kdc/kdc-tester.c

   1 /*
   2  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kdc_locl.h"
  37 #include "send_to_kdc_plugin.h"
  38
  39 struct perf {
  40     unsigned long as_req;
  41     unsigned long tgs_req;
  42     struct timeval start;
  43     struct timeval stop;
  44     struct perf *next;
  45 } *ptop;
  46
  47 int detach_from_console = -1;
  48 int daemon_child = -1;
  49
  50 static krb5_kdc_configuration *kdc_config;
  51 static krb5_context kdc_context;
  52
  53 static struct sockaddr_storage sa;
  54 static const char *astr = "0.0.0.0";
  55
  56 static void eval_object(heim_object_t);
  57
  58
  59 /*
  60  *
  61  */
  62
  63 static krb5_error_code
  64 plugin_init(krb5_context context, void **pctx)
  65 {
  66     *pctx = NULL;
  67     return 0;
  68 }
  69
  70 static void
  71 plugin_fini(void *ctx)
  72 {
  73 }
  74
  75 static krb5_error_code
  76 plugin_send_to_kdc(krb5_context context,
  77                    void *ctx,
  78                    krb5_krbhst_info *ho,
  79                    time_t timeout,
  80                    const krb5_data *in,
  81                    krb5_data *out)
  82 {
  83     return KRB5_PLUGIN_NO_HANDLE;
  84 }
  85
  86 static krb5_error_code
  87 plugin_send_to_realm(krb5_context context,
  88                      void *ctx,
  89                      krb5_const_realm realm,
  90                      time_t timeout,
  91                      const krb5_data *in,
  92                      krb5_data *out)
  93 {
  94     int ret;
  95
  96     krb5_kdc_update_time(NULL);
  97
  98     ret = krb5_kdc_process_request(kdc_context, kdc_config,
  99                                    in->data, in->length,
 100                                    out, NULL, astr,
 101                                    (struct sockaddr *)&sa, 0);
 102     if (ret)
 103         krb5_err(kdc_context, 1, ret, "krb5_kdc_process_request");
 104
 105     return 0;
 106 }
 107
 108 static krb5plugin_send_to_kdc_ftable send_to_kdc = {
 109     KRB5_PLUGIN_SEND_TO_KDC_VERSION_2,
 110     plugin_init,
 111     plugin_fini,
 112     plugin_send_to_kdc,
 113     plugin_send_to_realm
 114 };
 115
 116 static void
 117 perf_start(struct perf *perf)
 118 {
 119     memset(perf, 0, sizeof(*perf));
 120
 121     gettimeofday(&perf->start, NULL);
 122     perf->next = ptop;
 123     ptop = perf;
 124 }
 125
 126 static void
 127 perf_stop(struct perf *perf)
 128 {
 129     gettimeofday(&perf->stop, NULL);
 130     ptop = perf->next;
 131
 132     if (ptop) {
 133         ptop->as_req += perf->as_req;
 134         ptop->tgs_req += perf->tgs_req;
 135     }
 136
 137     timevalsub(&perf->stop, &perf->start);
 138     printf("time: %lu.%06lu\n",
 139            (unsigned long)perf->stop.tv_sec,
 140            (unsigned long)perf->stop.tv_usec);
 141
 142 #define USEC_PER_SEC 1000000
 143
 144     if (perf->as_req) {
 145         double as_ps = 0.0;
 146         as_ps = (perf->as_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
 147         printf("as-req/s %.2lf  (total %lu requests)\n", as_ps, perf->as_req);
 148     }
 149
 150     if (perf->tgs_req) {
 151         double tgs_ps = 0.0;
 152         tgs_ps = (perf->tgs_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
 153         printf("tgs-req/s %.2lf (total %lu requests)\n", tgs_ps, perf->tgs_req);
 154     }
 155 }
 156
 157 /*
 158  *
 159  */
 160
 161 static void
 162 eval_repeat(heim_dict_t o)
 163 {
 164     heim_object_t or = heim_dict_get_value(o, HSTR("value"));
 165     heim_number_t n = heim_dict_get_value(o, HSTR("num"));
 166     int i, num;
