source4/torture/krb5/kdc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Validate the krb5 pac generation routines
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2015
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "torture/smbtorture.h"
  26 #include "torture/winbind/proto.h"
  27 #include "auth/credentials/credentials.h"
  28 #include "lib/cmdline/popt_common.h"
  29 #include "source4/auth/kerberos/kerberos.h"
  30 #include "source4/auth/kerberos/kerberos_util.h"
  31 #include "lib/util/util_net.h"
  32
  33 static bool torture_krb5_init_context(struct torture_context *tctx,
  34                                       struct smb_krb5_context **smb_krb5_context)
  35 {
  36         const char *host = torture_setting_string(tctx, "host", NULL);
  37         krb5_error_code k5ret;
  38         bool ok;
  39         struct addrinfo *server;
  40
  41         k5ret = smb_krb5_init_context(tctx, tctx->lp_ctx, smb_krb5_context);
  42         torture_assert_int_equal(tctx, k5ret, 0, "smb_krb5_init_context failed");
  43
  44         ok = interpret_string_addr_internal(&server, host, AI_NUMERICHOST);
  45         torture_assert(tctx, ok, "Failed to parse target server");
  46
  47         set_sockaddr_port(server->ai_addr, 88);
  48
  49         k5ret = krb5_set_send_to_kdc_func((*smb_krb5_context)->krb5_context,
  50                                           smb_krb5_send_and_recv_func_forced,
  51                                           server);
  52         torture_assert_int_equal(tctx, k5ret, 0, "krb5_set_send_to_kdc_func failed");
  53         return true;
  54 }
  55
  56 static bool torture_krb5_as_req_1(struct torture_context *tctx)
  57 {
  58         krb5_error_code k5ret;
  59         bool ok;
  60         krb5_creds my_creds;
  61         krb5_principal principal;
  62         struct smb_krb5_context *smb_krb5_context;
  63         enum credentials_obtained obtained;
  64         const char *error_string;
  65         const char *password = cli_credentials_get_password(cmdline_credentials);
  66
  67         ok = torture_krb5_init_context(tctx, &smb_krb5_context);
  68         torture_assert(tctx, ok, "torture_krb5_init_context failed");
  69
  70         k5ret = principal_from_credentials(tctx, cmdline_credentials, smb_krb5_context, &principal, &obtained,  &error_string);
  71         torture_assert_int_equal(tctx, k5ret, 0, error_string);
  72
  73         k5ret = krb5_get_init_creds_password(smb_krb5_context->krb5_context, &my_creds, principal,
  74                                              password, NULL, NULL, 0,
  75                                              NULL, NULL);
  76         torture_assert_int_equal(tctx, k5ret, 0, "krb5_get_init_creds_password failed");
  77
  78         torture_assert_int_equal(tctx,
  79                                  krb5_principal_get_type(smb_krb5_context->krb5_context,
  80                                                          my_creds.client), KRB5_NT_PRINCIPAL,
  81                                  "smb_krb5_init_context gave incorrect client->name.name_type");
  82
  83         torture_assert(tctx, krb5_principal_compare(smb_krb5_context->krb5_context,
  84                                                     principal, my_creds.client),
  85                        "krb5_get_init_creds_password returned a different principal");
  86
  87         torture_assert_int_equal(tctx,
  88                                  krb5_principal_get_type(smb_krb5_context->krb5_context,
  89                                                          my_creds.server), KRB5_NT_SRV_INST,
  90                                  "smb_krb5_init_context gave incorrect client->name.name_type");
  91
  92         torture_assert_str_equal(tctx, krb5_principal_get_comp_string(smb_krb5_context->krb5_context,
  93                                                                       my_creds.server, 0),
  94                                  "krbtgt",
  95                                  "smb_krb5_init_context gave incorrect my_creds.server->name.name_string[0]");
  96
  97         k5ret = krb5_free_cred_contents(smb_krb5_context->krb5_context, &my_creds);
  98         torture_assert_int_equal(tctx, k5ret, 0, "krb5_free_creds failed");
  99
 100         return true;
 101 }
 102
 103 NTSTATUS torture_krb5_init(void);
 104 NTSTATUS torture_krb5_init(void)
 105 {
 106         struct torture_suite *suite = torture_suite_create(talloc_autofree_context(), "krb5");
 107         struct torture_suite *kdc_suite = torture_suite_create(suite, "kdc");
 108         suite->description = talloc_strdup(suite, "Kerberos tests");
 109         kdc_suite->description = talloc_strdup(kdc_suite, "Kerberos KDC tests");
 110
 111         torture_suite_add_simple_test(kdc_suite, "as-req-1",
 112                                       torture_krb5_as_req_1);
 113
 114         torture_suite_add_suite(suite, kdc_suite);
 115
 116         torture_register_suite(suite);
 117         return NT_STATUS_OK;
 118 }