3 # Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
4 # (Royal Institute of Technology, Stockholm, Sweden).
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
11 # 1. Redistributions of source code must retain the above copyright
12 # notice, this list of conditions and the following disclaimer.
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
18 # 3. Neither the name of the Institute nor the names of its contributors
19 # may be used to endorse or promote products derived from this software
20 # without specific prior written permission.
22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 # ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 top_builddir
="@top_builddir@"
35 env_setup
="@env_setup@"
40 KRB5_CONFIG
="${1-${objdir}/krb5.conf}"
43 testfailed
="echo test failed; cat messages.log; exit 1"
45 # If there is no useful db support compiled in, disable test
63 r
=`echo "$R" | tr '[A-Z]' '[a-z]'`
64 h1
=`echo "${H1}" | tr '[A-Z]' '[a-z]'`
65 h2
=`echo "${H2}" | tr '[A-Z]' '[a-z]'`
66 h3
=`echo "${H3}" | tr '[A-Z]' '[a-z]'`
67 h4
=`echo "${H4}" | tr '[A-Z]' '[a-z]'`
72 kadmin5
="${kadmin} -l -r $R5"
73 kadmin
="${kadmin} -l -r $R"
74 kdc
="${kdc} --addresses=localhost -P $port"
75 kpasswdd
="${kpasswdd} --addresses=localhost -p $pwport"
77 server
=host
/datan.
test.h5l.se
78 server2
=host
/computer.example.com
79 serverip
=host
/10.11.12.13
80 serveripname
=host
/ip.
test.h5l.org
81 serveripname2
=host
/10.11.12.14
82 alias1
=host
/datan.example.com
84 aliaskeytab
=host
/datan
85 cache
="FILE:${objdir}/cache.krb5"
86 ocache
="FILE:${objdir}/ocache.krb5"
87 o2cache
="FILE:${objdir}/o2cache.krb5"
88 icache
="FILE:${objdir}/icache.krb5"
89 keytabfile
=${objdir}/server.keytab
90 keytab
="FILE:${keytabfile}"
91 ps
="proxy-service@${R}"
92 aesenctype
="aes256-cts-hmac-sha1-96"
94 kinit
="${kinit} -c $cache ${afs_no_afslog}"
95 klist
="${klist} -c $cache"
96 kgetcred
="${kgetcred} -c $cache"
97 kgetcred_imp
="${kgetcred} -c $cache --out-cache=${ocache}"
98 kdestroy
="${kdestroy} -c $cache ${afs_no_unlog}"
99 kimpersonate
="${kimpersonate} -k ${keytab} --ccache=${ocache}"
100 test_set_kvno0
="${test_set_kvno0} -c $cache"
109 echo Creating database
112 --realm-max-ticket-life=1day \
113 --realm-max-renewable-life=1month \
118 --realm-max-ticket-life=1day \
119 --realm-max-renewable-life=1month \
124 --realm-max-ticket-life=1day \
125 --realm-max-renewable-life=1month \
130 --realm-max-ticket-life=1day \
131 --realm-max-renewable-life=1month \
136 --realm-max-ticket-life=1day \
137 --realm-max-renewable-life=1month \
142 --realm-max-ticket-life=1day \
143 --realm-max-renewable-life=1month \
148 --realm-max-ticket-life=1day \
149 --realm-max-renewable-life=1month \
154 --realm-max-ticket-life=1day \
155 --realm-max-renewable-life=1month \
160 --realm-max-ticket-life=1day \
161 --realm-max-renewable-life=1month \
166 --realm-max-ticket-life=1day \
167 --realm-max-renewable-life=1month \
172 --realm-max-ticket-life=1day \
173 --realm-max-renewable-life=1month \
178 --realm-max-ticket-life=1day \
179 --realm-max-renewable-life=1month \
184 --realm-max-ticket-life=1day \
185 --realm-max-renewable-life=1month \
188 ${kadmin} cpw -r krbtgt/${R}@${R} ||
exit 1
189 ${kadmin} cpw -r krbtgt/${R}@${R} ||
exit 1
190 ${kadmin} cpw -r krbtgt/${R}@${R} ||
exit 1
191 ${kadmin} cpw -r krbtgt/${R}@${R} ||
exit 1
193 ${kadmin} add
-p foo
--use-defaults foo@
${R} ||
exit 1
194 ${kadmin} add -p foo --use-defaults foo/host.${r}@${R} ||
exit 1
195 ${kadmin} add
-p foo
--use-defaults foo@
${R2} ||
exit 1
196 ${kadmin} add
-p foo
--use-defaults foo@
${R3} ||
exit 1
197 ${kadmin} add
-p foo
--use-defaults foo@
${R4} ||
exit 1
198 ${kadmin5} add
-p foo
--use-defaults foo@
${R5} ||
exit 1
199 ${kadmin} add
-p foo
--use-defaults foo@
${R6} ||
exit 1
200 ${kadmin} add
-p foo
--use-defaults foo@
${R7} ||
exit 1
201 ${kadmin} add
-p foo
--use-defaults foo@
${R8} ||
exit 1
202 ${kadmin} add
-p foo
--use-defaults foo@
${H1} ||
exit 1
203 ${kadmin} add -p foo --use-defaults foo/host.${h1}@${H1} ||
