|
 |
7d335d |
commit 6f8d5135334c9ddb674f9824e750872b3b0642ea
|
|
|
7d335d |
Author: Greg Hudson <ghudson@mit.edu>
|
|
|
7d335d |
Date: Thu Jan 16 11:49:55 2014 -0500
|
|
|
7d335d |
|
|
|
7d335d |
Add test for gss_acquire_cred_from rcache feature
|
|
|
7d335d |
|
|
|
7d335d |
diff --git a/src/tests/gssapi/t_credstore.c b/src/tests/gssapi/t_credstore.c
|
|
|
7d335d |
index 575f96d..e28f5d0 100644
|
|
|
7d335d |
--- a/src/tests/gssapi/t_credstore.c
|
|
|
7d335d |
+++ b/src/tests/gssapi/t_credstore.c
|
|
|
7d335d |
@@ -46,7 +46,9 @@ main(int argc, char *argv[])
|
|
|
7d335d |
gss_cred_usage_t cred_usage = GSS_C_BOTH;
|
|
|
7d335d |
gss_OID_set mechs = GSS_C_NO_OID_SET;
|
|
|
7d335d |
gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
|
|
|
7d335d |
- krb5_boolean store_creds = FALSE;
|
|
|
7d335d |
+ gss_ctx_id_t ictx = GSS_C_NO_CONTEXT, actx = GSS_C_NO_CONTEXT;
|
|
|
7d335d |
+ gss_buffer_desc itok, atok;
|
|
|
7d335d |
+ krb5_boolean store_creds = FALSE, replay = FALSE;
|
|
|
7d335d |
char opt;
|
|
|
7d335d |
|
|
|
7d335d |
/* Parse options. */
|
|
|
7d335d |
@@ -54,6 +56,8 @@ main(int argc, char *argv[])
|
|
|
7d335d |
opt = (*argv)[1];
|
|
|
7d335d |
if (opt == 's')
|
|
|
7d335d |
store_creds = TRUE;
|
|
|
7d335d |
+ else if (opt == 'r')
|
|
|
7d335d |
+ replay = TRUE;
|
|
|
7d335d |
else if (opt == 'a')
|
|
|
7d335d |
cred_usage = GSS_C_ACCEPT;
|
|
|
7d335d |
else if (opt == 'b')
|
|
|
7d335d |
@@ -101,6 +105,31 @@ main(int argc, char *argv[])
|
|
|
7d335d |
&store, &cred, NULL, NULL);
|
|
|
7d335d |
check_gsserr("gss_acquire_cred_from", major, minor);
|
|
|
7d335d |
|
|
|
7d335d |
+ if (replay) {
|
|
|
7d335d |
+ /* Induce a replay using cred as the acceptor cred, to test the replay
|
|
|
7d335d |
+ * cache indicated by the store. */
|
|
|
7d335d |
+ major = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL, &ictx, name,
|
|
|
7d335d |
+ &mech_krb5, 0, GSS_C_INDEFINITE,
|
|
|
7d335d |
+ GSS_C_NO_CHANNEL_BINDINGS,
|
|
|
7d335d |
+ GSS_C_NO_BUFFER, NULL, &itok, NULL, NULL);
|
|
|
7d335d |
+ check_gsserr("gss_init_sec_context", major, minor);
|
|
|
7d335d |
+ (void)gss_delete_sec_context(&minor, &ictx, NULL);
|
|
|
7d335d |
+
|
|
|
7d335d |
+ major = gss_accept_sec_context(&minor, &actx, cred, &itok,
|
|
|
7d335d |
+ GSS_C_NO_CHANNEL_BINDINGS, NULL, NULL,
|
|
|
7d335d |
+ &atok, NULL, NULL, NULL);
|
|
|
7d335d |
+ check_gsserr("gss_accept_sec_context(1)", major, minor);
|
|
|
7d335d |
+ (void)gss_release_buffer(&minor, &atok);
|
|
|
7d335d |
+ (void)gss_delete_sec_context(&minor, &actx, NULL);
|
|
|
7d335d |
+
|
|
|
7d335d |
+ major = gss_accept_sec_context(&minor, &actx, cred, &itok,
|
|
|
7d335d |
+ GSS_C_NO_CHANNEL_BINDINGS, NULL, NULL,
|
|
|
7d335d |
+ &atok, NULL, NULL, NULL);
|
|
|
7d335d |
+ check_gsserr("gss_accept_sec_context(2)", major, minor);
|
|
|
7d335d |
+ (void)gss_release_buffer(&minor, &atok);
|
|
|
7d335d |
+ (void)gss_delete_sec_context(&minor, &actx, NULL);
|
|
|
7d335d |
+ }
|
|
|
7d335d |
+
|
|
|
7d335d |
gss_release_name(&minor, &name);
|
|
|
7d335d |
gss_release_cred(&minor, &cred);
|
|
|
7d335d |
free(store.elements);
|
|
|
7d335d |
diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py
|
|
|
7d335d |
index 74139e4..106910d 100755
|
|
|
7d335d |
--- a/src/tests/gssapi/t_gssapi.py
|
|
|
7d335d |
+++ b/src/tests/gssapi/t_gssapi.py
|
|
|
4be148 |
@@ -91,6 +91,15 @@ realm.kinit(service_cs, None, ['-k', '-t', servicekeytab])
|
|
|
4be148 |
realm.run(['./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache,
|
|
|
4be148 |
'keytab', servicekeytab])
|
|
|
7d335d |
|
|
|
7d335d |
+# Test rcache feature of cred stores. t_credstore -r should produce a
|
|
|
7d335d |
+# replay error normally, but not with rcache set to "none:".
|
|
|
4be148 |
+output = realm.run(['./t_credstore', '-r', '-a', 'p:' + realm.host_princ],
|
|
|
4be148 |
+ expected_code=1)
|
|
|
7d335d |
+if 'gss_accept_sec_context(2): Request is a replay' not in output:
|
|
|
7d335d |
+ fail('Expected replay error not seen in t_credstore output')
|
|
|
4be148 |
+realm.run(['./t_credstore', '-r', '-a', 'p:' + realm.host_princ,
|
|
|
4be148 |
+ 'rcache', 'none:'])
|
|
|
7d335d |
+
|
|
|
7d335d |
# Verify that we can't acquire acceptor creds without a keytab.
|
|
|
7d335d |
os.remove(realm.keytab)
|
|
|
4be148 |
output = realm.run(['./t_accname', 'p:abc'], expected_code=1)
|