1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
#!/usr/bin/python
# Copyright (C) 2010 by the Massachusetts Institute of Technology.
# All rights reserved.
#
# Export of this software from the United States of America may
# require a specific license from the United States Government.
# It is the responsibility of any person or organization contemplating
# export to obtain such a license before exporting.
#
# WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
# distribute this software and its documentation for any purpose and
# without fee is hereby granted, provided that the above copyright
# notice appear in all copies and that both that copyright notice and
# this permission notice appear in supporting documentation, and that
# the name of M.I.T. not be used in advertising or publicity pertaining
# to distribution of the software without specific, written prior
# permission. Furthermore if you modify this software you must label
# your software as modified software and not distribute it in such a
# fashion that it might be confused with the original M.I.T. software.
# M.I.T. makes no representations about the suitability of
# this software for any purpose. It is provided "as is" without express
# or implied warranty.
from k5test import *
appdir = os.path.join(buildtop, 'appl', 'gss-sample')
gss_client = os.path.join(appdir, 'gss-client')
gss_server = os.path.join(appdir, 'gss-server')
# Run a gss-server process and a gss-client process, with additional
# gss-client flags given by options and additional gss-server flags
# given by server_options. Return the output of gss-client.
def run_client_server(realm, options, server_options, **kwargs):
portstr = str(realm.server_port())
server_args = [gss_server, '-export', '-port', portstr]
server_args += server_options + ['host']
server = realm.start_server(server_args, 'starting...')
realm.run([gss_client, '-port', portstr] + options +
[hostname, 'host', 'testmsg'], **kwargs)
stop_daemon(server)
# Run a gss-server and gss-client process, and verify that gss-client
# displayed the expected output for a successful negotiation.
def server_client_test(realm, options, server_options):
run_client_server(realm, options, server_options,
expected_msg='Signature verified.')
# Make up a filename to hold user's initial credentials.
def ccache_savefile(realm):
return os.path.join(realm.testdir, 'ccache.copy')
# Move user's initial credentials into the save file.
def ccache_save(realm):
os.rename(realm.ccache, ccache_savefile(realm))
# Copy user's initial credentials from the save file into the ccache.
def ccache_restore(realm):
shutil.copyfile(ccache_savefile(realm), realm.ccache)
# Perform a regular (TGS path) test of the server and client.
def tgs_test(realm, options, server_options=[]):
ccache_restore(realm)
server_client_test(realm, options, server_options)
realm.klist(realm.user_princ, realm.host_princ)
# Perform a test of the server and client with initial credentials
# obtained through gss_acquire_cred_with_password().
def pw_test(realm, options, server_options=[]):
if os.path.exists(realm.ccache):
os.remove(realm.ccache)
options = options + ['-user', realm.user_princ, '-pass', password('user')]
server_client_test(realm, options, server_options)
if os.path.exists(realm.ccache):
fail('gss_acquire_cred_with_password created ccache')
# Perform a test using the wrong password, and make sure that failure
# occurs during the expected operation (gss_init_sec_context() for
# IAKERB, gss_aqcuire_cred_with_password() otherwise).
def wrong_pw_test(realm, options, server_options=[], iakerb=False):
options = options + ['-user', realm.user_princ, '-pass', 'wrongpw']
failed_op = 'initializing context' if iakerb else 'acquiring creds'
msg = 'GSS-API error ' + failed_op
run_client_server(realm, options, server_options, expected_code=1,
expected_msg=msg)
# Perform a test of the server and client with initial credentials
# obtained with the client keytab
def kt_test(realm, options, server_options=[]):
if os.path.exists(realm.ccache):
os.remove(realm.ccache)
server_client_test(realm, options, server_options)
realm.klist(realm.user_princ, realm.host_princ)
for realm in multipass_realms():
ccache_save(realm)
tgs_test(realm, ['-krb5'])
tgs_test(realm, ['-spnego'])
tgs_test(realm, ['-iakerb'], ['-iakerb'])
# test default (i.e., krb5) mechanism with GSS_C_DCE_STYLE
tgs_test(realm, ['-dce'])
pw_test(realm, ['-krb5'])
pw_test(realm, ['-spnego'])
pw_test(realm, ['-iakerb'], ['-iakerb'])
pw_test(realm, ['-dce'])
wrong_pw_test(realm, ['-krb5'])
wrong_pw_test(realm, ['-spnego'])
wrong_pw_test(realm, ['-iakerb'], ['-iakerb'], True)
wrong_pw_test(realm, ['-dce'])
realm.extract_keytab(realm.user_princ, realm.client_keytab)
kt_test(realm, ['-krb5'])
kt_test(realm, ['-spnego'])
kt_test(realm, ['-iakerb'], ['-iakerb'])
kt_test(realm, ['-dce'])
success('GSS sample application')
|