exit 1
204 ${kadmin} add
-p foo
--use-defaults foo@
${H2} ||
exit 1
205 ${kadmin} add -p foo --use-defaults foo/host.${h2}@${H2} ||
exit 1
206 ${kadmin} add
-p foo
--use-defaults foo@
${H3} ||
exit 1
207 ${kadmin} add -p foo --use-defaults foo/host.${h3}@${H3} ||
exit 1
208 ${kadmin} add
-p foo
--use-defaults foo@
${H4} ||
exit 1
209 ${kadmin} add -p foo --use-defaults foo/host.${h4}@${H4} ||
exit 1
210 ${kadmin} add
-p bar
--use-defaults bar@
${R} ||
exit 1
211 ${kadmin} add
-p foo
--use-defaults remove@
${R} ||
exit 1
212 ${kadmin} add -p nop --use-defaults ${server}@${R} ||
exit 1
213 ${kadmin} cpw -p bla --keepold ${server}@${R} ||
exit 1
214 ${kadmin} cpw -p kaka --keepold ${server}@${R} ||
exit 1
215 ${kadmin} add -p kaka --use-defaults ${server}-des3@${R} ||
exit 1
216 ${kadmin} add
-p kaka
--use-defaults kt-des3@
${R} ||
exit 1
217 ${kadmin} add
-p kaka
--use-defaults foo
/des3-only@
${R} ||
exit 1
218 ${kadmin} add
-p kaka
--use-defaults bar
/des3-only@
${R} ||
exit 1
219 ${kadmin} add
-p kaka
--use-defaults foo
/aes-only@
${R} ||
exit 1
220 ${kadmin} add
-p foo
--use-defaults ${ps} ||
exit 1
221 ${kadmin} modify
--attributes=+trusted-for-delegation
${ps} ||
exit 1
222 ${kadmin} modify --constrained-delegation=${server} ${ps} ||
exit 1
223 ${kadmin} ext -k ${keytab} ${server}@${R} ||
exit 1
224 ${kadmin} ext -k ${keytab} ${ps} ||
exit 1
226 ${kadmin} add -p kaka --use-defaults ${server2}@${R2} ||
exit 1
227 ${kadmin} ext -k ${keytab} ${server2}@${R2} ||
exit 1
228 ${kadmin} add -p kaka --use-defaults ${serverip}@${R} ||
exit 1
229 ${kadmin} ext -k ${keytab} ${serverip}@${R} ||
exit 1
230 ${kadmin} add -p kaka --use-defaults ${serveripname}@${R} ||
exit 1
231 ${kadmin} ext -k ${keytab} ${serveripname}@${R} ||
exit 1
232 ${kadmin} modify --alias=${serveripname2}@${R} ${serveripname}@${R}
233 ${kadmin} add
-p foo
--use-defaults remove2@
${R2} ||
exit 1
235 ${kadmin} add -p kaka --use-defaults ${alias1}@${R} ||
exit 1
236 ${kadmin} ext -k ${keytab} ${alias1}@${R} ||
exit 1
237 ${kadmin} modify --alias=${alias2}@${R} ${alias1}@${R}
239 ${kadmin} add -p cross1 --use-defaults krbtgt/${R2}@${R} ||
exit 1
240 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${R2} ||
exit 1
242 ${kadmin} add -p cross1 --use-defaults krbtgt/${R3}@${R2} ||
exit 1
243 ${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R3} ||
exit 1
245 ${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R2} ||
exit 1
246 ${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R4} ||
exit 1
248 ${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R3} ||
exit 1
249 ${kadmin} add -p cross2 --use-defaults krbtgt/${R3}@${R4} ||
exit 1
251 ${kadmin} add -p cross1 --use-defaults krbtgt/${R5}@${R} ||
exit 1
252 ${kadmin5} add -p cross2 --use-defaults krbtgt/${R}@${R5} ||
exit 1
254 ${kadmin5} add -p cross1 --use-defaults krbtgt/${R6}@${R5} ||
exit 1
255 ${kadmin} add -p cross2 --use-defaults krbtgt/${R5}@${R6} ||
exit 1
257 ${kadmin} add -p cross1 --use-defaults krbtgt/${R7}@${R6} ||
exit 1
258 ${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R7} ||
exit 1
260 ${kadmin} add -p cross1 --use-defaults krbtgt/${R8}@${R6} ||
exit 1
261 ${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R8} ||
exit 1
263 ${kadmin} add -p cross1 --use-defaults krbtgt/${H1}@${R} ||
exit 1
264 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H1} ||
exit 1
266 ${kadmin} add -p cross1 --use-defaults krbtgt/${H2}@${R} ||
exit 1
267 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H2} ||
exit 1
269 ${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H2} ||
exit 1
270 ${kadmin} add -p cross2 --use-defaults krbtgt/${H2}@${H3} ||
exit 1
272 ${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H4} ||
exit 1
273 ${kadmin} add -p cross2 --use-defaults krbtgt/${H4}@${H3} ||
exit 1
275 ${kadmin} add
-p foo
--use-defaults pw-expire@
${R} ||
exit 1
276 ${kadmin} modify
--pw-expiration-time=+1day pw-expire@
${R} ||
exit 1
278 ${kadmin} add
-p foo
--use-defaults pw-expired@
${R} ||
exit 1
279 ${kadmin} modify
