2 Unix SMB/CIFS implementation.
4 Validate the krb5 pac generation routines
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2015
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/kerberos.h"
25 #include "torture/smbtorture.h"
26 #include "torture/winbind/proto.h"
27 #include "auth/credentials/credentials.h"
28 #include "lib/cmdline/popt_common.h"
29 #include "source4/auth/kerberos/kerberos.h"
30 #include "source4/auth/kerberos/kerberos_util.h"
31 #include "lib/util/util_net.h"
33 enum torture_krb5_test
{
34 TORTURE_KRB5_TEST_PLAIN
,
35 TORTURE_KRB5_TEST_WIN2K
,
36 TORTURE_KRB5_TEST_PAC_REQUEST
,
37 TORTURE_KRB5_TEST_BREAK_PW
,
38 TORTURE_KRB5_TEST_CLOCK_SKEW
,
41 struct torture_krb5_context
{
42 struct torture_context
*tctx
;
43 struct addrinfo
*server
;
44 enum torture_krb5_test test
;
50 static bool torture_krb5_pre_send_test(struct torture_krb5_context
*test_context
, const krb5_data
*send_buf
)
53 switch (test_context
->test
)
55 case TORTURE_KRB5_TEST_PLAIN
:
56 case TORTURE_KRB5_TEST_WIN2K
:
57 case TORTURE_KRB5_TEST_PAC_REQUEST
:
58 case TORTURE_KRB5_TEST_BREAK_PW
:
59 case TORTURE_KRB5_TEST_CLOCK_SKEW
:
60 torture_assert_int_equal(test_context
->tctx
,
61 decode_AS_REQ(send_buf
->data
, send_buf
->length
, &test_context
->as_req
, &used
), 0,
62 "decode_AS_REQ failed");
63 torture_assert_int_equal(test_context
->tctx
, used
, send_buf
->length
, "length mismatch");
64 torture_assert_int_equal(test_context
->tctx
, test_context
->as_req
.pvno
, 5, "Got wrong as_req->pvno");
70 static bool torture_krb5_post_recv_test(struct torture_krb5_context
*test_context
, const krb5_data
*recv_buf
)
74 switch (test_context
->test
)
76 case TORTURE_KRB5_TEST_PLAIN
:
77 case TORTURE_KRB5_TEST_WIN2K
:
78 if (test_context
->packet_count
== 0) {
79 torture_assert_int_equal(test_context
->tctx
,
80 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
81 "decode_AS_REP failed");
82 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
83 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
84 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KDC_ERR_PREAUTH_REQUIRED
- KRB5KDC_ERR_NONE
,
85 "Got wrong error.error_code");
86 free_KRB_ERROR(&error
);
87 } else if ((decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
) == 0)
88 && (test_context
->packet_count
== 1)) {
89 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
90 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
91 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KRB_ERR_RESPONSE_TOO_BIG
- KRB5KDC_ERR_NONE
,
92 "Got wrong error.error_code");
93 free_KRB_ERROR(&error
);
95 torture_assert_int_equal(test_context
->tctx
,
96 decode_AS_REP(recv_buf
->data
, recv_buf
->length
, &test_context
->as_rep
, &used
), 0,
97 "decode_AS_REP failed");
98 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
99 torture_assert_int_equal(test_context
->tctx
,
100 test_context
->as_rep
.pvno
, 5,
101 "Got wrong as_rep->pvno");
102 torture_assert_int_equal(test_context
->tctx
,
103 test_context
->as_rep
.ticket
.tkt_vno
, 5,
104 "Got wrong as_rep->ticket.tkt_vno");
105 torture_assert(test_context
->tctx
,
106 test_context
->as_rep
.ticket
.enc_part
.kvno
,
107 "Did not get a KVNO in test_context->as_rep.ticket.enc_part.kvno");
108 if (torture_setting_bool(test_context
->tctx
, "expect_rodc", false)) {
109 torture_assert_int_not_equal(test_context
->tctx
,
110 *test_context
->as_rep
.ticket
.enc_part
.kvno
& 0xFFFF0000,
111 0, "Did not get a RODC number in the KVNO");
113 torture_assert_int_equal(test_context
->tctx
,
114 *test_context
->as_rep
.ticket
.enc_part
.kvno
& 0xFFFF0000,
115 0, "Unexpecedly got a RODC number in the KVNO");
117 free_AS_REP(&test_context
->as_rep
);
119 torture_assert(test_context
->tctx
, test_context
->packet_count
< 3, "too many packets");
120 free_AS_REQ(&test_context
->as_req
);
