From 56cee506e7918e93bfe86bf2b7f960ab05cff0df Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 23 Nov 2022 18:27:49 +0100 Subject: [PATCH] New upstream version (1.20.1) Also set "supportedCMSTypes" to SHA-512/256 with RSA encryption Resolves: rhbz#2124463 Resolves: rhbz#2114766 Signed-off-by: Julien Rische --- .gitignore | 95 +- ... 0001-downstream-ksu-pam-integration.patch | 21 +- ... 0002-downstream-SELinux-integration.patch | 100 +- ...ownstream-fix-debuginfo-with-y.tab.c.patch | 9 +- ... 0004-downstream-Remove-3des-support.patch | 1015 +- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 84 +- ...-krad-UDP-TCP-localhost-connection-w.patch | 11 +- ...-variable-for-default-PKCS-11-module.patch | 30 +- ...asonable-supportedCMSTypes-in-PKINIT.patch | 159 + 0009-Simplify-plugin-loading-code.patch | 622 + Add-APIs-for-marshalling-credentials.patch | 220 - ...P_GET_CRED_LIST-for-faster-iteration.patch | 358 - ...detection-of-the-OpenSSL-3-KDF-inter.patch | 25 - ...canonicalization-helper-to-k5test.py.patch | 84 - ...ith-keytab-to-defer-canonicalization.patch | 60 - ...context-after-failed-open-in-libkdb5.patch | 35 - ...up-gssapi_krb5-ccache-name-functions.patch | 193 - ...CM-flag-transmission-for-remove_cred.patch | 103 - Fix-KCM-retrieval-support-for-sssd.patch | 62 - ...-deref-on-TGS-inner-body-null-server.patch | 45 - Fix-integer-overflows-in-PAC-parsing.patch | 106 - Fix-k5tls-module-for-OpenSSL-3.patch | 58 - ...in-k-with-fallback-or-referral-realm.patch | 64 - ...aks-on-error-in-kadm5-init-functions.patch | 664 - ...pkcs11-build-issues-with-openssl-3.0.patch | 552 - ...incipal-realm-canonicalization-cases.patch | 96 - Handle-OpenSSL-3-s-providers.patch | 301 - ...teration-fallback-work-with-sssd-kcm.patch | 26 - ...dejagnu-kadmin-tests-to-Python-tests.patch | 1750 -- ...GSS-configuration-files-with-mtime-0.patch | 71 - Remove-TCL-based-libkadm5-API-tests.patch | 18229 ---------------- ...ecated-OpenSSL-calls-from-softpkcs11.patch | 150 - Support-host-based-GSS-initiator-names.patch | 578 - ...-avoid-password-change-replay-errors.patch | 91 - Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 235 - ...KDF-and-KRB5KDF-for-deriving-long-te.patch | 482 - ...SSL-s-SSKDF-in-PKINIT-when-available.patch | 408 - ...nstead-of-SHA1-for-PKINIT-CMS-digest.patch | 113 - Use-asan-in-one-of-the-CI-builds.patch | 22 - ...ackported-version-of-OpenSSL-3-KDF-i.patch | 752 - krb5-krad-larger-attrs.patch | 69 - krb5-krad-remote.patch | 209 - krb5.spec | 127 +- sources | 4 +- 44 files changed, 1453 insertions(+), 27035 deletions(-) rename downstream-ksu-pam-integration.patch => 0001-downstream-ksu-pam-integration.patch (98%) rename downstream-SELinux-integration.patch => 0002-downstream-SELinux-integration.patch (94%) rename downstream-fix-debuginfo-with-y.tab.c.patch => 0003-downstream-fix-debuginfo-with-y.tab.c.patch (90%) rename downstream-Remove-3des-support.patch => 0004-downstream-Remove-3des-support.patch (92%) rename downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch => 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch (91%) rename downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch => 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch (90%) rename Add-configure-variable-for-default-PKCS-11-module.patch => 0007-Add-configure-variable-for-default-PKCS-11-module.patch (93%) create mode 100644 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch create mode 100644 0009-Simplify-plugin-loading-code.patch delete mode 100644 Add-APIs-for-marshalling-credentials.patch delete mode 100644 Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch delete mode 100644 Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch delete mode 100644 Add-hostname-canonicalization-helper-to-k5test.py.patch delete mode 100644 Allow-kinit-with-keytab-to-defer-canonicalization.patch delete mode 100644 Clean-up-context-after-failed-open-in-libkdb5.patch delete mode 100644 Clean-up-gssapi_krb5-ccache-name-functions.patch delete mode 100644 Fix-KCM-flag-transmission-for-remove_cred.patch delete mode 100644 Fix-KCM-retrieval-support-for-sssd.patch delete mode 100644 Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch delete mode 100644 Fix-integer-overflows-in-PAC-parsing.patch delete mode 100644 Fix-k5tls-module-for-OpenSSL-3.patch delete mode 100644 Fix-kadmin-k-with-fallback-or-referral-realm.patch delete mode 100644 Fix-leaks-on-error-in-kadm5-init-functions.patch delete mode 100644 Fix-softpkcs11-build-issues-with-openssl-3.0.patch delete mode 100644 Fix-some-principal-realm-canonicalization-cases.patch delete mode 100644 Handle-OpenSSL-3-s-providers.patch delete mode 100644 Make-KCM-iteration-fallback-work-with-sssd-kcm.patch delete mode 100644 Move-some-dejagnu-kadmin-tests-to-Python-tests.patch delete mode 100644 Read-GSS-configuration-files-with-mtime-0.patch delete mode 100644 Remove-TCL-based-libkadm5-API-tests.patch delete mode 100644 Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch delete mode 100644 Support-host-based-GSS-initiator-names.patch delete mode 100644 Try-harder-to-avoid-password-change-replay-errors.patch delete mode 100644 Use-KCM_OP_RETRIEVE-in-KCM-client.patch delete mode 100644 Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch delete mode 100644 Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch delete mode 100644 Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch delete mode 100644 Use-asan-in-one-of-the-CI-builds.patch delete mode 100644 downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch delete mode 100644 krb5-krad-larger-attrs.patch delete mode 100644 krb5-krad-remote.patch diff --git a/.gitignore b/.gitignore index c3c3cb9..7fa0027 100644 --- a/.gitignore +++ b/.gitignore @@ -1,49 +1,50 @@ -krb5-1.3.4.tar.gz -krb5-1.3.5.tar.gz -krb5-1.3.5.tar.gz.asc -krb5-1.3.6.tar.gz -krb5-1.3.6.tar.gz.asc -krb5-1.4.tar.gz -krb5-1.4.tar.gz.asc -krb5-1.4.1.tar.gz -krb5-1.4.1.tar.gz.asc -krb5-1.4.2.tar.gz -krb5-1.4.2.tar.gz.asc -krb5-1.4.3.tar.gz -krb5-1.4.3.tar.gz.asc -krb5-1.5.tar.gz -krb5-1.5.tar.gz.asc -krb5-1.6.tar.gz -krb5-1.6.tar.gz.asc -krb5-1.6-pdf.tar.gz -krb5-1.6.1.tar.gz -krb5-1.6.1.tar.gz.asc -krb5-1.6.1-pdf.tar.gz -krb5-1.6.2.tar.gz -krb5-1.6.2.tar.gz.asc -krb5-1.6.2-pdf.tar.gz -krb5-1.6.3.tar.gz -krb5-1.6.3.tar.gz.asc -krb5-1.6.3-pdf.tar.gz -krb5-1.7.tar.gz -krb5-1.7.tar.gz.asc -krb5-1.7-pdf.tar.gz -krb5-1.7.1.tar.gz -krb5-1.7.1.tar.gz.asc -krb5-1.7.1-pdf.tar.gz -krb5-1.8.tar.gz -krb5-1.8.tar.gz.asc -krb5-appl-1.0.tar.gz -krb5-appl-1.0.tar.gz.asc -krb5-1.8-pdf.tar.gz -krb5-1.8.1.tar.gz -krb5-1.8.1.tar.gz.asc -krb5-1.8.1-pdf.tar.gz -krb5-1.8.2.tar.gz.asc -krb5-1.8.2-pdf.tar.gz -krb5-1.8.3.tar.gz -krb5-1.8.3.tar.gz.asc -krb5-1.8.3-pdf.tar.gz +/results_krb5 +/krb5-1.3.4.tar.gz +/krb5-1.3.5.tar.gz +/krb5-1.3.5.tar.gz.asc +/krb5-1.3.6.tar.gz +/krb5-1.3.6.tar.gz.asc +/krb5-1.4.tar.gz +/krb5-1.4.tar.gz.asc +/krb5-1.4.1.tar.gz +/krb5-1.4.1.tar.gz.asc +/krb5-1.4.2.tar.gz +/krb5-1.4.2.tar.gz.asc +/krb5-1.4.3.tar.gz +/krb5-1.4.3.tar.gz.asc +/krb5-1.5.tar.gz +/krb5-1.5.tar.gz.asc +/krb5-1.6.tar.gz +/krb5-1.6.tar.gz.asc +/krb5-1.6-pdf.tar.gz +/krb5-1.6.1.tar.gz +/krb5-1.6.1.tar.gz.asc +/krb5-1.6.1-pdf.tar.gz +/krb5-1.6.2.tar.gz +/krb5-1.6.2.tar.gz.asc +/krb5-1.6.2-pdf.tar.gz +/krb5-1.6.3.tar.gz +/krb5-1.6.3.tar.gz.asc +/krb5-1.6.3-pdf.tar.gz +/krb5-1.7.tar.gz +/krb5-1.7.tar.gz.asc +/krb5-1.7-pdf.tar.gz +/krb5-1.7.1.tar.gz +/krb5-1.7.1.tar.gz.asc +/krb5-1.7.1-pdf.tar.gz +/krb5-1.8.tar.gz +/krb5-1.8.tar.gz.asc +/krb5-appl-1.0.tar.gz +/krb5-appl-1.0.tar.gz.asc +/krb5-1.8-pdf.tar.gz +/krb5-1.8.1.tar.gz +/krb5-1.8.1.tar.gz.asc +/krb5-1.8.1-pdf.tar.gz +/krb5-1.8.2.tar.gz.asc +/krb5-1.8.2-pdf.tar.gz +/krb5-1.8.3.tar.gz +/krb5-1.8.3.tar.gz.asc +/krb5-1.8.3-pdf.tar.gz /krb5-1.9-beta2.tar.gz /krb5-1.9-beta2.tar.gz.asc /krb5-1.9-beta2-pdf.tar.bz2 @@ -199,3 +200,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.19.1.tar.gz.asc /krb5-1.19.2.tar.gz /krb5-1.19.2.tar.gz.asc +/krb5-1.20.1.tar.gz +/krb5-1.20.1.tar.gz.asc diff --git a/downstream-ksu-pam-integration.patch b/0001-downstream-ksu-pam-integration.patch similarity index 98% rename from downstream-ksu-pam-integration.patch rename to 0001-downstream-ksu-pam-integration.patch index bebe946..2b737c0 100644 --- a/downstream-ksu-pam-integration.patch +++ b/0001-downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 659b3b4a654b879ce84ad8fb4621dde5ae693385 Mon Sep 17 00:00:00 2001 +From 37d69135d0be7f46732c401cdbb3abc075bf4117 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -30,10 +30,10 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/clients/ksu/pam.h diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 024d6370c..ca9fcf664 100644 +index 9920476f91..bf9da35bbc 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then +@@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then OPENLDAP_PLUGIN=yes fi ])dnl @@ -107,7 +107,7 @@ index 024d6370c..ca9fcf664 100644 +])dnl + diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in -index 8b4edce4d..9d58f29b5 100644 +index 8b4edce4d8..9d58f29b5d 100644 --- a/src/clients/ksu/Makefile.in +++ b/src/clients/ksu/Makefile.in @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S).. @@ -145,7 +145,7 @@ index 8b4edce4d..9d58f29b5 100644 clean: $(RM) ksu diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index af1286172..931f05404 100644 +index af12861729..931f054041 100644 --- a/src/clients/ksu/main.c +++ b/src/clients/ksu/main.c @@ -26,6 +26,7 @@ @@ -303,7 +303,7 @@ index af1286172..931f05404 100644 } diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c new file mode 100644 -index 000000000..cbfe48704 +index 0000000000..cbfe487047 --- /dev/null +++ b/src/clients/ksu/pam.c @@ -0,0 +1,389 @@ @@ -698,7 +698,7 @@ index 000000000..cbfe48704 +#endif diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h new file mode 100644 -index 000000000..0ab76569c +index 0000000000..0ab76569cb --- /dev/null +++ b/src/clients/ksu/pam.h @@ -0,0 +1,57 @@ @@ -760,10 +760,10 @@ index 000000000..0ab76569c +void appl_pam_cleanup(void); +#endif diff --git a/src/configure.ac b/src/configure.ac -index 4eb080784..693f76a81 100644 +index f03028b5fd..aa970b0447 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1389,6 +1389,8 @@ AC_SUBST([VERTO_VERSION]) +@@ -1400,6 +1400,8 @@ AC_SUBST([VERTO_VERSION]) AC_PATH_PROG(GROFF, groff) @@ -772,3 +772,6 @@ index 4eb080784..693f76a81 100644 # Make localedir work in autoconf 2.5x. if test "${localedir+set}" != set; then localedir='$(datadir)/locale' +-- +2.38.1 + diff --git a/downstream-SELinux-integration.patch b/0002-downstream-SELinux-integration.patch similarity index 94% rename from downstream-SELinux-integration.patch rename to 0002-downstream-SELinux-integration.patch index 48b058b..4271d66 100644 --- a/downstream-SELinux-integration.patch +++ b/0002-downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 97966ffaac6bf9f2e09ac33a16b15794b31d51de Mon Sep 17 00:00:00 2001 +From c6b58ed180ed91b579d322ff5004f68750f1eb4f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -36,7 +36,9 @@ The selabel APIs for looking up the context should be thread-safe (per Red Hat #273081), so switching to using them instead of matchpathcon(), which we used earlier, is some improvement. -Last-updated: krb5-1.18-beta1 +Last-updated: krb5-1.20.1 +[jrische@redhat.com: Replace deprecated security_context_t by char *: + - src/util/support/selinux.c] --- src/aclocal.m4 | 48 +++ src/build-tools/krb5-config.in | 3 +- @@ -61,13 +63,13 @@ Last-updated: krb5-1.18-beta1 .../kdb/ldap/ldap_util/kdb5_ldap_services.c | 11 +- src/util/profile/prof_file.c | 3 +- src/util/support/Makefile.in | 3 +- - src/util/support/selinux.c | 406 ++++++++++++++++++ - 24 files changed, 573 insertions(+), 21 deletions(-) + src/util/support/selinux.c | 405 ++++++++++++++++++ + 24 files changed, 572 insertions(+), 21 deletions(-) create mode 100644 src/include/k5-label.h create mode 100644 src/util/support/selinux.c diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index ca9fcf664..5afb96e58 100644 +index bf9da35bbc..01283f482e 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag) @@ -78,7 +80,7 @@ index ca9fcf664..5afb96e58 100644 KRB5_LIB_PARAMS KRB5_AC_INITFINI KRB5_AC_ENABLE_THREADS -@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS) +@@ -1526,4 +1527,51 @@ AC_SUBST(PAM_LIBS) AC_SUBST(PAM_MAN) AC_SUBST(NON_PAM_MAN) ])dnl @@ -131,7 +133,7 @@ index ca9fcf664..5afb96e58 100644 +AC_SUBST(SELINUX_LIBS) +])dnl diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index dead0dddc..fef3e054f 100755 +index dead0dddce..fef3e054fc 100755 --- a/src/build-tools/krb5-config.in +++ b/src/build-tools/krb5-config.in @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@' @@ -152,7 +154,7 @@ index dead0dddc..fef3e054f 100755 echo $lib_flags diff --git a/src/config/pre.in b/src/config/pre.in -index 3752174c7..0d2068575 100644 +index a0c60c70b3..7eaa2f351c 100644 --- a/src/config/pre.in +++ b/src/config/pre.in @@ -177,6 +177,7 @@ LD = $(PURE) @LD@ @@ -163,7 +165,7 @@ index 3752174c7..0d2068575 100644 INSTALL=@INSTALL@ INSTALL_STRIP= -@@ -403,7 +404,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) +@@ -379,7 +380,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) # HESIOD_LIBS is -lhesiod... HESIOD_LIBS = @HESIOD_LIBS@ @@ -173,10 +175,10 @@ index 3752174c7..0d2068575 100644 GSS_LIBS = $(GSS_KRB5_LIB) # needs fixing if ever used on macOS! diff --git a/src/configure.ac b/src/configure.ac -index 693f76a81..dd2cad3ee 100644 +index aa970b0447..40545f2bfc 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff) +@@ -1402,6 +1402,8 @@ AC_PATH_PROG(GROFF, groff) KRB5_WITH_PAM @@ -186,7 +188,7 @@ index 693f76a81..dd2cad3ee 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index cf524252f..efb523689 100644 +index 44dc1eeb3f..c3aecba7d4 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; @@ -199,7 +201,7 @@ index cf524252f..efb523689 100644 #define KRB5_KDB_MAX_RLIFE (60*60*24*7) /* one week */ diff --git a/src/include/k5-label.h b/src/include/k5-label.h new file mode 100644 -index 000000000..dfaaa847c +index 0000000000..dfaaa847cb --- /dev/null +++ b/src/include/k5-label.h @@ -0,0 +1,32 @@ @@ -236,7 +238,7 @@ index 000000000..dfaaa847c +#endif +#endif diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 045334a08..db80063eb 100644 +index c0194c3c94..7e1dea2cbf 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -87,6 +87,12 @@ @@ -253,7 +255,7 @@ index 045334a08..db80063eb 100644 #include diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c -index 634ba4a8b..cea7939f4 100644 +index a89b5144f6..4d6cc0bdf9 100644 --- a/src/kadmin/dbutil/dump.c +++ b/src/kadmin/dbutil/dump.c @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname) @@ -288,10 +290,10 @@ index 634ba4a8b..cea7939f4 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index 3be6dcb07..24d441e16 100644 +index 38b9299066..085afc9220 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c -@@ -872,7 +872,7 @@ write_pid_file(const char *path) +@@ -848,7 +848,7 @@ write_pid_file(const char *path) FILE *file; unsigned long pid; @@ -301,10 +303,10 @@ index 3be6dcb07..24d441e16 100644 return errno; pid = (unsigned long) getpid(); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index 498ca599a..c6b8efc28 100644 +index f2341d720f..ffdac9f397 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c -@@ -487,6 +487,9 @@ doit(int fd) +@@ -488,6 +488,9 @@ doit(int fd) krb5_enctype etype; int database_fd; char host[INET6_ADDRSTRLEN + 1]; @@ -314,7 +316,7 @@ index 498ca599a..c6b8efc28 100644 signal_wrapper(SIGALRM, alarm_handler); alarm(params.iprop_resync_timeout); -@@ -542,9 +545,15 @@ doit(int fd) +@@ -543,9 +546,15 @@ doit(int fd) free(name); exit(1); } @@ -331,7 +333,7 @@ index 498ca599a..c6b8efc28 100644 KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK); if (retval) { diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c -index c6885edf2..9aec3c05e 100644 +index c6885edf2a..9aec3c05e8 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do @@ -353,7 +355,7 @@ index c6885edf2..9aec3c05e 100644 set_cloexec_file(f); log_control.log_entries[lindex].lfu_filep = f; diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c -index 2659a2501..e9b95fce5 100644 +index 2659a25018..e9b95fce59 100644 --- a/src/lib/kdb/kdb_log.c +++ b/src/lib/kdb/kdb_log.c @@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries) @@ -366,7 +368,7 @@ index 2659a2501..e9b95fce5 100644 retval = errno; goto cleanup; diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c -index 7b100a0ec..5683a0433 100644 +index 1da40b51d0..f3ab7340a6 100644 --- a/src/lib/krb5/ccache/cc_dir.c +++ b/src/lib/krb5/ccache/cc_dir.c @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents) @@ -416,7 +418,7 @@ index 7b100a0ec..5683a0433 100644 _("Credential cache directory %s does not exist"), dirname); diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c -index e510211fc..f3ea28c8e 100644 +index e510211fc5..f3ea28c8ec 100644 --- a/src/lib/krb5/keytab/kt_file.c +++ b/src/lib/krb5/keytab/kt_file.c @@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode) @@ -437,10 +439,10 @@ index e510211fc..f3ea28c8e 100644 goto report_errno; writevno = 1; diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c -index 7073459f0..e9b99f4ca 100644 +index 3369fc4ba6..95f82cda03 100644 --- a/src/lib/krb5/os/trace.c +++ b/src/lib/krb5/os/trace.c -@@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) +@@ -459,7 +459,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) fd = malloc(sizeof(*fd)); if (fd == NULL) return ENOMEM; @@ -450,7 +452,7 @@ index 7073459f0..e9b99f4ca 100644 free(fd); return errno; diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c -index 7db30a33b..2b9d01921 100644 +index 7db30a33b0..2b9d01921d 100644 --- a/src/plugins/kdb/db2/adb_openclose.c +++ b/src/plugins/kdb/db2/adb_openclose.c @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename, @@ -463,7 +465,7 @@ index 7db30a33b..2b9d01921 100644 * maybe someone took away write permission so we could only * get shared locks? diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c -index 1a476b586..b40bb2240 100644 +index 2c163d91cc..9a344a603e 100644 --- a/src/plugins/kdb/db2/kdb_db2.c +++ b/src/plugins/kdb/db2/kdb_db2.c @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc) @@ -478,7 +480,7 @@ index 1a476b586..b40bb2240 100644 retval = errno; goto cleanup; diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c -index 2977b17f3..d5809a5a9 100644 +index 2977b17f3a..d5809a5a93 100644 --- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c +++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c @@ -60,6 +60,7 @@ static char sccsid[] = "@(#)bt_open.c 8.11 (Berkeley) 11/2/95"; @@ -499,7 +501,7 @@ index 2977b17f3..d5809a5a9 100644 } else { diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c -index 862dbb164..686a960c9 100644 +index 862dbb1640..686a960c96 100644 --- a/src/plugins/kdb/db2/libdb2/hash/hash.c +++ b/src/plugins/kdb/db2/libdb2/hash/hash.c @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)hash.c 8.12 (Berkeley) 11/7/95"; @@ -520,7 +522,7 @@ index 862dbb164..686a960c9 100644 (void)fcntl(hashp->fp, F_SETFD, 1); } diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c -index d8b26e701..b0daa7c02 100644 +index d8b26e7011..b0daa7c021 100644 --- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c +++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)rec_open.c 8.12 (Berkeley) 11/18/94"; @@ -542,7 +544,7 @@ index d8b26e701..b0daa7c02 100644 if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) { diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c -index e87688d66..30f7c00ab 100644 +index e87688d666..30f7c00ab5 100644 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c @@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv) @@ -579,7 +581,7 @@ index e87688d66..30f7c00ab 100644 if (newfile == NULL) { com_err(me, errno, _("Error creating file %s"), tmp_file); diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c -index aa951df05..79f9500f6 100644 +index aa951df05f..79f9500f69 100644 --- a/src/util/profile/prof_file.c +++ b/src/util/profile/prof_file.c @@ -33,6 +33,7 @@ @@ -600,7 +602,7 @@ index aa951df05..79f9500f6 100644 retval = errno; if (retval == 0) diff --git a/src/util/support/Makefile.in b/src/util/support/Makefile.in -index 86d5a950a..1052d53a1 100644 +index 86d5a950a6..1052d53a1e 100644 --- a/src/util/support/Makefile.in +++ b/src/util/support/Makefile.in @@ -74,6 +74,7 @@ IPC_SYMS= \ @@ -622,10 +624,10 @@ index 86d5a950a..1052d53a1 100644 diff --git a/src/util/support/selinux.c b/src/util/support/selinux.c new file mode 100644 -index 000000000..6d41f3244 +index 0000000000..807d039da3 --- /dev/null +++ b/src/util/support/selinux.c -@@ -0,0 +1,406 @@ +@@ -0,0 +1,405 @@ +/* + * Copyright 2007,2008,2009,2011,2012,2013,2016 Red Hat, Inc. All Rights Reserved. + * @@ -724,17 +726,16 @@ index 000000000..6d41f3244 + } +} + -+static security_context_t ++static char * +push_fscreatecon(const char *pathname, mode_t mode) +{ -+ security_context_t previous, configuredsc, currentsc, derivedsc; ++ char *previous, *configuredsc, *currentsc, *genpath; ++ const char *derivedsc, *fullpath, *currentuser; + context_t current, derived; -+ const char *fullpath, *currentuser; -+ char *genpath; + -+ previous = configuredsc = currentsc = derivedsc = NULL; ++ previous = configuredsc = currentsc = genpath = NULL; ++ derivedsc = NULL; + current = derived = NULL; -+ genpath = NULL; + + fullpath = pathname; + @@ -862,7 +863,7 @@ index 000000000..6d41f3244 +} + +static void -+pop_fscreatecon(security_context_t previous) ++pop_fscreatecon(char *previous) +{ + if (!is_selinux_enabled()) { + return; @@ -916,7 +917,7 @@ index 000000000..6d41f3244 +{ + FILE *fp; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + if ((strcmp(mode, "r") == 0) || + (strcmp(mode, "rb") == 0)) { @@ -942,7 +943,7 @@ index 000000000..6d41f3244 +{ + int fd; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -963,7 +964,7 @@ index 000000000..6d41f3244 +{ + int ret; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -984,7 +985,7 @@ index 000000000..6d41f3244 +{ + int ret; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -1005,7 +1006,7 @@ index 000000000..6d41f3244 +{ + int fd; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + mode_t mode; + va_list ap; + @@ -1032,3 +1033,6 @@ index 000000000..6d41f3244 +} + +#endif /* USE_SELINUX */ +-- +2.38.1 + diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/0003-downstream-fix-debuginfo-with-y.tab.c.patch similarity index 90% rename from downstream-fix-debuginfo-with-y.tab.c.patch rename to 0003-downstream-fix-debuginfo-with-y.tab.c.patch index 494152c..3c58cc1 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/0003-downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 98b50683165089bf7bd9d91f953abbd79a8b1b08 Mon Sep 17 00:00:00 2001 +From c7fe7cbd61f7debf052ddcc6cc5f01bb7e4f5385 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c @@ -14,7 +14,7 @@ Last-updated: krb5-1.9 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in -index adfea6e2b..d1327e400 100644 +index adfea6e2b5..d1327e400b 100644 --- a/src/kadmin/cli/Makefile.in +++ b/src/kadmin/cli/Makefile.in @@ -37,3 +37,8 @@ clean-unix:: @@ -27,7 +27,7 @@ index adfea6e2b..d1327e400 100644 + $(YACC.y) $< + $(CP) y.tab.c $@ diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in -index 8669c2436..a22f23c02 100644 +index 8669c2436c..a22f23c02c 100644 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in @@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE) @@ -39,3 +39,6 @@ index 8669c2436..a22f23c02 100644 install: $(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG) +-- +2.38.1 + diff --git a/downstream-Remove-3des-support.patch b/0004-downstream-Remove-3des-support.patch similarity index 92% rename from downstream-Remove-3des-support.patch rename to 0004-downstream-Remove-3des-support.patch index 3d351eb..4ec3a0f 100644 --- a/downstream-Remove-3des-support.patch +++ b/0004-downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From defa8816e26ab9f5a8f0b61e7bebad67175c433e Mon Sep 17 00:00:00 2001 +From 7b40250066bbcc529b5348b68199c58fbad82376 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -8,13 +8,17 @@ des3-hmac-sha1, des3-cbc-sha1-kd). Update all tests and documentation to user other enctypes. Mark the 3DES enctypes UNSUPPORTED and retain their constants. -Last-updated: 1.19-beta1 +Last-updated: 1.20-final [antorres@redhat.com: remove diffs for: - src/kdamin/testing/proto/kdc.conf.proto - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp since they were removed by Remove-TCL-based-libkadm5-API-tests.patch] +[jrische@redhat.com: restore supportedCMSTypes (not using 3DES any more): + - src/plugins/preauth/pkinit/pkinit_crypto.h + - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c + - src/plugins/preauth/pkinit/pkinit_clnt.c] --- doc/admin/advanced/retiring-des.rst | 11 + doc/admin/conf_files/kdc_conf.rst | 7 +- @@ -24,35 +28,34 @@ Last-updated: 1.19-beta1 doc/conf.py | 2 +- doc/mitK5features.rst | 2 +- src/Makefile.in | 4 +- - src/configure.ac | 1 - + src/configure.ac | 4 +- src/include/krb5/krb5.hin | 10 +- - src/kadmin/testing/proto/kdc.conf.proto | 4 +- src/kdc/kdc_util.c | 4 - src/lib/crypto/Makefile.in | 8 +- src/lib/crypto/builtin/Makefile.in | 6 +- src/lib/crypto/builtin/des/ISSUES | 13 - - src/lib/crypto/builtin/des/Makefile.in | 80 ---- - src/lib/crypto/builtin/des/d3_aead.c | 133 ------ - src/lib/crypto/builtin/des/d3_kysched.c | 51 --- - src/lib/crypto/builtin/des/deps | 150 ------- + src/lib/crypto/builtin/des/Makefile.in | 82 ---- + src/lib/crypto/builtin/des/d3_aead.c | 137 ------ + src/lib/crypto/builtin/des/d3_kysched.c | 55 --- + src/lib/crypto/builtin/des/deps | 146 ------- src/lib/crypto/builtin/des/des_int.h | 285 ------------- - src/lib/crypto/builtin/des/des_keys.c | 40 -- + src/lib/crypto/builtin/des/des_keys.c | 38 -- src/lib/crypto/builtin/des/destest.c | 240 ----------- src/lib/crypto/builtin/des/doc/libdes.doc | 208 --------- - src/lib/crypto/builtin/des/f_aead.c | 173 -------- + src/lib/crypto/builtin/des/f_aead.c | 177 -------- src/lib/crypto/builtin/des/f_cbc.c | 256 ------------ - src/lib/crypto/builtin/des/f_cksum.c | 136 ------ - src/lib/crypto/builtin/des/f_parity.c | 56 --- - src/lib/crypto/builtin/des/f_sched.c | 359 ---------------- - src/lib/crypto/builtin/des/f_tables.c | 370 ---------------- + src/lib/crypto/builtin/des/f_cksum.c | 141 ------- + src/lib/crypto/builtin/des/f_parity.c | 64 --- + src/lib/crypto/builtin/des/f_sched.c | 363 ---------------- + src/lib/crypto/builtin/des/f_tables.c | 375 ----------------- src/lib/crypto/builtin/des/f_tables.h | 285 ------------- - src/lib/crypto/builtin/des/key_sched.c | 62 --- + src/lib/crypto/builtin/des/key_sched.c | 66 --- src/lib/crypto/builtin/des/keytest.data | 171 -------- src/lib/crypto/builtin/des/t_verify.c | 395 ------------------ - src/lib/crypto/builtin/des/weak_key.c | 86 ---- - .../crypto/builtin/enc_provider/Makefile.in | 6 +- - src/lib/crypto/builtin/enc_provider/deps | 13 - - src/lib/crypto/builtin/enc_provider/des3.c | 105 ----- + src/lib/crypto/builtin/des/weak_key.c | 90 ---- + .../crypto/builtin/enc_provider/Makefile.in | 5 +- + src/lib/crypto/builtin/enc_provider/deps | 11 - + src/lib/crypto/builtin/enc_provider/des3.c | 109 ----- src/lib/crypto/crypto_tests/t_cf2.expected | 1 - src/lib/crypto/crypto_tests/t_cf2.in | 5 - src/lib/crypto/crypto_tests/t_cksums.c | 10 - @@ -61,45 +64,40 @@ Last-updated: 1.19-beta1 src/lib/crypto/crypto_tests/t_encrypt.c | 1 - src/lib/crypto/crypto_tests/t_short.c | 1 - src/lib/crypto/crypto_tests/t_str2key.c | 52 --- + src/lib/crypto/crypto_tests/vectors.c | 4 - src/lib/crypto/krb/Makefile.in | 3 - src/lib/crypto/krb/cksumtypes.c | 6 - - src/lib/crypto/krb/crypto_int.h | 16 - + src/lib/crypto/krb/crypto_int.h | 11 - src/lib/crypto/krb/default_state.c | 10 - src/lib/crypto/krb/enctype_util.c | 3 + src/lib/crypto/krb/etypes.c | 21 - src/lib/crypto/krb/prf_des.c | 47 --- - src/lib/crypto/krb/random_to_key.c | 45 -- + src/lib/crypto/krb/random_to_key.c | 28 -- src/lib/crypto/libk5crypto.exports | 1 - src/lib/crypto/openssl/Makefile.in | 8 +- src/lib/crypto/openssl/des/Makefile.in | 20 - - src/lib/crypto/openssl/des/deps | 15 - - src/lib/crypto/openssl/des/des_keys.c | 40 -- + src/lib/crypto/openssl/des/deps | 14 - + src/lib/crypto/openssl/des/des_keys.c | 39 -- .../crypto/openssl/enc_provider/Makefile.in | 3 - src/lib/crypto/openssl/enc_provider/deps | 11 - - src/lib/crypto/openssl/enc_provider/des3.c | 184 -------- + src/lib/crypto/openssl/enc_provider/des3.c | 188 --------- + src/lib/crypto/openssl/kdf.c | 2 - src/lib/gssapi/krb5/accept_sec_context.c | 1 - src/lib/gssapi/krb5/gssapiP_krb5.h | 6 +- src/lib/gssapi/krb5/k5seal.c | 35 +- src/lib/gssapi/krb5/k5sealiov.c | 27 +- - src/lib/gssapi/krb5/k5unseal.c | 102 ++--- + src/lib/gssapi/krb5/k5unseal.c | 88 ++-- src/lib/gssapi/krb5/k5unsealiov.c | 38 +- src/lib/gssapi/krb5/util_crypt.c | 11 - - .../api.current/chpass-principal-v2.exp | 4 +- - .../api.current/get-principal-v2.exp | 4 +- - .../api.current/randkey-principal-v2.exp | 4 +- src/lib/krb5/krb/init_ctx.c | 3 - src/lib/krb5/krb/s4u_creds.c | 2 - src/lib/krb5/krb/t_etypes.c | 48 +-- src/lib/krb5/os/t_trace.c | 4 +- src/lib/krb5/os/t_trace.ref | 2 +- src/plugins/preauth/pkinit/pkcs11.h | 6 +- - src/plugins/preauth/pkinit/pkinit_clnt.c | 8 - - src/plugins/preauth/pkinit/pkinit_crypto.h | 12 - - .../preauth/pkinit/pkinit_crypto_openssl.c | 38 -- - src/plugins/preauth/pkinit/pkinit_kdf_test.c | 31 -- + src/plugins/preauth/pkinit/pkinit_crypto.h | 10 +- + src/plugins/preauth/pkinit/pkinit_kdf_test.c | 30 -- src/plugins/preauth/spake/t_vectors.c | 25 -- - src/tests/dejagnu/config/default.exp | 78 ---- - src/tests/dejagnu/krb-standalone/kprop.exp | 2 +- src/tests/gssapi/t_enctypes.py | 33 +- src/tests/gssapi/t_invalid.c | 12 - src/tests/gssapi/t_pcontok.c | 16 +- @@ -111,7 +109,7 @@ Last-updated: 1.19-beta1 src/tests/t_salt.py | 5 +- src/util/k5test.py | 7 - .../leash/htmlhelp/html/Encryption_Types.htm | 13 - - 95 files changed, 160 insertions(+), 4835 deletions(-) + 89 files changed, 151 insertions(+), 4713 deletions(-) delete mode 100644 src/lib/crypto/builtin/des/ISSUES delete mode 100644 src/lib/crypto/builtin/des/Makefile.in delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c @@ -140,7 +138,7 @@ Last-updated: 1.19-beta1 delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst -index 38f76d3f4..d5e3c30c0 100644 +index 38f76d3f45..d5e3c30c04 100644 --- a/doc/admin/advanced/retiring-des.rst +++ b/doc/admin/advanced/retiring-des.rst @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit @@ -169,10 +167,10 @@ index 38f76d3f4..d5e3c30c0 100644 ------------- diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst -index 1dc958d62..3a72aabef 100644 +index 74a0a2acef..846c58ed82 100644 --- a/doc/admin/conf_files/kdc_conf.rst +++ b/doc/admin/conf_files/kdc_conf.rst -@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for +@@ -854,8 +854,6 @@ Encryption types marked as "weak" and "deprecated" are available for compatibility but not recommended for use. ==================================================== ========================================================= @@ -181,7 +179,7 @@ index 1dc958d62..3a72aabef 100644 aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1 AES-256 CTS mode with 96-bit SHA-1 HMAC aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1 AES-128 CTS mode with 96-bit SHA-1 HMAC aes256-cts-hmac-sha384-192 aes256-sha2 AES-256 CTS mode with 192-bit SHA-384 HMAC -@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 (deprecat +@@ -864,7 +862,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 (deprecat arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp Exportable RC4 with HMAC/MD5 (weak) camellia256-cts-cmac camellia256-cts Camellia-256 CTS mode with CMAC camellia128-cts-cmac camellia128-cts Camellia-128 CTS mode with CMAC @@ -189,7 +187,7 @@ index 1dc958d62..3a72aabef 100644 aes The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128 rc4 The RC4 family: arcfour-hmac camellia The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac -@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-"). +@@ -876,8 +873,8 @@ from the current list by prefixing them with a minus sign ("-"). Types or families can be prefixed with a plus sign ("+") for symmetry; it has the same meaning as just listing the type or family. For example, "``DEFAULT -rc4``" would be the default set of encryption @@ -201,7 +199,7 @@ index 1dc958d62..3a72aabef 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index 694922c0d..c4d5499d3 100644 +index 694922c0d9..c4d5499d3b 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst @@ -129,7 +129,7 @@ enctype weak? krb5 Windows @@ -229,7 +227,7 @@ index 694922c0d..c4d5499d3 100644 Migrating away from older encryption types diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst -index ade5e1f87..e4dc54f7e 100644 +index ade5e1f87a..e4dc54f7e5 100644 --- a/doc/admin/troubleshoot.rst +++ b/doc/admin/troubleshoot.rst @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type @@ -249,7 +247,7 @@ index ade5e1f87..e4dc54f7e 100644 .. _err_cert_chain_cert_expired: diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index 5542d9850..0cb2e81bd 100644 +index a0d4f26701..5f34dea5e8 100644 --- a/doc/appdev/refs/macros/index.rst +++ b/doc/appdev/refs/macros/index.rst @@ -36,7 +36,6 @@ Public @@ -261,7 +259,7 @@ index 5542d9850..0cb2e81bd 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index 14158ae81..a876fd633 100644 +index fa0eb80f1f..12168fa695 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -278,7 +278,7 @@ else: @@ -274,7 +272,7 @@ index 14158ae81..a876fd633 100644 .. |copy| unicode:: U+000A9 ''' diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst -index 4954bb3aa..92ce2a772 100644 +index ca2d6ef117..100c64a1c1 100644 --- a/doc/mitK5features.rst +++ b/doc/mitK5features.rst @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB @@ -287,7 +285,7 @@ index 4954bb3aa..92ce2a772 100644 Interoperability ---------------- diff --git a/src/Makefile.in b/src/Makefile.in -index 7d2507ef8..c16715ac7 100644 +index 8f14e9bf2c..ba3bb18eec 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \ @@ -309,19 +307,26 @@ index 7d2507ef8..c16715ac7 100644 ##DOS## $(WCONFIG) config < $@.in > $@ ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP) diff --git a/src/configure.ac b/src/configure.ac -index dd2cad3ee..3e1052db7 100644 +index 40545f2bfc..8dc864718d 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1480,7 +1480,6 @@ V5_AC_OUTPUT_MAKEFILE(. - lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL - lib/crypto/$CRYPTO_IMPL/enc_provider - lib/crypto/$CRYPTO_IMPL/hash_provider -- lib/crypto/$CRYPTO_IMPL/des - lib/crypto/$CRYPTO_IMPL/md4 lib/crypto/$CRYPTO_IMPL/md5 - lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2 - lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia +@@ -1489,12 +1489,12 @@ V5_AC_OUTPUT_MAKEFILE(. + lib lib/kdb + + lib/crypto lib/crypto/krb lib/crypto/crypto_tests +- lib/crypto/builtin lib/crypto/builtin/des ++ lib/crypto/builtin + lib/crypto/builtin/aes lib/crypto/builtin/camellia + lib/crypto/builtin/md4 lib/crypto/builtin/md5 + lib/crypto/builtin/sha1 lib/crypto/builtin/sha2 + lib/crypto/builtin/enc_provider lib/crypto/builtin/hash_provider +- lib/crypto/openssl lib/crypto/openssl/des ++ lib/crypto/openssl + lib/crypto/openssl/enc_provider lib/crypto/openssl/hash_provider + + lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index db80063eb..63e67a2ba 100644 +index 7e1dea2cbf..fb9f2a366c 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov { @@ -347,20 +352,20 @@ index db80063eb..63e67a2ba 100644 #define ENCTYPE_AES128_CTS_HMAC_SHA1_96 0x0011 /**< RFC 3962 */ #define ENCTYPE_AES256_CTS_HMAC_SHA1_96 0x0012 /**< RFC 3962 */ #define ENCTYPE_AES128_CTS_HMAC_SHA256_128 0x0013 /**< RFC 8009 */ -@@ -458,7 +458,7 @@ typedef struct _krb5_crypto_iov { +@@ -463,7 +463,7 @@ typedef struct _krb5_crypto_iov { #define CKSUMTYPE_RSA_MD5 0x0007 #define CKSUMTYPE_RSA_MD5_DES 0x0008 #define CKSUMTYPE_NIST_SHA 0x0009 -#define CKSUMTYPE_HMAC_SHA1_DES3 0x000c +#define CKSUMTYPE_HMAC_SHA1_DES3 0x000c /* @deprecated removed */ + #define CKSUMTYPE_SHA1 0x000e /**< RFC 3961 */ #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with ENCTYPE_AES128_CTS_HMAC_SHA1_96 */ - #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index 60f30c4f4..c65375aef 100644 +index 9f2a67d189..b7a9aa4992 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c -@@ -1017,8 +1017,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) +@@ -1111,8 +1111,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) name = "rsaEncryption-EnvOID"; else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV) name = "id-RSAES-OAEP-EnvOID"; @@ -369,7 +374,7 @@ index 60f30c4f4..c65375aef 100644 else return krb5_enctype_to_name(ktype, FALSE, buf, buflen); -@@ -1605,8 +1603,6 @@ krb5_boolean +@@ -1704,8 +1702,6 @@ krb5_boolean enctype_requires_etype_info_2(krb5_enctype enctype) { switch(enctype) { @@ -379,28 +384,25 @@ index 60f30c4f4..c65375aef 100644 case ENCTYPE_ARCFOUR_HMAC_EXP : return 0; diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in -index c3fcfd7e8..890d54adf 100644 +index 10e8c74cf8..25c4f40cc3 100644 --- a/src/lib/crypto/Makefile.in +++ b/src/lib/crypto/Makefile.in -@@ -13,7 +13,7 @@ STOBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST \ - $(CRYPTO_IMPL)/hash_provider/OBJS.ST \ - $(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST \ - $(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST \ -- $(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST \ -+ $(CRYPTO_IMPL)/aes/OBJS.ST \ - $(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST \ - $(CRYPTO_IMPL)/OBJS.ST +@@ -10,12 +10,12 @@ LIBMINOR=1 + RELDIR=crypto -@@ -21,7 +21,7 @@ SUBDIROBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST \ - $(CRYPTO_IMPL)/hash_provider/OBJS.ST \ - $(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST \ - $(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST \ -- $(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST \ -+ $(CRYPTO_IMPL)/aes/OBJS.ST \ - $(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST \ - $(CRYPTO_IMPL)/OBJS.ST + STOBJLISTS=krb/OBJS.ST \ +- builtin/OBJS.ST builtin/des/OBJS.ST \ ++ builtin/OBJS.ST \ + builtin/aes/OBJS.ST builtin/camellia/OBJS.ST \ + builtin/md4/OBJS.ST builtin/md5/OBJS.ST \ + builtin/sha1/OBJS.ST builtin/sha2/OBJS.ST \ + builtin/enc_provider/OBJS.ST builtin/hash_provider/OBJS.ST \ +- openssl/OBJS.ST openssl/des/OBJS.ST \ ++ openssl/OBJS.ST \ + openssl/enc_provider/OBJS.ST openssl/hash_provider/OBJS.ST -@@ -34,8 +34,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB) + SUBDIROBJLISTS=$(STOBJLISTS) +@@ -28,8 +28,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB) SHLIB_LDFLAGS= $(LDFLAGS) @SHLIB_RPATH_DIRS@ ##DOS##LIBNAME=$(OUTPRE)crypto.lib @@ -412,7 +414,7 @@ index c3fcfd7e8..890d54adf 100644 all-unix: all-liblinks install-unix: install-libs diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in -index baf5d974f..82adf1dec 100644 +index daf19da195..c9e967c807 100644 --- a/src/lib/crypto/builtin/Makefile.in +++ b/src/lib/crypto/builtin/Makefile.in @@ -1,6 +1,6 @@ @@ -420,11 +422,11 @@ index baf5d974f..82adf1dec 100644 BUILDTOP=$(REL)..$(S)..$(S).. -SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider +SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider - LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir) + LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS) ##DOS##BUILDTOP = ..\..\.. -@@ -22,7 +22,7 @@ SRCS=\ - $(srcdir)/init.c \ +@@ -25,7 +25,7 @@ SRCS=\ + $(srcdir)/kdf.c \ $(srcdir)/pbkdf2.c -STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ @@ -432,7 +434,7 @@ index baf5d974f..82adf1dec 100644 md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ enc_provider/OBJS.ST \ hash_provider/OBJS.ST \ -@@ -30,7 +30,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ +@@ -33,7 +33,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ camellia/OBJS.ST \ OBJS.ST @@ -443,7 +445,7 @@ index baf5d974f..82adf1dec 100644 hash_provider/OBJS.ST \ diff --git a/src/lib/crypto/builtin/des/ISSUES b/src/lib/crypto/builtin/des/ISSUES deleted file mode 100644 -index 157891103..000000000 +index 1578911033..0000000000 --- a/src/lib/crypto/builtin/des/ISSUES +++ /dev/null @@ -1,13 +0,0 @@ @@ -462,13 +464,13 @@ index 157891103..000000000 -const? diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in deleted file mode 100644 -index 54b329d0f..000000000 +index 397ac87ed4..0000000000 --- a/src/lib/crypto/builtin/des/Makefile.in +++ /dev/null -@@ -1,80 +0,0 @@ +@@ -1,82 +0,0 @@ -mydir=lib$(S)crypto$(S)builtin$(S)des -BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../krb +-LOCALINCLUDES=-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) - -##DOS##BUILDTOP = ..\..\..\.. -##DOS##PREFIXDIR = builtin\des @@ -526,7 +528,9 @@ index 54b329d0f..000000000 - -all-unix: all-libobjs - --check-unix: verify destest +-check-unix: check-unix-@CRYPTO_BUILTIN_TESTS@ +-check-unix-no: +-check-unix-yes: verify destest - $(RUN_TEST) ./verify -z - $(RUN_TEST) ./verify -m - $(RUN_TEST) ./verify @@ -548,10 +552,10 @@ index 54b329d0f..000000000 - diff --git a/src/lib/crypto/builtin/des/d3_aead.c b/src/lib/crypto/builtin/des/d3_aead.c deleted file mode 100644 -index bddf75a47..000000000 +index fb83f73b43..0000000000 --- a/src/lib/crypto/builtin/des/d3_aead.c +++ /dev/null -@@ -1,133 +0,0 @@ +@@ -1,137 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 2008 by the Massachusetts Institute of Technology. @@ -580,6 +584,8 @@ index bddf75a47..000000000 -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -void -krb5int_des3_cbc_encrypt(krb5_crypto_iov *data, unsigned long num_data, - const mit_des_key_schedule ks1, @@ -685,12 +691,14 @@ index bddf75a47..000000000 - store_32_be(ocipherr, ivec + 4); - } -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/d3_kysched.c b/src/lib/crypto/builtin/des/d3_kysched.c deleted file mode 100644 -index ebd1050b1..000000000 +index 55fb9449b5..0000000000 --- a/src/lib/crypto/builtin/des/d3_kysched.c +++ /dev/null -@@ -1,51 +0,0 @@ +@@ -1,55 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright 1995 by Richard P. Basch. All Rights Reserved. @@ -714,9 +722,11 @@ index ebd1050b1..000000000 - * express or implied warranty. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -int -mit_des3_key_sched(mit_des3_cblock k, mit_des3_key_schedule schedule) -{ @@ -742,20 +752,20 @@ index ebd1050b1..000000000 - /* if key was good, return 0 */ - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps deleted file mode 100644 -index a1db1f36e..000000000 +index 1c1239d696..0000000000 --- a/src/lib/crypto/builtin/des/deps +++ /dev/null -@@ -1,150 +0,0 @@ +@@ -1,146 +0,0 @@ -# -# Generated makefile dependencies follow. -# -d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -767,20 +777,18 @@ index a1db1f36e..000000000 -d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- d3_kysched.c des_int.h +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h d3_kysched.c des_int.h -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \ -- $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \ -- $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ @@ -791,8 +799,6 @@ index a1db1f36e..000000000 -f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -803,69 +809,71 @@ index a1db1f36e..000000000 - des_int.h f_aead.c f_tables.h -f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ -- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ -- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des_int.h f_cksum.c \ -- f_tables.h +- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des_int.h f_cksum.c f_tables.h -f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h f_parity.c --f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ -- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ - $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des_int.h f_sched.c +- $(top_srcdir)/include/socket-utils.h des_int.h f_parity.c +-f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ +- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des_int.h f_sched.c -f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h f_tables.c f_tables.h +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h f_tables.c \ +- f_tables.h -key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h key_sched.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h key_sched.c -weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h weak_key.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h weak_key.c -destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -900,7 +908,7 @@ index a1db1f36e..000000000 - des_int.h t_verify.c diff --git a/src/lib/crypto/builtin/des/des_int.h b/src/lib/crypto/builtin/des/des_int.h deleted file mode 100644 -index f8dc6b296..000000000 +index f8dc6b296a..0000000000 --- a/src/lib/crypto/builtin/des/des_int.h +++ /dev/null @@ -1,285 +0,0 @@ @@ -1191,10 +1199,10 @@ index f8dc6b296..000000000 -#endif /*DES_INTERNAL_DEFS*/ diff --git a/src/lib/crypto/builtin/des/des_keys.c b/src/lib/crypto/builtin/des/des_keys.c deleted file mode 100644 -index 32b119aad..000000000 +index 027b09d728..0000000000 --- a/src/lib/crypto/builtin/des/des_keys.c +++ /dev/null -@@ -1,40 +0,0 @@ +@@ -1,38 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/des_keys.c - Key functions used by Kerberos code */ -/* @@ -1224,20 +1232,18 @@ index 32b119aad..000000000 -#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES_KEY_PARITY +- -void -k5_des_fixup_key_parity(unsigned char *keybits) -{ - mit_des_fixup_key_parity(keybits); -} - --krb5_boolean --k5_des_is_weak_key(unsigned char *keybits) --{ -- return mit_des_is_weak_key(keybits); --} +-#endif /* K5_BUILTIN_DES_KEY_PARITY */ diff --git a/src/lib/crypto/builtin/des/destest.c b/src/lib/crypto/builtin/des/destest.c deleted file mode 100644 -index 52114304e..000000000 +index 52114304e3..0000000000 --- a/src/lib/crypto/builtin/des/destest.c +++ /dev/null @@ -1,240 +0,0 @@ @@ -1483,7 +1489,7 @@ index 52114304e..000000000 -} diff --git a/src/lib/crypto/builtin/des/doc/libdes.doc b/src/lib/crypto/builtin/des/doc/libdes.doc deleted file mode 100644 -index 6e9431ed2..000000000 +index 6e9431ed2e..0000000000 --- a/src/lib/crypto/builtin/des/doc/libdes.doc +++ /dev/null @@ -1,208 +0,0 @@ @@ -1697,10 +1703,10 @@ index 6e9431ed2..000000000 -string length desired. diff --git a/src/lib/crypto/builtin/des/f_aead.c b/src/lib/crypto/builtin/des/f_aead.c deleted file mode 100644 -index 71b8dff4d..000000000 +index f887735820..0000000000 --- a/src/lib/crypto/builtin/des/f_aead.c +++ /dev/null -@@ -1,173 +0,0 @@ +@@ -1,177 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 2008 by the Massachusetts Institute of Technology. @@ -1729,6 +1735,8 @@ index 71b8dff4d..000000000 -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -const mit_des_cblock mit_des_zeroblock /* = all zero */; - -void @@ -1874,9 +1882,11 @@ index 71b8dff4d..000000000 - DES_DO_DECRYPT_1 (*left, *right, kp); -} -#endif +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_cbc.c b/src/lib/crypto/builtin/des/f_cbc.c deleted file mode 100644 -index 84d5382f2..000000000 +index 84d5382f22..0000000000 --- a/src/lib/crypto/builtin/des/f_cbc.c +++ /dev/null @@ -1,256 +0,0 @@ @@ -2138,10 +2148,10 @@ index 84d5382f2..000000000 -} diff --git a/src/lib/crypto/builtin/des/f_cksum.c b/src/lib/crypto/builtin/des/f_cksum.c deleted file mode 100644 -index cb482b009..000000000 +index 615a947f4a..0000000000 --- a/src/lib/crypto/builtin/des/f_cksum.c +++ /dev/null -@@ -1,136 +0,0 @@ +@@ -1,141 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_cksum.c */ -/* @@ -2173,9 +2183,12 @@ index cb482b009..000000000 -/* - * des_cbc_cksum.c - compute an 8 byte checksum using DES in CBC mode - */ +-#include "crypto_int.h" -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * This routine performs DES cipher-block-chaining checksum operation, - * a.k.a. Message Authentication Code. It ALWAYS encrypts from input @@ -2278,12 +2291,14 @@ index cb482b009..000000000 - */ - return right & 0xFFFFFFFFUL; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_parity.c b/src/lib/crypto/builtin/des/f_parity.c deleted file mode 100644 -index 460b5061b..000000000 +index a658878f6f..0000000000 --- a/src/lib/crypto/builtin/des/f_parity.c +++ /dev/null -@@ -1,56 +0,0 @@ +@@ -1,64 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * These routines check and fix parity of encryption keys for the DES @@ -2295,9 +2310,11 @@ index 460b5061b..000000000 - * Mark Eichin -- Cygnus Support - */ - -- +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES_KEY_PARITY +- -/* - * des_fixup_key_parity: Forces odd parity per byte; parity is bits - * 8,16,...64 in des order, implies 0, 8, 16, ... @@ -2320,6 +2337,10 @@ index 460b5061b..000000000 - return; -} - +-#endif /* K5_BUILTIN_DES_KEY_PARITY */ +- +-#ifdef K5_BUILTIN_DES +- -/* - * des_check_key_parity: returns true iff key has the correct des parity. - * See des_fix_key_parity for the definition of @@ -2340,12 +2361,14 @@ index 460b5061b..000000000 - - return(1); -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_sched.c b/src/lib/crypto/builtin/des/f_sched.c deleted file mode 100644 -index 666a510fb..000000000 +index bbc88a1c8d..0000000000 --- a/src/lib/crypto/builtin/des/f_sched.c +++ /dev/null -@@ -1,359 +0,0 @@ +@@ -1,363 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_sched.c */ -/* @@ -2377,9 +2400,11 @@ index 666a510fb..000000000 -/* - * des_make_sched.c - permute a DES key, returning the resulting key schedule - */ --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * Permuted choice 1 tables. These are used to extract bits - * from the left and right parts of the key to form Ci and Di. @@ -2705,12 +2730,14 @@ index 666a510fb..000000000 - } - return (0); -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_tables.c b/src/lib/crypto/builtin/des/f_tables.c deleted file mode 100644 -index 6308cb0d5..000000000 +index e50ab1fc60..0000000000 --- a/src/lib/crypto/builtin/des/f_tables.c +++ /dev/null -@@ -1,370 +0,0 @@ +@@ -1,375 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_tables.c */ -/* @@ -2747,9 +2774,12 @@ index 6308cb0d5..000000000 - * Include the header file so something will complain if the - * declarations get out of sync - */ +-#include "crypto_int.h" -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * These tables may be declared const if you want. Many compilers - * don't support this, though. @@ -3081,9 +3111,11 @@ index 6308cb0d5..000000000 - 0x40000000, 0x40080010, 0x40084010, 0x00084000 - }, -}; +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_tables.h b/src/lib/crypto/builtin/des/f_tables.h deleted file mode 100644 -index fc91b566c..000000000 +index fc91b566cf..0000000000 --- a/src/lib/crypto/builtin/des/f_tables.h +++ /dev/null @@ -1,285 +0,0 @@ @@ -3374,10 +3406,10 @@ index fc91b566c..000000000 -#endif /* __DES_TABLES_H__ */ diff --git a/src/lib/crypto/builtin/des/key_sched.c b/src/lib/crypto/builtin/des/key_sched.c deleted file mode 100644 -index 87f02b6a9..000000000 +index d6dedd93c6..0000000000 --- a/src/lib/crypto/builtin/des/key_sched.c +++ /dev/null -@@ -1,62 +0,0 @@ +@@ -1,66 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/key_sched.c */ -/* @@ -3423,9 +3455,11 @@ index 87f02b6a9..000000000 - * Originally written 6/85 by Steve Miller, MIT Project Athena. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -int -mit_des_key_sched(mit_des_cblock k, mit_des_key_schedule schedule) -{ @@ -3440,9 +3474,11 @@ index 87f02b6a9..000000000 - /* if key was good, return 0 */ - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/keytest.data b/src/lib/crypto/builtin/des/keytest.data deleted file mode 100644 -index 7ff34eedc..000000000 +index 7ff34eedcf..0000000000 --- a/src/lib/crypto/builtin/des/keytest.data +++ /dev/null @@ -1,171 +0,0 @@ @@ -3619,7 +3655,7 @@ index 7ff34eedc..000000000 -1C587F1C13924FEF 305532286D6F295A 63FAC0D034D9F793 diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c deleted file mode 100644 -index 4a19933ca..000000000 +index 4a19933cad..0000000000 --- a/src/lib/crypto/builtin/des/t_verify.c +++ /dev/null @@ -1,395 +0,0 @@ @@ -4020,10 +4056,10 @@ index 4a19933ca..000000000 -} diff --git a/src/lib/crypto/builtin/des/weak_key.c b/src/lib/crypto/builtin/des/weak_key.c deleted file mode 100644 -index eb41b267d..000000000 +index f8304a3638..0000000000 --- a/src/lib/crypto/builtin/des/weak_key.c +++ /dev/null -@@ -1,86 +0,0 @@ +@@ -1,90 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/weak_key.c */ -/* @@ -4059,9 +4095,11 @@ index eb41b267d..000000000 - * Originally written 8/85 by Steve Miller, MIT Project Athena. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * The following are the weak DES keys: - */ @@ -4110,20 +4148,21 @@ index eb41b267d..000000000 - - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in -index 3459e1d0e..af6276b96 100644 +index 6ad7cbd4e0..655966b255 100644 --- a/src/lib/crypto/builtin/enc_provider/Makefile.in +++ b/src/lib/crypto/builtin/enc_provider/Makefile.in -@@ -1,7 +1,6 @@ +@@ -1,6 +1,6 @@ mydir=lib$(S)crypto$(S)builtin$(S)enc_provider BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/../des \ -- -I$(srcdir)/../aes \ -+LOCALINCLUDES = -I$(srcdir)/../aes \ - -I$(srcdir)/../camellia \ - -I$(srcdir)/../../krb \ - -I$(srcdir)/.. -@@ -11,19 +10,16 @@ LOCALINCLUDES = -I$(srcdir)/../des \ +-LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \ ++LOCALINCLUDES = -I$(srcdir)/../aes -I$(srcdir)/../camellia \ + -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) + + ##DOS##BUILDTOP = ..\..\..\.. +@@ -8,19 +8,16 @@ LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \ ##DOS##OBJFILE = ..\..\$(OUTPRE)enc_provider.lst STLIBOBJS= \ @@ -4144,19 +4183,17 @@ index 3459e1d0e..af6276b96 100644 $(srcdir)/camellia.c \ $(srcdir)/rc4.c diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps -index ea4ffecd8..061289a91 100644 +index a3414a38ec..dc29d9fce8 100644 --- a/src/lib/crypto/builtin/enc_provider/deps +++ b/src/lib/crypto/builtin/enc_provider/deps -@@ -1,19 +1,6 @@ +@@ -1,17 +1,6 @@ # # Generated makefile dependencies follow. # -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \ -- $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ +- $(srcdir)/../des/des_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ @@ -4169,10 +4206,10 @@ index ea4ffecd8..061289a91 100644 $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ diff --git a/src/lib/crypto/builtin/enc_provider/des3.c b/src/lib/crypto/builtin/enc_provider/des3.c deleted file mode 100644 -index 9b8244223..000000000 +index c2634d5e10..0000000000 --- a/src/lib/crypto/builtin/enc_provider/des3.c +++ /dev/null -@@ -1,105 +0,0 @@ +@@ -1,109 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 1998 by the FundsXpress, INC. @@ -4203,6 +4240,8 @@ index 9b8244223..000000000 -#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -static krb5_error_code -validate_and_schedule(krb5_key key, const krb5_data *ivec, - const krb5_crypto_iov *data, size_t num_data, @@ -4278,8 +4317,10 @@ index 9b8244223..000000000 - krb5int_des_init_state, - krb5int_default_free_state -}; +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/crypto_tests/t_cf2.expected b/src/lib/crypto/crypto_tests/t_cf2.expected -index f8251a16c..bc6aa50c8 100644 +index f8251a16cb..bc6aa50c84 100644 --- a/src/lib/crypto/crypto_tests/t_cf2.expected +++ b/src/lib/crypto/crypto_tests/t_cf2.expected @@ -1,6 +1,5 @@ @@ -4290,7 +4331,7 @@ index f8251a16c..bc6aa50c8 100644 edd02a39d2dbde31611c16e610be062c 67f6ea530aea85a37dcbb23349ea52dcc61ca8493ff557252327fd8304341584 diff --git a/src/lib/crypto/crypto_tests/t_cf2.in b/src/lib/crypto/crypto_tests/t_cf2.in -index 73e2f8fbc..c4d23b506 100644 +index 73e2f8fbc9..c4d23b506b 100644 --- a/src/lib/crypto/crypto_tests/t_cf2.in +++ b/src/lib/crypto/crypto_tests/t_cf2.in @@ -8,11 +8,6 @@ key1 @@ -4306,7 +4347,7 @@ index 73e2f8fbc..c4d23b506 100644 key1 key2 diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c -index 8297fcbf5..3063d12ec 100644 +index 557340ec5e..9f9a177ef0 100644 --- a/src/lib/crypto/crypto_tests/t_cksums.c +++ b/src/lib/crypto/crypto_tests/t_cksums.c @@ -59,16 +59,6 @@ struct test { @@ -4327,7 +4368,7 @@ index 8297fcbf5..3063d12ec 100644 { KV5M_DATA, 37, "eight nine ten eleven twelve thirteen" }, CKSUMTYPE_HMAC_SHA1_96_AES128, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 3, diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c -index a40a85500..716f2c337 100644 +index a40a855007..716f2c337a 100644 --- a/src/lib/crypto/crypto_tests/t_decrypt.c +++ b/src/lib/crypto/crypto_tests/t_decrypt.c @@ -39,62 +39,6 @@ struct test { @@ -4402,7 +4443,7 @@ index a40a85500..716f2c337 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES128_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_derive.c b/src/lib/crypto/crypto_tests/t_derive.c -index afbf7477f..93ce30da2 100644 +index afbf7477f6..93ce30da20 100644 --- a/src/lib/crypto/crypto_tests/t_derive.c +++ b/src/lib/crypto/crypto_tests/t_derive.c @@ -38,41 +38,6 @@ struct test { @@ -4456,7 +4497,7 @@ index afbf7477f..93ce30da2 100644 case ENCTYPE_AES256_CTS_HMAC_SHA1_96: return &krb5int_enc_aes256; case ENCTYPE_CAMELLIA128_CTS_CMAC: return &krb5int_enc_camellia128; diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c -index bd9b94691..290a72e1e 100644 +index bd9b94691c..290a72e1e0 100644 --- a/src/lib/crypto/crypto_tests/t_encrypt.c +++ b/src/lib/crypto/crypto_tests/t_encrypt.c @@ -37,7 +37,6 @@ @@ -4468,7 +4509,7 @@ index bd9b94691..290a72e1e 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES256_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c -index d4c2b97df..4466b7115 100644 +index d4c2b97dfd..4466b71158 100644 --- a/src/lib/crypto/crypto_tests/t_short.c +++ b/src/lib/crypto/crypto_tests/t_short.c @@ -34,7 +34,6 @@ @@ -4480,7 +4521,7 @@ index d4c2b97df..4466b7115 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES256_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c -index cdb1acc6d..ef4c4a7d3 100644 +index cdb1acc6d0..ef4c4a7d3b 100644 --- a/src/lib/crypto/crypto_tests/t_str2key.c +++ b/src/lib/crypto/crypto_tests/t_str2key.c @@ -35,58 +35,6 @@ struct test { @@ -4542,11 +4583,33 @@ index cdb1acc6d..ef4c4a7d3 100644 /* Test vectors from RFC 3962 appendix B. */ { ENCTYPE_AES128_CTS_HMAC_SHA1_96, +diff --git a/src/lib/crypto/crypto_tests/vectors.c b/src/lib/crypto/crypto_tests/vectors.c +index bcf5c9106f..eb107dbcd2 100644 +--- a/src/lib/crypto/crypto_tests/vectors.c ++++ b/src/lib/crypto/crypto_tests/vectors.c +@@ -190,8 +190,6 @@ test_s2k (krb5_enctype enctype) + } + } + +-static void test_des3_s2k () { test_s2k (ENCTYPE_DES3_CBC_SHA1); } +- + static void + keyToData (krb5_keyblock *k, krb5_data *d) + { +@@ -208,8 +206,6 @@ void check_error (int r, int line) { + } + #define CHECK check_error(r, __LINE__) + +-extern struct krb5_enc_provider krb5int_enc_des3; +-struct krb5_enc_provider *enc = &krb5int_enc_des3; + extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256; + + void DK (krb5_keyblock *out, krb5_keyblock *in, const krb5_data *usage) { diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in -index b74e6f7cc..2b0c4163d 100644 +index cb2e40a3a5..f66698bd53 100644 --- a/src/lib/crypto/krb/Makefile.in +++ b/src/lib/crypto/krb/Makefile.in -@@ -50,7 +50,6 @@ STLIBOBJS=\ +@@ -47,7 +47,6 @@ STLIBOBJS=\ prf.o \ prf_aes2.o \ prf_cmac.o \ @@ -4554,7 +4617,7 @@ index b74e6f7cc..2b0c4163d 100644 prf_dk.o \ prf_rc4.o \ prng.o \ -@@ -109,7 +108,6 @@ OBJS=\ +@@ -103,7 +102,6 @@ OBJS=\ $(OUTPRE)prf.$(OBJEXT) \ $(OUTPRE)prf_aes2.$(OBJEXT) \ $(OUTPRE)prf_cmac.$(OBJEXT) \ @@ -4562,7 +4625,7 @@ index b74e6f7cc..2b0c4163d 100644 $(OUTPRE)prf_dk.$(OBJEXT) \ $(OUTPRE)prf_rc4.$(OBJEXT) \ $(OUTPRE)prng.