1#!/bin/sh 2# 3# Copyright (c) 2006 Kungliga Tekniska Högskolan 4# (Royal Institute of Technology, Stockholm, Sweden). 5# All rights reserved. 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 11# 1. Redistributions of source code must retain the above copyright 12# notice, this list of conditions and the following disclaimer. 13# 14# 2. Redistributions in binary form must reproduce the above copyright 15# notice, this list of conditions and the following disclaimer in the 16# documentation and/or other materials provided with the distribution. 17# 18# 3. Neither the name of the Institute nor the names of its contributors 19# may be used to endorse or promote products derived from this software 20# without specific prior written permission. 21# 22# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25# ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32# SUCH DAMAGE. 33# 34# $Id$ 35# 36 37srcdir="@srcdir@" 38objdir="@objdir@" 39 40# If there is no useful db support compile in, disable test 41../db/have-db || exit 77 42 43R=TEST.H5L.SE 44 45port=@port@ 46 47keytabfile=${objdir}/server.keytab 48keytab="FILE:${keytabfile}" 49cache="FILE:krb5ccfile" 50cacheds="FILE:krb5ccfile-ds" 51 52kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache ${afs_no_afslog} --forwardable" 53kinitds="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cacheds ${afs_no_afslog}" 54kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R" 55kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port" 56 57context="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_context" 58 59KRB5_CONFIG="${objdir}/krb5.conf" 60export KRB5_CONFIG 61 62KRB5_KTNAME="${keytab}" 63export KRB5_KTNAME 64KRB5CCNAME="${cache}" 65export KRB5CCNAME 66NTLM_ACCEPTOR_CCACHE="${cacheds}" 67export NTLM_ACCEPTOR_CCACHE 68NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt" 69export NTLM_USER_FILE 70 71GSSAPI_SPNEGO_NAME=host@host.test.h5l.se 72export GSSAPI_SPNEGO_NAME 73 74rm -f ${keytabfile} 75rm -f current-db* 76rm -f out-* 77rm -f mkey.file* 78 79> messages.log 80 81echo Creating database 82${kadmin} \ 83 init \ 84 --realm-max-ticket-life=1day \ 85 --realm-max-renewable-life=1month \ 86 ${R} || exit 1 87 88${kadmin} add -p p1 --use-defaults host/host.test.h5l.se@${R} || exit 1 89${kadmin} ext -k ${keytab} host/host.test.h5l.se@${R} || exit 1 90 91${kadmin} add -p kaka --use-defaults digest/${R}@${R} || exit 1 92 93${kadmin} add -p ds --use-defaults digestserver@${R} || exit 1 94${kadmin} modify --attributes=+allow-digest digestserver@${R} || exit 1 95 96${kadmin} add -p u1 --use-defaults user1@${R} || exit 1 97 98echo "Doing database check" 99${kadmin} check ${R} || exit 1 100 101echo u1 > ${objdir}/foopassword 102echo ds > ${objdir}/barpassword 103 104echo Starting kdc 105${kdc} & 106kdcpid=$! 107 108sh ${srcdir}/../kdc/wait-kdc.sh 109if [ "$?" != 0 ] ; then 110 kill ${kdcpid} 111 exit 1 112fi 113 114trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT 115 116exitcode=0 117 118echo "Getting client initial tickets" 119${kinit} --password-file=${objdir}/foopassword user1@${R} || exitcode=1 120echo "Getting digestserver initial tickets" 121${kinitds} --password-file=${objdir}/barpassword digestserver@${R} || exitcode=1 122 123echo "======context building for each mech" 124 125for mech in ntlm krb5 ; do 126 echo "${mech}" 127 ${context} --mech-type=${mech} --ret-mech-type=${mech} \ 128 --name-type=hostbased-service host@host.test.h5l.se || \ 129 { exitcode=1 ; echo test failed; } 130done 131 132echo "spnego" 133${context} \ 134 --mech-type=spnego \ 135 --ret-mech-type=krb5 \ 136 --name-type=hostbased-service \ 137 host@host.test.h5l.se || \ 138 { exitcode=1 ; echo test failed; } 139 140echo "test failure cases" 141${context} --mech-type=ntlm --ret-mech-type=krb5 \ 142 --name-type=hostbased-service host@host.test.h5l.se 2> /dev/null && \ 143 { exitcode=1 ; echo test failed; } 144 145${context} --mech-type=krb5 --ret-mech-type=ntlm \ 146 --name-type=hostbased-service host@host.test.h5l.se 2> /dev/null && \ 147 { exitcode=1 ; echo test failed; } 148 149echo "======spnego variants context building" 150 151for arg in \ 152 "" \ 153 "--mutual" \ 154 "--delegate" \ 155 "--mutual --delegate" \ 156 "--getverifymic --wrapunwrap" \ 157 "--mutual --getverifymic --wrapunwrap" \ 158 ; do 159 160 echo "no NTLM acceptor cred ${arg}" 161 NTLM_ACCEPTOR_CCACHE="${cacheds}-no" 162 ${context} --mech-type=spnego \ 163 $arg \ 164 --client-name=user1@TEST.H5L.SE \ 165 --name-type=hostbased-service \ 166 --ret-mech-type=krb5 \ 167 host@host.test.h5l.se || \ 168 { exitcode=1 ; echo test failed; } 169 NTLM_ACCEPTOR_CCACHE="${cacheds}" 170 171 echo "no NTLM initiator cred ${arg}" 172 NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt-no" 173 ${context} --mech-type=spnego \ 174 $arg \ 175 --client-name=user1@TEST.H5L.SE \ 176 --name-type=hostbased-service \ 177 --ret-mech-type=krb5 \ 178 host@host.test.h5l.se || \ 179 { exitcode=1 ; echo test failed; } 180 NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt" 181 182 echo "no krb5 acceptor cred ${arg}" 183 KRB5_KTNAME="${keytab}-no" 184 ${context} --mech-type=spnego \ 185 $arg \ 186 --client-name=user1@TEST.H5L.SE \ 187 --server-no-delegate \ 188 --name-type=hostbased-service \ 189 --ret-mech-type=ntlm \ 190 host@host.test.h5l.se || \ 191 { exitcode=1 ; echo test failed; } 192 KRB5_KTNAME="${keytab}" 193 194 echo "no krb5 initiator cred ${arg}" 195 KRB5CCNAME="${cache}-no" 196 ${context} --mech-type=spnego \ 197 $arg \ 198 --client-name=user1@TEST.H5L.SE \ 199 --server-no-delegate \ 200 --name-type=hostbased-service \ 201 --ret-mech-type=ntlm \ 202 host@host.test.h5l.se || \ 203 { exitcode=1 ; echo test failed; } 204 KRB5CCNAME="${cache}" 205 206done 207 208trap "" EXIT 209 210echo "killing kdc (${kdcpid})" 211kill ${kdcpid} 2> /dev/null 212 213exit $exitcode 214 215 216