122 case TORTURE_KRB5_TEST_PAC_REQUEST
:
123 if (test_context
->packet_count
== 0) {
124 torture_assert_int_equal(test_context
->tctx
,
125 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
126 "decode_AS_REP failed");
127 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
128 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
129 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KRB_ERR_RESPONSE_TOO_BIG
- KRB5KDC_ERR_NONE
,
130 "Got wrong error.error_code");
131 free_KRB_ERROR(&error
);
132 } else if (test_context
->packet_count
== 1) {
133 torture_assert_int_equal(test_context
->tctx
,
134 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
135 "decode_AS_REP failed");
136 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
137 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
138 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KDC_ERR_PREAUTH_REQUIRED
- KRB5KDC_ERR_NONE
,
139 "Got wrong error.error_code");
140 free_KRB_ERROR(&error
);
141 } else if ((decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
) == 0)
142 && (test_context
->packet_count
== 2)) {
143 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
144 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
145 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KRB_ERR_RESPONSE_TOO_BIG
- KRB5KDC_ERR_NONE
,
146 "Got wrong error.error_code");
147 free_KRB_ERROR(&error
);
149 torture_assert_int_equal(test_context
->tctx
,
150 decode_AS_REP(recv_buf
->data
, recv_buf
->length
, &test_context
->as_rep
, &used
), 0,
151 "decode_AS_REP failed");
152 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
153 torture_assert_int_equal(test_context
->tctx
, test_context
->as_rep
.pvno
, 5, "Got wrong as_rep->pvno");
154 free_AS_REP(&test_context
->as_rep
);
156 torture_assert(test_context
->tctx
, test_context
->packet_count
< 3, "too many packets");
157 free_AS_REQ(&test_context
->as_req
);
159 case TORTURE_KRB5_TEST_BREAK_PW
:
160 if (test_context
->packet_count
== 0) {
161 torture_assert_int_equal(test_context
->tctx
,
162 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
163 "decode_AS_REP failed");
164 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
165 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
166 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KDC_ERR_PREAUTH_REQUIRED
- KRB5KDC_ERR_NONE
,
167 "Got wrong error.error_code");
168 free_KRB_ERROR(&error
);
169 } else if (test_context
->packet_count
== 1) {
170 torture_assert_int_equal(test_context
->tctx
,
171 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
172 "decode_AS_REP failed");
173 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
174 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
175 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KDC_ERR_PREAUTH_FAILED
- KRB5KDC_ERR_NONE
,
176 "Got wrong error.error_code");
177 free_KRB_ERROR(&error
);
179 torture_assert(test_context
->tctx
, test_context
->packet_count
< 2, "too many packets");
180 free_AS_REQ(&test_context
->as_req
);
182 case TORTURE_KRB5_TEST_CLOCK_SKEW
:
183 if (test_context
->packet_count
== 0) {
184 torture_assert_int_equal(test_context
->tctx
,
185 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
186 "decode_AS_REP failed");
187 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
188 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
189 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KDC_ERR_PREAUTH_REQUIRED
- KRB5KDC_ERR_NONE
,
190 "Got wrong error.error_code");
191 free_KRB_ERROR(&error
);
192 } else if (test_context
->packet_count
== 1) {
193 torture_assert_int_equal(test_context
->tctx
,
194 decode_KRB_ERROR(recv_buf
->data
, recv_buf
->length
, &error
, &used
), 0,
195 "decode_AS_REP failed");
196 torture_assert_int_equal(test_context
->tctx
, used
, recv_buf
->length
, "length mismatch");