$(OBJEXT) \ -@@ -168,7 +166,6 @@ SRCS=\ +@@ -159,7 +157,6 @@ SRCS=\ $(srcdir)/prf.c \ $(srcdir)/prf_aes2.c \ $(srcdir)/prf_cmac.c \ @@ -4571,10 +4634,10 @@ index b74e6f7cc..2b0c4163d 100644 $(srcdir)/prf_rc4.c \ $(srcdir)/prng.c \ diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c -index ecc2e08c9..f5fbe8a2a 100644 +index f7ba322f24..25a3ffd2d2 100644 --- a/src/lib/crypto/krb/cksumtypes.c +++ b/src/lib/crypto/krb/cksumtypes.c -@@ -46,12 +46,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { +@@ -52,12 +52,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { krb5int_unkeyed_checksum, NULL, 20, 20, CKSUM_UNKEYED }, @@ -4588,21 +4651,19 @@ index ecc2e08c9..f5fbe8a2a 100644 "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" }, "Microsoft HMAC MD5", diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h -index 19f808749..4bc430c7a 100644 +index 3629616d96..1ee4b30e02 100644 --- a/src/lib/crypto/krb/crypto_int.h +++ b/src/lib/crypto/krb/crypto_int.h -@@ -276,10 +276,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc, +@@ -332,8 +332,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc, /* Random to key */ krb5_error_code k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock); --krb5_error_code k5_rand2key_des(const krb5_data *randombits, -- krb5_keyblock *keyblock); -krb5_error_code k5_rand2key_des3(const krb5_data *randombits, - krb5_keyblock *keyblock); /* Pseudo-random function */ krb5_error_code krb5int_des_prf(const struct krb5_keytypes *ktp, -@@ -368,11 +364,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage); +@@ -411,11 +409,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage); /* Ensure library initialization has occurred. */ int krb5int_crypto_init(void); @@ -4614,7 +4675,7 @@ index 19f808749..4bc430c7a 100644 /* Default state cleanup handler (used by module enc providers). */ void krb5int_default_free_state(krb5_data *state); -@@ -425,7 +416,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block); +@@ -468,7 +461,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block); /* Modules must implement the k5_sha256() function prototyped in k5-int.h. */ /* Modules must implement the following enc_providers and hash_providers: */ @@ -4622,21 +4683,18 @@ index 19f808749..4bc430c7a 100644 extern const struct krb5_enc_provider krb5int_enc_arcfour; extern const struct krb5_enc_provider krb5int_enc_aes128; extern const struct krb5_enc_provider krb5int_enc_aes256; -@@ -442,12 +432,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384; +@@ -485,9 +477,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384; /* Modules must implement the following functions. */ -/* Set the parity bits to the correct values in keybits. */ -void k5_des_fixup_key_parity(unsigned char *keybits); -- --/* Return true if keybits is a weak or semi-weak DES key. */ --krb5_boolean k5_des_is_weak_key(unsigned char *keybits); - /* Compute an HMAC using the provided hash function, key, and data, storing the * result into output (caller-allocated). */ krb5_error_code krb5int_hmac(const struct krb5_hash_provider *hash, diff --git a/src/lib/crypto/krb/default_state.c b/src/lib/crypto/krb/default_state.c -index 0757c8b02..f89dc7902 100644 +index 0757c8b02c..f89dc79023 100644 --- a/src/lib/crypto/krb/default_state.c +++ b/src/lib/crypto/krb/default_state.c @@ -32,16 +32,6 @@ @@ -4657,7 +4715,7 @@ index 0757c8b02..f89dc7902 100644 krb5int_default_free_state(krb5_data *state) { diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c -index 1542d4062..a0037912a 100644 +index 1542d40629..a0037912a7 100644 --- a/src/lib/crypto/krb/enctype_util.c +++ b/src/lib/crypto/krb/enctype_util.c @@ -45,6 +45,9 @@ struct { @@ -4671,7 +4729,7 @@ index 1542d4062..a0037912a 100644 }; diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c -index fc278783b..7635393a4 100644 +index fc278783b9..7635393a41 100644 --- a/src/lib/crypto/krb/etypes.c +++ b/src/lib/crypto/krb/etypes.c @@ -35,27 +35,6 @@ @@ -4704,7 +4762,7 @@ index fc278783b..7635393a4 100644 { ENCTYPE_ARCFOUR_HMAC, diff --git a/src/lib/crypto/krb/prf_des.c b/src/lib/crypto/krb/prf_des.c deleted file mode 100644 -index 7a2d719c5..000000000 +index 7a2d719c5f..0000000000 --- a/src/lib/crypto/krb/prf_des.c +++ /dev/null @@ -1,47 +0,0 @@ @@ -4756,10 +4814,10 @@ index 7a2d719c5..000000000 - return ktp->enc->encrypt(key, NULL, &iov, 1); -} diff --git a/src/lib/crypto/krb/random_to_key.c b/src/lib/crypto/krb/random_to_key.c -index 157462526..863090beb 100644 +index 9394385aa0..863090beb2 100644 --- a/src/lib/crypto/krb/random_to_key.c +++ b/src/lib/crypto/krb/random_to_key.c -@@ -71,48 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock) +@@ -71,31 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock) memcpy(keyblock->contents, randombits->data, randombits->length); return 0; } @@ -4773,23 +4831,6 @@ index 157462526..863090beb 100644 -} - -krb5_error_code --k5_rand2key_des(const krb5_data *randombits, krb5_keyblock *keyblock) --{ -- if (randombits->length != 7) -- return(KRB5_CRYPTO_INTERNAL); -- -- keyblock->magic = KV5M_KEYBLOCK; -- -- /* Take the seven bytes, move them around into the top 7 bits of the -- * 8 key bytes, then compute the parity bits. */ -- memcpy(keyblock->contents, randombits->data, randombits->length); -- eighth_byte(keyblock->contents); -- k5_des_fixup_key_parity(keyblock->contents); -- -- return 0; --} -- --krb5_error_code -k5_rand2key_des3(const krb5_data *randombits, krb5_keyblock *keyblock) -{ - int i; @@ -4809,7 +4850,7 @@ index 157462526..863090beb 100644 - return 0; -} diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports -index d6cc1b423..f44cb9170 100644 +index 052f4d4b51..d8ffa63304 100644 --- a/src/lib/crypto/libk5crypto.exports +++ b/src/lib/crypto/libk5crypto.exports @@ -86,7 +86,6 @@ krb5_k_verify_checksum @@ -4818,23 +4859,23 @@ index d6cc1b423..f44cb9170 100644 krb5int_aes_decrypt -krb5int_enc_des3 krb5int_arcfour_gsscrypt - krb5int_camellia_cbc_mac + krb5int_camellia_encrypt krb5int_cmac_checksum diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in -index aa434b168..234fc0e76 100644 +index 08de047d0a..88f7fd0a09 100644 --- a/src/lib/crypto/openssl/Makefile.in +++ b/src/lib/crypto/openssl/Makefile.in @@ -1,6 +1,6 @@ mydir=lib$(S)crypto$(S)openssl BUILDTOP=$(REL)..$(S)..$(S).. --SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider -+SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider - LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir) +-SUBDIRS=des enc_provider hash_provider ++SUBDIRS=enc_provider hash_provider + LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS) STLIBOBJS=\ @@ -24,14 +24,14 @@ SRCS=\ - $(srcdir)/sha256.c \ - $(srcdir)/stubs.c + $(srcdir)/pbkdf2.c \ + $(srcdir)/sha256.c -STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ +STOBJLISTS= md4/OBJS.ST \ @@ -4860,13 +4901,13 @@ index aa434b168..234fc0e76 100644 @libobj_frag@ diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in deleted file mode 100644 -index 4392fb8ea..000000000 +index a6cece1dd1..0000000000 --- a/src/lib/crypto/openssl/des/Makefile.in +++ /dev/null @@ -1,20 +0,0 @@ -mydir=lib$(S)crypto$(S)openssl$(S)des -BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/.. +-LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) - -STLIBOBJS= des_keys.o - @@ -4886,31 +4927,30 @@ index 4392fb8ea..000000000 - diff --git a/src/lib/crypto/openssl/des/deps b/src/lib/crypto/openssl/des/deps deleted file mode 100644 -index 21b904f89..000000000 +index 723c268082..0000000000 --- a/src/lib/crypto/openssl/des/deps +++ /dev/null -@@ -1,15 +0,0 @@ +@@ -1,14 +0,0 @@ -# -# Generated makefile dependencies follow. -# -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \ -- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_keys.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_keys.c diff --git a/src/lib/crypto/openssl/des/des_keys.c b/src/lib/crypto/openssl/des/des_keys.c deleted file mode 100644 -index 51d9db216..000000000 +index 83f1cbf22a..0000000000 --- a/src/lib/crypto/openssl/des/des_keys.c +++ /dev/null -@@ -1,40 +0,0 @@ +@@ -1,39 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/openssl/des/des_keys.c - Key functions used by Kerberos code */ -/* @@ -4938,6 +4978,9 @@ index 51d9db216..000000000 - */ - -#include "crypto_int.h" +- +-#ifdef K5_OPENSSL_DES_KEY_PARITY +- -#include - -void @@ -4946,17 +4989,13 @@ index 51d9db216..000000000 - DES_set_odd_parity((DES_cblock *)keybits); -} - --krb5_boolean --k5_des_is_weak_key(unsigned char *keybits) --{ -- return DES_is_weak_key((DES_cblock *)keybits); --} +-#endif diff --git a/src/lib/crypto/openssl/enc_provider/Makefile.in b/src/lib/crypto/openssl/enc_provider/Makefile.in -index a9069d22d..2b32c3ac4 100644 +index 26827cfed5..f0d37c1213 100644 --- a/src/lib/crypto/openssl/enc_provider/Makefile.in +++ b/src/lib/crypto/openssl/enc_provider/Makefile.in @@ -3,19 +3,16 @@ BUILDTOP=$(REL)..$(S)..$(S)..$(S).. - LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/.. + LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) STLIBOBJS= \ - des3.o \ @@ -4976,7 +5015,7 @@ index a9069d22d..2b32c3ac4 100644 $(srcdir)/camellia.c \ $(srcdir)/rc4.c diff --git a/src/lib/crypto/openssl/enc_provider/deps b/src/lib/crypto/openssl/enc_provider/deps -index 1c28cc842..91ba48234 100644 +index 1c87a526d0..a502990a0c 100644 --- a/src/lib/crypto/openssl/enc_provider/deps +++ b/src/lib/crypto/openssl/enc_provider/deps @@ -1,17 +1,6 @@ @@ -4986,23 +5025,23 @@ index 1c28cc842..91ba48234 100644 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ -- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des3.c +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des3.c aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c deleted file mode 100644 -index 1c439c2cd..000000000 +index 90fcf9acb5..0000000000 --- a/src/lib/crypto/openssl/enc_provider/des3.c +++ /dev/null -@@ -1,184 +0,0 @@ +@@ -1,188 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/openssl/enc_provider/des3.c */ -/* @@ -5055,8 +5094,10 @@ index 1c439c2cd..000000000 - */ - -#include "crypto_int.h" --#include - +-#ifdef K5_OPENSSL_DES +- +-#include - -#define DES3_BLOCK_SIZE 8 -#define DES3_KEY_SIZE 24 @@ -5187,11 +5228,26 @@ index 1c439c2cd..000000000 - krb5int_des_init_state, - krb5int_default_free_state -}; +- +-#endif /* K5_OPENSSL_DES */ +diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c +index 41e845eae0..5a43c3d9eb 100644 +--- a/src/lib/crypto/openssl/kdf.c ++++ b/src/lib/crypto/openssl/kdf.c +@@ -60,8 +60,6 @@ enc_name(const struct krb5_enc_provider *enc) + return "AES-128-CBC"; + if (enc == &krb5int_enc_aes256) + return "AES-256-CBC"; +- if (enc == &krb5int_enc_des3) +- return "DES-EDE3-CBC"; + return NULL; + } + diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 75f071c3e..fcf2c2152 100644 +index d4e90793f9..1bc807172b 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -1039,7 +1039,6 @@ kg_accept_krb5(minor_status, context_handle, +@@ -1030,7 +1030,6 @@ kg_accept_krb5(minor_status, context_handle, } switch (negotiated_etype) { @@ -5200,7 +5256,7 @@ index 75f071c3e..fcf2c2152 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index a7e0e63ec..3bacdcd35 100644 +index a4446530fc..88d41130a7 100644 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h @@ -125,14 +125,14 @@ enum sgn_alg { @@ -5230,7 +5286,7 @@ index a7e0e63ec..3bacdcd35 100644 }; diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c -index d1cdce486..7f7146a0a 100644 +index d1cdce486f..7f7146a0a2 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c @@ -136,19 +136,12 @@ make_seal_token_v1 (krb5_context context, @@ -5283,7 +5339,7 @@ index d1cdce486..7f7146a0a 100644 krb5_free_checksum_contents(context, &md5cksum); diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c -index 9bb2ee109..9147bb2c7 100644 +index 9bb2ee1099..9147bb2c78 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c @@ -144,18 +144,11 @@ make_seal_token_v1_iov(krb5_context context, @@ -5328,7 +5384,7 @@ index 9bb2ee109..9147bb2c7 100644 /* create the seq_num */ code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF, diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c -index 9b183bc33..f0cc4a680 100644 +index 9b183bc337..f0cc4a6809 100644 --- a/src/lib/gssapi/krb5/k5unseal.c +++ b/src/lib/gssapi/krb5/k5unseal.c @@ -131,28 +131,21 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, @@ -5393,13 +5449,15 @@ index 9b183bc33..f0cc4a680 100644 + if (signalg != SGN_ALG_HMAC_MD5) { *minor_status = 0; return(GSS_S_DEFECTIVE_TOKEN); -- ++ } + - case SGN_ALG_HMAC_SHA1_DES3_KD: - case SGN_ALG_HMAC_MD5: - /* compute the checksum of the message */ - - /* 8 = bytes of token body to be checksummed according to spec */ -- ++ /* compute the checksum of the message */ + - if (! (data_ptr = xmalloc(8 + plainlen))) { - if (sealalg != 0xffff) - xfree(plain); @@ -5408,33 +5466,9 @@ index 9b183bc33..f0cc4a680 100644 - *minor_status = ENOMEM; - return(GSS_S_FAILURE); - } -- -- (void) memcpy(data_ptr, ptr-2, 8); -- -- (void) memcpy(data_ptr+8, plain, plainlen); -- -- plaind.length = 8 + plainlen; -- plaind.data = data_ptr; -- code = krb5_k_make_checksum(context, md5cksum.checksum_type, -- ctx->seq, sign_usage, -- &plaind, &md5cksum); -- xfree(data_ptr); -- -- if (code) { -- if (toktype == KG_TOK_SEAL_MSG) -- gssalloc_free(token.value); -- *minor_status = code; -- return(GSS_S_FAILURE); -- } -- -- code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); -- break; - } - -+ /* compute the checksum of the message */ -+ + /* 8 = bytes of token body to be checksummed according to spec */ -+ + +- (void) memcpy(data_ptr, ptr-2, 8); + if (! (data_ptr = xmalloc(8 + plainlen))) { + if (sealalg != 0xffff) + xfree(plain); @@ -5443,32 +5477,47 @@ index 9b183bc33..f0cc4a680 100644 + *minor_status = ENOMEM; + return(GSS_S_FAILURE); + } -+ + +- (void) memcpy(data_ptr+8, plain, plainlen); + (void) memcpy(data_ptr, ptr-2, 8); -+ + +- plaind.length = 8 + plainlen; +- plaind.data = data_ptr; +- code = krb5_k_make_checksum(context, md5cksum.checksum_type, +- ctx->seq, sign_usage, +- &plaind, &md5cksum); +- xfree(data_ptr); + (void) memcpy(data_ptr+8, plain, plainlen); -+ + +- if (code) { +- if (toktype == KG_TOK_SEAL_MSG) +- gssalloc_free(token.value); +- *minor_status = code; +- return(GSS_S_FAILURE); +- } + plaind.length = 8 + plainlen; + plaind.data = data_ptr; + code = krb5_k_make_checksum(context, md5cksum.checksum_type, + ctx->seq, sign_usage, + &plaind, &md5cksum); + xfree(data_ptr); -+ + +- code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); +- break; + if (code) { + if (toktype == KG_TOK_SEAL_MSG) + gssalloc_free(token.value); + *minor_status = code; + return(GSS_S_FAILURE); -+ } -+ + } + + code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); + krb5_free_checksum_contents(context, &md5cksum); if (sealalg != 0xffff) xfree(plain); diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c -index 85a9574f3..3ce2a90ce 100644 +index 85a9574f36..3ce2a90ce9 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context, @@ -5547,7 +5596,7 @@ index 85a9574f3..3ce2a90ce 100644 code = 0; retval = GSS_S_BAD_SIG; diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c -index 84f194988..32150f5e3 100644 +index 84f1949887..32150f5e34 100644 --- a/src/lib/gssapi/krb5/util_crypt.c +++ b/src/lib/gssapi/krb5/util_crypt.c @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey, @@ -5569,7 +5618,7 @@ index 84f194988..32150f5e3 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype, diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index aa35baa3c..bfa99d9eb 100644 +index 87b486c53f..2b5abcd817 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5580,7 +5629,7 @@ index aa35baa3c..bfa99d9eb 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -467,8 +466,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5590,7 +5639,7 @@ index aa35baa3c..bfa99d9eb 100644 mod_list(ENCTYPE_AES256_CTS_HMAC_SHA1_96, sel, weak, &list); mod_list(ENCTYPE_AES128_CTS_HMAC_SHA1_96, sel, weak, &list); diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c -index 44d113e7c..966278578 100644 +index 44d113e7c5..9662785783 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c @@ -288,8 +288,6 @@ verify_s4u2self_reply(krb5_context context, @@ -5603,7 +5652,7 @@ index 44d113e7c..966278578 100644 case ENCTYPE_ARCFOUR_HMAC_EXP : not_newer = TRUE; diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c -index 90c9f626c..935aca12f 100644 +index 90c9f626c6..935aca12f5 100644 --- a/src/lib/krb5/krb/t_etypes.c +++ b/src/lib/krb5/krb/t_etypes.c @@ -50,17 +50,6 @@ static struct { @@ -5675,7 +5724,7 @@ index 90c9f626c..935aca12f 100644 { NULL, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 }, diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c -index 10ba8d0ac..24064ffcf 100644 +index 10ba8d0ac7..24064ffcfd 100644 --- a/src/lib/krb5/os/t_trace.c +++ b/src/lib/krb5/os/t_trace.c @@ -65,8 +65,8 @@ main (int argc, char *argv[]) @@ -5690,7 +5739,7 @@ index 10ba8d0ac..24064ffcf 100644 krb5_keytab keytab; krb5_creds creds; diff --git a/src/lib/krb5/os/t_trace.ref b/src/lib/krb5/os/t_trace.ref -index 044a66999..98fb14f3f 100644 +index 044a66999e..98fb14f3f7 100644 --- a/src/lib/krb5/os/t_trace.ref +++ b/src/lib/krb5/os/t_trace.ref @@ -41,7 +41,7 @@ int, krb5_principal type: ? @@ -5703,7 +5752,7 @@ index 044a66999..98fb14f3f 100644 krb5_ccache, display type:name: FILE:/path/to/ccache krb5_keytab, display name: FILE:/etc/krb5.keytab diff --git a/src/plugins/preauth/pkinit/pkcs11.h b/src/plugins/preauth/pkinit/pkcs11.h -index e3d284631..586661bb7 100644 +index e3d2846315..586661bb7e 100644 --- a/src/plugins/preauth/pkinit/pkcs11.h +++ b/src/plugins/preauth/pkinit/pkcs11.h @@ -339,9 +339,9 @@ typedef unsigned long ck_key_type_t; @@ -5719,99 +5768,29 @@ index e3d284631..586661bb7 100644 #define CKK_CAST (0x16) #define CKK_CAST3 (0x17) #define CKK_CAST128 (0x18) -diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c -index 2817cc213..a385da7c3 100644 ---- a/src/plugins/preauth/pkinit/pkinit_clnt.c -+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c -@@ -212,14 +212,6 @@ pkinit_as_req_create(krb5_context context, - auth_pack.clientPublicValue = &info; - auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids; - -- /* add List of CMS algorithms */ -- retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx, -- reqctx->cryptoctx, -- reqctx->idctx, &cmstypes); -- auth_pack.supportedCMSTypes = cmstypes; -- if (retval) -- goto cleanup; -- - switch(protocol) { - case DH_PROTOCOL: - TRACE_PKINIT_CLIENT_REQ_DH(context); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 77d5c61fe..1f9868351 100644 +index 94a1b22fb1..65f6210727 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h -@@ -380,18 +380,6 @@ krb5_error_code server_process_dh - unsigned int *server_key_len_out); /* OUT - receives length of DH secret key */ - --/* -- * this functions takes in crypto specific representation of -- * supportedCMSTypes and creates a list of -- * krb5_algorithm_identifier -- */ --krb5_error_code create_krb5_supportedCMSTypes +@@ -376,11 +376,11 @@ krb5_error_code server_process_dh + * krb5_algorithm_identifier + */ + krb5_error_code create_krb5_supportedCMSTypes - (krb5_context context, /* IN */ - pkinit_plg_crypto_context plg_cryptoctx, /* IN */ - pkinit_req_crypto_context req_cryptoctx, /* IN */ - pkinit_identity_crypto_context id_cryptoctx, /* IN */ - krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */ -- ++ (krb5_context context, /* IN */ ++ pkinit_plg_crypto_context plg_cryptoctx, /* IN */ ++ pkinit_req_crypto_context req_cryptoctx, /* IN */ ++ pkinit_identity_crypto_context id_cryptoctx, /* IN */ ++ krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */ + /* * this functions takes in crypto specific representation of - * trustedCertifiers and creates a list of -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e5940a513..e1153344e 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -5486,44 +5486,6 @@ cleanup: - return retval; - } - --krb5_error_code --create_krb5_supportedCMSTypes(krb5_context context, -- pkinit_plg_crypto_context plg_cryptoctx, -- pkinit_req_crypto_context req_cryptoctx, -- pkinit_identity_crypto_context id_cryptoctx, -- krb5_algorithm_identifier ***oids) --{ -- -- krb5_error_code retval = ENOMEM; -- krb5_algorithm_identifier **loids = NULL; -- krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" }; -- -- *oids = NULL; -- loids = malloc(2 * sizeof(krb5_algorithm_identifier *)); -- if (loids == NULL) -- goto cleanup; -- loids[1] = NULL; -- loids[0] = malloc(sizeof(krb5_algorithm_identifier)); -- if (loids[0] == NULL) { -- free(loids); -- goto cleanup; -- } -- retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid); -- if (retval) { -- free(loids[0]); -- free(loids); -- goto cleanup; -- } -- loids[0]->parameters.length = 0; -- loids[0]->parameters.data = NULL; -- -- *oids = loids; -- retval = 0; --cleanup: -- -- return retval; --} -- - krb5_error_code - create_krb5_trustedCertifiers(krb5_context context, - pkinit_plg_crypto_context plg_cryptoctx, diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c -index 7acbd0d28..cd998a29a 100644 +index 7f38e84910..99c93ac128 100644 --- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c +++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c @@ -49,7 +49,6 @@ char eighteen_bs[9]; @@ -5822,14 +5801,13 @@ index 7acbd0d28..cd998a29a 100644 const krb5_data lha_data = DATA_FROM_STRING("lha"); krb5_octet key1_hex[] = -@@ -185,36 +184,6 @@ main(int argc, char **argv) +@@ -187,35 +186,6 @@ main(int argc, char **argv) goto cleanup; } - /* TEST 3: SHA-512/DES3 */ - /* set up algorithm id */ -- alg_id.algorithm.data = (char *)krb5_pkinit_sha512_oid; -- alg_id.algorithm.length = krb5_pkinit_sha512_oid_len; +- alg_id.algorithm = sha512_id; - - enctype = enctype_des3; - @@ -5839,7 +5817,7 @@ index 7acbd0d28..cd998a29a 100644 - u_principal, v_principal, - enctype, &as_req, &pk_as_rep, - &key_block))) { -- printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d", +- printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n", - retval); - goto cleanup; - } @@ -5860,7 +5838,7 @@ index 7acbd0d28..cd998a29a 100644 /* release all allocated resources, whether good or bad return */ free(secret.data); diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c -index 2279202d3..96b0307d7 100644 +index 2279202d3a..96b0307d78 100644 --- a/src/plugins/preauth/spake/t_vectors.c +++ b/src/plugins/preauth/spake/t_vectors.c @@ -56,31 +56,6 @@ struct test { @@ -5895,158 +5873,8 @@ index 2279202d3..96b0307d7 100644 { ENCTYPE_ARCFOUR_HMAC, SPAKE_GROUP_EDWARDS25519, /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", -diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp -index 85bbf478a..302dee74c 100644 ---- a/src/tests/dejagnu/config/default.exp -+++ b/src/tests/dejagnu/config/default.exp -@@ -15,8 +15,6 @@ set timeout 100 - set stty_init {erase \^h kill \^u} - set env(TERM) dumb - --set des3_krbtgt 0 -- - if { [string length $VALGRIND] } { - rename spawn valgrind_aux_spawn - proc spawn { args } { -@@ -105,17 +103,9 @@ if { $PRIOCNTL_HACK } { - # particularly with regards to encryption types. - - set passes { -- { -- des3 -- mode=udp -- des3_krbtgt=1 -- {supported_enctypes=des3-cbc-sha1:normal} -- {dummy=[verbose -log "DES3 TGT, DES3 enctype"]} -- } - { - aes-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=aes256-cts-hmac-sha1-96:normal} - {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96} - {permitted_enctypes(client)=aes256-cts-hmac-sha1-96} -@@ -130,7 +120,6 @@ set passes { - { - aes-sha2-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=aes256-sha2:normal} - {permitted_enctypes(kdc)=aes256-sha2} - {permitted_enctypes(replica)=aes256-sha2} -@@ -146,7 +135,6 @@ set passes { - { - camellia-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=camellia256-cts:normal} - {permitted_enctypes(kdc)=camellia256-cts} - {permitted_enctypes(replica)=camellia256-cts} -@@ -159,32 +147,9 @@ set passes { - {master_key_type=camellia256-cts} - {dummy=[verbose -log "Camellia-256 enctype"]} - } -- { -- aes-des3 -- mode=udp -- des3_krbtgt=0 -- {supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal} -- {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {master_key_type=aes256-cts-hmac-sha1-96} -- {dummy=[verbose -log "AES + DES3 + DES enctypes"]} -- } -- { -- aes-des3tgt -- mode=udp -- des3_krbtgt=1 -- {supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal} -- {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {master_key_type=aes256-cts-hmac-sha1-96} -- {dummy=[verbose -log "AES enctypes, DES3 TGT"]} -- } - { - all-enctypes - mode=udp -- des3_krbtgt=0 - {allow_weak_crypto(kdc)=false} - {allow_weak_crypto(replica)=false} - {allow_weak_crypto(client)=false} -@@ -946,7 +911,6 @@ proc setup_kerberos_db { standalone } { - global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY - global tmppwd hostname - global spawn_id -- global des3_krbtgt - global multipass_name last_passname_db - - set failall 0 -@@ -1143,48 +1107,6 @@ proc setup_kerberos_db { standalone } { - } - } - -- if $des3_krbtgt { -- # Set the TGT key to DES3. -- set test "kadmin.local TGT to DES3" -- set body { -- if $failall { -- break -- } -- spawn $KADMIN_LOCAL -r $REALMNAME -e des3-cbc-sha1:normal -- verbose "starting $test" -- expect_after $def_exp_after -- -- expect "kadmin.local: " -- send "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r" -- # It echos... -- expect "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r" -- expect { -- "Key for \"krbtgt/$REALMNAME@$REALMNAME\" randomized." { } -- } -- expect "kadmin.local: " -- send "quit\r" -- expect eof -- catch expect_after -- if ![check_exit_status kadmin_local] { -- break -- } -- } -- set ret [catch $body] -- catch "expect eof" -- catch expect_after -- if $ret { -- set failall 1 -- if $standalone { -- fail $test -- } else { -- delete_db -- } -- } else { -- if $standalone { -- pass $test -- } -- } -- } - envstack_pop - - # create the admin database lock file -diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp -index 661e3fd9a..2b8f60045 100644 ---- a/src/tests/dejagnu/krb-standalone/kprop.exp -+++ b/src/tests/dejagnu/krb-standalone/kprop.exp -@@ -54,7 +54,7 @@ proc doit { } { - global REALMNAME KEY - global KADMIN_LOCAL KTUTIL KDB5_UTIL KPROPLOG KPROP kpropd_spawn_id - global hostname tmppwd spawn_id timeout -- global KRBIV supported_enctypes portbase mode ulog des3_krbtgt -+ global KRBIV supported_enctypes portbase mode ulog - - # Delete any db, ulog files - delete_db diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py -index 7494d7fcd..2f95d8996 100755 +index 7494d7fcdb..2f95d89967 100755 --- a/src/tests/gssapi/t_enctypes.py +++ b/src/tests/gssapi/t_enctypes.py @@ -1,24 +1,17 @@ @@ -6115,7 +5943,7 @@ index 7494d7fcd..2f95d8996 100755 # because the ticket session key and initiator subkey are # non-permitted. (This is unfortunate if the acceptor's restriction diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c -index 9876a11e6..fb8fe5511 100644 +index 9876a11e67..fb8fe55111 100644 --- a/src/tests/gssapi/t_invalid.c +++ b/src/tests/gssapi/t_invalid.c @@ -84,18 +84,6 @@ struct test { @@ -6138,7 +5966,7 @@ index 9876a11e6..fb8fe5511 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC, SEAL_ALG_MICROSOFT_RC4, SGN_ALG_HMAC_MD5, 8, diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c -index 7368f752f..bf22bd3da 100644 +index 7368f752f0..bf22bd3da1 100644 --- a/src/tests/gssapi/t_pcontok.c +++ b/src/tests/gssapi/t_pcontok.c @@ -43,7 +43,6 @@ @@ -6173,7 +6001,7 @@ index 7368f752f..bf22bd3da 100644 tlen = 20 + mech_krb5.length + cksize; token = malloc(tlen); diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c -index f71774cdc..d1857c433 100644 +index f71774cdc9..d1857c433f 100644 --- a/src/tests/gssapi/t_prf.c +++ b/src/tests/gssapi/t_prf.c @@ -41,13 +41,6 @@ static struct { @@ -6191,10 +6019,10 @@ index f71774cdc..d1857c433 100644 "3BB3AE288C12B3B9D06B208A4151B3B6", "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28" diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py -index 3fa957ad2..2e01f46bc 100644 +index 97e2474bf8..47ea9e4b47 100644 --- a/src/tests/t_authdata.py +++ b/src/tests/t_authdata.py -@@ -174,7 +174,7 @@ realm.run([kvno, 'restricted']) +@@ -164,7 +164,7 @@ realm.run([kvno, 'restricted']) # preferred krbtgt enctype changes. mark('#8139 regression test') realm.kinit(realm.user_princ, password('user'), ['-f']) @@ -6204,7 +6032,7 @@ index 3fa957ad2..2e01f46bc 100644 realm.run(['./forward']) realm.run([kvno, realm.host_princ]) diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py -index c982508d8..96e90a69d 100644 +index c982508d8b..96e90a69d2 100644 --- a/src/tests/t_etype_info.py +++ b/src/tests/t_etype_info.py @@ -1,6 +1,6 @@ @@ -6253,7 +6081,7 @@ index c982508d8..96e90a69d 100644 # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED # error if the client does optimistic preauth. diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py -index 2c825a692..f29e0d550 100755 +index 2c825a6922..f29e0d5500 100755 --- a/src/tests/t_keyrollover.py +++ b/src/tests/t_keyrollover.py @@ -37,9 +37,9 @@ realm.run([klist, '-e'], expected_msg=msg) @@ -6281,7 +6109,7 @@ index 2c825a692..f29e0d550 100755 realm.stop() diff --git a/src/tests/t_mkey.py b/src/tests/t_mkey.py -index 32f4070bc..da0ed1831 100755 +index 32f4070bcb..da0ed1831e 100755 --- a/src/tests/t_mkey.py +++ b/src/tests/t_mkey.py @@ -7,7 +7,6 @@ import struct @@ -6334,7 +6162,7 @@ index 32f4070bc..da0ed1831 100755 # master key fetch does not segfault. mark('#8395 regression test') diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py -index 65084bbf3..55ca89745 100755 +index 65084bbf35..55ca897459 100755 --- a/src/tests/t_salt.py +++ b/src/tests/t_salt.py @@ -16,13 +16,12 @@ def test_salt(realm, e1, salt, e2): @@ -6354,10 +6182,10 @@ index 65084bbf3..55ca89745 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. diff --git a/src/util/k5test.py b/src/util/k5test.py -index 6afe4b92c..789b0f4b9 100644 +index 619f1995f8..771f82e3cc 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py -@@ -1278,13 +1278,6 @@ _passes = [ +@@ -1344,13 +1344,6 @@ _passes = [ # No special settings; exercises AES256. ('default', None, None, None), @@ -6372,7 +6200,7 @@ index 6afe4b92c..789b0f4b9 100644 ('arcfour', None, {'libdefaults': {'permitted_enctypes': 'rc4'}}, diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm -index 1aebdd0b4..c38eefd2b 100644 +index 1aebdd0b4a..c38eefd2bd 100644 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm +++ b/src/windows/leash/htmlhelp/html/Encryption_Types.htm @@ -79,19 +79,6 @@ will have an entry in the Encryption type column.