--pw-expiration-time=2012-06-12 pw-expired@
${R} ||
exit 1
281 ${kadmin} add
-p foo
--use-defaults account-expired@
${R} ||
exit 1
282 ${kadmin} modify
--expiration-time=2012-06-12 account-expired@
${R} ||
exit 1
284 ${kadmin} add
-p foo
--use-defaults foo@
${RH} ||
exit 1
287 ${kadmin} add
-p foo
--use-defaults -- -p ||
exit 1
288 ${kadmin} delete
-- -p ||
exit 1
290 echo "Doing database check"
291 ${kadmin} check
${R} ||
exit 1
292 ${kadmin} check
${R2} ||
exit 1
293 ${kadmin} check
${R3} ||
exit 1
294 ${kadmin} check
${R4} ||
exit 1
295 ${kadmin5} check
${R5} ||
exit 1
296 ${kadmin} check
${R6} ||
exit 1
297 ${kadmin} check
${R7} ||
exit 1
298 ${kadmin} check
${R8} ||
exit 1
299 ${kadmin} check
${H1} ||
exit 1
300 ${kadmin} check
${H2} ||
exit 1
301 ${kadmin} check
${H3} ||
exit 1
302 ${kadmin} check
${H4} ||
exit 1
304 echo "Extracting enctypes"
305 ${ktutil} -k ${keytab} list
> tempfile ||
exit 1
306 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
307 ${EGREP} -v "$server" |
# we did cpw for this one
308 awk '$1 !~ /1/ { exit 1 }' ||
exit 1
309 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
310 ${EGREP} "$server" |
head -1 |
311 awk '$1 !~ /3/ { exit 1 }' ||
exit 1
314 ${kadmin} get foo@
${R} > tempfile ||
exit 1
315 enctypes
=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g'`
317 enctype_sans_aes
=`echo $enctypes | sed 's/aes[^ ]*//g'`
318 enctype_sans_des3
=`echo $enctypes | sed 's/des3-cbc-sha1//g'`
320 echo "deleting all but des enctypes on kt-des3 in keytab"
321 ${kadmin} ext -k ${keytab} kt-des3@${R} ||
exit 1
322 for a
in ${enctype_sans_des3} ; do
323 ${ktutil} -k ${keytab} remove -p kt-des3@${R} -e $a
326 echo "checking globbing keys rules"
327 ${kadmin} get foo
/des3-only@
${R} > tempfile ||
exit 1
328 enctypes
=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
329 if [ X
"$enctypes" != Xdes3-cbc-sha1
] ; then
330 echo "des3 only is not only des3: $enctypes"
334 ${kadmin} get foo
/aes-only@
${R} > tempfile ||
exit 1
335 enctypes
=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
336 if [ X
"$enctypes" != Xaes256-cts-hmac-sha1-96
] ; then
337 echo "aes only is not only aes: $enctypes"
342 echo foo
> ${objdir}/foopassword
343 echo notfoo
> ${objdir}/notfoopassword
345 echo Starting kdc
; > messages.log
346 env MallocStackLogging
=1 MallocStackLoggingNoCompact
=1 MallocErrorAbort
=1 MallocLogFile
=${objdir}/malloc-log \
347 ${kdc} --detach --testing ||
348 { echo "kdc failed to start"; exit 1; }
351 echo Starting kpasswdd
; > messages.log
352 env
${HEIM_MALLOC_DEBUG} ${kpasswdd} --detach ||
353 { echo "kpasswdd failed to start"; exit 1; }
354 kpasswddpid
=`getpid kpasswdd`
357 trap "kill -9 ${kdcpid} ${kpasswddpid}; echo signal killing kdc kpasswdd; exit 1;" EXIT
361 echo "Getting client initial tickets with wrong password"; > messages.log
362 ${kinit} --password-file=${objdir}/notfoopassword \
363 foo@
${R} 2>kinit-log.tmp
&& \
364 { ec
=1 ; eval "${testfailed}"; }
365 grep 'Password incorrect' kinit-log.tmp
> /dev
/null || \
366 { ec
=1 ; eval "${testfailed}"; }
367 echo "Getting client initial tickets"; > messages.log
368 ${kinit} --password-file=${objdir}/foopassword foo@
$R || \
369 { ec
=1 ; eval "${testfailed}"; }
370 echo "Doing krbtgt key rollover"; > messages.log
371 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} ||
exit 1
372 echo "Getting tickets"; > messages.log
373 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
374 echo "Listing tickets"; > messages.log
375 ${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
376 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
377 { ec
=1 ; eval "${testfailed}"; }
380 echo "Getting client initial tickets (http transport)"; > messages.log
381 ${kinit} --password-file=${objdir}/foopassword foo@${RH} || \
382 { ec
=1 ; eval "${testfailed}"; }
385 echo "Testing capaths logic"
386 ${kinit} --password-file=${objdir}/foopassword \
387 -e ${aesenctype} -e ${aesenctype} \
389 { ec
=1 ; eval "${testfailed}"; }
391 echo "Getting x-realm tickets with capaths for $R -> $R2"
