3 # Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
4 # (Royal Institute of Technology, Stockholm, Sweden).
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
11 # 1. Redistributions of source code must retain the above copyright
12 # notice, this list of conditions and the following disclaimer.
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
18 # 3. Neither the name of the Institute nor the names of its contributors
19 # may be used to endorse or promote products derived from this software
20 # without specific prior written permission.
22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 # ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
41 testfailed
="echo test failed; cat messages.log; exit 1"
43 # If there is no useful db support compile in, disable test
44 ..
/db
/have-db ||
exit 77
50 kadmin
="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
51 kdc
="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port"
53 server
=host
/datan.
test.h5l.se
54 cache
="FILE:${objdir}/cache.krb5"
55 keyfile
="${srcdir}/../../lib/hx509/data/key.der"
56 keyfile2
="${srcdir}/../../lib/hx509/data/key2.der"
58 kinit
="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache --no-afslog"
59 kgetcred
="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache"
60 kdestroy
="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache --no-unlog"
61 hxtool
="${TESTS_ENVIRONMENT} ../../lib/hx509/hxtool"
63 KRB5_CONFIG
="${objdir}/krb5-pkinit.conf"
68 if ${hxtool} info |
grep 'rsa: hx509 null RSA' > /dev
/null
; then
71 if ${hxtool} info |
grep 'rand: not available' > /dev
/null
; then
75 if ${kinit} --help 2>&1 |
grep "CA certificates" > /dev
/null
; then
79 # If we doesn't support pkinit and have RSA, give up
80 if test "$pkinit" != yes -o "$rsa" != yes ; then
91 echo Creating database
94 --realm-max-ticket-life=1day \
95 --realm-max-renewable-life=1month \
98 ${kadmin} add
-p foo
--use-defaults foo@
${R} ||
exit 1
99 ${kadmin} add
-p bar
--use-defaults bar@
${R} ||
exit 1
100 ${kadmin} add
-p baz
--use-defaults baz@
${R} ||
exit 1
101 ${kadmin} modify
--pkinit-acl="CN=baz,DC=test,DC=h5l,DC=se" baz@
${R} ||
exit 1
103 ${kadmin} add -p kaka --use-defaults ${server}@${R} ||
exit 1
105 echo "Doing database check"
106 ${kadmin} check
${R} ||
exit 1
108 echo "Setting up certificates"
109 ${hxtool} request-create \
110 --subject="CN=kdc,DC=test,DC=h5l,DC=se" \
111 --key=FILE
:${keyfile2} \
112 req-kdc.der ||
exit 1
113 ${hxtool} request-create \
114 --subject="CN=bar,DC=test,DC=h5l,DC=se" \
115 --key=FILE
:${keyfile2} \
116 req-pkinit.der ||
exit 1
117 ${hxtool} request-create \
118 --subject="CN=baz,DC=test,DC=h5l,DC=se" \
119 --key=FILE
:${keyfile2} \
120 req-pkinit2.der ||
exit 1
122 echo "issue self-signed ca cert"
123 ${hxtool} issue-certificate \
126 --ca-private-key=FILE
:${keyfile} \
127 --subject="CN=CA,DC=test,DC=h5l,DC=se" \
128 --certificate="FILE:ca.crt" ||
exit 1
130 echo "issue kdc certificate"
131 ${hxtool} issue-certificate \
132 --ca-certificate=FILE
:$objdir/ca.crt
,${keyfile} \
133 --type="pkinit-kdc" \
134 --pk-init-principal="krbtgt/TEST.H5L.SE@TEST.H5L.SE" \
135 --req="PKCS10:req-kdc.der" \
136 --certificate="FILE:kdc.crt" ||
exit 1
138 echo "issue user certificate (pkinit san)"
139 ${hxtool} issue-certificate \
140 --ca-certificate=FILE
:$objdir/ca.crt
,${keyfile} \
141 --type="pkinit-client" \
142 --pk-init-principal="bar@TEST.H5L.SE" \
