You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
130 lines
5.2 KiB
130 lines
5.2 KiB
From d59b00fd1fdcc473739f3033c0f67eb402f20d9c Mon Sep 17 00:00:00 2001 |
|
From: Greg Hudson <ghudson@mit.edu> |
|
Date: Sat, 19 Aug 2017 19:09:24 -0400 |
|
Subject: [PATCH] Fix bugs in kdcpolicy commit |
|
|
|
Commit d0969f6a8170344031ef58fd2a161190f1edfb96 added tests using |
|
"klist ccachname -e", which does not work with a POSIX-conformant |
|
getopt() implementation such as the one in Solaris. Fix |
|
t_kdcpolicy.py to use "klist -e ccachename" instead. |
|
|
|
The tests could fail if the clock second rolled over between kinit and |
|
kvno. Divide service ticket maximum lifetimes by 2 in the test module |
|
to correctly exercise TGS policy restrictions and ensure that service |
|
tickets are not constrained by the TGT end time. |
|
|
|
Also use the correct trace macro when a kdcpolicy module declines to |
|
initialize (my mistake when revising the commit, noted by rharwood). |
|
|
|
ticket: 8606 |
|
(cherry picked from commit 09acbd91efc6df54e1572285ffc94c6acb3a9113) |
|
--- |
|
src/kdc/policy.c | 2 +- |
|
src/plugins/kdcpolicy/test/main.c | 10 +++++----- |
|
src/tests/t_kdcpolicy.py | 13 +++++++++---- |
|
3 files changed, 15 insertions(+), 10 deletions(-) |
|
|
|
diff --git a/src/kdc/policy.c b/src/kdc/policy.c |
|
index e49644e06..26c16f97c 100644 |
|
--- a/src/kdc/policy.c |
|
+++ b/src/kdc/policy.c |
|
@@ -222,7 +222,7 @@ load_kdcpolicy_plugins(krb5_context context) |
|
if (h->vt.init != NULL) { |
|
ret = h->vt.init(context, &h->moddata); |
|
if (ret == KRB5_PLUGIN_NO_HANDLE) { |
|
- TRACE_KADM5_AUTH_INIT_SKIP(context, h->vt.name); |
|
+ TRACE_KDCPOLICY_INIT_SKIP(context, h->vt.name); |
|
free(h); |
|
continue; |
|
} |
|
diff --git a/src/plugins/kdcpolicy/test/main.c b/src/plugins/kdcpolicy/test/main.c |
|
index eb8fde053..86c808958 100644 |
|
--- a/src/plugins/kdcpolicy/test/main.c |
|
+++ b/src/plugins/kdcpolicy/test/main.c |
|
@@ -35,7 +35,7 @@ |
|
#include <krb5/kdcpolicy_plugin.h> |
|
|
|
static krb5_error_code |
|
-output_from_indicator(const char *const *auth_indicators, |
|
+output_from_indicator(const char *const *auth_indicators, int divisor, |
|
krb5_deltat *lifetime_out, |
|
krb5_deltat *renew_lifetime_out, |
|
const char **status) |
|
@@ -46,11 +46,11 @@ output_from_indicator(const char *const *auth_indicators, |
|
} |
|
|
|
if (strcmp(auth_indicators[0], "ONE_HOUR") == 0) { |
|
- *lifetime_out = 3600; |
|
+ *lifetime_out = 3600 / divisor; |
|
*renew_lifetime_out = *lifetime_out * 2; |
|
return 0; |
|
} else if (strcmp(auth_indicators[0], "SEVEN_HOURS") == 0) { |
|
- *lifetime_out = 7 * 3600; |
|
+ *lifetime_out = 7 * 3600 / divisor; |
|
*renew_lifetime_out = *lifetime_out * 2; |
|
return 0; |
|
} |
|
@@ -71,7 +71,7 @@ test_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata, |
|
*status = "LOCAL_POLICY"; |
|
return KRB5KDC_ERR_POLICY; |
|
} |
|
- return output_from_indicator(auth_indicators, lifetime_out, |
|
+ return output_from_indicator(auth_indicators, 1, lifetime_out, |
|
renew_lifetime_out, status); |
|
} |
|
|
|
@@ -87,7 +87,7 @@ test_check_tgs(krb5_context context, krb5_kdcpolicy_moddata moddata, |
|
*status = "LOCAL_POLICY"; |
|
return KRB5KDC_ERR_POLICY; |
|
} |
|
- return output_from_indicator(auth_indicators, lifetime_out, |
|
+ return output_from_indicator(auth_indicators, 2, lifetime_out, |
|
renew_lifetime_out, status); |
|
} |
|
|
|
diff --git a/src/tests/t_kdcpolicy.py b/src/tests/t_kdcpolicy.py |
|
index 6a745b959..b5d308461 100644 |
|
--- a/src/tests/t_kdcpolicy.py |
|
+++ b/src/tests/t_kdcpolicy.py |
|
@@ -18,16 +18,21 @@ realm.run([kadminl, 'addprinc', '-pw', password('fail'), 'fail']) |
|
def verify_time(out, target_time): |
|
times = re.findall(r'\d\d/\d\d/\d\d \d\d:\d\d:\d\d', out) |
|
times = [datetime.strptime(t, '%m/%d/%y %H:%M:%S') for t in times] |
|
+ divisor = 1 |
|
while len(times) > 0: |
|
starttime = times.pop(0) |
|
endtime = times.pop(0) |
|
renewtime = times.pop(0) |
|
|
|
- if str(endtime - starttime) != target_time: |
|
+ if str((endtime - starttime) * divisor) != target_time: |
|
fail('unexpected lifetime value') |
|
- if str(renewtime - endtime) != target_time: |
|
+ if str((renewtime - endtime) * divisor) != target_time: |
|
fail('unexpected renewable value') |
|
|
|
+ # Service tickets should have half the lifetime of initial |
|
+ # tickets. |
|
+ divisor = 2 |
|
+ |
|
rflags = ['-r', '1d', '-l', '12h'] |
|
|
|
# Test AS+TGS success path. |
|
@@ -35,7 +40,7 @@ realm.kinit(realm.user_princ, password('user'), |
|
rflags + ['-X', 'indicators=SEVEN_HOURS']) |
|
realm.run([kvno, realm.host_princ]) |
|
realm.run(['./adata', realm.host_princ], expected_msg='+97: [SEVEN_HOURS]') |
|
-out = realm.run([klist, realm.ccache, '-e']) |
|
+out = realm.run([klist, '-e', realm.ccache]) |
|
verify_time(out, '7:00:00') |
|
|
|
# Test AS+TGS success path with different values. |
|
@@ -43,7 +48,7 @@ realm.kinit(realm.user_princ, password('user'), |
|
rflags + ['-X', 'indicators=ONE_HOUR']) |
|
realm.run([kvno, realm.host_princ]) |
|
realm.run(['./adata', realm.host_princ], expected_msg='+97: [ONE_HOUR]') |
|
-out = realm.run([klist, realm.ccache, '-e']) |
|
+out = realm.run([klist, '-e', realm.ccache]) |
|
verify_time(out, '1:00:00') |
|
|
|
# Test TGS failure path (using previous creds).
|
|
|