197 torture_assert_int_equal(test_context
->tctx
, error
.pvno
, 5, "Got wrong error.pvno");
198 torture_assert_int_equal(test_context
->tctx
, error
.error_code
, KRB5KRB_AP_ERR_SKEW
- KRB5KDC_ERR_NONE
,
199 "Got wrong error.error_code");
200 free_KRB_ERROR(&error
);
202 torture_assert(test_context
->tctx
, test_context
->packet_count
< 2, "too many packets");
203 free_AS_REQ(&test_context
->as_req
);
209 static krb5_error_code
smb_krb5_send_and_recv_func_override(krb5_context context
,
210 void *data
, /* struct torture_krb5_context */
211 krb5_krbhst_info
*hi
,
213 const krb5_data
*send_buf
,
216 krb5_error_code k5ret
;
219 struct torture_krb5_context
*test_context
220 = talloc_get_type_abort(data
, struct torture_krb5_context
);
222 ok
= torture_krb5_pre_send_test(test_context
, send_buf
);
227 k5ret
= smb_krb5_send_and_recv_func_forced(context
, test_context
->server
,
228 hi
, timeout
, send_buf
, recv_buf
);
230 ok
= torture_krb5_post_recv_test(test_context
, recv_buf
);
235 test_context
->packet_count
++;
240 static int test_context_destructor(struct torture_krb5_context
*test_context
)
242 freeaddrinfo(test_context
->server
);
247 static bool torture_krb5_init_context(struct torture_context
*tctx
,
248 enum torture_krb5_test test
,
249 struct smb_krb5_context
**smb_krb5_context
)
251 const char *host
= torture_setting_string(tctx
, "host", NULL
);
252 krb5_error_code k5ret
;
255 struct torture_krb5_context
*test_context
= talloc_zero(tctx
, struct torture_krb5_context
);
256 torture_assert(tctx
, test_context
!= NULL
, "Failed to allocate");
258 test_context
->test
= test
;
259 test_context
->tctx
= tctx
;
261 k5ret
= smb_krb5_init_context(tctx
, tctx
->lp_ctx
, smb_krb5_context
);
262 torture_assert_int_equal(tctx
, k5ret
, 0, "smb_krb5_init_context failed");
264 ok
= interpret_string_addr_internal(&test_context
->server
, host
, AI_NUMERICHOST
);
265 torture_assert(tctx
, ok
, "Failed to parse target server");
267 talloc_set_destructor(test_context
, test_context_destructor
);
269 set_sockaddr_port(test_context
->server
->ai_addr
, 88);
271 k5ret
= krb5_set_send_to_kdc_func((*smb_krb5_context
)->krb5_context
,
272 smb_krb5_send_and_recv_func_override
,
274 torture_assert_int_equal(tctx
, k5ret
, 0, "krb5_set_send_to_kdc_func failed");
278 static bool torture_krb5_as_req_creds(struct torture_context
*tctx
,
279 struct cli_credentials
*credentials
,
280 enum torture_krb5_test test
)
282 krb5_error_code k5ret
;
285 krb5_principal principal
;
286 struct smb_krb5_context
*smb_krb5_context
;
287 enum credentials_obtained obtained
;
288 const char *error_string
;
289 const char *password
= cli_credentials_get_password(credentials
);
290 krb5_get_init_creds_opt
*krb_options
= NULL
;
292 ok
= torture_krb5_init_context(tctx
, test
, &smb_krb5_context
);
293 torture_assert(tctx
, ok
, "torture_krb5_init_context failed");
295 k5ret
= principal_from_credentials(tctx
, credentials
, smb_krb5_context
,
296 &principal
, &obtained
, &error_string
);
297 torture_assert_int_equal(tctx
, k5ret
, 0, error_string
);
301 case TORTURE_KRB5_TEST_PLAIN
:
304 case TORTURE_KRB5_TEST_WIN2K
:
305 torture_assert_int_equal(tctx
,
306 krb5_get_init_creds_opt_alloc(smb_krb5_context
->krb5_context
, &krb_options
),
307 0, "krb5_get_init_creds_opt_alloc failed");
309 torture_assert_int_equal(tctx
,
310 krb5_get_init_creds_opt_set_win2k(smb_krb5_context
->krb5_context
, krb_options
, true),
311 0, "krb5_get_init_creds_opt_set_win2k failed");
314 case TORTURE_KRB5_TEST_PAC_REQUEST
:
315 torture_assert_int_equal(tctx
,
316 krb5_get_init_creds_opt_alloc(smb_krb5_context
->krb5_context
, &krb_options
),
317 0, "krb5_get_init_creds_opt_alloc failed");
319 torture_assert_int_equal(tctx
,
320 krb5_get_init_creds_opt_set_pac_request(smb_krb5_context
->krb5_context
, krb_options
, true),