392 ${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
393 echo "Getting x-realm tickets with capaths for $R -> $R3"
394 ${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
395 echo "Getting x-realm tickets with capaths for $R -> $R4"
396 ${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
397 echo "Getting x-realm tickets with capaths for $R -> $R5"
398 ${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
399 echo "Getting x-realm tickets with capaths for $R -> $R6"
400 ${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
401 echo "Getting x-realm tickets with capaths for $R -> $R7"
402 ${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
403 echo "Should not get x-realm tickets with capaths for $R -> $R8"
404 ${kgetcred} foo@${R8} && { ec=1 ; eval "${testfailed}"; }
407 echo "Testing capaths logic (reverse order)"
408 ${kinit} --password-file=${objdir}/foopassword \
409 -e ${aesenctype} -e ${aesenctype} \
411 { ec
=1 ; eval "${testfailed}"; }
413 echo "Getting x-realm tickets with capaths for $R -> $R4"
414 ${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
415 echo "Getting x-realm tickets with capaths for $R -> $R3"
416 ${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
417 echo "Getting x-realm tickets with capaths for $R -> $R2"
418 ${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
419 echo "Getting x-realm tickets with capaths for $R -> $R7"
420 ${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
421 echo "Getting x-realm tickets with capaths for $R -> $R6"
422 ${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
423 echo "Getting x-realm tickets with capaths for $R -> $R5"
424 ${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
427 echo "Testing hierarchical referral logic"
428 ${kinit} --password-file=${objdir}/foopassword \
429 -e ${aesenctype} -e ${aesenctype} \
431 { ec
=1 ; eval "${testfailed}"; }
433 echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H1"
434 ${kgetcred} --hostbased --canonicalize foo host.${h1} || { ec=1 ; eval "${testfailed}"; }
435 fgrep
"cross-realm ${H3} -> ${H1} via [${H2}, ${R}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
436 echo "Getting x-realm tickets with hierarchical referrals
for $H3 -> $R"
437 ${kgetcred} --hostbased --canonicalize foo host.${r} || { ec=1 ; eval "${testfailed}"; }
438 fgrep "cross-realm
${H3} -> ${R} via [${H2}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
439 echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H2"
440 ${kgetcred} --hostbased --canonicalize foo host.${h2} || { ec=1 ; eval "${testfailed}"; }
441 fgrep
"cross-realm ${H3} -> ${H2}" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
444 echo "Testing multi-hop
[capaths
] referral logic
"
445 ${kinit} --password-file=${objdir}/foopassword \
446 -e ${aesenctype} -e ${aesenctype} \
448 { ec=1 ; eval "${testfailed}"; }
450 echo "Getting x-realm tickets with
[capaths
] referrals
for $H4 -> $H1"
451 ${kgetcred} --hostbased --canonicalize foo/host.${h1}@${H4} || { ec=1 ; eval "${testfailed}"; }
454 echo "Testing forwardable
/renewable flag copying
in TGS-REQ
"
455 ${kinit} -f --renewable -r 5d --password-file=${objdir}/foopassword foo@$R || \
456 { ec=1 ; eval "${testfailed}"; }
457 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
458 ${klist} -f | grep ${server} | grep FRA > /dev/null || \
459 { ec=1 ; eval "${testfailed}"; }
462 echo "Specific enctype
"; > messages.log
463 ${kinit} --password-file=${objdir}/foopassword \
464 -e ${aesenctype} -e ${aesenctype} \
466 { ec=1 ; eval "${testfailed}"; }
468 for a in $enctypes; do
469 echo "Getting client initial tickets
($a)"; > messages.log
470 ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
471 echo "Getting tickets
"; > messages.log
472 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
473 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || { ec=1 ; eval "${testfailed}"; }
478 echo "Getting client initial tickets
"; > messages.log
479 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
480 { ec=1 ; eval "${testfailed}"; }