@@ -6395,3 +6223,6 @@ index 1aebdd0b4..c38eefd2b 100644 aes The AES Advanced Encryption Standard family, like 3DES, is a symmetric block cipher and was designed +-- +2.38.1 + diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch similarity index 91% rename from downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch rename to 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 553dec9..ecf661d 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 91e1d43858d90f59f5d9f45987cfca02c3175feb Mon Sep 17 00:00:00 2001 +From 239cd24624b801d4fc4bb4686bef8526e7675d77 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -21,10 +21,10 @@ post7 restores MD5 and adds radius_md5_fips_override. post8 silences a static analyzer warning. -Last-updated: krb5-1.17 +Last-updated: krb5-1.20 --- doc/admin/conf_files/krb5_conf.rst | 6 +++ - src/lib/crypto/krb/prng.c | 11 ++++- + src/lib/crypto/krb/prng.c | 15 +++++- .../crypto/openssl/enc_provider/camellia.c | 6 +++ src/lib/crypto/openssl/enc_provider/rc4.c | 13 +++++- .../crypto/openssl/hash_provider/hash_evp.c | 12 +++++ @@ -38,10 +38,10 @@ Last-updated: krb5-1.17 src/lib/krad/t_attrset.c | 4 +- src/plugins/preauth/spake/spake_client.c | 6 +++ src/plugins/preauth/spake/spake_kdc.c | 6 +++ - 15 files changed, 151 insertions(+), 33 deletions(-) + 15 files changed, 155 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 675175955..adba8238d 100644 +index d5d6e06ebb..2a4962069f 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: @@ -58,22 +58,26 @@ index 675175955..adba8238d 100644 If this flag is true, reverse name lookup will be used in addition to forward name lookup to canonicalizing hostnames for use in diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c -index cb9ca9b98..f0e9984ca 100644 +index d6b79e2dea..9e80a03d21 100644 --- a/src/lib/crypto/krb/prng.c +++ b/src/lib/crypto/krb/prng.c -@@ -26,6 +26,8 @@ +@@ -26,6 +26,12 @@ #include "crypto_int.h" +#include ++ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++#include ++#endif + krb5_error_code KRB5_CALLCONV krb5_c_random_seed(krb5_context context, krb5_data *data) { -@@ -99,9 +101,16 @@ krb5_boolean - k5_get_os_entropy(unsigned char *buf, size_t len, int strong) +@@ -96,9 +102,16 @@ cleanup: + static krb5_boolean + get_os_entropy(unsigned char *buf, size_t len) { - const char *device; -#if defined(__linux__) && defined(SYS_getrandom) int r; @@ -89,10 +93,10 @@ index cb9ca9b98..f0e9984ca 100644 /* * Pull from the /dev/urandom pool, but require it to have been seeded. diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c -index 2da691329..f79679a0b 100644 +index 01920e6ce1..d9f327add6 100644 --- a/src/lib/crypto/openssl/enc_provider/camellia.c +++ b/src/lib/crypto/openssl/enc_provider/camellia.c -@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data, +@@ -387,6 +387,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data, unsigned char blockY[CAMELLIA_BLOCK_SIZE], blockB[CAMELLIA_BLOCK_SIZE]; struct iov_cursor cursor; @@ -102,7 +106,7 @@ index 2da691329..f79679a0b 100644 if (output->length < CAMELLIA_BLOCK_SIZE) return KRB5_BAD_MSIZE; -@@ -331,6 +334,9 @@ static krb5_error_code +@@ -418,6 +421,9 @@ static krb5_error_code krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage, krb5_data *state) { @@ -113,10 +117,10 @@ index 2da691329..f79679a0b 100644 state->data = (void *) malloc(16); if (state->data == NULL) diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c -index bc87c6f42..9bf407899 100644 +index 448d563348..ce63cb5f1b 100644 --- a/src/lib/crypto/openssl/enc_provider/rc4.c +++ b/src/lib/crypto/openssl/enc_provider/rc4.c -@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, +@@ -69,6 +69,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, EVP_CIPHER_CTX *ctx = NULL; struct arcfour_state *arcstate; @@ -126,7 +130,7 @@ index bc87c6f42..9bf407899 100644 arcstate = (state != NULL) ? (void *)state->data : NULL; if (arcstate != NULL) { ctx = arcstate->ctx; -@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, +@@ -116,7 +119,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, static void k5_arcfour_free_state(krb5_data *state) { @@ -140,7 +144,7 @@ index bc87c6f42..9bf407899 100644 EVP_CIPHER_CTX_free(arcstate->ctx); free(arcstate); -@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key, +@@ -128,6 +136,9 @@ k5_arcfour_init_state(const krb5_keyblock *key, { struct arcfour_state *arcstate; @@ -151,10 +155,10 @@ index bc87c6f42..9bf407899 100644 * The cipher state here is a saved pointer to a struct arcfour_state * object, rather than a flat byte array as in most enc providers. The diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c -index 1e0fb8fc3..2eb5139c0 100644 +index f2fbffdb29..11659908bb 100644 --- a/src/lib/crypto/openssl/hash_provider/hash_evp.c +++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c -@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, +@@ -60,6 +60,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, if (ctx == NULL) return ENOMEM; @@ -166,7 +170,7 @@ index 1e0fb8fc3..2eb5139c0 100644 ok = EVP_DigestInit_ex(ctx, type, NULL); for (i = 0; i < num_data; i++) { if (!SIGN_IOV(&data[i])) -@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, +@@ -78,6 +83,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, static krb5_error_code hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) { @@ -178,6 +182,7 @@ index 1e0fb8fc3..2eb5139c0 100644 return hash_evp(EVP_md4(), data, num_data, output); } +@@ -90,6 +100,8 @@ const struct krb5_hash_provider krb5int_hash_md4 = { static krb5_error_code hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) { @@ -187,24 +192,24 @@ index 1e0fb8fc3..2eb5139c0 100644 } diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c -index 7dc59dcc0..769a50c00 100644 +index bf12b8d6a0..f21e268f7f 100644 --- a/src/lib/crypto/openssl/hmac.c +++ b/src/lib/crypto/openssl/hmac.c -@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash) +@@ -111,7 +111,11 @@ map_digest(const struct krb5_hash_provider *hash) return EVP_sha256(); - else if (!strncmp(hash->hash_name, "SHA-384",7)) + else if (hash == &krb5int_hash_sha384) return EVP_sha384(); -- else if (!strncmp(hash->hash_name, "MD5", 3)) +- else if (hash == &krb5int_hash_md5) + + if (FIPS_mode()) + return NULL; + -+ if (!strncmp(hash->hash_name, "MD5", 3)) ++ if (hash == &krb5int_hash_md5) return EVP_md5(); - else if (!strncmp(hash->hash_name, "MD4", 3)) + else if (hash == &krb5int_hash_md4) return EVP_md4(); diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c -index 9c13d9d75..42d354a3b 100644 +index 9c13d9d755..42d354a3b5 100644 --- a/src/lib/krad/attr.c +++ b/src/lib/krad/attr.c @@ -38,7 +38,8 @@ @@ -328,7 +333,7 @@ index 9c13d9d75..42d354a3b 100644 krad_attr diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c -index 03c613716..d89982a13 100644 +index f309f1581c..6ec031e320 100644 --- a/src/lib/krad/attrset.c +++ b/src/lib/krad/attrset.c @@ -167,7 +167,8 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy) @@ -351,7 +356,7 @@ index 03c613716..d89982a13 100644 return retval; diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 0143d155a..57672982f 100644 +index 7619563fc5..e123763954 100644 --- a/src/lib/krad/internal.h +++ b/src/lib/krad/internal.h @@ -39,6 +39,8 @@ @@ -397,7 +402,7 @@ index 0143d155a..57672982f 100644 /* Decode attributes from a buffer. */ krb5_error_code -@@ -152,4 +163,17 @@ gai_error_code(int err) +@@ -156,4 +167,17 @@ gai_error_code(int err) } } @@ -416,7 +421,7 @@ index 0143d155a..57672982f 100644 + #endif /* INTERNAL_H_ */ diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c -index c597174b6..fc2d24800 100644 +index c597174b65..fc2d248001 100644 --- a/src/lib/krad/packet.c +++ b/src/lib/krad/packet.c @@ -53,12 +53,6 @@ typedef unsigned char uchar; @@ -477,7 +482,7 @@ index c597174b6..fc2d24800 100644 } diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index a938665f6..7b5804b1d 100644 +index 06ae751bc8..929f1cef67 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr) @@ -498,7 +503,7 @@ index a938665f6..7b5804b1d 100644 request_finish(r, 0, rsp); break; } -@@ -455,6 +455,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, +@@ -460,6 +460,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, (krad_packet_iter_cb)iterator, &r, &tmp); if (retval != 0) goto error; @@ -512,7 +517,7 @@ index a938665f6..7b5804b1d 100644 K5_TAILQ_FOREACH(r, &rr->list, list) { if (r->request == tmp) { diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c -index eb2a780c8..4d285ad9d 100644 +index eb2a780c89..4d285ad9de 100644 --- a/src/lib/krad/t_attr.c +++ b/src/lib/krad/t_attr.c @@ -50,6 +50,7 @@ main() @@ -533,7 +538,7 @@ index eb2a780c8..4d285ad9d 100644 insist(len == sizeof(encoded)); insist(memcmp(outbuf, encoded, len) == 0); diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c -index 7928335ca..0f9576253 100644 +index 7928335ca4..0f95762534 100644 --- a/src/lib/krad/t_attrset.c +++ b/src/lib/krad/t_attrset.c @@ -49,6 +49,7 @@ main() @@ -555,7 +560,7 @@ index 7928335ca..0f9576253 100644 /* Manually encode User-Name. */ diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c -index 00734a13b..a3ce22b70 100644 +index 00734a13b5..a3ce22b70f 100644 --- a/src/plugins/preauth/spake/spake_client.c +++ b/src/plugins/preauth/spake/spake_client.c @@ -38,6 +38,8 @@ @@ -579,7 +584,7 @@ index 00734a13b..a3ce22b70 100644 vt->name = "spake"; vt->pa_type_list = pa_types; diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c -index 88c964ce1..c7df0392f 100644 +index 1a772d450f..232e78bc05 100644 --- a/src/plugins/preauth/spake/spake_kdc.c +++ b/src/plugins/preauth/spake/spake_kdc.c @@ -41,6 +41,8 @@ @@ -591,7 +596,7 @@ index 88c964ce1..c7df0392f 100644 /* * The SPAKE kdcpreauth module uses a secure cookie containing the following * concatenated fields (all integer fields are big-endian): -@@ -571,6 +573,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver, +@@ -551,6 +553,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver, if (maj_ver != 1) return KRB5_PLUGIN_VER_NOTSUPP; @@ -602,3 +607,6 @@ index 88c964ce1..c7df0392f 100644 vt = (krb5_kdcpreauth_vtable)vtable; vt->name = "spake"; vt->pa_type_list = pa_types; +-- +2.38.1 + diff --git a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch similarity index 90% rename from downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch rename to 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch index 7455cb9..b8e5429 100644 --- a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch +++ b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch @@ -1,7 +1,8 @@ -From a43d621ae83c89abb74764f0fd9d90a8e9992333 Mon Sep 17 00:00:00 2001 +From 5587c755b6ca82bde093523e2d17b255158cd90e Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 May 2022 17:15:12 +0200 -Subject: [PATCH] Allow krad UDP/TCP localhost connection with FIPS +Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection + with FIPS libkrad allows to establish connections only to UNIX socket in FIPS mode, because MD5 digest is not considered safe enough to be used for @@ -17,7 +18,7 @@ Resolves: rhbz#2082189 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index 7b5804b1d..e671bc5c2 100644 +index 929f1cef67..063f17a613 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -33,6 +33,7 @@ @@ -64,7 +65,7 @@ index 7b5804b1d..e671bc5c2 100644 /* Iterate over the set of outstanding packets. */ static const krad_packet * iterator(request **out) -@@ -455,8 +485,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, +@@ -460,8 +490,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, (krad_packet_iter_cb)iterator, &r, &tmp); if (retval != 0) goto error; @@ -77,5 +78,5 @@ index 7b5804b1d..e671bc5c2 100644 retval = ESOCKTNOSUPPORT; goto error; -- -2.35.1 +2.38.1 diff --git a/Add-configure-variable-for-default-PKCS-11-module.patch b/0007-Add-configure-variable-for-default-PKCS-11-module.patch similarity index 93% rename from Add-configure-variable-for-default-PKCS-11-module.patch rename to 0007-Add-configure-variable-for-default-PKCS-11-module.patch index 724b707..1445133 100644 --- a/Add-configure-variable-for-default-PKCS-11-module.patch +++ b/0007-Add-configure-variable-for-default-PKCS-11-module.patch @@ -1,4 +1,4 @@ -From 2a91dabd9752825b96faf3b25ea643d5282c5957 Mon Sep 17 00:00:00 2001 +From 842b4c3b5695e2518e6f1a1545db78865c04b59c Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Fri, 22 Apr 2022 14:12:37 +0200 Subject: [PATCH] Add configure variable for default PKCS#11 module @@ -20,10 +20,10 @@ ticket: 9058 (new) 9 files changed, 34 insertions(+), 16 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index adba8238d..3d25c9a12 100644 +index 2a4962069f..a33711d918 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst -@@ -1020,7 +1020,7 @@ information for PKINIT is as follows: +@@ -1017,7 +1017,7 @@ information for PKINIT is as follows: All keyword/values are optional. *modname* specifies the location of a library implementing PKCS #11. If a value is encountered with no keyword, it is assumed to be the *modname*. If no @@ -33,10 +33,10 @@ index adba8238d..3d25c9a12 100644 a particular smard card reader or token if there is more than one available. ``certid=`` and/or ``certlabel=`` may be specified to diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst -index a8959626d..8f8ac911c 100644 +index 9e355dc2c5..e879b18bd2 100644 --- a/doc/build/options2configure.rst +++ b/doc/build/options2configure.rst -@@ -143,6 +143,9 @@ Environment variables +@@ -137,6 +137,9 @@ Environment variables This option allows one to specify libraries to be passed to the linker (e.g., ``-l``) @@ -47,7 +47,7 @@ index a8959626d..8f8ac911c 100644 If ``-lss`` is not the correct way to link in your installed ss library, for example if additional support libraries are needed, diff --git a/doc/conf.py b/doc/conf.py -index a876fd633..252ab891a 100644 +index 12168fa695..0ab5ff9606 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -242,6 +242,7 @@ if 'mansubs' in tags: @@ -75,7 +75,7 @@ index a876fd633..252ab891a 100644 .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst -index 74e69f4ad..aea7af3db 100644 +index 74e69f4ad0..aea7af3dbb 100644 --- a/doc/mitK5defaults.rst +++ b/doc/mitK5defaults.rst @@ -59,18 +59,19 @@ subdirectories of ``/usr/local``. When MIT krb5 is integrated into an @@ -111,10 +111,10 @@ index 74e69f4ad..aea7af3db 100644 The default client keytab name (DEFCKTNAME) typically defaults to ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom diff --git a/src/configure.ac b/src/configure.ac -index 82b049af9..52e6563da 100644 +index 8dc864718d..9774cb71ae 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1442,6 +1442,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) +@@ -1471,6 +1471,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"], [Define to default client keytab name]) @@ -130,7 +130,7 @@ index 82b049af9..52e6563da 100644 AC_CONFIG_FILES([build-tools/kadm-server.pc build-tools/kadm-client.pc diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in -index 379bc3651..a1b0cff0a 100644 +index 379bc36511..a1b0cff0a4 100644 --- a/src/doc/Makefile.in +++ b/src/doc/Makefile.in @@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@ @@ -150,7 +150,7 @@ index 379bc3651..a1b0cff0a 100644 # Dummy rule that man/Makefile can invoke version.py: $(docsrc)/version.py diff --git a/src/man/Makefile.in b/src/man/Makefile.in -index 00b1b2de0..85cae0914 100644 +index 00b1b2de06..85cae0914e 100644 --- a/src/man/Makefile.in +++ b/src/man/Makefile.in @@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@ @@ -172,10 +172,10 @@ index 00b1b2de0..85cae0914 100644 all: $(MANSUBS) diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man -index e993d5c09..42f5ea4f9 100644 +index 51acb38815..fd2c6f2bc4 100644 --- a/src/man/krb5.conf.man +++ b/src/man/krb5.conf.man -@@ -1151,7 +1151,7 @@ user\(aqs certificate and private key. +@@ -1148,7 +1148,7 @@ user\(aqs certificate and private key. All keyword/values are optional. \fImodname\fP specifies the location of a library implementing PKCS #11. If a value is encountered with no keyword, it is assumed to be the \fImodname\fP\&. If no @@ -185,7 +185,7 @@ index e993d5c09..42f5ea4f9 100644 a particular smard card reader or token if there is more than one available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h -index b437fd53f..a2018cb10 100644 +index 8135535e2c..66f92d8f03 100644 --- a/src/plugins/preauth/pkinit/pkinit.h +++ b/src/plugins/preauth/pkinit/pkinit.h @@ -42,7 +42,6 @@ @@ -197,5 +197,5 @@ index b437fd53f..a2018cb10 100644 #define PK_NOSLOT 999999 #endif -- -2.35.1 +2.38.1 diff --git a/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch b/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch new file mode 100644 index 0000000..3755c15 --- /dev/null +++ b/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch @@ -0,0 +1,159 @@ +From 3fb8c4c68274d2ff4addb44b7b95b4698c2c4f34 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 1 Jun 2022 18:02:04 +0200 +Subject: [PATCH] Set reasonable supportedCMSTypes in PKINIT + +The PKINIT client uses AuthPack.supportedCMSTypes to let the KDC know +the algorithms it supports for verification of the CMS data signature. +(The MIT krb5 KDC currently ignores this list, but other +implementations use it.) + +Replace 3DES with sha512WithRSAEncryption and sha256WithRSAEncryption. + +[ghudson@mit.edu: simplified code and used appropriate helpers; edited +commit message] + +ticket: 9066 (new) +--- + src/plugins/preauth/pkinit/pkinit_constants.c | 33 ++++++++++++- + src/plugins/preauth/pkinit/pkinit_crypto.h | 4 ++ + .../preauth/pkinit/pkinit_crypto_openssl.c | 49 ++++++++++--------- + 3 files changed, 60 insertions(+), 26 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c +index 652897fa14..1da482e0b4 100644 +--- a/src/plugins/preauth/pkinit/pkinit_constants.c ++++ b/src/plugins/preauth/pkinit/pkinit_constants.c +@@ -32,9 +32,14 @@ + + #include "pkinit.h" + +-/* statically declare OID constants for all three algorithms */ +-static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01}; ++/* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */ ++static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 }; ++/* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */ + static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 }; ++/* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */ + static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 }; + + const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid }; +@@ -48,6 +53,30 @@ krb5_data const * const supported_kdf_alg_ids[] = { + NULL + }; + ++/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) ++ * rsadsi(113549) pkcs(1) 1 11 */ ++static char sha256WithRSAEncr_oid[9] = { ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b ++}; ++/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) ++ * rsadsi(113549) pkcs(1) 1 13 */ ++static char sha512WithRSAEncr_oid[9] = { ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d ++}; ++ ++const krb5_data sha256WithRSAEncr_id = { ++ KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid ++}; ++const krb5_data sha512WithRSAEncr_id = { ++ KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid ++}; ++ ++krb5_data const * const supported_cms_algs[] = { ++ &sha512WithRSAEncr_id, ++ &sha256WithRSAEncr_id, ++ NULL ++}; ++ + /* RFC 2412 section E.2 (well-known group 2) parameters, DER-encoded as + * DomainParameters (RFC 3279 section 2.3.3). */ + static const uint8_t o1024[] = { +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 65f6210727..64300da856 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -620,6 +620,10 @@ extern const krb5_data oakley_4096; + */ + extern krb5_data const * const supported_kdf_alg_ids[]; + ++/* CMS signature algorithms supported by this implementation, in order of ++ * decreasing preference. */ ++extern krb5_data const * const supported_cms_algs[]; ++ + krb5_error_code + crypto_encode_der_cert(krb5_context context, pkinit_req_crypto_context reqctx, + uint8_t **der_out, size_t *der_len); +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index d500455dec..1c2aa02827 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -5475,37 +5475,38 @@ create_krb5_supportedCMSTypes(krb5_context context, + pkinit_plg_crypto_context plg_cryptoctx, + pkinit_req_crypto_context req_cryptoctx, + pkinit_identity_crypto_context id_cryptoctx, +- krb5_algorithm_identifier ***oids) ++ krb5_algorithm_identifier ***algs_out) + { ++ krb5_error_code ret; ++ krb5_algorithm_identifier **algs = NULL; ++ size_t i, count; + +- krb5_error_code retval = ENOMEM; +- krb5_algorithm_identifier **loids = NULL; +- krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" }; ++ *algs_out = NULL; + +- *oids = NULL; +- loids = malloc(2 * sizeof(krb5_algorithm_identifier *)); +- if (loids == NULL) +- goto cleanup; +- loids[1] = NULL; +- loids[0] = malloc(sizeof(krb5_algorithm_identifier)); +- if (loids[0] == NULL) { +- free(loids); +- goto cleanup; +- } +- retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid); +- if (retval) { +- free(loids[0]); +- free(loids); ++ /* Count supported OIDs and allocate list (including null terminator). */ ++ for (count = 0; supported_cms_algs[count] != NULL; count++); ++ algs = k5calloc(count + 1, sizeof(*algs), &ret); ++ if (algs == NULL) + goto cleanup; ++ ++ /* Add an algorithm identifier for each OID, with no parameters. */ ++ for (i = 0; i < count; i++) { ++ algs[i] = k5alloc(sizeof(*algs[i]), &ret); ++ if (algs[i] == NULL) ++ goto cleanup; ++ ret = krb5int_copy_data_contents(context, supported_cms_algs[i], ++ &algs[i]->algorithm); ++ if (ret) ++ goto cleanup; ++ algs[i]->parameters = empty_data(); + } +- loids[0]->parameters.length = 0; +- loids[0]->parameters.data = NULL; + +- *oids = loids; +- retval = 0; +-cleanup: ++ *algs_out = algs; ++ algs = NULL; + +- return retval; ++cleanup: ++ free_krb5_algorithm_identifiers(&algs); ++ return ret; + } + + krb5_error_code +-- +2.38.1 + diff --git a/0009-Simplify-plugin-loading-code.patch b/0009-Simplify-plugin-loading-code.patch new file mode 100644 index 0000000..42802e5 --- /dev/null +++ b/0009-Simplify-plugin-loading-code.patch @@ -0,0 +1,622 @@ +From ffb47e4120d68aef015453350a3a50a9bab1ec58 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 23 Jun 2022 16:41:40 -0400 +Subject: [PATCH] Simplify plugin loading code + +Remove the USE_CFBUNDLE code, which was only used by KfM. Handle +platform conditionals according to current practice. Use +k5_dir_filenames() instead of opendir() and remove the Windows +implementation of opendir(). +--- + src/util/support/plugins.c | 507 +++++++++++-------------------------- + 1 file changed, 150 insertions(+), 357 deletions(-) + +diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c +index c6a9a21d57..0850565687 100644 +--- a/src/util/support/plugins.c ++++ b/src/util/support/plugins.c +@@ -29,16 +29,6 @@ + #if USE_DLOPEN + #include + #endif +-#include +-#ifdef HAVE_SYS_STAT_H +-#include +-#endif +-#ifdef HAVE_SYS_PARAM_H +-#include +-#endif +-#ifdef HAVE_UNISTD_H +-#include +-#endif + + #if USE_DLOPEN + #ifdef RTLD_GROUP +@@ -68,16 +58,6 @@ + #endif + #endif + +-#if USE_DLOPEN && USE_CFBUNDLE +-#include +- +-/* Currently CoreFoundation only exists on the Mac so we just use +- * pthreads directly to avoid creating empty function calls on other +- * platforms. If a thread initializer ever gets created in the common +- * plugin code, move this there */ +-static pthread_mutex_t krb5int_bundle_mutex = PTHREAD_MUTEX_INITIALIZER; +-#endif +- + #include + static void Tprintf (const char *fmt, ...) + { +@@ -90,374 +70,193 @@ static void Tprintf (const char *fmt, ...) + } + + struct plugin_file_handle { +-#if USE_DLOPEN ++#if defined(USE_DLOPEN) + void *dlhandle; +-#endif +-#ifdef _WIN32 +- HMODULE hinstPlugin; +-#endif +-#if !defined (USE_DLOPEN) && !defined (_WIN32) ++#elif defined(_WIN32) ++ HMODULE module; ++#else + char dummy; + #endif + }; + +-#ifdef _WIN32 +-struct dirent { +- long d_ino; /* inode (always 1 in WIN32) */ +- off_t d_off; /* offset to this dirent */ +- unsigned short d_reclen; /* length of d_name */ +- char d_name[_MAX_FNAME+1]; /* filename (null terminated) */ +-}; +- +-typedef struct { +- intptr_t handle; /* _findfirst/_findnext handle */ +- short offset; /* offset into directory */ +- short finished; /* 1 if there are not more files */ +- struct _finddata_t fileinfo;/* from _findfirst/_findnext */ +- char *dir; /* the dir we are reading */ +- struct dirent dent; /* the dirent to return */ +-} DIR; ++#if defined(USE_DLOPEN) + +-DIR * opendir(const char *dir) ++static long ++open_plugin_dlfcn(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) + { +- DIR *dp; +- char *filespec; +- intptr_t handle; +- int index; +- +- filespec = malloc(strlen(dir) + 2 + 1); +- strcpy(filespec, dir); +- index = strlen(filespec) - 1; +- if (index >= 0 && (filespec[index] == '/' || filespec[index] == '\\')) +- filespec[index] = '\0'; +- strcat(filespec, "/*"); +- +- dp = (DIR *)malloc(sizeof(DIR)); +- dp->offset = 0; +- dp->finished = 0; +- dp->dir = strdup(dir); +- +- if ((handle = _findfirst(filespec, &(dp->fileinfo))) < 0) { +- if (errno == ENOENT) +- dp->finished = 1; +- else { +- free(filespec); +- free(dp->dir); +- free(dp); +- return NULL; +- } ++ const char *e; ++ ++ h->dlhandle = dlopen(filename, PLUGIN_DLOPEN_FLAGS); ++ if (h->dlhandle == NULL) { ++ e = dlerror(); ++ if (e == NULL) ++ e = _("unknown failure"); ++ Tprintf("dlopen(%s): %s\n", filename, e); ++ k5_set_error(ep, ENOENT, _("unable to load plugin [%s]: %s"), ++ filename, e); ++ return ENOENT; + } +- +- dp->handle = handle; +- free(filespec); +- +- return dp; ++ return 0; + } ++#define open_plugin open_plugin_dlfcn + +-struct dirent * readdir(DIR *dp) ++static long ++get_sym_dlfcn(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- if (!dp || dp->finished) return NULL; +- +- if (dp->offset != 0) { +- if (_findnext(dp->handle, &(dp->fileinfo)) < 0) { +- dp->finished = 1; +- return NULL; +- } ++ const char *e; ++ ++ if (h->dlhandle == NULL) ++ return ENOENT; ++ *sym_out = dlsym(h->dlhandle, csymname); ++ if (*sym_out == NULL) { ++ e = dlerror(); ++ if (e == NULL) ++ e = _("unknown failure"); ++ Tprintf("dlsym(%s): %s\n", csymname, e); ++ k5_set_error(ep, ENOENT, "%s", e); ++ return ENOENT; + } +- dp->offset++; +- +- strncpy(dp->dent.d_name, dp->fileinfo.name, _MAX_FNAME); +- dp->dent.d_ino = 1; +- dp->dent.d_reclen = (unsigned short)strlen(dp->dent.d_name); +- dp->dent.d_off = dp->offset; +- +- return &(dp->dent); +-} +- +-int closedir(DIR *dp) +-{ +- if (!dp) return 0; +- _findclose(dp->handle); +- free(dp->dir); +- free(dp); +- + return 0; + } +-#endif ++#define get_sym get_sym_dlfcn + +-long KRB5_CALLCONV +-krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct errinfo *ep) ++static void ++close_plugin_dlfcn(struct plugin_file_handle *h) + { +- long err = 0; +- struct plugin_file_handle *htmp = NULL; +- int got_plugin = 0; +-#if defined(USE_CFBUNDLE) || defined(_WIN32) +- struct stat statbuf; +- +- if (!err) { +- if (stat (filepath, &statbuf) < 0) { +- err = errno; +- Tprintf ("stat(%s): %s\n", filepath, strerror (err)); +- k5_set_error(ep, err, _("unable to find plugin [%s]: %s"), +- filepath, strerror(err)); +- } +- } +-#endif +- +- if (!err) { +- htmp = calloc (1, sizeof (*htmp)); /* calloc initializes ptrs to NULL */ +- if (htmp == NULL) { err = ENOMEM; } +- } +- +-#if USE_DLOPEN +- if (!err +-#if USE_CFBUNDLE +- && ((statbuf.st_mode & S_IFMT) == S_IFREG +- || (statbuf.st_mode & S_IFMT) == S_IFDIR) +-#endif /* USE_CFBUNDLE */ +- ) { +- void *handle = NULL; +- +-#if USE_CFBUNDLE +- char executablepath[MAXPATHLEN]; +- +- if ((statbuf.st_mode & S_IFMT) == S_IFDIR) { +- int lock_err = 0; +- CFStringRef pluginString = NULL; +- CFURLRef pluginURL = NULL; +- CFBundleRef pluginBundle = NULL; +- CFURLRef executableURL = NULL; +- +- /* Lock around CoreFoundation calls since objects are refcounted +- * and the refcounts are not thread-safe. Using pthreads directly +- * because this code is Mac-specific */ +- lock_err = pthread_mutex_lock(&krb5int_bundle_mutex); +- if (lock_err) { err = lock_err; } +- +- if (!err) { +- pluginString = CFStringCreateWithCString (kCFAllocatorDefault, +- filepath, +- kCFStringEncodingASCII); +- if (pluginString == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- pluginURL = CFURLCreateWithFileSystemPath (kCFAllocatorDefault, +- pluginString, +- kCFURLPOSIXPathStyle, +- true); +- if (pluginURL == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- pluginBundle = CFBundleCreate (kCFAllocatorDefault, pluginURL); +- if (pluginBundle == NULL) { err = ENOENT; } /* XXX need better error */ +- } +- +- if (!err) { +- executableURL = CFBundleCopyExecutableURL (pluginBundle); +- if (executableURL == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- if (!CFURLGetFileSystemRepresentation (executableURL, +- true, /* absolute */ +- (UInt8 *)executablepath, +- sizeof (executablepath))) { +- err = ENOMEM; +- } +- } +- +- if (!err) { +- /* override the path the caller passed in */ +- filepath = executablepath; +- } +- +- if (executableURL != NULL) { CFRelease (executableURL); } +- if (pluginBundle != NULL) { CFRelease (pluginBundle); } +- if (pluginURL != NULL) { CFRelease (pluginURL); } +- if (pluginString != NULL) { CFRelease (pluginString); } +- +- /* unlock after CFRelease calls since they modify refcounts */ +- if (!lock_err) { pthread_mutex_unlock (&krb5int_bundle_mutex); } +- } +-#endif /* USE_CFBUNDLE */ +- +- if (!err) { +- handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); +- if (handle == NULL) { +- const char *e = dlerror(); +- if (e == NULL) +- e = _("unknown failure"); +- Tprintf ("dlopen(%s): %s\n", filepath, e); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, _("unable to load plugin [%s]: %s"), +- filepath, e); +- } +- } ++ if (h->dlhandle != NULL) ++ dlclose(h->dlhandle); ++} ++#define close_plugin close_plugin_dlfcn + +- if (!err) { +- got_plugin = 1; +- htmp->dlhandle = handle; +- handle = NULL; +- } ++#elif defined(_WIN32) + +- if (handle != NULL) { dlclose (handle); } ++static long ++open_plugin_win32(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) ++{ ++ h->module = LoadLibrary(filename); ++ if (h == NULL) { ++ Tprintf("Unable to load dll: %s\n", filename); ++ k5_set_error(ep, ENOENT, _("unable to load DLL [%s]"), filename); ++ return ENOENT; + } +-#endif /* USE_DLOPEN */ +- +-#ifdef _WIN32 +- if (!err && (statbuf.st_mode & S_IFMT) == S_IFREG) { +- HMODULE handle = NULL; ++ return 0; ++} ++#define open_plugin open_plugin_win32 + +- handle = LoadLibrary(filepath); +- if (handle == NULL) { +- Tprintf ("Unable to load dll: %s\n", filepath); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, _("unable to load DLL [%s]"), filepath); +- } ++static long ++get_sym_win32(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) ++{ ++ LPVOID lpMsgBuf; ++ DWORD dw; + +- if (!err) { +- got_plugin = 1; +- htmp->hinstPlugin = handle; +- handle = NULL; ++ if (h->module == NULL) ++ return ENOENT; ++ *sym_out = GetProcAddress(h->module, csymname); ++ if (*sym_out == NULL) { ++ Tprintf("GetProcAddress(%s): %i\n", csymname, GetLastError()); ++ dw = GetLastError(); ++ if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | ++ FORMAT_MESSAGE_FROM_SYSTEM, ++ NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), ++ (LPTSTR)&lpMsgBuf, 0, NULL)) { ++ k5_set_error(ep, ENOENT, _("unable to get DLL