 167     struct perf perf;
 168
 169     perf_start(&perf);
 170
 171     heim_assert(or != NULL, "value missing");
 172     heim_assert(n != NULL, "num missing");
 173
 174     num = heim_number_get_int(n);
 175     heim_assert(num >= 0, "num >= 0");
 176
 177     for (i = 0; i < num; i++)
 178         eval_object(or);
 179
 180     perf_stop(&perf);
 181 }
 182
 183 /*
 184  *
 185  */
 186
 187 static krb5_error_code
 188 copy_keytab(krb5_context context, krb5_keytab from, krb5_keytab to)
 189 {
 190     krb5_keytab_entry entry;
 191     krb5_kt_cursor cursor;
 192     krb5_error_code ret;
 193
 194     ret = krb5_kt_start_seq_get(context, from, &cursor);
 195     if (ret)
 196         return ret;
 197     while((ret = krb5_kt_next_entry(context, from, &entry, &cursor)) == 0){
 198         krb5_kt_add_entry(context, to, &entry);
 199         krb5_kt_free_entry(context, &entry);
 200     }
 201     return krb5_kt_end_seq_get(context, from, &cursor);
 202 }
 203
 204 /*
 205  *
 206  */
 207
 208 static void
 209 eval_kinit(heim_dict_t o)
 210 {
 211     heim_string_t user, password, keytab, fast_armor_cc, pk_user_id, ccache;
 212     krb5_get_init_creds_opt *opt;
 213     krb5_init_creds_context ctx;
 214     krb5_principal client;
 215     krb5_keytab ktmem = NULL;
 216     krb5_ccache fast_cc = NULL;
 217     krb5_error_code ret;
 218
 219     if (ptop)
 220         ptop->as_req++;
 221
 222     user = heim_dict_get_value(o, HSTR("client"));
 223     if (user == NULL)
 224         krb5_errx(kdc_context, 1, "no client");
 225
 226     password = heim_dict_get_value(o, HSTR("password"));
 227     keytab = heim_dict_get_value(o, HSTR("keytab"));
 228     pk_user_id = heim_dict_get_value(o, HSTR("pkinit-user-cert-id"));
 229     if (password == NULL && keytab == NULL && pk_user_id == NULL)
 230         krb5_errx(kdc_context, 1, "password, keytab, nor PKINIT user cert ID");
 231
 232     ccache = heim_dict_get_value(o, HSTR("ccache"));
 233
 234     ret = krb5_parse_name(kdc_context, heim_string_get_utf8(user), &client);
 235     if (ret)
 236         krb5_err(kdc_context, 1, ret, "krb5_unparse_name");
 237
 238     /* PKINIT parts */
 239     ret = krb5_get_init_creds_opt_alloc (kdc_context, &opt);
 240     if (ret)
 241         krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_alloc");
 242
 243     if (pk_user_id) {
 244         heim_bool_t rsaobj = heim_dict_get_value(o, HSTR("pkinit-use-rsa"));
 245         int use_rsa = rsaobj ? heim_bool_val(rsaobj) : 0;
 246
 247         ret = krb5_get_init_creds_opt_set_pkinit(kdc_context, opt,
 248                                                  client,
 249                                                  heim_string_get_utf8(pk_user_id),
 250                                                  NULL, NULL, NULL,
 251                                                  use_rsa ? 2 : 0,
 252                                                  NULL, NULL, NULL);
 253         if (ret)
 254             krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
 255     }
 256
 257     ret = krb5_init_creds_init(kdc_context, client, NULL, NULL, 0, opt, &ctx);
 258     if (ret)
 259         krb5_err(kdc_context, 1, ret, "krb5_init_creds_init");
 260
 261     fast_armor_cc = heim_dict_get_value(o, HSTR("fast-armor-cc"));
 262     if (fast_armor_cc) {
 263
 264         ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(fast_armor_cc), &fast_cc);
 265         if (ret)
 266             krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 267
 268         ret = krb5_init_creds_set_fast_ccache(kdc_context, ctx, fast_cc);