481 for a in $enctypes; do
482 echo "Getting tickets
($a)"; > messages.log
483 ${kgetcred} -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
484 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
485 { ec=1 ; eval "${testfailed}"; }
486 ${kdestroy} --credential=${server}@${R}
490 echo "Getting client authenticated anonymous initial tickets
"; > messages.log
491 ${kinit} -n --password-file=${objdir}/foopassword foo@$R || \
492 { ec=1 ; eval "${testfailed}"; }
493 for a in $enctypes; do
494 echo "Getting tickets
($a)"; > messages.log
495 ${kgetcred} -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
496 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
497 { ec=1 ; eval "${testfailed}"; }
498 ${kdestroy} --credential=${server}@${R}
502 echo "Getting client anonymous service tickets
"; > messages.log
503 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
504 { ec=1 ; eval "${testfailed}"; }
505 for a in $enctypes; do
506 echo "Getting tickets
($a)"; > messages.log
507 ${kgetcred} -n -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
508 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
509 { ec=1 ; eval "${testfailed}"; }
510 ${kdestroy} --credential=${server}@${R}
514 echo "Getting client initial tickets
for cross realm
case"; > messages.log
515 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
516 for a in $enctypes; do
517 echo "Getting cross realm tickets
($a)"; > messages.log
518 ${kgetcred} -e $a ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
519 echo " checking we we got back right ticket
"
520 ${klist} | grep ${server2}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
521 echo " checking
if ticket is useful
"
522 ${test_ap_req} ${server2}@${R2} ${keytab} ${cache} || \
523 { ec=1 ; eval "${testfailed}"; }
524 ${kdestroy} --credential=${server2}@${R2}
528 echo "Trying x-realm TGT with kvno
0 case";
529 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
530 { ec=1 ; eval "${testfailed}"; }
531 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
532 echo "Getting cross realm tickets
"; > messages.log
533 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
534 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
535 echo "Getting service ticket
"; > messages.log
536 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
539 echo "Trying x-realm TGT with kvno
0 case with key rollover
";
540 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
541 { ec=1 ; eval "${testfailed}"; }
542 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
543 echo "Getting cross realm tickets
"; > messages.log
544 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
545 echo "Rolling over cross realm keys
"; > messages.log
546 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
547 ${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
548 ${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
549 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
550 echo "Getting service ticket
"; > messages.log
551 echo "Start tracing kdc
, then hit
return"
552 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
555 echo "Trying x-realm TGT with no kvno
case";
556 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
557 { ec=1 ; eval "${testfailed}"; }
558 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
559 echo "Getting cross realm tickets
"; > messages.log
560 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
561 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
562 echo "Getting service ticket
"; > messages.log
563 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
566 echo "Trying x-realm TGT with no kvno
case with key rollover
";
567 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
568 { ec=1 ; eval "${testfailed}"; }
569 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
570 echo "Getting cross realm tickets
"; > messages.log
571 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
572 echo "Rolling over cross realm keys
"; > messages.log
573 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