Symbol: %s"), ++ (char *)lpMsgBuf); ++ LocalFree(lpMsgBuf); + } +- +- if (handle != NULL) +- FreeLibrary(handle); +- } +-#endif +- +- if (!err && !got_plugin) { +- err = ENOENT; /* no plugin or no way to load plugins */ +- k5_set_error(ep, err, _("plugin unavailable: %s"), strerror(err)); ++ return ENOENT; + } ++ return 0; ++} ++#define get_sym get_sym_win32 + +- if (!err) { +- *h = htmp; +- htmp = NULL; /* h takes ownership */ +- } ++static void ++close_plugin_win32(struct plugin_file_handle *h) ++{ ++ if (h->module != NULL) ++ FreeLibrary(h->module); ++} ++#define close_plugin close_plugin_win32 + +- free(htmp); ++#else + +- return err; ++static long ++open_plugin_dummy(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) ++{ ++ k5_set_error(ep, ENOENT, _("plugin loading unavailable")); ++ return ENOENT; + } ++#define open_plugin open_plugin_dummy + + static long +-krb5int_get_plugin_sym (struct plugin_file_handle *h, +- const char *csymname, int isfunc, void **ptr, +- struct errinfo *ep) ++get_sym_dummy(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- long err = 0; +- void *sym = NULL; ++ return ENOENT; ++} ++#define get_sym get_sym_dummy ++ ++static void ++close_plugin_dummy(struct plugin_file_handle *h) ++{ ++} ++#define close_plugin close_plugin_dummy + +-#if USE_DLOPEN +- if (!err && !sym && (h->dlhandle != NULL)) { +- /* XXX Do we need to add a leading "_" to the symbol name on any +- modern platforms? */ +- sym = dlsym (h->dlhandle, csymname); +- if (sym == NULL) { +- const char *e = dlerror (); /* XXX copy and save away */ +- if (e == NULL) +- e = "unknown failure"; +- Tprintf ("dlsym(%s): %s\n", csymname, e); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, "%s", e); +- } +- } + #endif + +-#ifdef _WIN32 +- LPVOID lpMsgBuf; +- DWORD dw; ++long KRB5_CALLCONV ++krb5int_open_plugin(const char *filename, ++ struct plugin_file_handle **handle_out, struct errinfo *ep) ++{ ++ long ret; ++ struct plugin_file_handle *h; + +- if (!err && !sym && (h->hinstPlugin != NULL)) { +- sym = GetProcAddress(h->hinstPlugin, csymname); +- if (sym == NULL) { +- const char *e = "unable to get dll symbol"; /* XXX copy and save away */ +- Tprintf ("GetProcAddress(%s): %i\n", csymname, GetLastError()); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, "%s", e); +- +- dw = GetLastError(); +- if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | +- FORMAT_MESSAGE_FROM_SYSTEM, +- NULL, +- dw, +- MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), +- (LPTSTR) &lpMsgBuf, +- 0, NULL )) { +- +- fprintf (stderr, "unable to get dll symbol, %s\n", (LPCTSTR)lpMsgBuf); +- LocalFree(lpMsgBuf); +- } +- } +- } +-#endif ++ *handle_out = NULL; + +- if (!err && (sym == NULL)) { +- err = ENOENT; /* unimplemented */ +- } ++ h = calloc(1, sizeof(*h)); ++ if (h == NULL) ++ return ENOMEM; + +- if (!err) { +- *ptr = sym; ++ ret = open_plugin(h, filename, ep); ++ if (ret) { ++ free(h); ++ return ret; + } + +- return err; ++ *handle_out = h; ++ return 0; + } + + long KRB5_CALLCONV +-krb5int_get_plugin_data (struct plugin_file_handle *h, const char *csymname, +- void **ptr, struct errinfo *ep) ++krb5int_get_plugin_data(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- return krb5int_get_plugin_sym (h, csymname, 0, ptr, ep); ++ return get_sym(h, csymname, sym_out, ep); + } + + long KRB5_CALLCONV +-krb5int_get_plugin_func (struct plugin_file_handle *h, const char *csymname, +- void (**ptr)(), struct errinfo *ep) ++krb5int_get_plugin_func(struct plugin_file_handle *h, const char *csymname, ++ void (**sym_out)(), struct errinfo *ep) + { + void *dptr = NULL; +- long err = krb5int_get_plugin_sym (h, csymname, 1, &dptr, ep); +- if (!err) { +- /* Cast function pointers to avoid code duplication */ +- *ptr = (void (*)()) dptr; +- } +- return err; ++ long ret = get_sym(h, csymname, &dptr, ep); ++ ++ if (!ret) ++ *sym_out = (void (*)())dptr; ++ return ret; + } + + void KRB5_CALLCONV + krb5int_close_plugin (struct plugin_file_handle *h) + { +-#if USE_DLOPEN +- if (h->dlhandle != NULL) { dlclose(h->dlhandle); } +-#endif +-#ifdef _WIN32 +- if (h->hinstPlugin != NULL) { FreeLibrary(h->hinstPlugin); } +-#endif +- free (h); ++ close_plugin(h); ++ free(h); + } + +-/* autoconf docs suggest using this preference order */ +-#if HAVE_DIRENT_H || USE_DIRENT_H +-#include +-#define NAMELEN(D) strlen((D)->d_name) +-#else +-#ifndef _WIN32 +-#define dirent direct +-#define NAMELEN(D) ((D)->d->namlen) +-#else +-#define NAMELEN(D) strlen((D)->d_name) +-#endif +-#if HAVE_SYS_NDIR_H +-# include +-#elif HAVE_SYS_DIR_H +-# include +-#elif HAVE_NDIR_H +-# include +-#endif +-#endif +- + static long + krb5int_plugin_file_handle_array_init (struct plugin_file_handle ***harray) + { +@@ -619,42 +418,36 @@ krb5int_open_plugin_dirs (const char * const *dirnames, + if (handle != NULL) { krb5int_close_plugin (handle); } + } + } else { +- /* load all plugins in each directory */ +- DIR *dir = opendir (dirnames[i]); ++ char **fnames = NULL; ++ int j; + +- while (dir != NULL && !err) { +- struct dirent *d = NULL; ++ err = k5_dir_filenames(dirnames[i], &fnames); ++ for (j = 0; !err && fnames[j] != NULL; j++) { + char *filepath = NULL; + struct plugin_file_handle *handle = NULL; + +- d = readdir (dir); +- if (d == NULL) { break; } +- +- if ((strcmp (d->d_name, ".") == 0) || +- (strcmp (d->d_name, "..") == 0)) { ++ if (strcmp(fnames[j], ".") == 0 || ++ strcmp(fnames[j], "..") == 0) + continue; +- } + +- if (!err) { +- int len = NAMELEN (d); +- if (asprintf(&filepath, "%s/%*s", dirnames[i], len, d->d_name) < 0) { +- filepath = NULL; +- err = ENOMEM; +- } ++ if (asprintf(&filepath, "%s/%s", dirnames[i], fnames[j]) < 0) { ++ filepath = NULL; ++ err = ENOMEM; + } + +- if (!err) { +- if (krb5int_open_plugin (filepath, &handle, ep) == 0) { +- err = krb5int_plugin_file_handle_array_add (&h, &count, handle); +- if (!err) { handle = NULL; } /* h takes ownership */ +- } ++ if (!err && krb5int_open_plugin(filepath, &handle, ep) == 0) { ++ err = krb5int_plugin_file_handle_array_add(&h, &count, ++ handle); ++ if (!err) ++ handle = NULL; /* h takes ownership */ + } + + free(filepath); +- if (handle != NULL) { krb5int_close_plugin (handle); } ++ if (handle != NULL) ++ krb5int_close_plugin(handle); + } + +- if (dir != NULL) { closedir (dir); } ++ k5_free_filenames(fnames); + } + } + +-- +2.38.1 + diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch deleted file mode 100644 index 8578721..0000000 --- a/Add-APIs-for-marshalling-credentials.patch +++ /dev/null @@ -1,220 +0,0 @@ -From 3a99832252755cf7e5fef2bd824459cea3eb823e Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 14 Jan 2021 18:13:09 -0500 -Subject: [PATCH] Add APIs for marshalling credentials - -Faciliate KCM daemon implementations by providing functions to -deserialize and reserialize credentials in the FILE v4 format. - -[ghudson@mit.edu: minor editorial changes] - -ticket: 8980 (new) -(cherry picked from commit 18ea3bd2fca55b789b7de9c663624bc11d348fa6) ---- - doc/appdev/refs/api/index.rst | 2 ++ - src/include/krb5/krb5.hin | 36 ++++++++++++++++++++++ - src/lib/krb5/ccache/ccmarshal.c | 53 +++++++++++++++++++++++++++++++++ - src/lib/krb5/ccache/t_marshal.c | 15 +++++++++- - src/lib/krb5/libkrb5.exports | 2 ++ - src/lib/krb5_32.def | 4 +++ - 6 files changed, 111 insertions(+), 1 deletion(-) - -diff --git a/doc/appdev/refs/api/index.rst b/doc/appdev/refs/api/index.rst -index 727d9b492..9e03fd386 100644 ---- a/doc/appdev/refs/api/index.rst -+++ b/doc/appdev/refs/api/index.rst -@@ -232,6 +232,7 @@ Rarely used public interfaces - krb5_kt_remove_entry.rst - krb5_kt_start_seq_get.rst - krb5_make_authdata_kdc_issued.rst -+ krb5_marshal_credentials.rst - krb5_merge_authdata.rst - krb5_mk_1cred.rst - krb5_mk_error.rst -@@ -285,6 +286,7 @@ Rarely used public interfaces - krb5_tkt_creds_get_times.rst - krb5_tkt_creds_init.rst - krb5_tkt_creds_step.rst -+ krb5_unmarshal_credentials.rst - krb5_verify_init_creds.rst - krb5_verify_init_creds_opt_init.rst - krb5_verify_init_creds_opt_set_ap_req_nofail.rst -diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 63e67a2ba..c26dde535 100644 ---- a/src/include/krb5/krb5.hin -+++ b/src/include/krb5/krb5.hin -@@ -3125,6 +3125,42 @@ krb5_get_credentials(krb5_context context, krb5_flags options, - krb5_ccache ccache, krb5_creds *in_creds, - krb5_creds **out_creds); - -+/** -+ * Serialize a @c krb5_creds object. -+ * -+ * @param [in] context Library context -+ * @param [in] creds The credentials object to serialize -+ * @param [out] data_out The serialized credentials -+ * -+ * Serialize @a creds in the format used by the FILE ccache format (vesion 4) -+ * and KCM ccache protocol. -+ * -+ * Use krb5_free_data() to free @a data_out when it is no longer needed. -+ * -+ * @retval 0 Success; otherwise - Kerberos error codes -+ */ -+krb5_error_code KRB5_CALLCONV -+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, -+ krb5_data **data_out); -+ -+/** -+ * Deserialize a @c krb5_creds object. -+ * -+ * @param [in] context Library context -+ * @param [in] data The serialized credentials -+ * @param [out] creds_out The resulting creds object -+ * -+ * Deserialize @a data to credentials in the format used by the FILE ccache -+ * format (vesion 4) and KCM ccache protocol. -+ * -+ * Use krb5_free_creds() to free @a creds_out when it is no longer needed. -+ * -+ * @retval 0 Success; otherwise - Kerberos error codes -+ */ -+krb5_error_code KRB5_CALLCONV -+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, -+ krb5_creds **creds_out); -+ - /** @deprecated Replaced by krb5_get_validated_creds. */ - krb5_error_code KRB5_CALLCONV - krb5_get_credentials_validate(krb5_context context, krb5_flags options, -diff --git a/src/lib/krb5/ccache/ccmarshal.c b/src/lib/krb5/ccache/ccmarshal.c -index ae634ccab..ab284e721 100644 ---- a/src/lib/krb5/ccache/ccmarshal.c -+++ b/src/lib/krb5/ccache/ccmarshal.c -@@ -515,3 +515,56 @@ k5_marshal_mcred(struct k5buf *buf, krb5_creds *mcred) - if (mcred->second_ticket.length > 0) - put_data(buf, version, &mcred->second_ticket); - } -+ -+krb5_error_code KRB5_CALLCONV -+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, -+ krb5_data **data_out) -+{ -+ krb5_error_code ret; -+ krb5_data *data; -+ struct k5buf buf; -+ -+ *data_out = NULL; -+ -+ data = k5alloc(sizeof(krb5_data), &ret); -+ if (ret) -+ return ret; -+ -+ k5_buf_init_dynamic(&buf); -+ k5_marshal_cred(&buf, 4, in_creds); -+ -+ ret = k5_buf_status(&buf); -+ if (ret) { -+ free(data); -+ return ret; -+ } -+ -+ /* Steal payload from buf. */ -+ *data = make_data(buf.data, buf.len); -+ *data_out = data; -+ return 0; -+} -+ -+krb5_error_code KRB5_CALLCONV -+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, -+ krb5_creds **creds_out) -+{ -+ krb5_error_code ret; -+ krb5_creds *creds; -+ -+ *creds_out = NULL; -+ -+ creds = k5alloc(sizeof(krb5_creds), &ret); -+ if (ret) -+ return ret; -+ -+ ret = k5_unmarshal_cred((unsigned char *)data->data, data->length, 4, -+ creds); -+ if (ret) { -+ free(creds); -+ return ret; -+ } -+ -+ *creds_out = creds; -+ return 0; -+} -diff --git a/src/lib/krb5/ccache/t_marshal.c b/src/lib/krb5/ccache/t_marshal.c -index bd0284afa..96e0931a2 100644 ---- a/src/lib/krb5/ccache/t_marshal.c -+++ b/src/lib/krb5/ccache/t_marshal.c -@@ -268,13 +268,14 @@ main(int argc, char **argv) - krb5_context context; - krb5_ccache cache; - krb5_principal princ; -- krb5_creds cred1, cred2; -+ krb5_creds cred1, cred2, *alloc_cred; - krb5_cc_cursor cursor; - const char *filename; - char *ccname, filebuf[256]; - int version, fd; - const struct test *t; - struct k5buf buf; -+ krb5_data ser_data, *alloc_data; - - if (argc != 2) - abort(); -@@ -285,6 +286,18 @@ main(int argc, char **argv) - if (krb5_init_context(&context) != 0) - abort(); - -+ /* Test public functions for unmarshalling and marshalling. */ -+ ser_data = make_data((char *)tests[3].cred1, tests[3].cred1len); -+ if (krb5_unmarshal_credentials(context, &ser_data, &alloc_cred) != 0) -+ abort(); -+ verify_cred1(alloc_cred); -+ if (krb5_marshal_credentials(context, alloc_cred, &alloc_data) != 0) -+ abort(); -+ assert(alloc_data->length == tests[3].cred1len); -+ assert(memcmp(tests[3].cred1, alloc_data->data, alloc_data->length) == 0); -+ krb5_free_data(context, alloc_data); -+ krb5_free_creds(context, alloc_cred); -+ - for (version = FIRST_VERSION; version <= 4; version++) { - t = &tests[version - 1]; - -diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index 2d9d56530..adbfa332b 100644 ---- a/src/lib/krb5/libkrb5.exports -+++ b/src/lib/krb5/libkrb5.exports -@@ -489,6 +489,7 @@ krb5_lock_file - krb5_make_authdata_kdc_issued - krb5_make_full_ipaddr - krb5_make_fulladdr -+krb5_marshal_credentials - krb5_mcc_ops - krb5_merge_authdata - krb5_mk_1cred -@@ -592,6 +593,7 @@ krb5_timeofday - krb5_timestamp_to_sfstring - krb5_timestamp_to_string - krb5_unlock_file -+krb5_unmarshal_credentials - krb5_unpack_full_ipaddr - krb5_unparse_name - krb5_unparse_name_ext -diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def -index 4953907aa..60b8dd311 100644 ---- a/src/lib/krb5_32.def -+++ b/src/lib/krb5_32.def -@@ -503,3 +503,7 @@ EXPORTS - ; new in 1.19 - k5_cc_store_primary_cred @470 ; PRIVATE - k5_kt_have_match @471 ; PRIVATE GSSAPI -+ -+; new in 1.20 -+ krb5_marshal_credentials @472 -+ krb5_unmarshal_credentials @473 diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch deleted file mode 100644 index 455e3e0..0000000 --- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch +++ /dev/null @@ -1,358 +0,0 @@ -From 8772d8f47b7460a0eef48366881483fd9b3acfd3 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20B=C5=99ezina?= -Date: Thu, 11 Feb 2021 15:33:10 +0100 -Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration - -For large caches, one IPC operation per credential dominates the cost -of iteration. Instead transfer the whole list of credentials to the -client in one IPC operation. - -Add optional support for the new opcode to the test KCM server to -allow testing of the main and fallback code paths. - -[ghudson@mit.edu: fixed memory leaks and potential memory errors; -adjusted code style and comments; rewrote commit message; added -kcmserver.py support and tests] - -ticket: 8990 (new) -(cherry picked from commit 81bdb47d8ded390263d8ee48f71d5c312b4f1736) ---- - src/include/kcm.h | 12 ++- - src/lib/krb5/ccache/cc_kcm.c | 144 ++++++++++++++++++++++++++++++++--- - src/tests/kcmserver.py | 28 ++++++- - src/tests/t_ccache.py | 10 ++- - 4 files changed, 175 insertions(+), 19 deletions(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index 5ea1447cd..e4140c3a0 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -51,9 +51,9 @@ - * - * All replies begin with a 32-bit big-endian reply code. - * -- * Parameters are appended to the request or reply with no delimiters. Flags -- * and time offsets are stored as 32-bit big-endian integers. Names are -- * marshalled as zero-terminated strings. Principals and credentials are -+ * Parameters are appended to the request or reply with no delimiters. Flags, -+ * time offsets, and lengths are stored as 32-bit big-endian integers. Names -+ * are marshalled as zero-terminated strings. Principals and credentials are - * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists - * are not delimited, so nothing can come after them. - */ -@@ -89,7 +89,11 @@ typedef enum kcm_opcode { - KCM_OP_HAVE_NTLM_CRED, - KCM_OP_DEL_NTLM_CRED, - KCM_OP_DO_NTLM_AUTH, -- KCM_OP_GET_NTLM_USER_LIST -+ KCM_OP_GET_NTLM_USER_LIST, -+ -+ /* MIT extensions */ -+ KCM_OP_MIT_EXTENSION_BASE = 13000, -+ KCM_OP_GET_CRED_LIST, /* (name) -> (count, count*{len, cred}) */ - } kcm_opcode; - - #endif /* KCM_H */ -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 9093f894d..772928e4d 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -61,6 +61,17 @@ struct uuid_list { - size_t pos; - }; - -+struct cred_list { -+ krb5_creds *creds; -+ size_t count; -+ size_t pos; -+}; -+ -+struct kcm_cursor { -+ struct uuid_list *uuids; -+ struct cred_list *creds; -+}; -+ - struct kcmio { - SOCKET fd; - #ifdef __APPLE__ -@@ -489,6 +500,69 @@ free_uuid_list(struct uuid_list *uuids) - free(uuids); - } - -+static void -+free_cred_list(struct cred_list *list) -+{ -+ size_t i; -+ -+ if (list == NULL) -+ return; -+ -+ /* Creds are transferred to the caller as list->pos is incremented, so we -+ * can start freeing there. */ -+ for (i = list->pos; i < list->count; i++) -+ krb5_free_cred_contents(NULL, &list->creds[i]); -+ free(list->creds); -+ free(list); -+} -+ -+/* Fetch a cred list from req->reply. */ -+static krb5_error_code -+kcmreq_get_cred_list(struct kcmreq *req, struct cred_list **creds_out) -+{ -+ struct cred_list *list; -+ const unsigned char *data; -+ krb5_error_code ret = 0; -+ size_t count, len, i; -+ -+ *creds_out = NULL; -+ -+ /* Check a rough bound on the count to prevent very large allocations. */ -+ count = k5_input_get_uint32_be(&req->reply); -+ if (count > req->reply.len / 4) -+ return KRB5_KCM_MALFORMED_REPLY; -+ -+ list = malloc(sizeof(*list)); -+ if (list == NULL) -+ return ENOMEM; -+ -+ list->creds = NULL; -+ list->count = count; -+ list->pos = 0; -+ list->creds = k5calloc(count, sizeof(*list->creds), &ret); -+ if (list->creds == NULL) { -+ free(list); -+ return ret; -+ } -+ -+ for (i = 0; i < count; i++) { -+ len = k5_input_get_uint32_be(&req->reply); -+ data = k5_input_get_bytes(&req->reply, len); -+ if (data == NULL) -+ break; -+ ret = k5_unmarshal_cred(data, len, 4, &list->creds[i]); -+ if (ret) -+ break; -+ } -+ if (i < count) { -+ free_cred_list(list); -+ return (ret == ENOMEM) ? ENOMEM : KRB5_KCM_MALFORMED_REPLY; -+ } -+ -+ *creds_out = list; -+ return 0; -+} -+ - static void - kcmreq_free(struct kcmreq *req) - { -@@ -753,33 +827,53 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - { - krb5_error_code ret; - struct kcmreq req = EMPTY_KCMREQ; -- struct uuid_list *uuids; -+ struct uuid_list *uuids = NULL; -+ struct cred_list *creds = NULL; -+ struct kcm_cursor *cursor; - - *cursor_out = NULL; - - get_kdc_offset(context, cache); - -- kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); -+ kcmreq_init(&req, KCM_OP_GET_CRED_LIST, cache); - ret = cache_call(context, cache, &req); -- if (ret) -+ if (ret == 0) { -+ /* GET_CRED_LIST is available. */ -+ ret = kcmreq_get_cred_list(&req, &creds); -+ if (ret) -+ goto cleanup; -+ } else if (ret == KRB5_FCC_INTERNAL) { -+ /* Fall back to GET_CRED_UUID_LIST. */ -+ kcmreq_free(&req); -+ kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); -+ ret = cache_call(context, cache, &req); -+ if (ret) -+ goto cleanup; -+ ret = kcmreq_get_uuid_list(&req, &uuids); -+ if (ret) -+ goto cleanup; -+ } else { - goto cleanup; -- ret = kcmreq_get_uuid_list(&req, &uuids); -- if (ret) -+ } -+ -+ cursor = k5alloc(sizeof(*cursor), &ret); -+ if (cursor == NULL) - goto cleanup; -- *cursor_out = (krb5_cc_cursor)uuids; -+ cursor->uuids = uuids; -+ cursor->creds = creds; -+ *cursor_out = (krb5_cc_cursor)cursor; - - cleanup: - kcmreq_free(&req); - return ret; - } - --static krb5_error_code KRB5_CALLCONV --kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, -- krb5_creds *cred_out) -+static krb5_error_code -+next_cred_by_uuid(krb5_context context, krb5_ccache cache, -+ struct uuid_list *uuids, krb5_creds *cred_out) - { - krb5_error_code ret; - struct kcmreq req; -- struct uuid_list *uuids = (struct uuid_list *)*cursor; - - memset(cred_out, 0, sizeof(*cred_out)); - -@@ -797,11 +891,39 @@ kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, - return map_invalid(ret); - } - -+static krb5_error_code KRB5_CALLCONV -+kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, -+ krb5_creds *cred_out) -+{ -+ struct kcm_cursor *c = (struct kcm_cursor *)*cursor; -+ struct cred_list *list; -+ -+ if (c->uuids != NULL) -+ return next_cred_by_uuid(context, cache, c->uuids, cred_out); -+ -+ list = c->creds; -+ if (list->pos >= list->count) -+ return KRB5_CC_END; -+ -+ /* Transfer memory ownership of one cred to the caller. */ -+ *cred_out = list->creds[list->pos]; -+ memset(&list->creds[list->pos], 0, sizeof(*list->creds)); -+ list->pos++; -+ -+ return 0; -+} -+ - static krb5_error_code KRB5_CALLCONV - kcm_end_seq_get(krb5_context context, krb5_ccache cache, - krb5_cc_cursor *cursor) - { -- free_uuid_list((struct uuid_list *)*cursor); -+ struct kcm_cursor *c = *cursor; -+ -+ if (c == NULL) -+ return 0; -+ free_uuid_list(c->uuids); -+ free_cred_list(c->creds); -+ free(c); - *cursor = NULL; - return 0; - } -diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py -index 57432e5a7..8c5e66ff1 100644 ---- a/src/tests/kcmserver.py -+++ b/src/tests/kcmserver.py -@@ -23,6 +23,7 @@ - # traceback.print_exception(etype, value, tb, file=f) - # sys.excepthook = ehook - -+import optparse - import select - import socket - import struct -@@ -49,12 +50,14 @@ class KCMOpcodes(object): - SET_DEFAULT_CACHE = 21 - GET_KDC_OFFSET = 22 - SET_KDC_OFFSET = 23 -+ GET_CRED_LIST = 13001 - - - class KRB5Errors(object): - KRB5_CC_END = -1765328242 - KRB5_CC_NOSUPP = -1765328137 - KRB5_FCC_NOFILE = -1765328189 -+ KRB5_FCC_INTERNAL = -1765328188 - - - def make_uuid(): -@@ -183,6 +186,14 @@ def op_set_kdc_offset(argbytes): - return 0, b'' - - -+def op_get_cred_list(argbytes): -+ name, rest = unmarshal_name(argbytes) -+ cache = get_cache(name) -+ creds = [cache.creds[u] for u in cache.cred_uuids] -+ return 0, (struct.pack('>L', len(creds)) + -+ b''.join(struct.pack('>L', len(c)) + c for c in creds)) -+ -+ - ophandlers = { - KCMOpcodes.GEN_NEW : op_gen_new, - KCMOpcodes.INITIALIZE : op_initialize, -@@ -197,7 +208,8 @@ ophandlers = { - KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache, - KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache, - KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset, -- KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset -+ KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset, -+ KCMOpcodes.GET_CRED_LIST : op_get_cred_list - } - - # Read and respond to a request from the socket s. -@@ -215,7 +227,11 @@ def service_request(s): - - majver, minver, op = struct.unpack('>BBH', req[:4]) - argbytes = req[4:] -- code, payload = ophandlers[op](argbytes) -+ -+ if op in ophandlers: -+ code, payload = ophandlers[op](argbytes) -+ else: -+ code, payload = KRB5Errors.KRB5_FCC_INTERNAL, b'' - - # The KCM response is the code (4 bytes) and the response payload. - # The Heimdal IPC response is the length of the KCM response (4 -@@ -226,9 +242,15 @@ def service_request(s): - s.sendall(hipc_response) - return True - -+parser = optparse.OptionParser() -+parser.add_option('-c', '--credlist', action='store_true', dest='credlist', -+ default=False, help='Support KCM_OP_GET_CRED_LIST') -+(options, args) = parser.parse_args() -+if not options.credlist: -+ del ophandlers[KCMOpcodes.GET_CRED_LIST] - - server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) --server.bind(sys.argv[1]) -+server.bind(args[0]) - server.listen(5) - select_input = [server,] - sys.stderr.write('starting...\n') -diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py -index 66804afa5..90040fb7b 100755 ---- a/src/tests/t_ccache.py -+++ b/src/tests/t_ccache.py -@@ -125,10 +125,18 @@ def collection_test(realm, ccname): - - - collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) -+ -+# Test KCM without and with GET_CRED_LIST support. - kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') --realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], -+kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], -+ 'starting...') -+collection_test(realm, 'KCM:') -+stop_daemon(kcmd) -+os.remove(kcm_socket_path) -+realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') -+ - if test_keyring: - def cleanup_keyring(anchor, name): - out = realm.run(['keyctl', 'list', anchor]) diff --git a/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch b/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch deleted file mode 100644 index 269a457..0000000 --- a/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 2f039fc910022c9569fe6941a194f0b26bd6c894 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 20 Sep 2019 16:11:29 -0400 -Subject: [PATCH] Add buildsystem detection of the OpenSSL-3 KDF interface - -(cherry picked from commit a3e03dfd40928c4615bd9b8546eac0c104377850) ---- - src/configure.ac | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/configure.ac b/src/configure.ac -index eb6307468..9c2e816fe 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) - AC_SUBST(CRYPTO_IMPL_CFLAGS) - AC_SUBST(CRYPTO_IMPL_LIBS) - -+if test "$CRYPTO_IMPL" = openssl; then -+ AC_CHECK_FUNCS(EVP_KDF_fetch) -+fi -+ - AC_ARG_WITH([prng-alg], - AC_HELP_STRING([--with-prng-alg=ALG], [use specified PRNG algorithm. @<:@fortuna@:>@]), - [PRNG_ALG=$withval diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch deleted file mode 100644 index 58179a2..0000000 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ /dev/null @@ -1,84 +0,0 @@ -From e88f0319427cee7245fb05c97a25473297c9d2d6 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 15 Jan 2021 14:43:34 -0500 -Subject: [PATCH] Add hostname canonicalization helper to k5test.py - -To facilitate fallback tests, add a canonicalize_hostname() function -to k5test.py which works similarly to krb5_expand_hostname(). Use it -in t_gssapi.py for the recently-added acceptor name fallback test. - -(cherry picked from commit 225fffe4e912772acea3a01d45bafb60bfb80948) ---- - src/tests/gssapi/t_gssapi.py | 11 +++-------- - src/util/k5test.py | 22 ++++++++++++++++++++++ - 2 files changed, 25 insertions(+), 8 deletions(-) - -diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py -index 1af6f31c2..e22cec427 100755 ---- a/src/tests/gssapi/t_gssapi.py -+++ b/src/tests/gssapi/t_gssapi.py -@@ -8,7 +8,7 @@ for realm in multipass_realms(): - realm.run(['./t_iov', '-s', 'p:' + realm.host_princ]) - realm.run(['./t_pcontok', 'p:' + realm.host_princ]) - --realm = K5Realm(krb5_conf={'libdefaults': {'rdns': 'false'}}) -+realm = K5Realm() - - # Test gss_add_cred(). - realm.run(['./t_add_cred']) -@@ -62,13 +62,8 @@ realm.run(['./t_accname', 'p:host/-nomatch-', - expected_msg=' not found in keytab') - - # If possible, test with an acceptor name requiring fallback to match --# against a keytab entry. Forward-canonicalize the hostname, relying --# on the rdns=false realm setting. --try: -- ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME) -- (family, socktype, proto, canonname, sockaddr) = ai[0] --except socket.gaierror: -- canonname = hostname -+# against a keytab entry. -+canonname = canonicalize_hostname(hostname) - if canonname != hostname: - os.rename(realm.keytab, realm.keytab + '.save') - canonprinc = 'host/' + canonname -diff --git a/src/util/k5test.py b/src/util/k5test.py -index 789b0f4b9..251d11a9d 100644 ---- a/src/util/k5test.py -+++ b/src/util/k5test.py -@@ -155,6 +155,10 @@ Scripts may use the following functions and variables: - * password(name): Return a weakly random password based on name. The - password will be consistent across calls with the same name. - -+* canonicalize_hostname(name, rdns=True): Return the DNS -+ canonicalization of name, optionally using reverse DNS. On error, -+ return name converted to lowercase. -+ - * stop_daemon(proc): Stop a daemon process started with - realm.start_server() or realm.start_in_inetd(). Only necessary if - the port needs to be reused; daemon processes will be stopped -@@ -458,6 +462,24 @@ def password(name): - return name + str(os.getpid()) - - -+def canonicalize_hostname(name, rdns=True): -+ """Canonicalize name using DNS, optionally with reverse DNS.""" -+ try: -+ ai = socket.getaddrinfo(name, None, 0, 0, 0, socket.AI_CANONNAME) -+ except socket.gaierror as e: -+ return name.lower() -+ (family, socktype, proto, canonname, sockaddr) = ai[0] -+ -+ if not rdns: -+ return canonname.lower() -+ -+ try: -+ rname = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD) -+ except socket.gaierror: -+ return canonname.lower() -+ return rname[0].lower() -+ -+ - # Exit handler which ensures processes are cleaned up and, on failure, - # prints messages to help developers debug the problem. - def _onexit(): diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch deleted file mode 100644 index eee7d1d..0000000 --- a/Allow-kinit-with-keytab-to-defer-canonicalization.patch +++ /dev/null @@ -1,60 +0,0 @@ -From fb4d9fa851b1d0d3375556d1cdc1fce72176df1e Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 3 Jun 2021 16:03:07 -0400 -Subject: [PATCH] Allow kinit with keytab to defer canonicalization - -[ghudson@mit.edu: added tests] - -ticket: 9012 (new) -(cherry picked from commit 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e) ---- - src/clients/kinit/kinit.c | 11 ----------- - src/tests/t_keytab.py | 13 +++++++++++++ - 2 files changed, 13 insertions(+), 11 deletions(-) - -diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c -index d1f5d74c3..5a6d7237c 100644 ---- a/src/clients/kinit/kinit.c -+++ b/src/clients/kinit/kinit.c -@@ -510,17 +510,6 @@ k5_begin(struct k_opts *opts, struct k5_data *k5) - _("when creating default server principal name")); - goto cleanup; - } -- if (k5->me->realm.data[0] == 0) { -- ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name); -- if (ret == 0) { -- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, -- _("(principal %s)"), k5->name); -- } else { -- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, -- _("for local services")); -- } -- goto cleanup; -- } - } else if (k5->out_cc != NULL) { - /* If the output ccache is initialized, use its principal. */ - if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0) -diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py -index 850375c92..a9adebb26 100755 ---- a/src/tests/t_keytab.py -+++ b/src/tests/t_keytab.py -@@ -41,6 +41,19 @@ realm.kinit(realm.user_princ, flags=['-i'], - expected_msg='keytab specified, forcing -k') - realm.klist(realm.user_princ) - -+# Test default principal for -k. This operation requires -+# canonicalization against the keytab in krb5_get_init_creds_keytab() -+# as the krb5_sname_to_principal() result won't have a realm. Try -+# with and without without fallback processing since the code paths -+# are different. -+mark('default principal for -k') -+realm.run([kinit, '-k']) -+realm.klist(realm.host_princ) -+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} -+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) -+realm.run([kinit, '-k'], env=no_canon) -+realm.klist(realm.host_princ) -+ - # Test extracting keys with multiple key versions present. - mark('multi-kvno extract') - os.remove(realm.keytab) diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch deleted file mode 100644 index fca6a71..0000000 --- a/Clean-up-context-after-failed-open-in-libkdb5.