1#!/bin/sh
2#
3# Copyright (c) 2006 Kungliga Tekniska Högskolan
4# (Royal Institute of Technology, Stockholm, Sweden). 
5# All rights reserved. 
6#
7# Redistribution and use in source and binary forms, with or without 
8# modification, are permitted provided that the following conditions 
9# are met: 
10#
11# 1. Redistributions of source code must retain the above copyright 
12#    notice, this list of conditions and the following disclaimer. 
13#
14# 2. Redistributions in binary form must reproduce the above copyright 
15#    notice, this list of conditions and the following disclaimer in the 
16#    documentation and/or other materials provided with the distribution. 
17#
18# 3. Neither the name of the Institute nor the names of its contributors 
19#    may be used to endorse or promote products derived from this software 
20#    without specific prior written permission. 
21#
22# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
23# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
24# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
25# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
26# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
27# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
28# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
29# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
30# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
31# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
32# SUCH DAMAGE. 
33#
34# $Id$
35#
36
37srcdir="@srcdir@"
38objdir="@objdir@"
39
40# If there is no useful db support compile in, disable test
41../db/have-db || exit 77
42
43R=TEST.H5L.SE
44
45port=@port@
46
47keytabfile=${objdir}/server.keytab
48keytab="FILE:${keytabfile}"
49cache="FILE:krb5ccfile"
50cacheds="FILE:krb5ccfile-ds"
51
52kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache ${afs_no_afslog} --forwardable"
53kinitds="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cacheds ${afs_no_afslog}"
54kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
55kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port"
56
57context="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_context"
58
59KRB5_CONFIG="${objdir}/krb5.conf"
60export KRB5_CONFIG
61
62KRB5_KTNAME="${keytab}"
63export KRB5_KTNAME
64KRB5CCNAME="${cache}"
65export KRB5CCNAME
66NTLM_ACCEPTOR_CCACHE="${cacheds}"
67export NTLM_ACCEPTOR_CCACHE
68NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt"
69export NTLM_USER_FILE
70
71GSSAPI_SPNEGO_NAME=host@host.test.h5l.se
72export GSSAPI_SPNEGO_NAME
73
74rm -f ${keytabfile}
75rm -f current-db*
76rm -f out-*
77rm -f mkey.file*
78
79> messages.log
80
81echo Creating database
82${kadmin} \
83    init \
84    --realm-max-ticket-life=1day \
85    --realm-max-renewable-life=1month \
86    ${R} || exit 1
87
88${kadmin} add -p p1 --use-defaults host/host.test.h5l.se@${R} || exit 1
89${kadmin} ext -k ${keytab} host/host.test.h5l.se@${R} || exit 1
90
91${kadmin} add -p kaka --use-defaults digest/${R}@${R} || exit 1
92
93${kadmin} add -p ds --use-defaults digestserver@${R} || exit 1
94${kadmin} modify --attributes=+allow-digest digestserver@${R} || exit 1
95
96${kadmin} add -p u1 --use-defaults user1@${R} || exit 1
97
98echo "Doing database check"
99${kadmin} check ${R} || exit 1
100
101echo u1 > ${objdir}/foopassword
102echo ds > ${objdir}/barpassword
103
104echo Starting kdc
105${kdc} &
106kdcpid=$!
107
108sh ${srcdir}/../kdc/wait-kdc.sh
109if [ "$?" != 0 ] ; then
110    kill ${kdcpid}
111    exit 1
112fi
113
114trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
115
116exitcode=0
117
118echo "Getting client initial tickets"
119${kinit} --password-file=${objdir}/foopassword user1@${R} || exitcode=1
120echo "Getting digestserver initial tickets"
121${kinitds} --password-file=${objdir}/barpassword digestserver@${R} || exitcode=1
122
123echo "======context building for each mech"
124
125for mech in ntlm krb5 ; do 
126    echo "${mech}"
127    ${context} --mech-type=${mech} --ret-mech-type=${mech} \
128        --name-type=hostbased-service host@host.test.h5l.se || \
129	{ exitcode=1 ; echo test failed; }
130done
131
132echo "spnego"
133${context} \
134    --mech-type=spnego \
135    --ret-mech-type=krb5 \
136    --name-type=hostbased-service \
137    host@host.test.h5l.se || \
138    { exitcode=1 ; echo test failed; }
139
140echo "test failure cases"
141${context} --mech-type=ntlm --ret-mech-type=krb5 \
142    --name-type=hostbased-service host@host.test.h5l.se 2> /dev/null && \
143    { exitcode=1 ; echo test failed; }
144
145${context} --mech-type=krb5 --ret-mech-type=ntlm \
146    --name-type=hostbased-service host@host.test.h5l.se 2> /dev/null && \
147    { exitcode=1 ; echo test failed; }
148
149echo "======spnego variants context building"
150
151for arg in \
152     "" \
153     "--mutual" \
154     "--delegate" \
155     "--mutual --delegate" \
156     "--getverifymic --wrapunwrap" \
157     "--mutual --getverifymic --wrapunwrap" \
158    ; do
159
160    echo "no NTLM acceptor cred ${arg}"
161    NTLM_ACCEPTOR_CCACHE="${cacheds}-no"
162    ${context} --mech-type=spnego \
163        $arg \
164	--client-name=user1@TEST.H5L.SE \
165        --name-type=hostbased-service \
166        --ret-mech-type=krb5  \
167        host@host.test.h5l.se || \
168        { exitcode=1 ; echo test failed; }
169    NTLM_ACCEPTOR_CCACHE="${cacheds}"
170
171    echo "no NTLM initiator cred ${arg}"
172    NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt-no"
173    ${context} --mech-type=spnego \
174        $arg \
175	--client-name=user1@TEST.H5L.SE \
176        --name-type=hostbased-service \
177        --ret-mech-type=krb5 \
178        host@host.test.h5l.se || \
179        { exitcode=1 ; echo test failed; }
180    NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt"
181
182    echo "no krb5 acceptor cred ${arg}"
183    KRB5_KTNAME="${keytab}-no"
184    ${context} --mech-type=spnego \
185        $arg \
186	--client-name=user1@TEST.H5L.SE \
187	--server-no-delegate \
188        --name-type=hostbased-service \
189        --ret-mech-type=ntlm \
190        host@host.test.h5l.se || \
191        { exitcode=1 ; echo test failed; }
192    KRB5_KTNAME="${keytab}"
193
194    echo "no krb5 initiator cred ${arg}"
195    KRB5CCNAME="${cache}-no"
196    ${context} --mech-type=spnego \
197        $arg \
198	--client-name=user1@TEST.H5L.SE \
199	--server-no-delegate \
200        --name-type=hostbased-service \
201        --ret-mech-type=ntlm \
202        host@host.test.h5l.se || \
203        { exitcode=1 ; echo test failed; }
204    KRB5CCNAME="${cache}"
205
206done
207
208trap "" EXIT
209
210echo "killing kdc (${kdcpid})"
211kill ${kdcpid} 2> /dev/null
212
213exit $exitcode
214
215
216