574 ${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
575 ${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
576 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
577 echo "Getting service ticket
"; > messages.log
578 echo "Start tracing kdc
, then hit
return"
579 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
582 echo "try all permutations
"; > messages.log
583 for a in $enctypes; do
584 echo "Getting client initial tickets
($a)"; > messages.log
585 ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || \
586 { ec=1 ; eval "${testfailed}"; }
587 for b in $enctypes; do
588 echo "Getting tickets
($a -> $b)"; > messages.log
589 ${kgetcred} -e $b ${server}@${R} || \
590 { ec=1 ; eval "${testfailed}"; }
591 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
592 { ec=1 ; eval "${testfailed}"; }
593 ${kdestroy} --credential=${server}@${R}
598 echo "Getting client initial tickets ip based name
"; > messages.log
599 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
600 echo "Getting ip based name tickets
"; > messages.log
601 ${kgetcred} ${serverip}@${R} || { ec=1 ; eval "${testfailed}"; }
602 echo " checking we we got back right ticket
"
603 ${klist} | grep ${serverip}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
604 echo " checking
if ticket is useful
"
605 ${test_ap_req} ${serverip}@${R} ${keytab} ${cache} || \
606 { ec=1 ; eval "${testfailed}"; }
609 echo "Getting client initial tickets ip based name
(alias)"; > messages.log
610 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
611 for a in ${serveripname} ${serveripname2} ; do
612 echo "Getting ip based name tickets
(alias) $a"; > messages.log
613 ${kgetcred} ${a}@${R} || { ec=1 ; eval "${testfailed}"; }
614 echo " checking we we got back right ticket
"
615 ${klist} | grep ${a}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
616 echo " checking
if ticket is useful
"
617 ${test_ap_req} --server-any ${a}@${R} ${keytab} ${cache} || \
618 { ec=1 ; eval "${testfailed}"; }
622 echo "Getting server initial tickets
"; > messages.log
623 ${kinit} --keytab=${keytab} ${server}@$R || { ec=1 ; eval "${testfailed}"; }
624 echo "Listing tickets
"; > messages.log
625 ${klist} | grep "Principal
: ${server}" > /dev/null || \
626 { ec=1 ; eval "${testfailed}"; }
629 echo "Getting key
for key that are a subset
in keytab compared to kdb
"
630 ${kinit} --keytab=${keytab} kt-des3@${R}
631 ${klist} | grep "Principal
: kt-des3
" > /dev/null || \
632 { ec=1 ; eval "${testfailed}"; }
635 echo "initial tickets
for deleted user
test case"; > messages.log
636 ${kinit} --password-file=${objdir}/foopassword remove@$R || \
637 { ec=1 ; eval "${testfailed}"; }
638 ${kadmin} delete remove@${R} || { ec=1 ; eval "${testfailed}"; }
639 echo "try getting ticket with deleted user
"; > messages.log
640 ${kgetcred} ${server}@${R} 2> /dev/null && { ec=1 ; eval "${testfailed}"; }
643 echo "cross realm
case (deleted user
)"; > messages.log
644 ${kinit} --password-file=${objdir}/foopassword remove2@$R2 || \
645 { ec=1 ; eval "${testfailed}"; }
646 ${kgetcred} krbtgt/${R}@${R2} 2> /dev/null || \
647 { ec=1 ; eval "${testfailed}"; }
648 ${kadmin} delete remove2@${R2} || exit 1
649 ${kgetcred} ${server}@${R} 2> /dev/null || \
650 { ec=1 ; eval "${testfailed}"; }
653 echo "rename user
"; > messages.log
654 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
655 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
656 { ec=1 ; eval "${testfailed}"; }
657 ${kadmin} rename rename@${R} rename2@${R} || exit 1
658 ${kinit} --password-file=${objdir}/foopassword rename2@${R} || \
659 { ec=1 ; eval "${testfailed}"; }
661 ${kadmin} delete rename2@${R} || exit 1
663 echo "rename user to another realm
"; > messages.log
664 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
665 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
666 { ec=1 ; eval "${testfailed}"; }
667 ${kadmin} rename rename@${R} rename@${R2} || exit 1
668 ${kinit} --password-file=${objdir}/foopassword rename@${R2} || \
669 { ec=1 ; eval "${testfailed}"; }