321 0, "krb5_get_init_creds_opt_set_pac_request failed");
324 case TORTURE_KRB5_TEST_BREAK_PW
:
325 password
= "NOT the password";
328 case TORTURE_KRB5_TEST_CLOCK_SKEW
:
329 torture_assert_int_equal(tctx
,
330 krb5_set_real_time(smb_krb5_context
->krb5_context
, time(NULL
) + 3600, 0),
331 0, "krb5_set_real_time failed");
336 k5ret
= krb5_get_init_creds_password(smb_krb5_context
->krb5_context
, &my_creds
, principal
,
337 password
, NULL
, NULL
, 0,
339 krb5_get_init_creds_opt_free(smb_krb5_context
->krb5_context
, krb_options
);
343 case TORTURE_KRB5_TEST_PLAIN
:
344 case TORTURE_KRB5_TEST_WIN2K
:
345 case TORTURE_KRB5_TEST_PAC_REQUEST
:
346 torture_assert_int_equal(tctx
, k5ret
, 0, "krb5_get_init_creds_password failed");
349 case TORTURE_KRB5_TEST_BREAK_PW
:
350 torture_assert_int_equal(tctx
, k5ret
, KRB5KDC_ERR_PREAUTH_FAILED
, "krb5_get_init_creds_password should have failed");
353 case TORTURE_KRB5_TEST_CLOCK_SKEW
:
354 torture_assert_int_equal(tctx
, k5ret
, KRB5KRB_AP_ERR_SKEW
, "krb5_get_init_creds_password should have failed");
359 torture_assert_int_equal(tctx
,
360 krb5_principal_get_type(smb_krb5_context
->krb5_context
,
361 my_creds
.client
), KRB5_NT_PRINCIPAL
,
362 "smb_krb5_init_context gave incorrect client->name.name_type");
364 torture_assert(tctx
, krb5_principal_compare(smb_krb5_context
->krb5_context
,
365 principal
, my_creds
.client
),
366 "krb5_get_init_creds_password returned a different principal");
368 torture_assert_int_equal(tctx
,
369 krb5_principal_get_type(smb_krb5_context
->krb5_context
,
370 my_creds
.server
), KRB5_NT_SRV_INST
,
371 "smb_krb5_init_context gave incorrect client->name.name_type");
373 torture_assert_str_equal(tctx
, krb5_principal_get_comp_string(smb_krb5_context
->krb5_context
,
376 "smb_krb5_init_context gave incorrect my_creds.server->name.name_string[0]");
378 k5ret
= krb5_free_cred_contents(smb_krb5_context
->krb5_context
, &my_creds
);
379 torture_assert_int_equal(tctx
, k5ret
, 0, "krb5_free_creds failed");
384 static bool torture_krb5_as_req_cmdline(struct torture_context
*tctx
)
386 return torture_krb5_as_req_creds(tctx
, cmdline_credentials
, TORTURE_KRB5_TEST_PLAIN
);
389 static bool torture_krb5_as_req_win2k(struct torture_context
*tctx
)
391 return torture_krb5_as_req_creds(tctx
, cmdline_credentials
, TORTURE_KRB5_TEST_WIN2K
);
394 static bool torture_krb5_as_req_pac_request(struct torture_context
*tctx
)
396 return torture_krb5_as_req_creds(tctx
, cmdline_credentials
, TORTURE_KRB5_TEST_PAC_REQUEST
);
399 static bool torture_krb5_as_req_break_pw(struct torture_context
*tctx
)
401 return torture_krb5_as_req_creds(tctx
, cmdline_credentials
, TORTURE_KRB5_TEST_BREAK_PW
);
404 static bool torture_krb5_as_req_clock_skew(struct torture_context
*tctx
)
406 return torture_krb5_as_req_creds(tctx
, cmdline_credentials
, TORTURE_KRB5_TEST_CLOCK_SKEW
);
409 NTSTATUS
torture_krb5_init(void);
410 NTSTATUS
torture_krb5_init(void)
412 struct torture_suite
*suite
= torture_suite_create(talloc_autofree_context(), "krb5");
413 struct torture_suite
*kdc_suite
= torture_suite_create(suite
, "kdc");
414 suite
->description
= talloc_strdup(suite
, "Kerberos tests");
415 kdc_suite
->description
= talloc_strdup(kdc_suite
, "Kerberos KDC tests");
417 torture_suite_add_simple_test(kdc_suite
, "as-req-cmdline",
418 torture_krb5_as_req_cmdline
);
420 torture_suite_add_simple_test(kdc_suite
, "as-req-win2k",
421 torture_krb5_as_req_win2k
);
423 torture_suite_add_simple_test(kdc_suite
, "as-req-pac-request",
424 torture_krb5_as_req_pac_request
);
426 torture_suite_add_simple_test(kdc_suite
, "as-req-break-pw",
427 torture_krb5_as_req_break_pw
);
429 torture_suite_add_simple_test(kdc_suite
, "as-req-clock-skew",
430 torture_krb5_as_req_clock_skew
);
432 torture_suite_add_suite(suite
, kdc_suite
);
434 torture_register_suite(suite
);