 269         if (ret)
 270             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_fast_ccache");
 271     }
 272
 273     if (password) {
 274         ret = krb5_init_creds_set_password(kdc_context, ctx,
 275                                            heim_string_get_utf8(password));
 276         if (ret)
 277             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_password");
 278     }
 279     if (keytab) {
 280         krb5_keytab kt = NULL;
 281
 282         ret = krb5_kt_resolve(kdc_context, heim_string_get_utf8(keytab), &kt);
 283         if (ret)
 284             krb5_err(kdc_context, 1, ret, "krb5_kt_resolve");
 285
 286         ret = krb5_kt_resolve(kdc_context, "MEMORY:keytab", &ktmem);
 287         if (ret)
 288             krb5_err(kdc_context, 1, ret, "krb5_kt_resolve(MEMORY)");
 289
 290         ret = copy_keytab(kdc_context, kt, ktmem);
 291         if (ret)
 292             krb5_err(kdc_context, 1, ret, "copy_keytab");
 293
 294         krb5_kt_close(kdc_context, kt);
 295
 296         ret = krb5_init_creds_set_keytab(kdc_context, ctx, ktmem);
 297         if (ret)
 298             krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_keytab");
 299     }
 300
 301     ret = krb5_init_creds_get(kdc_context, ctx);
 302     if (ret)
 303         krb5_err(kdc_context, 1, ret, "krb5_init_creds_get");
 304
 305     if (ccache) {
 306         const char *name = heim_string_get_utf8(ccache);
 307         krb5_creds cred;
 308         krb5_ccache cc;
 309
 310         ret = krb5_init_creds_get_creds(kdc_context, ctx, &cred);
 311         if (ret)
 312             krb5_err(kdc_context, 1, ret, "krb5_init_creds_get_creds");
 313
 314         ret = krb5_cc_resolve(kdc_context, name, &cc);
 315         if (ret)
 316             krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 317
 318         krb5_init_creds_store(kdc_context, ctx, cc);
 319
 320         ret = krb5_cc_close(kdc_context, cc);
 321         if (ret)
 322             krb5_err(kdc_context, 1, ret, "krb5_cc_close");
 323
 324         krb5_free_cred_contents(kdc_context, &cred);
 325     }
 326
 327     krb5_init_creds_free(kdc_context, ctx);
 328
 329     if (ktmem)
 330         krb5_kt_close(kdc_context, ktmem);
 331     if (fast_cc)
 332         krb5_cc_close(kdc_context, fast_cc);
 333 }
 334
 335 /*
 336  *
 337  */
 338
 339 static void
 340 eval_kgetcred(heim_dict_t o)
 341 {
 342     heim_string_t server, ccache;
 343     krb5_get_creds_opt opt;
 344     heim_bool_t nostore;
 345     krb5_error_code ret;
 346     krb5_ccache cc = NULL;
 347     krb5_principal s;
 348     krb5_creds *out = NULL;
 349
 350     if (ptop)
 351         ptop->tgs_req++;
 352
 353     server = heim_dict_get_value(o, HSTR("server"));
 354     if (server == NULL)
 355         krb5_errx(kdc_context, 1, "no server");
 356
 357     ccache = heim_dict_get_value(o, HSTR("ccache"));
 358     if (ccache == NULL)
 359         krb5_errx(kdc_context, 1, "no ccache");
 360
 361     nostore = heim_dict_get_value(o, HSTR("nostore"));
 362     if (nostore == NULL)
 363         nostore = heim_bool_create(1);
 364
 365     ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(ccache), &cc);
 366     if (ret)
 367         krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 368
 369     ret = krb5_parse_name(kdc_context, heim_string_get_utf8(server), &s);
 370     if (ret)
 371         krb5_err(kdc_context, 1, ret, "krb5_parse_name");
 372
 373     ret = krb5_get_creds_opt_alloc(kdc_context, &opt);
 374     if (ret)
 375         krb5_err(kdc_context, 1, ret, "krb5_get_creds_opt_alloc");