671 ${kadmin} delete rename@${R2} || exit 1
673 echo deleting all but aes enctypes on krbtgt
674 ${kadmin} del_enctype krbtgt/${R}@${R} ${enctype_sans_aes} || exit 1
676 echo deleting all but des enctypes on server-des3
677 ${kadmin} del_enctype ${server}-des3@${R} ${enctype_sans_des3} || exit 1
678 ${kadmin} ext -k ${keytab} ${server}-des3@${R} || exit 1
680 echo "try all permutations
(only aes
)"; > messages.log
681 for a in $enctypes; do
682 echo "Getting client initial tickets
($a)"; > messages.log
683 ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@${R} ||\
684 { ec=1 ; eval "${testfailed}"; }
685 for b in $enctypes; do
686 echo "Getting tickets
($a -> $b)"; > messages.log
687 ${kgetcred} -e $b ${server}@${R} || \
688 { ec=1 ; eval "${testfailed}"; }
689 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
690 { ec=1 ; eval "${testfailed}"; }
692 echo "Getting tickets
($a -> $b) (server des3 only
)"; > messages.log
693 ${kgetcred} ${server}-des3@${R} || \
694 { ec=1 ; eval "${testfailed}"; }
695 ${test_ap_req} ${server}-des3@${R} ${keytab} ${cache} || \
696 { ec=1 ; eval "${testfailed}"; }
698 ${kdestroy} --credential=${server}@${R}
699 ${kdestroy} --credential=${server}-des3@${R}
704 echo deleting all enctypes on krbtgt
705 ${kadmin} del_enctype krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
706 { ec=1 ; eval "${testfailed}"; }
707 echo "try initial ticket w
/o and keys on krbtgt
"
708 ${kinit} --password-file=${objdir}/foopassword foo@${R} 2>/dev/null && \
709 { ec=1 ; eval "${testfailed}"; }
710 echo "adding random aes key
"
711 ${kadmin} add_enctype -r krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
712 { ec=1 ; eval "${testfailed}"; }
713 echo "try initial ticket with random aes key on krbtgt
"
714 ${kinit} --password-file=${objdir}/foopassword foo@${R} || \
715 { ec=1 ; eval "${testfailed}"; }
721 if ${hxtool} info | grep 'rsa: hx509 null RSA' > /dev/null ; then
724 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
727 if ${kinit} --help 2>&1 | grep "CA certificates
" > /dev/null; then
731 if ${hxtool} info | grep 'ecdsa: hcrypto null' > /dev/null ; then
736 # If we support pkinit and have RSA, lets try that
737 if test "$pkinit" = yes -a "$rsa" = yes ; then
739 echo "try anonymous pkinit
"; > messages.log
740 ${kinit} -n @${R} || \
741 { ec=1 ; eval "${testfailed}"; }
742 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
745 for type in "" "--pk-use-enckey"; do
746 echo "Trying pk-init
(principal
in certificate
) $type"; > messages.log
747 ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit.key bar@${R} || \
748 { ec=1 ; eval "${testfailed}"; }
749 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
752 echo "Trying pk-init
(principal
in pki-mapping
) $type"; > messages.log
753 ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit.key foo@${R} || \
754 { ec=1 ; eval "${testfailed}"; }
755 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
758 echo "Trying pk-init
(password protected key
) $type"; > messages.log
759 ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit-pw.key --password-file=${objdir}/foopassword foo@${R} || \
760 { ec=1 ; eval "${testfailed}"; }
761 ${kgetcred} ${server}@${R} || \
762 { ec=1 ; eval "${testfailed}"; }
765 echo "Trying pk-init
(proxy cert
) $type"; > messages.log
766 ${kinit} $type -C FILE:${hx509_data}/pkinit-proxy-chain.crt,${hx509_data}/pkinit-proxy.key foo@${R} || \
767 { ec=1 ; eval "${testfailed}"; }
768 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
773 if test "$ecdsa" = yes > /dev/null ; then
774 echo "Trying pk-init
(ec certificate
)"
776 ${kinit} -C FILE:${hx509_data}/pkinit-ec.crt,${hx509_data}/pkinit-ec.key bar@${R} || \
777 { ec=1 ; eval "${testfailed}"; }
778 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
780 grep 'PK-INIT using ecdh' messages.log > /dev/null || \
781 { ec=1 ; eval "${testfailed}"; }
785 echo "no pkinit
(pkinit
: $pkinit, rsa
: $rsa)"; > messages.log
788 echo "tickets
for impersonate
test case"; > messages.log