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 95547c12b39e62df55cef05cae890302834b7f98 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 23 Jun 2021 16:57:39 -0400 -Subject: [PATCH] Clean up context after failed open in libkdb5 - -If krb5_db_open() or krb5_db_create() fails, release the dal_handle, -as the caller is unlikely to call krb5_db_close() after a failure. - -(cherry picked from commit 849b7056e703bd3724d909263769ce190db59acc) ---- - src/lib/kdb/kdb5.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c -index 47e9b31a7..11e2430c4 100644 ---- a/src/lib/kdb/kdb5.c -+++ b/src/lib/kdb/kdb5.c -@@ -675,6 +675,8 @@ krb5_db_open(krb5_context kcontext, char **db_args, int mode) - return status; - status = v->init_module(kcontext, section, db_args, mode); - free(section); -+ if (status) -+ (void)krb5_db_fini(kcontext); - return status; - } - -@@ -702,6 +704,8 @@ krb5_db_create(krb5_context kcontext, char **db_args) - return status; - status = v->create(kcontext, section, db_args); - free(section); -+ if (status) -+ (void)krb5_db_fini(kcontext); - return status; - } - diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch deleted file mode 100644 index 207f186..0000000 --- a/Clean-up-gssapi_krb5-ccache-name-functions.patch +++ /dev/null @@ -1,193 +0,0 @@ -From 5e5ea8e8345c8b2f3254b0d346b8e0de0df3a696 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Wed, 26 May 2021 18:22:10 -0400 -Subject: [PATCH] Clean up gssapi_krb5 ccache name functions - -Modernize kg_get_ccache_name() and kg_get_ccache_name(). Drop -unnecessary use of const in kg_get_ccache_name() so that its return -value can be properly freed. Fixes some static analyzer false -positives. - -(cherry picked from commit f573f7f8ee5269103a0492d6521a3242c5ffb63b) ---- - src/lib/gssapi/krb5/gssapiP_krb5.h | 3 +- - src/lib/gssapi/krb5/gssapi_krb5.c | 47 ++++++++-------------- - src/lib/gssapi/krb5/set_ccache.c | 64 ++++++++++++------------------ - 3 files changed, 42 insertions(+), 72 deletions(-) - -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index fd7abbd77..88d41130a 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -380,8 +380,7 @@ OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status); - OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status, - int *out_caller_provided_name); - --OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, -- const char **out_name); -+OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, char **out_name); - - OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status, - const char *name); -diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c -index 46aa9b7a5..9915a8bb5 100644 ---- a/src/lib/gssapi/krb5/gssapi_krb5.c -+++ b/src/lib/gssapi/krb5/gssapi_krb5.c -@@ -253,46 +253,31 @@ kg_caller_provided_ccache_name (OM_uint32 *minor_status, - } - - OM_uint32 --kg_get_ccache_name (OM_uint32 *minor_status, const char **out_name) -+kg_get_ccache_name(OM_uint32 *minor_status, char **out_name) - { -- const char *name = NULL; -- OM_uint32 err = 0; - char *kg_ccache_name; -+ const char *def_name; -+ OM_uint32 err; -+ krb5_context context; -+ -+ *out_name = NULL; - - kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME); -- - if (kg_ccache_name != NULL) { -- name = strdup(kg_ccache_name); -- if (name == NULL) -- err = ENOMEM; -+ *out_name = strdup(kg_ccache_name); -+ err = (*out_name == NULL) ? ENOMEM : 0; - } else { -- krb5_context context = NULL; -- -- /* Reset the context default ccache (see text above), and then -- retrieve it. */ -+ /* Use the default ccache name. */ - err = krb5_gss_init_context(&context); -- if (!err) -- err = krb5_cc_set_default_name (context, NULL); -- if (!err) { -- name = krb5_cc_default_name(context); -- if (name) { -- name = strdup(name); -- if (name == NULL) -- err = ENOMEM; -- } -- } -- if (err && context) -- save_error_info(err, context); -- if (context) -- krb5_free_context(context); -- } -- -- if (!err) { -- if (out_name) { -- *out_name = name; -- } -+ if (err) -+ goto cleanup; -+ def_name = krb5_cc_default_name(context); -+ *out_name = (def_name != NULL) ? strdup(def_name) : NULL; -+ err = (*out_name == NULL) ? ENOMEM : 0; -+ krb5_free_context(context); - } - -+cleanup: - *minor_status = err; - return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; - } -diff --git a/src/lib/gssapi/krb5/set_ccache.c b/src/lib/gssapi/krb5/set_ccache.c -index 8acf3ec90..91c3462be 100644 ---- a/src/lib/gssapi/krb5/set_ccache.c -+++ b/src/lib/gssapi/krb5/set_ccache.c -@@ -26,7 +26,7 @@ - - /* - * Set ccache name used by gssapi, and optionally obtain old ccache -- * name. Caller should not free returned name. -+ * name. Caller must not free returned name. - */ - - #include -@@ -38,11 +38,9 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, - const gss_OID desired_object, - const gss_buffer_t value) - { -- char *old_name = NULL; - OM_uint32 err = 0; -- OM_uint32 minor = 0; -- char *gss_out_name; - struct krb5_gss_ccache_name_req *req; -+ char *old_name, *cur_name = NULL; - - err = gss_krb5int_initialize_library(); - if (err) { -@@ -57,45 +55,33 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, - - req = (struct krb5_gss_ccache_name_req *)value->value; - -- gss_out_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); -+ /* Our job is simple if the caller doesn't want the current name. */ -+ if (req->out_name == NULL) -+ return kg_set_ccache_name(minor_status, req->name); - -- if (req->out_name) { -- const char *tmp_name = NULL; -+ /* Fetch the current name and change it. */ -+ kg_get_ccache_name(&err, &cur_name); -+ if (err) -+ goto cleanup; -+ kg_set_ccache_name(&err, req->name); -+ if (err) -+ goto cleanup; - -- if (!err) { -- kg_get_ccache_name (&err, &tmp_name); -- } -- if (!err) { -- old_name = gss_out_name; -- gss_out_name = (char *)tmp_name; -- } -- } -- /* If out_name was NULL, we keep the same gss_out_name value, and -- don't free up any storage (leave old_name NULL). */ -+ /* Store the current name in a thread-specific variable. Free that -+ * variable's previous contents. */ -+ old_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); -+ err = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, cur_name); -+ if (err) -+ goto cleanup; -+ free(old_name); - -- if (!err) -- kg_set_ccache_name (&err, req->name); -- -- minor = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, gss_out_name); -- if (minor) { -- /* Um. Now what? */ -- if (err == 0) { -- err = minor; -- } -- free(gss_out_name); -- gss_out_name = NULL; -- } -- -- if (!err) { -- if (req->out_name) { -- *(req->out_name) = gss_out_name; -- } -- } -- -- if (old_name != NULL) { -- free (old_name); -- } -+ /* Give the caller an alias to the stored value. */ -+ *req->out_name = cur_name; -+ cur_name = NULL; -+ err = 0; - -+cleanup: -+ free(cur_name); - *minor_status = err; - return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; - } diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch deleted file mode 100644 index 77c383e..0000000 --- a/Fix-KCM-flag-transmission-for-remove_cred.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 1528c264d0e1eebff34132c01f4f770f01f1d1c2 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 29 Mar 2021 14:32:56 -0400 -Subject: [PATCH] Fix KCM flag transmission for remove_cred - -MIT krb5 uses low bits for KRB5_TC flags, while Heimdal uses high bits -so that the same flag word can also hold KRB5_GC flags. Add a mapping -function and send the Heimdal flag values when performing a -remove_cred operation. - -ticket: 8995 -(cherry picked from commit 11a82cf424f9c905bb73680c64524f087090d4ef) ---- - src/include/kcm.h | 19 +++++++++++++++++++ - src/lib/krb5/ccache/cc_kcm.c | 36 +++++++++++++++++++++++++++++++++++- - 2 files changed, 54 insertions(+), 1 deletion(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index e4140c3a0..9b66f1cbd 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -56,8 +56,27 @@ - * are marshalled as zero-terminated strings. Principals and credentials are - * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists - * are not delimited, so nothing can come after them. -+ * -+ * Flag words must use Heimdal flag values, which are not the same as MIT krb5 -+ * values for KRB5_GC and KRB5_TC constants. The same flag word may contain -+ * both kinds of flags in Heimdal, but not in MIT krb5. Defines for the -+ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC -+ * prefixes. - */ - -+#define KCM_GC_CACHED (1U << 0) -+ -+#define KCM_TC_DONT_MATCH_REALM (1U << 31) -+#define KCM_TC_MATCH_KEYTYPE (1U << 30) -+#define KCM_TC_MATCH_SRV_NAMEONLY (1U << 29) -+#define KCM_TC_MATCH_FLAGS_EXACT (1U << 28) -+#define KCM_TC_MATCH_FLAGS (1U << 27) -+#define KCM_TC_MATCH_TIMES_EXACT (1U << 26) -+#define KCM_TC_MATCH_TIMES (1U << 25) -+#define KCM_TC_MATCH_AUTHDATA (1U << 24) -+#define KCM_TC_MATCH_2ND_TKT (1U << 23) -+#define KCM_TC_MATCH_IS_SKEY (1U << 22) -+ - /* Opcodes without comments are currently unused in the MIT client - * implementation. */ - typedef enum kcm_opcode { -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 772928e4d..1f81a2190 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -110,6 +110,40 @@ map_invalid(krb5_error_code code) - KRB5_KCM_MALFORMED_REPLY : code; - } - -+/* -+ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word. Note -+ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM -+ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client -+ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES -+ * (which matches against enctypes from the krb5_context rather than the -+ * matching cred). -+ */ -+static inline krb5_flags -+map_tcflags(krb5_flags mitflags) -+{ -+ krb5_flags heimflags = 0; -+ -+ if (mitflags & KRB5_TC_MATCH_TIMES) -+ heimflags |= KCM_TC_MATCH_TIMES; -+ if (mitflags & KRB5_TC_MATCH_IS_SKEY) -+ heimflags |= KCM_TC_MATCH_IS_SKEY; -+ if (mitflags & KRB5_TC_MATCH_FLAGS) -+ heimflags |= KCM_TC_MATCH_FLAGS; -+ if (mitflags & KRB5_TC_MATCH_TIMES_EXACT) -+ heimflags |= KCM_TC_MATCH_TIMES_EXACT; -+ if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT) -+ heimflags |= KCM_TC_MATCH_FLAGS_EXACT; -+ if (mitflags & KRB5_TC_MATCH_AUTHDATA) -+ heimflags |= KCM_TC_MATCH_AUTHDATA; -+ if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY) -+ heimflags |= KCM_TC_MATCH_SRV_NAMEONLY; -+ if (mitflags & KRB5_TC_MATCH_2ND_TKT) -+ heimflags |= KCM_TC_MATCH_2ND_TKT; -+ if (mitflags & KRB5_TC_MATCH_KTYPE) -+ heimflags |= KCM_TC_MATCH_KEYTYPE; -+ return heimflags; -+} -+ - /* Begin a request for the given opcode. If cache is non-null, supply the - * cache name as a request parameter. */ - static void -@@ -936,7 +970,7 @@ kcm_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags, - struct kcmreq req; - - kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache); -- k5_buf_add_uint32_be(&req.reqbuf, flags); -+ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags)); - k5_marshal_mcred(&req.reqbuf, mcred); - ret = cache_call(context, cache, &req); - kcmreq_free(&req); diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch deleted file mode 100644 index 9c09507..0000000 --- a/Fix-KCM-retrieval-support-for-sssd.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 43be8fba5301d08fc4d5ddef14f8ae3d9655b0ba Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 11 May 2021 14:04:07 -0400 -Subject: [PATCH] Fix KCM retrieval support for sssd - -Commit 795ebba8c039be172ab93cd41105c73ffdba0fdb added a retrieval -handler using KCM_OP_RETRIEVE, falling back on the same error codes as -the previous KCM_OP_GET_CRED_LIST support. But sssd (as of 2.4) -returns KRB5_CC_NOSUPP instead of KRB5_CC_IO if it recognizes an -opcode but does not implement it. Add a helper function to recognize -all known unsupported-opcode error codes, and use it in kcm_retrieve() -and kcm_start_seq_get(). - -ticket: 8997 -(cherry picked from commit da103e36e13f3c846bcddbe38dd518a21e5260a0) ---- - src/lib/krb5/ccache/cc_kcm.c | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 23fcf13ea..18505cd3d 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -144,6 +144,20 @@ map_tcflags(krb5_flags mitflags) - return heimflags; - } - -+/* -+ * Return true if code could indicate an unsupported operation. Heimdal's KCM -+ * returns KRB5_FCC_INTERNAL. sssd's KCM daemon (as of sssd 2.4) returns -+ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it, -+ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate -+ * since it could also indicate a communication failure). -+ */ -+static krb5_boolean -+unsupported_op_error(krb5_error_code code) -+{ -+ return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO || -+ code == KRB5_CC_NOSUPP; -+} -+ - /* Begin a request for the given opcode. If cache is non-null, supply the - * cache name as a request parameter. */ - static void -@@ -841,7 +855,7 @@ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, - ret = cache_call(context, cache, &req); - - /* Fall back to iteration if the server does not support retrieval. */ -- if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ if (unsupported_op_error(ret)) { - ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, - cred_out); - goto cleanup; -@@ -922,7 +936,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - ret = kcmreq_get_cred_list(&req, &creds); - if (ret) - goto cleanup; -- } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ } else if (unsupported_op_error(ret)) { - /* Fall back to GET_CRED_UUID_LIST. */ - kcmreq_free(&req); - kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch deleted file mode 100644 index 24b9d95..0000000 --- a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch +++ /dev/null @@ -1,45 +0,0 @@ -From bb8fa495d00ccd931eec87a01b8920636cf7903e Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 3 Aug 2021 01:15:27 -0400 -Subject: [PATCH] Fix KDC null deref on TGS inner body null server - -After the KDC decodes a FAST inner body, it does not check for a null -server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this -would typically result in an error from krb5_unparse_name(), but with -the addition of get_local_tgt() it results in a null dereference. Add -a null check. - -Reported by Joseph Sutton of Catalyst. - -CVE-2021-37750: - -In MIT krb5 releases 1.14 and later, an authenticated attacker can -cause a null dereference in the KDC by sending a FAST TGS request with -no server field. - -ticket: 9008 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49) ---- - src/kdc/do_tgs_req.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 6d244ffd4..39a504ca1 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - status = "FIND_FAST"; - goto cleanup; - } -+ if (sprinc == NULL) { -+ status = "NULL_SERVER"; -+ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; -+ goto cleanup; -+ } - - errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, - &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/Fix-integer-overflows-in-PAC-parsing.patch b/Fix-integer-overflows-in-PAC-parsing.patch deleted file mode 100644 index 272e34e..0000000 --- a/Fix-integer-overflows-in-PAC-parsing.patch +++ /dev/null @@ -1,106 +0,0 @@ -From 06d30f43a41029d83248bbac1a9b65fc09987597 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 17 Oct 2022 20:25:11 -0400 -Subject: [PATCH] Fix integer overflows in PAC parsing - -In krb5_parse_pac(), check for buffer counts large enough to threaten -integer overflow in the header length and memory length calculations. -Avoid potential integer overflows when checking the length of each -buffer. - -CVE-2022-42898: - -In MIT krb5 releases 1.8 and later, an authenticated attacker may be -able to cause a KDC or kadmind process to crash by reading beyond the -bounds of allocated memory, creating a denial of service. A -privileged attacker may similarly be able to cause a Kerberos or GSS -application service to crash. On 32-bit platforms, an attacker can -also cause insufficient memory to be allocated for the result, -potentially leading to remote code execution in a KDC, kadmind, or GSS -or Kerberos application server process. An attacker with the -privileges of a cross-realm KDC may be able to extract secrets from -the KDC process's memory by having them copied into the PAC of a new -ticket. - -ticket: 9074 (new) -tags: pullup -target_version: 1.20-next -target_version: 1.19-next ---- - src/lib/krb5/krb/pac.c | 9 +++++++-- - src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++ - 2 files changed, 25 insertions(+), 2 deletions(-) - -diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c -index 950beda657..1b9ef12276 100644 ---- a/src/lib/krb5/krb/pac.c -+++ b/src/lib/krb5/krb/pac.c -@@ -27,6 +27,8 @@ - #include "k5-int.h" - #include "authdata.h" - -+#define MAX_BUFFERS 4096 -+ - /* draft-brezak-win2k-krb-authz-00 */ - - /* -@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context, - if (version != 0) - return EINVAL; - -+ if (cbuffers < 1 || cbuffers > MAX_BUFFERS) -+ return ERANGE; -+ - header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH); - if (len < header_len) - return ERANGE; -@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context, - krb5_pac_free(context, pac); - return EINVAL; - } -- if (buffer->Offset < header_len || -- buffer->Offset + buffer->cbBufferSize > len) { -+ if (buffer->Offset < header_len || buffer->Offset > len || -+ buffer->cbBufferSize > len - buffer->Offset) { - krb5_pac_free(context, pac); - return ERANGE; - } -diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c -index ee47152ee4..ccd165380d 100644 ---- a/src/lib/krb5/krb/t_pac.c -+++ b/src/lib/krb5/krb/t_pac.c -@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = { - 0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00 - }; - -+static const unsigned char fuzz1[] = { -+ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, -+ 0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5 -+}; -+ -+static const unsigned char fuzz2[] = { -+ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, -+ 0x20, 0x20 -+}; -+ - static const char *s4u_principal = "w2k8u@ACME.COM"; - static const char *s4u_enterprise = "w2k8u@abc@ACME.COM"; - -@@ -646,6 +656,14 @@ main(int argc, char **argv) - krb5_free_principal(context, sep); - } - -+ /* Check problematic PACs found by fuzzing. */ -+ ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac); -+ if (!ret) -+ err(context, ret, "krb5_pac_parse should have failed"); -+ ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac); -+ if (!ret) -+ err(context, ret, "krb5_pac_parse should have failed"); -+ - /* - * Test empty free - */ --- -2.37.3 - diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch deleted file mode 100644 index a2b9e34..0000000 --- a/Fix-k5tls-module-for-OpenSSL-3.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 51938a8b731740299fe47d132b8840edba4141bc Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 29 May 2021 12:05:49 -0400 -Subject: [PATCH] Fix k5tls module for OpenSSL 3 - -Starting in OpenSSL 3, connection termination without a close_notify -alert causes SSL_read() to return SSL_ERROR_SSL instead of -SSL_ERROR_SYSCALL. OpenSSL 3 also provides a new option -SSL_OP_IGNORE_UNEXPECTED_EOF which allows an application to explicitly -ignore possible truncation attacks and receive SSL_ERROR_ZERO_RETURN -instead. - -Remove the call to SSL_CTX_get_options() since SSL_CTX_set_options() -doesn't clear existing options. - -[ghudson@mit.edu: edited commit message and comment] - -(cherry picked from commit aa9b4a2a64046afd2fab7cb49c346295874a5fb6) -(cherry picked from commit 201e38845e9f70234bcaa9ba7c25b28e38169b0a) ---- - src/plugins/tls/k5tls/openssl.c | 17 ++++++++++++++--- - 1 file changed, 14 insertions(+), 3 deletions(-) - -diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c -index 76a43b3cd..99fda7ffc 100644 ---- a/src/plugins/tls/k5tls/openssl.c -+++ b/src/plugins/tls/k5tls/openssl.c -@@ -433,7 +433,7 @@ setup(krb5_context context, SOCKET fd, const char *servername, - char **anchors, k5_tls_handle *handle_out) - { - int e; -- long options; -+ long options = SSL_OP_NO_SSLv2; - SSL_CTX *ctx = NULL; - SSL *ssl = NULL; - k5_tls_handle handle = NULL; -@@ -448,8 +448,19 @@ setup(krb5_context context, SOCKET fd, const char *servername, - ctx = SSL_CTX_new(SSLv23_client_method()); - if (ctx == NULL) - goto error; -- options = SSL_CTX_get_options(ctx); -- SSL_CTX_set_options(ctx, options | SSL_OP_NO_SSLv2); -+ -+#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF -+ /* -+ * For OpenSSL 3 and later, mark close_notify alerts as optional. We don't -+ * need to worry about truncation attacks because the protocols this module -+ * is used with (Kerberos and change-password) receive a single -+ * length-delimited message from the server. For prior versions of OpenSSL -+ * we check for SSL_ERROR_SYSCALL when reading instead (this error changes -+ * to SSL_ERROR_SSL in OpenSSL 3). -+ */ -+ options |= SSL_OP_IGNORE_UNEXPECTED_EOF; -+#endif -+ SSL_CTX_set_options(ctx, options); - - SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback); - X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), 0); diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch deleted file mode 100644 index a5162e7..0000000 --- a/Fix-kadmin-k-with-fallback-or-referral-realm.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 2d2bb9a14613b3283dabdd40c3ee28e5b680cf93 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 7 Jun 2021 15:00:41 -0400 -Subject: [PATCH] Fix kadmin -k with fallback or referral realm - -kadmin -k produces a client principal name with -krb5_sname_to_principal(), but it gets converted to a string and back -due to the signature of kadm5_init_with_skey(), which loses track of -the name type, so no canonicalization is performed. - -In libkadm5clnt initialization, recognize the important subset of this -case--an empty realm indicates either fallback processing or the -referral realm--and restore the host-based name type so that the -client principal can be canonicalized against the keytab. - -ticket: 9013 (new) -(cherry picked from commit dcb79089276624d7ddf44e08d35bd6d7d7e557d2) ---- - src/lib/kadm5/clnt/client_init.c | 7 +++++++ - src/tests/t_kadmin.py | 12 ++++++++++++ - 2 files changed, 19 insertions(+) - -diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c -index aa1223bb3..0aaca701f 100644 ---- a/src/lib/kadm5/clnt/client_init.c -+++ b/src/lib/kadm5/clnt/client_init.c -@@ -221,9 +221,16 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - return KADM5_MISSING_KRB5_CONF_PARAMS; - } - -+ /* -+ * Parse the client name. If it has an empty realm, it is almost certainly -+ * a host-based principal using DNS fallback processing or the referral -+ * realm, so give it the appropriate name type for canonicalization. -+ */ - code = krb5_parse_name(handle->context, client_name, &client); - if (code) - goto error; -+ if (init_type == INIT_SKEY && client->realm.length == 0) -+ client->type = KRB5_NT_SRV_HST; - - /* - * Get credentials. Also does some fallbacks in case kadmin/fqdn -diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py -index fe6a3cc2e..98453d92e 100644 ---- a/src/tests/t_kadmin.py -+++ b/src/tests/t_kadmin.py -@@ -51,4 +51,16 @@ for i in range(200): - realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) - realm.run_kadmin(['listprincs'], expected_msg='foo199') - -+# Test kadmin -k with the default principal, with and without -+# fallback. This operation requires canonicalization against the -+# keytab in krb5_get_init_creds_keytab() as the -+# krb5_sname_to_principal() result won't have a realm. Try with and -+# without without fallback processing since the code paths are -+# different. -+mark('kadmin -k') -+realm.run([kadmin, '-k', 'getprinc', realm.host_princ]) -+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} -+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) -+realm.run([kadmin, '-k', 'getprinc', realm.host_princ], env=no_canon) -+ - success('kadmin and kpasswd tests') diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch deleted file mode 100644 index bdacecb..0000000 --- a/Fix-leaks-on-error-in-kadm5-init-functions.patch +++ /dev/null @@ -1,664 +0,0 @@ -From a14e0fd3c1d00ba625e6d9eb72829f31527c6ad8 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 23 Jun 2021 16:53:16 -0400 -Subject: [PATCH] Fix leaks on error in kadm5 init functions - -In the GENERIC_CHECK_HANDLE function, separate out the -version-checking logic so we can call it in the init functions before -allocating resources. - -In the client and server library initialization functions, use a -single exit path after argument validation, and share the destruction -code with kadm5_destroy() via a helper. - -(cherry picked from commit 552d7b7626450f963b8e37345c472420c842402c) ---- - src/lib/kadm5/admin_internal.h | 39 ++++--- - src/lib/kadm5/clnt/client_init.c | 174 +++++++++++----------------- - src/lib/kadm5/srv/server_init.c | 191 ++++++++++--------------------- - 3 files changed, 145 insertions(+), 259 deletions(-) - -diff --git a/src/lib/kadm5/admin_internal.h b/src/lib/kadm5/admin_internal.h -index faf8e9c36..9be53883a 100644 ---- a/src/lib/kadm5/admin_internal.h -+++ b/src/lib/kadm5/admin_internal.h -@@ -11,29 +11,32 @@ - - #define KADM5_SERVER_HANDLE_MAGIC 0x12345800 - --#define GENERIC_CHECK_HANDLE(handle, old_api_version, new_api_version) \ -+#define CHECK_VERSIONS(struct_version, api_version, old_api_err, new_api_err) \ - { \ -- kadm5_server_handle_t srvr = \ -- (kadm5_server_handle_t) handle; \ -- \ -- if (! srvr) \ -- return KADM5_BAD_SERVER_HANDLE; \ -- if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ -- return KADM5_BAD_SERVER_HANDLE; \ -- if ((srvr->struct_version & KADM5_MASK_BITS) != \ -- KADM5_STRUCT_VERSION_MASK) \ -+ if ((struct_version & KADM5_MASK_BITS) != KADM5_STRUCT_VERSION_MASK) \ - return KADM5_BAD_STRUCT_VERSION; \ -- if (srvr->struct_version < KADM5_STRUCT_VERSION_1) \ -+ if (struct_version < KADM5_STRUCT_VERSION_1) \ - return KADM5_OLD_STRUCT_VERSION; \ -- if (srvr->struct_version > KADM5_STRUCT_VERSION_1) \ -+ if (struct_version > KADM5_STRUCT_VERSION_1) \ - return KADM5_NEW_STRUCT_VERSION; \ -- if ((srvr->api_version & KADM5_MASK_BITS) != \ -- KADM5_API_VERSION_MASK) \ -+ if ((api_version & KADM5_MASK_BITS) != KADM5_API_VERSION_MASK) \ - return KADM5_BAD_API_VERSION; \ -- if (srvr->api_version < KADM5_API_VERSION_2) \ -- return old_api_version; \ -- if (srvr->api_version > KADM5_API_VERSION_4) \ -- return new_api_version; \ -+ if (api_version < KADM5_API_VERSION_2) \ -+ return old_api_err; \ -+ if (api_version > KADM5_API_VERSION_4) \ -+ return new_api_err; \ -+ } -+ -+#define GENERIC_CHECK_HANDLE(handle, old_api_err, new_api_err) \ -+ { \ -+ kadm5_server_handle_t srvr = handle; \ -+ \ -+ if (srvr == NULL) \ -+ return KADM5_BAD_SERVER_HANDLE; \ -+ if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ -+ return KADM5_BAD_SERVER_HANDLE; \ -+ CHECK_VERSIONS(srvr->struct_version, srvr->api_version, \ -+ old_api_err, new_api_err); \ - } - - /* -diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c -index 0aaca701f..75614bb19 100644 ---- a/src/lib/kadm5/clnt/client_init.c -+++ b/src/lib/kadm5/clnt/client_init.c -@@ -138,6 +138,36 @@ kadm5_init_with_skey(krb5_context context, char *client_name, - server_handle); - } - -+static kadm5_ret_t -+free_handle(kadm5_server_handle_t handle) -+{ -+ kadm5_ret_t ret = 0; -+ OM_uint32 minor_stat; -+ krb5_ccache ccache; -+ -+ if (handle == NULL) -+ return 0; -+ -+ if (handle->destroy_cache && handle->cache_name != NULL) { -+ ret = krb5_cc_resolve(handle->context, handle->cache_name, &ccache); -+ if (!ret) -+ ret = krb5_cc_destroy(handle->context, ccache); -+ } -+ free(handle->cache_name); -+ (void)gss_release_cred(&minor_stat, &handle->cred); -+ if (handle->clnt != NULL && handle->clnt->cl_auth != NULL) -+ AUTH_DESTROY(handle->clnt->cl_auth); -+ if (handle->clnt != NULL) -+ clnt_destroy(handle->clnt); -+ if (handle->client_socket != -1) -+ close(handle->client_socket); -+ free(handle->lhandle); -+ kadm5_free_config_params(handle->context, &handle->params); -+ free(handle); -+ -+ return ret; -+} -+ - static kadm5_ret_t - init_any(krb5_context context, char *client_name, enum init_type init_type, - char *pass, krb5_ccache ccache_in, char *service_name, -@@ -145,36 +175,34 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - krb5_ui_4 api_version, char **db_args, void **server_handle) - { - int fd = -1; -- OM_uint32 minor_stat; - krb5_boolean iprop_enable; - int port; - rpcprog_t rpc_prog; - rpcvers_t rpc_vers; -- krb5_ccache ccache; - krb5_principal client = NULL, server = NULL; - struct timeval timeout; - -- kadm5_server_handle_t handle; -+ kadm5_server_handle_t handle = NULL; - kadm5_config_params params_local; - -- int code = 0; -+ krb5_error_code code; - generic_ret r = { 0, 0 }; - - initialize_ovk_error_table(); - initialize_ovku_error_table(); - -- if (! server_handle) { -+ if (server_handle == NULL || client_name == NULL) - return EINVAL; -- } - -- if (! (handle = malloc(sizeof(*handle)))) { -- return ENOMEM; -- } -- memset(handle, 0, sizeof(*handle)); -- if (! (handle->lhandle = malloc(sizeof(*handle)))) { -- free(handle); -- return ENOMEM; -- } -+ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_LIB_API_VERSION, -+ KADM5_NEW_LIB_API_VERSION); -+ -+ handle = k5alloc(sizeof(*handle), &code); -+ if (handle == NULL) -+ goto cleanup; -+ handle->lhandle = k5alloc(sizeof(*handle), &code); -+ if (handle->lhandle == NULL) -+ goto cleanup; - - handle->magic_number = KADM5_SERVER_HANDLE_MAGIC; - handle->struct_version = struct_version; -@@ -192,33 +220,20 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - - handle->context = context; - -- if(client_name == NULL) { -- free(handle); -- return EINVAL; -- } -- -- /* -- * Verify the version numbers before proceeding; we can't use -- * CHECK_HANDLE because not all fields are set yet. -- */ -- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION, -- KADM5_NEW_LIB_API_VERSION); -- - memset(¶ms_local, 0, sizeof(params_local)); - -- if ((code = kadm5_get_config_params(handle->context, 0, -- params_in, &handle->params))) { -- free(handle); -- return(code); -- } -+ code = kadm5_get_config_params(handle->context, 0, params_in, -+ &handle->params); -+ if (code) -+ goto cleanup; - - #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | \ - KADM5_CONFIG_ADMIN_SERVER | \ - KADM5_CONFIG_KADMIND_PORT) - - if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { -- free(handle); -- return KADM5_MISSING_KRB5_CONF_PARAMS; -+ code = KADM5_MISSING_KRB5_CONF_PARAMS; -+ goto cleanup; - } - - /* -@@ -228,7 +243,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - */ - code = krb5_parse_name(handle->context, client_name, &client); - if (code) -- goto error; -+ goto cleanup; - if (init_type == INIT_SKEY && client->realm.length == 0) - client->type = KRB5_NT_SRV_HST; - -@@ -239,7 +254,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - code = get_init_creds(handle, client, init_type, pass, ccache_in, - service_name, handle->params.realm, &server); - if (code) -- goto error; -+ goto cleanup; - - /* If the service_name and client_name are iprop-centric, use the iprop - * port and RPC identifiers. */ -@@ -258,7 +273,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - - code = connect_to_server(handle->params.admin_server, port, &fd); - if (code) -- goto error; -+ goto cleanup; - - handle->clnt = clnttcp_create(NULL, rpc_prog, rpc_vers, &fd, 0, 0); - if (handle->clnt == NULL) { -@@ -266,7 +281,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - #ifdef DEBUG - clnt_pcreateerror("clnttcp_create"); - #endif -- goto error; -+ goto cleanup; - } - - /* Set a one-hour timeout. */ -@@ -278,10 +293,6 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - handle->lhandle->clnt = handle->clnt; - handle->lhandle->client_socket = fd; - -- /* now that handle->clnt is set, we can check the handle */ -- if ((code = _kadm5_check_handle((void *) handle))) -- goto error; -- - /* - * The RPC connection is open; establish the GSS-API - * authentication context. -@@ -289,7 +300,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - code = setup_gss(handle, params_in, - (init_type == INIT_CREDS) ? client : NULL, server); - if (code) -- goto error; -+ goto cleanup; - - /* - * Bypass the remainder of the code and return straight away -@@ -297,7 +308,8 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - */ - if (iprop_enable) { - code = 0; -- *server_handle = (void *) handle; -+ *server_handle = handle; -+ handle = NULL; - goto cleanup; - } - -@@ -306,7 +318,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - #ifdef DEBUG - clnt_perror(handle->clnt, "init_2 null resp"); - #endif -- goto error; -+ goto cleanup; - } - /* Drop down to v3 wire protocol if server does not support v4 */ - if (r.code == KADM5_NEW_SERVER_API_VERSION && -@@ -315,7 +327,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - memset(&r, 0, sizeof(generic_ret)); - if (init_2(&handle->api_version, &r, handle->clnt)) { - code = KADM5_RPC_ERROR; -- goto error; -+ goto cleanup; - } - } - /* Drop down to v2 wire protocol if server does not support v3 */ -@@ -325,47 +337,21 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - memset(&r, 0, sizeof(generic_ret)); - if (init_2(&handle->api_version, &r, handle->clnt)) { - code = KADM5_RPC_ERROR; -- goto error; -+ goto cleanup; - } - } - if (r.code) { - code = r.code; -- goto error; -+ goto cleanup; - } - -- *server_handle = (void *) handle; -- -- goto cleanup; -- --error: -- /* -- * Note that it is illegal for this code to execute if "handle" -- * has not been allocated and initialized. I.e., don't use "goto -- * error" before the block of code at the top of the function -- * that allocates and initializes "handle". -- */ -- if (handle->destroy_cache && handle->cache_name) { -- if (krb5_cc_resolve(handle->context, -- handle->cache_name, &ccache) == 0) -- (void) krb5_cc_destroy (handle->context, ccache); -- } -- if (handle->cache_name) -- free(handle->cache_name); -- (void)gss_release_cred(&minor_stat, &handle->cred); -- if(handle->clnt && handle->clnt->cl_auth) -- AUTH_DESTROY(handle->clnt->cl_auth); -- if(handle->clnt) -- clnt_destroy(handle->clnt); -- if (fd != -1) -- close(fd); -- free(handle->lhandle); -- kadm5_free_config_params(handle->context, &handle->params); -+ *server_handle = handle; -+ handle = NULL; - - cleanup: -- krb5_free_principal(handle->context, client); -- krb5_free_principal(handle->context, server); -- if (code) -- free(handle); -+ krb5_free_principal(context, client); -+ krb5_free_principal(context, server); -+ (void)free_handle(handle); - - return code; - } -@@ -695,38 +681,8 @@ rpc_auth(kadm5_server_handle_t handle, kadm5_config_params *params_in, - kadm5_ret_t - kadm5_destroy(void *server_handle) - { -- OM_uint32 minor_stat; -- krb5_ccache ccache = NULL; -- int code = KADM5_OK; -- kadm5_server_handle_t handle = -- (kadm5_server_handle_t) server_handle; -- - CHECK_HANDLE(server_handle); -- -- if (handle->destroy_cache && handle->cache_name) { -- if ((code = krb5_cc_resolve(handle->context, -- handle->cache_name, &ccache)) == 0) -- code = krb5_cc_destroy (handle->context, ccache); -- } -- if (handle->cache_name) -- free(handle->cache_name); -- if (handle->cred) -- (void)gss_release_cred(&minor_stat, &handle->cred); -- if (handle->clnt && handle->clnt->cl_auth) -- AUTH_DESTROY(handle->clnt->cl_auth); -- if (handle->clnt) -- clnt_destroy(handle->clnt); -- if (handle->client_socket != -1) -- close(handle->client_socket); -- if (handle->lhandle) -- free (handle->lhandle); -- -- kadm5_free_config_params(handle->context, &handle->params); -- -- handle->magic_number = 0; -- free(handle); -- -- return code; -+ return free_handle(server_handle); - } - /* not supported on client */ - kadm5_ret_t kadm5_lock(void *server_handle) -diff --git a/src/lib/kadm5/srv/server_init.c b/src/lib/kadm5/srv/server_init.c -index 3adc4b57d..2c0d51efd 100644 ---- a/src/lib/kadm5/srv/server_init.c -+++ b/src/lib/kadm5/srv/server_init.c -@@ -19,23 +19,6 @@ - #include "osconf.h" - #include "iprop_hdr.h" - --/* -- * Function check_handle -- * -- * Purpose: Check a server handle and return a com_err code if it is -- * invalid or 0 if it is valid. -- * -- * Arguments: -- * -- * handle The server handle. -- */ -- --static int check_handle(void *handle) --{ -- CHECK_HANDLE(handle); -- return 0; --} -- - static int dup_db_args(kadm5_server_handle_t handle, char **db_args) - { - int count = 0; -@@ -84,6 +67,23 @@ static void free_db_args(kadm5_server_handle_t handle) - } - } - -+static void -+free_handle(kadm5_server_handle_t handle) -+{ -+ if (handle == NULL) -+ return; -+ -+ destroy_pwqual(handle); -+ k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); -+ ulog_fini(handle->context); -+ krb5_db_fini(handle->context); -+ krb5_free_principal(handle->context, handle->current_caller); -+ kadm5_free_config_params(handle->context, &handle->params); -+ free(handle->lhandle); -+ free_db_args(handle); -+ free(handle); -+} -+ - kadm5_ret_t kadm5_init_with_password(krb5_context context, char *client_name, - char *pass, char *service_name, - kadm5_config_params *params, -@@ -163,8 +163,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - char **db_args, - void **server_handle) - { -- int ret; -- kadm5_server_handle_t handle; -+ krb5_error_code ret; -+ kadm5_server_handle_t handle = NULL; - kadm5_config_params params_local; /* for v1 compat */ - - if (! server_handle) -@@ -173,17 +173,17 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - if (! client_name) - return EINVAL; - -- if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle))) -- return ENOMEM; -- memset(handle, 0, sizeof(*handle)); -+ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_SERVER_API_VERSION, -+ KADM5_NEW_SERVER_API_VERSION); -+ -+ handle = k5alloc(sizeof(*handle), &ret); -+ if (handle == NULL) -+ goto cleanup; -+ handle->context = context; - - ret = dup_db_args(handle, db_args); -- if (ret) { -- free(handle); -- return ret; -- } -- -- handle->context = context; -+ if (ret) -+ goto cleanup; - - initialize_ovk_error_table(); - initialize_ovku_error_table(); -@@ -192,13 +192,6 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - handle->struct_version = struct_version; - handle->api_version = api_version; - -- /* -- * Verify the version numbers before proceeding; we can't use -- * CHECK_HANDLE because not all fields are set yet. -- */ -- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION, -- KADM5_NEW_SERVER_API_VERSION); -- - /* - * Acquire relevant profile entries. Merge values - * in params_in with values from profile, based on -@@ -208,11 +201,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - - ret = kadm5_get_config_params(handle->context, 1, params_in, - &handle->params); -- if (ret) { -- free_db_args(handle); -- free(handle); -- return(ret); -- } -+ if (ret) -+ goto cleanup; - - #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME | \ - KADM5_CONFIG_ENCTYPE | \ -@@ -226,132 +216,69 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - KADM5_CONFIG_IPROP_PORT) - - if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return KADM5_MISSING_CONF_PARAMS; -+ ret = KADM5_MISSING_CONF_PARAMS; -+ goto cleanup; - } - if ((handle->params.mask & KADM5_CONFIG_IPROP_ENABLED) == KADM5_CONFIG_IPROP_ENABLED - && handle->params.iprop_enabled) { - if ((handle->params.mask & IPROP_REQUIRED_PARAMS) != IPROP_REQUIRED_PARAMS) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return KADM5_MISSING_CONF_PARAMS; -+ ret = KADM5_MISSING_CONF_PARAMS; -+ goto cleanup; - } - } - - ret = krb5_set_default_realm(handle->context, handle->params.realm); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = krb5_db_open(handle->context, db_args, - KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return(ret); -- } -+ if (ret) -+ goto cleanup; - -- if ((ret = krb5_parse_name(handle->context, client_name, -- &handle->current_caller))) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ ret = krb5_parse_name(handle->context, client_name, -+ &handle->current_caller); -+ if (ret) -+ goto cleanup; - -- if (! (handle->lhandle = malloc(sizeof(*handle)))) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ENOMEM; -- } -+ handle->lhandle = k5alloc(sizeof(*handle), &ret); -+ if (handle->lhandle == NULL) -+ goto cleanup; - *handle->lhandle = *handle; - handle->lhandle->api_version = KADM5_API_VERSION_4; - handle->lhandle->struct_version = KADM5_STRUCT_VERSION; - handle->lhandle->lhandle = handle->lhandle; - -- /* can't check the handle until current_caller is set */ -- ret = check_handle((void *) handle); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return ret; -- } -- - ret = kdb_init_master(handle, handle->params.realm, - (handle->params.mask & KADM5_CONFIG_MKEY_FROM_KBD) - && handle->params.mkey_from_kbd); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = kdb_init_hist(handle, handle->params.realm); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = k5_kadm5_hook_load(context,&handle->hook_handles); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = init_pwqual(handle); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- k5_kadm5_hook_free_handles(context, handle->hook_handles); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - -- *server_handle = (void *) handle; -+ *server_handle = handle; -+ handle = NULL; - -- return KADM5_OK; -+cleanup: -+ free_handle(handle); -+ return ret; - } - - kadm5_ret_t kadm5_destroy(void *server_handle) - { -- kadm5_server_handle_t handle = server_handle; -- - CHECK_HANDLE(server_handle); -- -- destroy_pwqual(handle); -- -- k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); -- ulog_fini(handle->context); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- kadm5_free_config_params(handle->context, &handle->params); -- handle->magic_number = 0; -- free(handle->lhandle); -- free_db_args(handle); -- free(handle); -- -+ free_handle(server_handle); - return KADM5_OK; - } - diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch deleted file mode 100644 index ba5a8b5..0000000 --- a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch +++ /dev/null @@ -1,552 +0,0 @@ -From f85a818fe1a7438db7e1ea579818da67e0be017d Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 17:35:25 -0400 -Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0 - -EVP_PKEY_get0_RSA() has been modified to have const return type. Remove -its usages in favor of the EVP_PKEY interface. Also remove calls to -RSA_blinding_off(), which we don't need and would require a non-const -object. Similarly, remove RSA_set_method() calls that set a pre-existing -default. - -Since softpkcs11 doesn't link against krb5 and can't use zap(), allocate -buffers with OPENSSL_malloc() so can use OPENSSL_clear_free(). - -Move several argument validation checks to the top of their functions. - -Fix some incorrect/inconsistent log messages. - -(cherry picked from commit 00de1aad7b3647b91017c7009b0bc65cd0c8b2e0) -(cherry picked from commit a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4) ---- - src/tests/softpkcs11/main.c | 360 ++++++++++++++---------------------- - 1 file changed, 141 insertions(+), 219 deletions(-) - -diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c -index 1cccdfb43..caa537b68 100644 ---- a/src/tests/softpkcs11/main.c -+++ b/src/tests/softpkcs11/main.c -@@ -375,10 +375,9 @@ add_st_object(void) - return NULL; - soft_token.object.objs = objs; - -- o = malloc(sizeof(*o)); -+ o = calloc(1, sizeof(*o)); - if (o == NULL) - return NULL; -- memset(o, 0, sizeof(*o)); - o->attrs = NULL; - o->num_attributes = 0; - o->object_handle = soft_token.object.num_objs; -@@ -424,7 +423,7 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) - CK_ULONG modulus_bits = 0; - CK_BYTE *exponent = NULL; - size_t exponent_len = 0; -- RSA *rsa; -+ const RSA *rsa; - const BIGNUM *n, *e; - - rsa = EVP_PKEY_get0_RSA(key); -@@ -445,8 +444,6 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) - add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, - exponent, exponent_len); - -- RSA_set_method(rsa, RSA_PKCS1_OpenSSL()); -- - free(modulus); - free(exponent); - } -@@ -679,10 +676,6 @@ add_certificate(char *label, - } else { - /* XXX verify keytype */ - -- if (key_type == CKK_RSA) -- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), -- RSA_PKCS1_OpenSSL()); -- - if (X509_check_private_key(cert, o->u.private_key.key) != 1) { - EVP_PKEY_free(o->u.private_key.key); - o->u.private_key.key = NULL; -@@ -695,7 +688,7 @@ add_certificate(char *label, - } - - ret = CKR_OK; -- out: -+out: - if (ret != CKR_OK) { - st_logf("something went wrong when adding cert!\n"); - -@@ -1224,8 +1217,6 @@ C_Login(CK_SESSION_HANDLE hSession, - } - - /* XXX check keytype */ -- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), -- RSA_PKCS1_OpenSSL()); - - if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) { - EVP_PKEY_free(o->u.private_key.key); -@@ -1495,8 +1486,9 @@ C_Encrypt(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ size_t buffer_len = 0; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Encrypt\n"); - -@@ -1512,70 +1504,58 @@ C_Encrypt(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.public_key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->encrypt_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len + padding_len < ulDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulEncryptedDataLen == NULL) { - st_logf("pulEncryptedDataLen NULL\n"); - ret = CKR_ARGUMENTS_BAD; - goto out; - } - -- if (pData == NULL_PTR) { -+ if (pData == NULL) { - st_logf("data NULL\n"); - ret = CKR_ARGUMENTS_BAD; - goto out; - } - -- len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding); -- if (len <= 0) { -+ switch(state->encrypt_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); -+ if (ctx == NULL || EVP_PKEY_encrypt_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_encrypt(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); - -- if (pEncryptedData != NULL_PTR) -- memcpy(pEncryptedData, buffer, len); -- *pulEncryptedDataLen = len; -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; - } -+ -+ if (EVP_PKEY_encrypt(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Encrypt done\n"); -+ -+ if (pEncryptedData != NULL) -+ memcpy(pEncryptedData, buffer, buffer_len); -+ *pulEncryptedDataLen = buffer_len; -+ -+ ret = CKR_OK; -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1646,8 +1626,9 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ size_t buffer_len = 0; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Decrypt\n"); - -@@ -1663,41 +1644,6 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->decrypt_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulDataLen == NULL) { - st_logf("pulDataLen NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -1710,24 +1656,48 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer, -- rsa, padding); -- if (len <= 0) { -+ switch(state->decrypt_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); -+ if (ctx == NULL || EVP_PKEY_decrypt_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_decrypt(ctx, NULL, &buffer_len, pEncryptedData, -+ ulEncryptedDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); -+ -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; -+ } -+ -+ if (EVP_PKEY_decrypt(ctx, buffer, &buffer_len, pEncryptedData, -+ ulEncryptedDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Decrypt done\n"); - - if (pData != NULL_PTR) -- memcpy(pData, buffer, len); -- *pulDataLen = len; -+ memcpy(pData, buffer, buffer_len); -+ *pulDataLen = buffer_len; - -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+ ret = CKR_OK; -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1806,8 +1776,9 @@ C_Sign(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ int padding; -+ size_t buffer_len = 0; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Sign\n"); - VERIFY_SESSION_HANDLE(hSession, &state); -@@ -1822,40 +1793,6 @@ C_Sign(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- switch(state->sign_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len < ulDataLen + padding_len) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulSignatureLen == NULL) { - st_logf("signature len NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -1868,26 +1805,46 @@ C_Sign(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding); -- st_logf("private encrypt done\n"); -- if (len <= 0) { -+ switch(state->sign_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); -+ if (ctx == NULL || EVP_PKEY_sign_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_sign(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); - -- if (pSignature != NULL_PTR) -- memcpy(pSignature, buffer, len); -- *pulSignatureLen = len; -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; -+ } -+ -+ if (EVP_PKEY_sign(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Sign done\n"); -+ -+ if (pSignature != NULL) -+ memcpy(pSignature, buffer, buffer_len); -+ *pulSignatureLen = buffer_len; - - ret = CKR_OK; -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1951,10 +1908,9 @@ C_Verify(CK_SESSION_HANDLE hSession, - { - struct session_state *state; - struct st_object *o; -- void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Verify\n"); - VERIFY_SESSION_HANDLE(hSession, &state); -@@ -1969,39 +1925,6 @@ C_Verify(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.public_key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->verify_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len < ulDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pSignature == NULL) { - st_logf("signature NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -2014,34 +1937,34 @@ C_Verify(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding); -- st_logf("private encrypt done\n"); -- if (len <= 0) { -+ switch(state->verify_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); -+ if (ctx == NULL || EVP_PKEY_verify_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_verify(ctx, pSignature, ulSignatureLen, pData, -+ ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); -+ st_logf("Verify done\n"); - -- if ((CK_ULONG)len != ulSignatureLen) { -- ret = CKR_GENERAL_ERROR; -- goto out; -- } -- -- if (memcmp(pSignature, buffer, len) != 0) { -- ret = CKR_GENERAL_ERROR; -- goto out; -- } -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+ ret = CKR_OK; -+out: -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -- - CK_RV - C_VerifyUpdate(CK_SESSION_HANDLE hSession, - CK_BYTE_PTR pPart, -@@ -2072,7 +1995,6 @@ C_GenerateRandom(CK_SESSION_HANDLE hSession, - return CKR_FUNCTION_NOT_SUPPORTED; - } - -- - CK_FUNCTION_LIST funcs = { - { 2, 11 }, - C_Initialize, diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch deleted file mode 100644 index 81fde7f..0000000 --- a/Fix-some-principal-realm-canonicalization-cases.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 0779309f52f4c05bb1f01f638261ef1b8ca82488 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 7 Jun 2021 13:27:29 -0400 -Subject: [PATCH] Fix some principal realm canonicalization cases - -The no_hostrealm and subst_defrealm flags in struct canonprinc were -only applied when dns_canonicalize_hostname=fallback; in the other -cases, the initial krb5_sname_to_principal() result is treated as -canonical. For no_hostrealm this limitation doesn't currently matter, -because all uses pass a principal with no realm as input. However, -subst_defrealm is used to convert the referral realm to the default -realm in krb5_get_init_creds_keytab(), krb5_cc_cache_match(), and -gss_acquire_cred() when it needs to check the desired name against a -specified ccache. - -In k5_canonprinc(), if the input principal is a -krb5_sname_to_principal() result and fallback isn't in effect, apply -subst_defrealm. Document in os-proto.h that no_hostrealm doesn't -remove an existing realm and that krb5_sname_to_principal() may -already have looked one up. - -ticket: 9011 (new) -(cherry picked from commit c077d0c6430c4ac163443aacc03d14d206a4cbb8) ---- - src/lib/krb5/os/os-proto.h | 13 +++++++++---- - src/lib/krb5/os/sn2princ.c | 24 +++++++++++++++++++++--- - 2 files changed, 30 insertions(+), 7 deletions(-) - -diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h -index 7d5e7978f..a985f2aec 100644 ---- a/src/lib/krb5/os/os-proto.h -+++ b/src/lib/krb5/os/os-proto.h -@@ -85,10 +85,15 @@ struct sendto_callback_info { - - /* - * Initialize with all zeros except for princ. Set no_hostrealm to disable -- * host-to-realm lookup, which ordinarily happens after canonicalizing the host -- * part. Set subst_defrealm to substitute the default realm for the referral -- * realm after realm lookup (this has no effect if no_hostrealm is set). Free -- * with free_canonprinc() when done. -+ * host-to-realm lookup, which ordinarily happens during fallback processing -+ * after canonicalizing the host part. Set subst_defrealm to substitute the -+ * default realm for the referral realm after realm lookup. Do not set both -+ * flags. Free with free_canonprinc() when done. -+ * -+ * no_hostrealm only applies if fallback processing is in use -+ * (dns_canonicalize_hostname = fallback). It will not remove the realm if -+ * krb5_sname_to_principal() already canonicalized the hostname and looked up a -+ * realm. subst_defrealm applies whether or not fallback processing is in use. - */ - struct canonprinc { - krb5_const_principal princ; -diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c -index c99b7da17..93c155932 100644 ---- a/src/lib/krb5/os/sn2princ.c -+++ b/src/lib/krb5/os/sn2princ.c -@@ -271,18 +271,36 @@ krb5_error_code - k5_canonprinc(krb5_context context, struct canonprinc *iter, - krb5_const_principal *princ_out) - { -+ krb5_error_code ret; - int step = ++iter->step; - - *princ_out = NULL; - -- /* If we're not doing fallback, the input principal is canonical. */ -- if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || -- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || -+ /* If the hostname isn't from krb5_sname_to_principal(), the input -+ * principal is canonical. */ -+ if (iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || - iter->princ->data[1].length == 0) { - *princ_out = (step == 1) ? iter->princ : NULL; - return 0; - } - -+ /* If we're not doing fallback, the hostname is canonical, but we may need -+ * to substitute the default realm. */ -+ if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK) { -+ if (step > 1) -+ return 0; -+ iter->copy = *iter->princ; -+ if (iter->subst_defrealm && iter->copy.realm.length == 0) { -+ ret = krb5_get_default_realm(context, &iter->realm); -+ if (ret) -+ return ret; -+ iter->copy = *iter->princ; -+ iter->copy.realm = string2data(iter->realm); -+ } -+ *princ_out = &iter->copy; -+ return 0; -+ } -+ - /* Canonicalize without DNS at step 1, with DNS at step 2. */ - if (step > 2) - return 0; diff --git a/Handle-OpenSSL-3-s-providers.patch b/Handle-OpenSSL-3-s-providers.patch deleted file mode 100644 index d7b0d90..0000000 --- a/Handle-OpenSSL-3-s-providers.patch +++ /dev/null @@ -1,301 +0,0 @@ -From e3f3d31a3db23f6c8437cd0efe45f67a7f4fc6aa Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 21:18:06 -0400 -Subject: [PATCH] Handle OpenSSL 3's providers - -OpenSSL 3 compartmentalizes what algorithms it uses, which for us means -another hoop to jump through to use dubious cryptography. (Right now, -we need to load "legacy" in order to access MD4 and RC4.) - -Use our normal initializer logic to set up providers both in the OpenSSL -provider an the PKINIT plugin. Since DT_FINI is too late, release them -using atexit() as OpenSSL does. - -(cherry picked from commit bea5a703a06da1f1ab56821b77a2d3661cb0dda4) -[rharwood@redhat.com: work around des3 removal and rc4 fips changes] ---- - src/configure.ac | 1 + - src/lib/crypto/openssl/enc_provider/aes.c | 16 ++++++ - .../crypto/openssl/enc_provider/camellia.c | 16 ++++++ - src/lib/crypto/openssl/enc_provider/rc4.c | 4 ++ - .../crypto/openssl/hash_provider/hash_evp.c | 5 ++ - src/lib/crypto/openssl/init.c | 53 +++++++++++++++++++ - src/plugins/preauth/pkinit/Makefile.in | 1 + - .../preauth/pkinit/pkinit_crypto_openssl.c | 33 ++++++++++-- - 8 files changed, 126 insertions(+), 3 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 9c2e816fe..20066918b 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -284,6 +284,7 @@ AC_SUBST(CRYPTO_IMPL_LIBS) - - if test "$CRYPTO_IMPL" = openssl; then - AC_CHECK_FUNCS(EVP_KDF_fetch) -+ AC_CHECK_FUNCS(OSSL_PROVIDER_load) - fi - - AC_ARG_WITH([prng-alg], -diff --git a/src/lib/crypto/openssl/enc_provider/aes.c b/src/lib/crypto/openssl/enc_provider/aes.c -index 6b4622fe9..31c90a69d 100644 ---- a/src/lib/crypto/openssl/enc_provider/aes.c -+++ b/src/lib/crypto/openssl/enc_provider/aes.c -@@ -68,6 +68,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -102,6 +106,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -137,6 +145,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - AES_KEY enck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -@@ -190,6 +202,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - AES_KEY deck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c -index f79679a0b..7cc7fc6fb 100644 ---- a/src/lib/crypto/openssl/enc_provider/camellia.c -+++ b/src/lib/crypto/openssl/enc_provider/camellia.c -@@ -92,6 +92,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -126,6 +130,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -161,6 +169,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - CAMELLIA_KEY enck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -@@ -214,6 +226,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - CAMELLIA_KEY deck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c -index 9bf407899..a10cb5192 100644 ---- a/src/lib/crypto/openssl/enc_provider/rc4.c -+++ b/src/lib/crypto/openssl/enc_provider/rc4.c -@@ -66,6 +66,10 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx = NULL; - struct arcfour_state *arcstate; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - if (FIPS_mode()) - return KRB5_CRYPTO_INTERNAL; - -diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c -index 2eb5139c0..09d7b3896 100644 ---- a/src/lib/crypto/openssl/hash_provider/hash_evp.c -+++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c -@@ -41,6 +41,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, - const krb5_data *d; - size_t i; - int ok; -+ krb5_error_code ret; -+ -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; - - if (output->length != (unsigned int)EVP_MD_size(type)) - return KRB5_CRYPTO_INTERNAL; -diff --git a/src/lib/crypto/openssl/init.c b/src/lib/crypto/openssl/init.c -index 1139bce53..f72dbfe81 100644 ---- a/src/lib/crypto/openssl/init.c -+++ b/src/lib/crypto/openssl/init.c -@@ -26,12 +26,65 @@ - - #include "crypto_int.h" - -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+ -+/* -+ * Starting in OpenSSL 3, algorithms are grouped into containers called -+ * "providers", not all of which are loaded by default. At time of writing, -+ * we need MD4 and RC4 from the legacy provider. Oddly, 3DES is not in -+ * legacy. -+ */ -+ -+#include -+ -+static OSSL_PROVIDER *legacy_provider = NULL; -+static OSSL_PROVIDER *default_provider = NULL; -+ -+static void -+unload_providers(void) -+{ -+ if (default_provider != NULL) -+ (void)OSSL_PROVIDER_unload(default_provider); -+ if (legacy_provider != NULL) -+ (void)OSSL_PROVIDER_unload(legacy_provider); -+ default_provider = NULL; -+ legacy_provider = NULL; -+} -+ -+int -+krb5int_crypto_impl_init(void) -+{ -+ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); -+ default_provider = OSSL_PROVIDER_load(NULL, "default"); -+ -+ /* -+ * Someone might build openssl without the legacy provider. They will -+ * have a bad time, but some things will still work. I don't know think -+ * this configuration is worth supporting. -+ */ -+ if (legacy_provider == NULL || default_provider == NULL) -+ abort(); -+ -+ /* -+ * If we attempt to do this with our normal LIBFINIFUNC logic (DT_FINI), -+ * OpenSSL will have cleaned itself up by the time we're invoked. OpenSSL -+ * registers its cleanup (OPENSSL_cleanup) with atexit() - do the same and -+ * we'll be higher on the stack. -+ */ -+ atexit(unload_providers); -+ return 0; -+} -+ -+#else /* !HAVE_OSSL_PROVIDER_LOAD */ -+ - int - krb5int_crypto_impl_init(void) - { - return 0; - } - -+#endif -+ - void - krb5int_crypto_impl_cleanup(void) - { -diff --git a/src/plugins/preauth/pkinit/Makefile.in b/src/plugins/preauth/pkinit/Makefile.in -index 15ca0eb48..d20fb18a8 100644 ---- a/src/plugins/preauth/pkinit/Makefile.in -+++ b/src/plugins/preauth/pkinit/Makefile.in -@@ -5,6 +5,7 @@ MODULE_INSTALL_DIR = $(KRB5_PA_MODULE_DIR) - LIBBASE=pkinit - LIBMAJOR=0 - LIBMINOR=0 -+LIBINITFUNC=pkinit_openssl_init - RELDIR=../plugins/preauth/pkinit - # Depends on libk5crypto and libkrb5 - SHLIB_EXPDEPS = \ -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 350c2118a..42e5c581d 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -44,6 +44,13 @@ - #include - #endif - -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+#include -+ -+static OSSL_PROVIDER *legacy_provider = NULL; -+static OSSL_PROVIDER *default_provider = NULL; -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2937,12 +2944,32 @@ cleanup: - return retval; - } - -+/* pkinit_openssl_init() and unload_providers() are largely duplicated from -+ * lib/crypto/openssl/init.c - see explanations there. */ -+static void -+unload_providers(void) -+{ -+ if (default_provider != NULL) -+ (void)OSSL_PROVIDER_unload(default_provider); -+ if (legacy_provider != NULL) -+ (void)OSSL_PROVIDER_unload(legacy_provider); -+ default_provider = NULL; -+ legacy_provider = NULL; -+} -+ - int - pkinit_openssl_init() - { -- /* Initialize OpenSSL. */ -- ERR_load_crypto_strings(); -- OpenSSL_add_all_algorithms(); -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); -+ default_provider = OSSL_PROVIDER_load(NULL, "default"); -+ -+ if (legacy_provider == NULL || default_provider == NULL) -+ abort(); -+ -+ atexit(unload_providers); -+#endif -+ - return 0; - } - diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch deleted file mode 100644 index a0e28a9..0000000 --- a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 32ee800fa31d3bbda660bb9270f9aa20718ab202 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20B=C5=99ezina?