 376
 377     if (heim_bool_val(nostore))
 378         krb5_get_creds_opt_add_options(kdc_context, opt, KRB5_GC_NO_STORE);
 379
 380     ret = krb5_get_creds(kdc_context, opt, cc, s, &out);
 381     if (ret)
 382         krb5_err(kdc_context, 1, ret, "krb5_get_creds");
 383
 384     krb5_free_creds(kdc_context, out);
 385     krb5_free_principal(kdc_context, s);
 386     krb5_get_creds_opt_free(kdc_context, opt);
 387     krb5_cc_close(kdc_context, cc);
 388 }
 389
 390
 391 /*
 392  *
 393  */
 394
 395 static void
 396 eval_kdestroy(heim_dict_t o)
 397 {
 398     heim_string_t ccache = heim_dict_get_value(o, HSTR("ccache"));;
 399     krb5_error_code ret;
 400     const char *name;
 401     krb5_ccache cc;
 402
 403     heim_assert(ccache != NULL, "ccache_missing");
 404
 405     name = heim_string_get_utf8(ccache);
 406
 407     ret = krb5_cc_resolve(kdc_context, name, &cc);
 408     if (ret)
 409         krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
 410
 411     krb5_cc_destroy(kdc_context, cc);
 412 }
 413
 414
 415 /*
 416  *
 417  */
 418
 419 static void
 420 eval_array_element(heim_object_t o, void *ptr, int *stop)
 421 {
 422     eval_object(o);
 423 }
 424
 425 static void
 426 eval_object(heim_object_t o)
 427 {
 428     heim_tid_t t = heim_get_tid(o);
 429
 430     if (t == heim_array_get_type_id()) {
 431         heim_array_iterate_f(o, NULL, eval_array_element);
 432     } else if (t == heim_dict_get_type_id()) {
 433         const char *op = heim_dict_get_value(o, HSTR("op"));
 434
 435         heim_assert(op != NULL, "op missing");
 436
 437         if (strcmp(op, "repeat") == 0) {
 438             eval_repeat(o);
 439         } else if (strcmp(op, "kinit") == 0) {
 440             eval_kinit(o);
 441         } else if (strcmp(op, "kgetcred") == 0) {
 442             eval_kgetcred(o);
 443         } else if (strcmp(op, "kdestroy") == 0) {
 444             eval_kdestroy(o);
 445         } else {
 446             errx(1, "unsupported ops %s", op);
 447         }
 448
 449     } else
 450         errx(1, "unsupported");
 451 }
 452
 453
 454 int
 455 main(int argc, char **argv)
 456 {
 457     krb5_error_code ret;
 458     int optidx = 0;
 459
 460     setprogname(argv[0]);
 461
 462     ret = krb5_init_context(&kdc_context);
 463     if (ret == KRB5_CONFIG_BADFORMAT)
 464         errx (1, "krb5_init_context failed to parse configuration file");
 465     else if (ret)
 466         errx (1, "krb5_init_context failed: %d", ret);
 467
 468     ret = krb5_kt_register(kdc_context, &hdb_get_kt_ops);
 469     if (ret)
 470         errx (1, "krb5_kt_register(HDB) failed: %d", ret);
 471
 472     kdc_config = configure(kdc_context, argc, argv, &optidx);
 473
 474     argc -= optidx;
 475     argv += optidx;
 476
 477     if (argc == 0)
 478         errx(1, "missing operations");
 479
 480     krb5_plugin_register(kdc_context, PLUGIN_TYPE_DATA,
 481                          KRB5_PLUGIN_SEND_TO_KDC, &send_to_kdc);
 482
 483     {
 484         void *buf;
 485         size_t size;
 486         heim_object_t o;
 487
 488         if (rk_undumpdata(argv[0], &buf, &size))
 489             errx(1, "undumpdata: %s", argv[0]);
 490
 491         o = heim_json_create_with_bytes(buf, size, 10, 0, NULL);
 492         free(buf);
 493         if (o == NULL)
 494             errx(1, "heim_json");
 495
 496         /*
 497          * do the work here
 498          */
 499
 500         eval_object(o);
 501
 502         heim_release(o);
 503     }
 504
 505     krb5_free_context(kdc_context);
 506     return 0;
 507 }