACHE
="$cache"
116 export NTLM_ACCEPTOR_CCACHE
118 echo "Trying server-init"
119 ${kdigest} ntlm-server-init \
120 --kerberos-realm=${R} \
121 > sdigest-init || exitcode
=1
124 ${test_ntlm} ||
{ echo "test_ntlm failed"; exit 1; }
126 NTLM_USER_FILE
="${srcdir}/ntlm-user-file.txt"
127 export NTLM_USER_FILE
129 echo "test_context --mech-type=ntlm"
130 ${test_context} --mech-type=ntlm \
131 --client-name=foo@TEST \
132 --name-type=hostbased-service datan@TEST || \
133 { echo "test_context 1 failed"; exit 1; }
135 ${test_context} --mech-type=ntlm \
136 --client-name=foo@TEST \
137 --name-type=hostbased-service datan@
host.TEST || \
138 { echo "test_context 2 failed"; exit 1; }
140 ${test_context} --mech-type=ntlm \
141 --client-name=foo@TEST \
142 --name-type=hostbased-service datan@
host.
test.domain2 || \
143 { echo "test_context 3 failed"; exit 1; }
145 echo "Trying SL in NTLM"
152 "--getverifymic --wrapunwrap" \
155 echo "Trying NTLM type: ${type}"
156 ${test_context} --mech-type=ntlm
${type} \
157 --client-name=foo@TEST \
158 --name-type=hostbased-service datan@TEST || \
159 { echo "test_context 1 failed"; exit 1; }
166 ${kdigest} digest-server-init \
167 --kerberos-realm=${R} \
169 > sdigest-reply || exitcode
=1
171 snonce
=`grep server-nonce= sdigest-reply | cut -f2- -d=`
172 identifier
=`grep identifier= sdigest-reply | cut -f2- -d=`
173 opaque
=`grep opaque= sdigest-reply | cut -f2- -d=`
175 ${kdigest} digest-client-request \
177 --username="$username" \
178 --password="$userpassword" \
180 --server-identifier="$identifier" \
181 --server-nonce="$snonce" \
182 > cdigest-reply || exitcode
=1
184 cresponseData
=`grep responseData= cdigest-reply | cut -f2- -d=`
186 #echo user: $username
187 #echo server-nonce: $snonce
188 #echo opaqeue: $opaque
189 #echo identifier: $identifier
191 ${kdigest} digest-server-request \
192 --kerberos-realm=${R} \
194 --username="$username" \
196 --client-response="$cresponseData" \
197 --server-identifier="$identifier" \
198 --server-nonce="$snonce" \
199 > s2digest-reply || exitcode
=1
201 status
=`grep status= s2digest-reply | cut -f2- -d=`
203 if test "X$status" = "Xok" ; then
204 echo "CHAP response ok"
206 echo "CHAP response failed"
210 cresponseData
=`echo $cresponseData | sed 's/..../DEADBEEF/'`
212 ${kdigest} digest-server-request \
213 --kerberos-realm=${R} \
215 --username="$username" \
217 --client-response="$cresponseData" \
218 --server-identifier="$identifier" \
219 --server-nonce="$snonce" \
220 > s2digest-reply || exitcode
=1
222 status
=`grep status= s2digest-reply | cut -f2- -d=`
224 if test "X$status" = "Xfailed" ; then
225 echo "CHAP response fail as it should"
227 echo "CHAP response succeeded errorously"
231 echo "Trying MS-CHAP-V2"
233 ${kdigest} digest-server-init \
234 --kerberos-realm=${R} \
236 > sdigest-reply || exitcode
=1
238 snonce
=`grep server-nonce= sdigest-reply | cut -f2- -d=`
239 opaque
=`grep opaque= sdigest-reply | cut -f2- -d=`
240 cnonce
="21402324255E262A28295F2B3A337C7E"
242 echo "MS-CHAP-V2 client request"
243 ${kdigest} digest-client-request \
245 --username="$username" \
246 --password="$userpassword" \
248 --client-nonce="$cnonce" \
249 --server-nonce="$snonce" \
250 > cdigest-reply || exitcode
=1
252 cresponseData
=`grep responseData= cdigest-reply | cut -f2- -d=`
253 cRsp
=`grep AuthenticatorResponse= cdigest-reply | cut -f2- -d=`
254 ckey
=`grep session-key= cdigest-reply | cut -f2- -d=`
256 ${kdigest} digest-server-request \
257 --kerberos-realm=${R} \
259 --username="$username" \
261 --client-response="$cresponseData" \
262 --client-nonce="$cnonce" \
263 --server-nonce="$snonce" \
264 > s2digest-reply || exitcode
=1
266 status
=`grep status= s2digest-reply | cut -f2- -d=`
267 sRsp
=`grep rsp= s2digest-reply | cut -f2- -d=`
268 skey
=`grep session-key= s2digest-reply | cut -f2- -d=`
270 if test "X$sRsp" != "X$cRsp" ; then
271 echo "rsp wrong $sRsp != $cRsp"
275 if test "X$skey" != "X$ckey" ; then
280 if test "X$status" = "Xok" ; then
281 echo "MS-CHAP-V2 response ok"
283 echo "MS-CHAP-V2 response failed"
289 echo "killing kdc (${kdcpid})"
290 sh
${leaks_kill} kdc
$kdcpid ||
exit 1