143 --req="PKCS10:req-pkinit.der" \
144 --certificate="FILE:pkinit.crt" ||
exit 1
146 echo "issue user 2 certificate (no san)"
147 ${hxtool} issue-certificate \
148 --ca-certificate=FILE
:$objdir/ca.crt
,${keyfile} \
149 --type="pkinit-client" \
150 --req="PKCS10:req-pkinit2.der" \
151 --certificate="FILE:pkinit2.crt" ||
exit 1
153 echo "issue user 3 certificate (ms san)"
154 ${hxtool} issue-certificate \
155 --ca-certificate=FILE
:$objdir/ca.crt
,${keyfile} \
156 --type="pkinit-client" \
157 --ms-upn="bar@test.h5l.se" \
158 --req="PKCS10:req-pkinit2.der" \
159 --certificate="FILE:pkinit3.crt" ||
exit 1
162 echo foo
> ${objdir}/foopassword
168 sh
${srcdir}/wait-kdc.sh
169 if [ "$?" != 0 ] ; then
174 trap "kill -9 ${kdcpid}; echo signal killing kdc; cat ca.crt kdc.crt pkinit.crt ;exit 1;" EXIT
178 echo "Trying pk-init (principal in cert)"; > messages.log
180 ${kinit} -C FILE:${base}/pkinit.crt,${keyfile2} bar@${R} || \
181 { ec
=1 ; eval "${testfailed}"; }
182 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
185 echo "Trying pk-init (principal in pki-mapping file) "; > messages.log
186 ${kinit} -C FILE:${base}/pkinit.crt,${keyfile2} foo@${R} || \
187 { ec
=1 ; eval "${testfailed}"; }
188 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
191 echo "Trying pk-init (principal subject in DB)"; > messages.log
192 ${kinit} -C FILE:${base}/pkinit2.crt,${keyfile2} baz@${R} || \
193 { ec
=1 ; eval "${testfailed}"; }
194 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
197 echo "Trying pk-init (ms upn)"; > messages.log
198 ${kinit} -C FILE:${base}/pkinit3.crt,${keyfile2} bar@${R} || \
199 { ec
=1 ; eval "${testfailed}"; }
200 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
203 KRB5_CONFIG
="${objdir}/krb5-pkinit-win.conf"
206 echo "Duplicated tests, now in windows 2000 mode"
208 echo "Trying pk-init (principal in cert)"; > messages.log
210 ${kinit} -C FILE:${base}/pkinit.crt,${keyfile2} bar@${R} || \
211 { ec
=1 ; eval "${testfailed}"; }
212 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
215 echo "Trying pk-init (principal in pki-mapping file) "; > messages.log
216 ${kinit} -C FILE:${base}/pkinit.crt,${keyfile2} foo@${R} || \
217 { ec
=1 ; eval "${testfailed}"; }
218 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
221 echo "Trying pk-init (principal subject in DB)"; > messages.log
222 ${kinit} -C FILE:${base}/pkinit2.crt,${keyfile2} baz@${R} || \
223 { ec
=1 ; eval "${testfailed}"; }
224 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
227 echo "Trying pk-init (ms upn)"; > messages.log
228 ${kinit} -C FILE:${base}/pkinit3.crt,${keyfile2} bar@${R} || \
229 { ec
=1 ; eval "${testfailed}"; }
230 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
234 KRB5_CONFIG
="${objdir}/krb5-pkinit.conf"
237 echo "Trying PKCS11 support"
239 cat > test-rc-file.rc
<<EOF
240 certificate cert User certificate FILE:${base}/pkinit.crt,${keyfile2}
244 SOFTPKCS11RC
="test-rc-file.rc"
247 dir
=${base}/..
/..
/lib
/hx509
250 for a
in libhx509.so .libs
/libhx509.so libhx509.dylib .libs
/libhx509.dylib
; do
251 if [ -f $dir/$a ] ; then
257 if [ X
"$file" != X
-a @DLOPEN@
] ; then
259 echo "Trying pk-init (principal in pki-mapping file) "; > messages.log
260 ${kinit} -C PKCS11:${file} foo@${R} || \
261 { ec
=1 ; eval "${testfailed}"; }
262 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
268 echo "killing kdc (${kdcpid})"
269 sh
${srcdir}/leaks-kill.sh kdc
$kdcpid ||
exit 1