789 ${kinit} --forwardable --password-file=${objdir}/foopassword ${ps} || \
790 { ec=1 ; eval "${testfailed}"; }
791 ${kgetcred_imp} --impersonate=bar@${R} ${ps} || \
792 { ec=1 ; eval "${testfailed}"; }
793 ${test_ap_req} ${ps} ${keytab} ${ocache} || \
794 { ec=1 ; eval "${testfailed}"; }
795 echo " negative check
"
796 ${kgetcred_imp} --impersonate=bar@${R} foo@${R} 2>/dev/null && \
797 { ec=1 ; eval "${testfailed}"; }
799 echo "test constrained delegation
"; > messages.log
800 ${kgetcred_imp} --forward --impersonate=bar@${R} ${ps} || \
801 { ec=1 ; eval "${testfailed}"; }
803 --out-cache=${o2cache} \
804 --delegation-credential-cache=${ocache} \
806 { ec=1 ; eval "${testfailed}"; }
807 echo " try using the credential
"
808 ${test_ap_req} ${server}@${R} ${keytab} ${o2cache} || \
809 { ec=1 ; eval "${testfailed}"; }
810 echo " negative check
"
812 --out-cache=${o2cache} \
813 --delegation-credential-cache=${ocache} \
814 bar@${R} 2>/dev/null && \
815 { ec=1 ; eval "${testfailed}"; }
817 echo "test constrained delegation impersonation
(non forward
)"; > messages.log
819 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} || \
820 { ec=1 ; eval "${testfailed}"; }
821 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
822 { ec=1 ; eval "${testfailed}"; }
824 echo "test constrained delegation impersonation
(missing KRB5SignedPath
)"; > messages.log
826 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} -f forwardable || \
827 { ec=1 ; eval "${testfailed}"; }
828 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
829 { ec=1 ; eval "${testfailed}"; }
833 echo "check renewing
" > messages.log
834 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
835 { ec=1 ; eval "${testfailed}"; }
838 { ec=1 ; eval "${testfailed}"; }
839 echo "check renewing MIT interface
" > messages.log
840 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
841 { ec=1 ; eval "${testfailed}"; }
843 env KRB5CCNAME=${cache} ${test_renew} || \
844 { ec=1 ; eval "${testfailed}"; }
847 echo "checking server aliases
"; > messages.log
848 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
849 { ec=1 ; eval "${testfailed}"; }
850 echo "Getting tickets
"; > messages.log
851 ${kgetcred} ${alias1}@${R} || { ec=1 ; eval "${testfailed}"; }
852 ${kgetcred} ${alias2}@${R} || { ec=1 ; eval "${testfailed}"; }
853 echo " verify entry
in keytab
"
854 ${test_ap_req} ${alias1}@${R} ${keytab} ${cache} || \
855 { ec=1 ; eval "${testfailed}"; }
856 echo " verify entry
in keytab with any
"
857 ${test_ap_req} --server-any ${alias1}@${R} ${keytab} ${cache} || \
858 { ec=1 ; eval "${testfailed}"; }
859 echo " verify failure with
alias entry
"
860 ${test_ap_req} ${alias2}@${R} ${keytab} ${cache} 2>/dev/null && \
861 { ec=1 ; eval "${testfailed}"; }
862 echo " verify
alias entry
in keytab with any
"
863 ${test_ap_req} --server-any ${alias2}@${R} ${keytab} ${cache} || \
864 { ec=1 ; eval "${testfailed}"; }
867 echo "testing removal of keytab
"
868 ${ktutil} -k ${keytab} destroy || { ec=1 ; eval "${testfailed}"; }
869 test -f ${keytabfile} && { ec=1 ; eval "${testfailed}"; }
871 echo "Checking client pw expire
"; > messages.log
872 ${kinit} --password-file=${objdir}/foopassword \
873 pw-expire@${R} 2>kinit-log.tmp|| \
874 { ec=1 ; eval "${testfailed}"; }
875 grep 'Your password will expire' kinit-log.tmp > /dev/null || \
876 { ec=1 ; eval "${testfailed}"; }
878 ${test_gic} --client=pw-expire@${R} --password=foo > kinit-log.tmp 2>/dev/null
879 ${EGREP} "^e
type: 6" kinit-log.tmp > /dev/null || \
880 { ec=1 ; eval "${testfailed}"; }
881 echo " test_gic passes
"
884 echo "Checking password expiration
" ; > messages.log
886 kinitpty=${objdir}/foopassword.rkpty
887 cat > ${kinitpty} <<EOF
890 expect Password has expired
895 expect Success: Password changed
898 echo "Checking client pw expire
"; > messages.log
899 ${rkpty} ${kinitpty} ${kinit} pw-expired@${R}|| \
900 { ec=1 ; eval "${testfailed}"; }
905 echo "killing kdc
(${kdcpid}) kpasswdd
(${kpasswddpid})"
906 sh ${leaks_kill} kdc $kdcpid || exit 1
907 sh ${leaks_kill} kpasswdd $kpasswddpid || exit 1