= -Date: Tue, 30 Mar 2021 14:35:28 +0200 -Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm - -sssd-kcm returns KRB5_CC_IO if the operation code is not known. - -ticket: 8990 -(cherry picked from commit 06afae820a44c1dc96ad88a0b16c3e50bc938b2a) ---- - src/lib/krb5/ccache/cc_kcm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 1f81a2190..46705f1da 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -876,7 +876,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - ret = kcmreq_get_cred_list(&req, &creds); - if (ret) - goto cleanup; -- } else if (ret == KRB5_FCC_INTERNAL) { -+ } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { - /* Fall back to GET_CRED_UUID_LIST. */ - kcmreq_free(&req); - kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch deleted file mode 100644 index 1c97190..0000000 --- a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch +++ /dev/null @@ -1,1750 +0,0 @@ -From 2fd38805a159020722395e79213540d9bcfa6c71 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 22 Apr 2021 15:51:36 -0400 -Subject: [PATCH] Move some dejagnu kadmin tests to Python tests - -Remove the dejagnu scripts kadmin.exp, pwchange.exp, and pwhist.exp. - -Add a new Python test script t_kadmin.py for the miscellaneous kadmin -tests from kadmin.exp. - -In t_changepw.py, use modprinc +needchange for one of the kinit -password change tests to gain the same coverage as pwchange.exp had, -and add the "password changes are usable by kinit" tests from -kadmin.exp. - -In t_policy.py, add the ticket 929 regression tests from kadmin.exp -and the ticket 2841 regression tests from pwhist.exp. - -(cherry picked from commit 8027531caf6911bb07bf13de087da0e6bef5a348) ---- - src/tests/Makefile.in | 1 + - src/tests/dejagnu/krb-standalone/kadmin.exp | 1133 ----------------- - src/tests/dejagnu/krb-standalone/pwchange.exp | 145 --- - src/tests/dejagnu/krb-standalone/pwhist.exp | 217 ---- - src/tests/t_changepw.py | 34 +- - src/tests/t_kadmin.py | 54 + - src/tests/t_policy.py | 62 + - 7 files changed, 143 insertions(+), 1503 deletions(-) - delete mode 100644 src/tests/dejagnu/krb-standalone/kadmin.exp - delete mode 100644 src/tests/dejagnu/krb-standalone/pwchange.exp - delete mode 100644 src/tests/dejagnu/krb-standalone/pwhist.exp - create mode 100644 src/tests/t_kadmin.py - -diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index fd714eedb..20f27d748 100644 ---- a/src/tests/Makefile.in -+++ b/src/tests/Makefile.in -@@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self - $(RUNPYTEST) $(srcdir)/t_referral.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_skew.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_keytab.py $(PYTESTFLAGS) -+ $(RUNPYTEST) $(srcdir)/t_kadmin.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kadmin_acl.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kadmin_parsing.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kdb.py $(PYTESTFLAGS) -diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp -deleted file mode 100644 -index fa50a61fb..000000000 ---- a/src/tests/dejagnu/krb-standalone/kadmin.exp -+++ /dev/null -@@ -1,1133 +0,0 @@ --# Kerberos kadmin test. --# This is a DejaGnu test script. --# This script tests Kerberos kadmin5 using kadmin.local as verification. -- --#++ --# kadmin_add - Test add new v5 principal function of kadmin. --# --# Adds principal $pname with password $password. Returns 1 on success. --#-- --proc kadmin_add { pname password } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin add $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*:" { -- send "adminpass$KEY\r" -- } -- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin add)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that a principal was created and that its -- # salt types are 0 (normal). -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getprinc $pname\r" } -- expect "Principal: $pname@$REALMNAME" { set good 1 } -- expect "Expiration date:" { verbose "got expiration date" } -- expect "Last password change:" { verbose "got last pwchange" } -- expect "Password expiration date:" { verbose "got pwexpire date" } -- expect "Maximum ticket life:" { verbose "got max life" } -- expect "Maximum renewable life:" { verbose "got max rlife" } -- expect "Last modified:" { verbose "got last modified" } -- expect "Last successful authentication:" { verbose "last succ auth" } -- expect "Last failed authentication:" { verbose "last pw failed" } -- expect "Failed password attempts:" { verbose "num failed attempts" } -- expect "Number of keys:" { verbose "num keys"} -- expect { -- "Key: " { verbose "Key listed" -- exp_continue -- } -- "Attributes:" { verbose "attributes" } -- } -- expect "kadmin.local: " { send "q\r" } -- -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin add $pname" -- return 1 -- } -- else { -- fail "kadmin add $pname" -- return 0 -- } -- } -- else { -- fail "kadmin add $pname" -- return 0 -- } --} -- --#++ --# kadmin_add_rnd - Test add new v5 principal with random key function. --# --# Adds principal $pname with random key. Returns 1 on success. --#-- --proc kadmin_add_rnd { pname { flags "" } } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin add rnd $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin add_rnd)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that a principal was created and that its -- # salt types are 0 (normal). -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local:" { send "getprinc $pname\r" } -- expect "Principal: $pname@$REALMNAME" { set good 1 } -- expect "kadmin.local:" { send "q\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin add_rnd $pname" -- return 1 -- } -- else { -- fail "kadmin add_rnd $pname" -- return 0 -- } -- } -- else { -- fail "kadmin add_rnd $pname" -- return 0 -- } --} -- --#++ --# kadmin_show - Test show principal function of kadmin. --# --# Retrieves entry for $pname. Returns 1 on success. --#-- --proc kadmin_show { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principal $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin show $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin show $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin show $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- expect -re "\r.*Principal: $pname@$REALMNAME.*Key: .*Attributes:.*Policy: .*\r" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin show)" -- catch "close -i $spawn_id" -- pass "kadmin show $pname" -- return 1 --} -- --#++ --# kadmin_cpw - Test change password function of kadmin --# --# Change password of $pname to $password. Returns 1 on success. --#-- --proc kadmin_cpw { pname password } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin cpw $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin cpw $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin cpw $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- -- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Password for \"$pname@$REALMNAME\" changed." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw)" -- catch "close -i $spawn_id" -- pass "kadmin cpw $pname" -- return 1 --} -- --#++ --# kadmin_cpw_rnd - Test change random key function of kadmin. --# --# Changes principal $pname's key to a new random key. Returns 1 on success. --#-- --proc kadmin_cpw_rnd { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw -randkey $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin cpw_rnd $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin cpw_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin cpw_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Key for \"$pname@$REALMNAME\" randomized." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw_rnd)" -- catch "close -i $spawn_id" -- pass "kadmin cpw_rnd $pname" -- return 1 --} -- --#++ --# kadmin_modify - Test modify principal function of kadmin. --# --# Modifies principal $pname with flags $flags. Returns 1 on success. --#-- --proc kadmin_modify { pname flags } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modprinc $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin modify $pname ($flags) lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin modify $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin modify $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Principal \"$pname@$REALMNAME\" modified." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modify)" -- catch "close -i $spawn_id" -- pass "kadmin modify $pname" -- return 1 --} -- -- --#++ --# kadmin_list - Test list database function of kadmin. --# --# Lists the database and verifies that output matches regular expression --# "(.*@$REALMNAME)*". Returns 1 on success. --#-- --proc kadmin_list { } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- # "*" would match everything -- # "*n" should match a few like kadmin/admin but see ticket 5667 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principals *n" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin ldb lost KDC" -- catch "expect_after" -- return 0 -- } -- "Communication failure" { -- fail "kadmin ldb got RPC error" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin ldb" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin ldb" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect -re "\(.*@$REALMNAME\r\n\)+" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin list)" -- catch "close -i $spawn_id" -- pass "kadmin ldb" -- return 1 --} -- --#++ --# kadmin_extract - Test extract service key function of kadmin. --# --# Extracts service key for service name $name instance $instance. Returns --# 1 on success. --#-- --proc kadmin_extract { instance name } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- global tmppwd -- -- catch "exec rm -f $tmppwd/keytab" -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst -k $tmppwd/keytab $name/$instance" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin xst $instance $name lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin xst $instance $name" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin xst $instance $name" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin xst)" -- catch "close -i $spawn_id" -- catch "exec rm -f $instance-new-keytab" -- pass "kadmin xst $instance $name" -- return 1 --} -- --#++ --# kadmin_delete - Test delete principal function of kadmin. --# --# Deletes principal $pname. Returns 1 on success. --#-- --proc kadmin_delete { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delete $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "Principal \"$pname@$REALMNAME\" deleted." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that the old principal is not present. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getprinc $pname\r" } -- expect "Principal does not exist while retrieving \"$pname@$REALMNAME\"." { set good 1 } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin delprinc $pname" -- return 1 -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } --} -- --#++ --# kadmin_delete - Test delete principal function of kadmin. --# --# Deletes principal $pname. Returns 1 on success. --#-- --proc kadmin_delete_locked_down { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- # -- # First test that we fail, then unlock and retry -- # -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delete $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "delete_principal: Operation requires ``delete'' privilege while deleting principal \"$pname@$REALMNAME\"" { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to remove lockdown. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "modprinc -lockdown_keys $pname\r" } -- expect "Principal \"$pname@$REALMNAME\" modified." { set good 1 } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- set good 0 -- if {[kadmin_delete $pname]} { set good 1 } -- } -- if { $good == 1 } { -- pass "kadmin delprinc $pname" -- return 1 -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } --} -- --#++ --# kpasswd_cpw - Test password changing using kpasswd. --# --# Change $princ's password from $opw to $npw. Returns 1 on success. --#-- --proc kpasswd_cpw { princ opw npw } { -- global KPASSWD -- global REALMNAME -- -- spawn $KPASSWD $princ -- expect_after { -- timeout { -- fail "kpasswd $princ $npw" --# catch "expect_after" -- return 0 -- } -- eof { -- fail "kpasswd $princ $npw" --# catch "expect_after" -- return 0 -- } -- } -- --# expect "Changing password for $princ." --# expect "Old password:" { send "$opw\r" } --# expect "New password:" { send "$npw\r" } --# expect "New password (again):" { send "$npw\r" } -- expect "Password for $princ@$REALMNAME:" { send "$opw\r" } -- expect "Enter new password:" { send "$npw\r" } -- expect "Enter it again:" { send "$npw\r" } --# expect "Kerberos password changed." -- expect "Password changed." -- expect_after -- expect eof -- -- if ![check_exit_status "kpasswd"] { -- fail "kpasswd $princ $npw" -- return 0 -- } -- pass "kpasswd $princ $npw" -- return 1 --} -- --#++ --# kadmin_addpol - Test add new policy function of kadmin. --# --# Adds policy $pname. Returns 1 on success. --#-- --proc kadmin_addpol { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "addpol $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin addpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)" -- catch "close -i $spawn_id" -- # -- # use kadmin.local to verify that a policy was created -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getpol $pname\r" } -- expect "Policy: $pname" { set good 1 } -- expect "Maximum password life:" { verbose "got max pw life" } -- expect "Minimum password life:" { verbose "got min pw life" } -- expect "Minimum password length:" { verbose "got min pw length" } -- expect "Minimum number of password character classes:" { -- verbose "got min pw character classes" } -- expect "Number of old keys kept:" { verbose "got num old keys kept" } -- expect "kadmin.local: " { send "q\r" } -- -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin addpol $pname" -- return 1 -- } -- else { -- fail "kadmin addpol $pname" -- return 0 -- } --} -- --#++ --# kadmin_delpol - Test delete policy function of kadmin. --# --# Deletes policy $pname. Returns 1 on success. --#-- --proc kadmin_delpol { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delpol -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delpol)" -- catch "close -i $spawn_id" -- # -- # use kadmin.local to verify that the old policy is not present. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getpol $pname\r" } -- expect "Policy does not exist while retrieving policy \"$pname\"." { -- set good 1 -- } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin delpol $pname" -- return 1 -- } -- else { -- fail "kadmin delpol $pname" -- return 0 -- } --} -- --#++ --# kadmin_listpols - Test list policy database function of kadmin. --# --# Lists the policies. Returns 1 on success. --#-- --proc kadmin_listpols { } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policies *" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin lpols lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin lpols" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin lpols" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin listpols)" -- catch "close -i $spawn_id" -- pass "kadmin lpols" -- return 1 --} -- --#++ --# kadmin_modpol - Test modify policy function of kadmin. --# --# Modifies policy $pname with flags $flags. Returns 1 on success. --#-- --proc kadmin_modpol { pname flags } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modpol $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin modpol $pname ($flags) lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin modpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin modpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- # When in doubt, jam one of these in there. -- expect "\r" -- # Sadly, kadmin doesn't print a confirmation message for policy operations. -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modpol)" -- catch "close -i $spawn_id" -- pass "kadmin modpol $pname" -- return 1 --} -- --#++ --# kadmin_showpol - Test show policy function of kadmin. --# --# Retrieves entry for $pname. Returns 1 on success. --#-- --proc kadmin_showpol { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policy $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin showpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin showpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin showpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin showpol)" -- catch "close -i $spawn_id" -- pass "kadmin showpol $pname" -- return 1 --} -- --#++ --# kdestroy --#-- --proc kdestroy { } { -- global KDESTROY -- -- spawn $KDESTROY -5 -- if ![check_exit_status "kdestroy"] { -- return 0 -- } -- return 1 --} -- --# Wrap the tests in a procedure, so that we can kill the daemons if --# we get some sort of error. -- --proc kadmin_test { } { -- global hostname -- -- # Start up the kerberos and kadmind daemons -- if {![start_kerberos_daemons 0] } { -- return -- } -- -- # Test basic kadmin functions. -- if {![kadmin_add v5principal/instance1 v5principal] \ -- || ![kadmin_addpol standardpol] \ -- || ![kadmin_showpol standardpol] \ -- || ![kadmin_listpols] \ -- || ![kadmin_modpol standardpol "-minlength 5"] \ -- || ![kadmin_add v4principal/instance2 v4principal] \ -- || ![kadmin_add_rnd v5random] \ -- || ![kadmin_show v5principal/instance1] \ -- || ![kadmin_show v4principal/instance2] \ -- || ![kadmin_show v5random] \ -- || ![kadmin_cpw v5principal/instance1 faroutman] \ -- || ![kadmin_cpw v4principal/instance2 honkydory] \ -- || ![kadmin_cpw_rnd v5random] \ -- || ![kadmin_modify v5random -allow_tix] \ -- || ![kadmin_modify v5random +allow_tix] \ -- || ![kadmin_modify v5random "-policy standardpol"] \ -- || ![kadmin_list] \ -- || ![kadmin_extract instance1 v5principal] \ -- || ![kadmin_delete v5random] \ -- || ![kadmin_delete v4principal/instance2] \ -- || ![kadmin_delete v5principal/instance1] \ -- || ![kadmin_delpol standardpol]} { -- return -- } -- --# You cannot extract a v4 key... --# || ![kadmin_extractv4 instance2 v4principal] \ -- -- # now test kpasswd -- if {![kadmin_add testprinc/instance thisisatest] \ -- || ![kpasswd_cpw testprinc/instance thisisatest anothertest] \ -- || ![kpasswd_cpw testprinc/instance anothertest goredsox] \ -- || ![kadmin_delete testprinc/instance]} { -- return -- } -- -- # now test that we can kinit with principals/passwords. -- # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd -- if {![kadmin_add testprinc1/instance thisisatest] \ -- || ![kinit testprinc1/instance thisisatest 0] \ -- || ![kpasswd_cpw testprinc1/instance thisisatest anothertest] \ -- || ![kdestroy] \ -- || ![kinit testprinc1/instance anothertest 0] \ -- || ![kdestroy] \ -- || ![kpasswd_cpw testprinc1/instance anothertest goredsox] \ -- || ![kinit testprinc1/instance goredsox 0] \ -- || ![kdestroy] \ -- || ![kadmin_cpw testprinc1/instance betterwork] \ -- || ![kinit testprinc1/instance betterwork 0] \ -- || ![kdestroy] \ -- || ![kadmin_delete testprinc1/instance]} { -- return -- } -- -- # now test modify changes. -- if {![kadmin_add testuser longtestpw] \ -- || ![kinit testuser longtestpw 0] \ -- || ![kdestroy] \ -- || ![kadmin_modify testuser "-maxlife \"2500 seconds\""] \ -- || ![kinit testuser longtestpw 0] \ -- || ![kdestroy] \ -- || ![kadmin_delete testuser]} { -- return -- } -- -- # now test that reducing the history number doesn't make kadmind vulnerable. -- if {![kadmin_addpol crashpol] \ -- || ![kadmin_modpol crashpol "-history 5"] \ -- || ![kadmin_add crash first] \ -- || ![kadmin_modify crash "-policy crashpol"] \ -- || ![kadmin_cpw crash second] \ -- || ![kadmin_cpw crash third] \ -- || ![kadmin_cpw crash fourth] \ -- || ![kadmin_modpol crashpol "-history 3"] \ -- || ![kadmin_cpw crash fifth] \ -- || ![kadmin_delete crash] \ -- || ![kadmin_delpol crashpol]} { -- return -- } -- -- # test retrieval of large number of principals -- # bug [2877] -- for { set i 0 } { $i < 200 } { incr i } { -- if { ![kadmin_add "foo$i" foopass] } { -- return -- } -- } -- -- if { ![kadmin_list] } { -- return -- } -- -- # test fallback to kadmin/hostname -- if {![kadmin_add_rnd kadmin/$hostname] \ -- || ![kadmin_delete_locked_down kadmin/admin] \ -- || ![kadmin_list] \ -- || ![kadmin_add_rnd kadmin/admin -allow_tgs_req] \ -- || ![kadmin_list]} { -- return -- } -- -- verbose "kadmin_test succeeded" --} -- --run_once kadmin { -- # Set up the kerberos database. -- if {![get_hostname] \ -- || ![setup_kerberos_files] \ -- || ![setup_kerberos_env] \ -- || ![setup_kerberos_db 0]} { -- return -- } -- -- # Run the test. -- set status [catch kadmin_test msg] -- -- # Shut down the kerberos daemons and the rsh daemon. -- stop_kerberos_daemons -- -- if { $status != 0 } { -- send_error "ERROR: error in kadmin.exp\n" -- send_error "$msg\n" -- exit 1 -- } --} -diff --git a/src/tests/dejagnu/krb-standalone/pwchange.exp b/src/tests/dejagnu/krb-standalone/pwchange.exp -deleted file mode 100644 -index 010e8344a..000000000 ---- a/src/tests/dejagnu/krb-standalone/pwchange.exp -+++ /dev/null -@@ -1,145 +0,0 @@ --# Password-changing Kerberos test. --# This is a DejaGnu test script. -- --# We are about to start up a couple of daemon processes. We do all --# the rest of the tests inside a proc, so that we can easily kill the --# processes when the procedure ends. -- --proc kinit_expecting_pwchange { name pass newpass } { -- global REALMNAME -- global KINIT -- global spawn_id -- -- # Use kinit to get a ticket. -- # -- # For now always get forwardable tickets. Later when we need to make -- # tests that distinguish between forwardable tickets and otherwise -- # we should but another option to this proc. --proven -- # -- spawn $KINIT -5 -f $name@$REALMNAME -- expect { -- "Password for $name@$REALMNAME:" { -- verbose "kinit started" -- } -- timeout { -- fail "kinit" -- return 0 -- } -- eof { -- fail "kinit" -- return 0 -- } -- } -- send "$pass\r" -- expect { -- "Enter new password: " { } -- timeout { -- fail "kinit (new password prompt)" -- return 0 -- } -- eof { -- fail "kinit (new password prompt)" -- return 0 -- } -- } -- send "$newpass\r" -- expect { -- " again: " { } -- timeout { -- fail "kinit (new password prompt2)" -- return 0 -- } -- eof { -- fail "kinit (new password prompt2)" -- return 0 -- } -- } -- send "$newpass\r" -- expect eof -- if ![check_exit_status kinit] { -- return 0 -- } -- -- return 1 --} -- --proc doit { } { -- global REALMNAME -- global KLIST -- global KDESTROY -- global KEY -- global KADMIN_LOCAL -- global KTUTIL -- global hostname -- global tmppwd -- global spawn_id -- global supported_enctypes -- global KRBIV -- global portbase -- global mode -- -- # Start up the kerberos and kadmind daemons. -- if ![start_kerberos_daemons 0] { -- return -- } -- -- # Use kadmin to add a key. -- if ![add_kerberos_key pwchanger 0] { -- return -- } -- -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -q "modprinc +needchange pwchanger" -- catch expect_after -- expect { -- timeout { -- fail "kadmin.local modprinc +needchange" -- } -- eof { -- pass "kadmin.local modprinc +needchange" -- } -- } -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modprinc +needchange)" -- catch "close -i $spawn_id" -- -- setup_kerberos_env client -- if ![kinit_expecting_pwchange pwchanger pwchanger$KEY floople] { -- return -- } -- pass "kinit (password change)" -- if ![kinit pwchanger floople 0] { -- return -- } -- pass "kinit (new password)" -- -- # Destroy the ticket. -- spawn $KDESTROY -5 -- if ![check_exit_status "kdestroy"] { -- return -- } -- pass "kdestroy" --} -- --run_once pwchange { -- # Set up the Kerberos files and environment. -- if {![get_hostname] || ![setup_kerberos_files] || ![setup_kerberos_env]} { -- return -- } -- -- # Initialize the Kerberos database. The argument tells -- # setup_kerberos_db that it is being called from here. -- if ![setup_kerberos_db 0] { -- return -- } -- -- set status [catch doit msg] -- -- stop_kerberos_daemons -- -- if { $status != 0 } { -- send_error "ERROR: error in pwchange.exp\n" -- send_error "$msg\n" -- exit 1 -- } --} -diff --git a/src/tests/dejagnu/krb-standalone/pwhist.exp b/src/tests/dejagnu/krb-standalone/pwhist.exp -deleted file mode 100644 -index ed7a3771a..000000000 ---- a/src/tests/dejagnu/krb-standalone/pwhist.exp -+++ /dev/null -@@ -1,217 +0,0 @@ --# password history tests -- --# one *non-interactive* kadmin.local request --proc onerq { rq pname str {flags ""} } { -- global REALMNAME -- global KADMIN_LOCAL -- -- spawn $KADMIN_LOCAL -r $REALMNAME -q "$rq $flags $pname" -- expect_after { -- timeout { -- verbose "kadmin.local $rq $flags $pname timed out" -- catch expect_after -- kill [exp_pid] -- close -- expect eof -- wait -- return 0 -- } eof { -- verbose "kadmin.local $rq $flags $pname got EOF" -- catch expect_after -- wait -- return 0 -- } -- } -- expect $str -- expect_after -- expect eof -- wait -- return 1 --} -- --proc addprinc { pname pw } { -- global REALMNAME -- -- return [onerq addprinc $pname \ -- "Principal \"$pname@$REALMNAME\" created." "-pw $pw"] --} -- --proc delprinc { pname } { -- global REALMNAME -- return [onerq delprinc $pname \ -- "Principal \"$pname@$REALMNAME\" deleted." "-force"] --} -- --proc cpw { pname pw } { -- global REALMNAME -- -- return [onerq cpw $pname \ -- "Password for \"$pname@$REALMNAME\" changed." "-pw $pw"] --} -- --proc modprinc { pname flags } { -- global REALMNAME -- -- return [onerq modprinc $pname \ -- "Principal \"$pname@$REALMNAME\" modified." $flags] --} -- --proc addpol { pname } { -- if ![onerq addpol $pname ""] { -- return 0 -- } -- return [onerq getpol $pname "Policy: $pname"] --} -- --proc delpol { pname } { -- onerq delpol $pname "" -force -- return [onerq getpol $pname \ -- "Policy does not exist while retrieving policy \"$pname\"."] --} -- --proc modpol { pname flags } { -- return [onerq modpol $pname "" $flags] --} -- --# Mandatory command must return true. --# Issues a break in its parent on failure. --proc mustrun { cmd } { -- if ![eval $cmd] { -- perror "mandatory command failed: $cmd" -- uplevel break -- } --} -- --# Fail test if command fails. --# Issues a break in its parent on failure. --proc chkpass { cmd } { -- upvar test test -- if ![eval $cmd] { -- verbose "unexpected failure: $cmd" -- fail $test -- uplevel break -- } --} -- --# Fail test if command succeeds. --# Issues a break in its parent on failure. --proc chkfail { cmd } { -- upvar test test -- if [eval $cmd] { -- verbose "unexpected success: $cmd" -- fail $test -- uplevel break -- } --} -- --# wrapper to run command (actually usually sequence of commands) --# --# If any part of CMD throws an exception, set failall, otherwise pass. --# If failall is already true, report unresolved. --proc wraptest { test cmd } { -- upvar failall failall -- if $failall { -- unresolved $test -- return -- } -- if [catch $cmd] { -- set failall 1 -- } else { -- pass $test -- } --} -- --run_once pwhist { -- # Set up the kerberos database. -- if {![get_hostname] \ -- || ![setup_kerberos_files] \ -- || ![setup_kerberos_env kdc] \ -- || ![setup_kerberos_db 0]} { -- return -- } -- -- set failall 0 -- wraptest "nkeys=1, nhist=3" { -- mustrun { addpol crashpol } -- mustrun { modpol crashpol "-history 3"} -- mustrun { addprinc crash 1111 } -- mustrun { modprinc crash "-policy crashpol" } -- chkpass { cpw crash 2222 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 1111 ->[] ]} -- -- # The following will result in reading/writing past array bounds if -- # add_to_history() is not patched. -- # -- # NOTE: A pass from this test does not mean the bug isn't present; -- # check with Purify, valgrind, etc. -- wraptest "array bounds ok on nkeys=1, nhist 3->2" { -- mustrun { modpol crashpol "-history 2" } -- chkpass { cpw crash 3333 } -- } -- verbose {old_keys [ ->2222 ]} -- -- wraptest "verify nhist=2" { -- mustrun { delprinc crash } -- mustrun { addprinc crash 1111 } -- mustrun { modprinc crash "-policy crashpol" } -- chkpass { cpw crash 2222 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ ->1111 ]} -- -- # The following will fail if growing the history array causes an extra -- # key to be lost due to failure to shift entries. -- wraptest "grow nhist 2->3" { -- mustrun { modpol crashpol "-history 3" } -- chkpass { cpw crash 3333 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 2222 ->1111 ]} -- -- wraptest "grow nhist 3->4" { -- mustrun { modpol crashpol "-history 4" } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- chkpass { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 2222 3333 ->1111 ]} -- wraptest "shrink nhist 4->3" { -- mustrun { modpol crashpol "-history 3" } -- chkfail { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- chkpass { cpw crash 5555 } -- } -- verbose {old_keys [ 4444 ->3333 ]} -- wraptest "verify nhist=3" { -- chkfail { cpw crash 5555 } -- chkfail { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkpass { cpw crash 2222 } -- } -- verbose {old_keys [ ->4444 5555 ]} -- wraptest "shrink nhist 3->2" { -- mustrun { modpol crashpol "-history 2" } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 5555 } -- chkfail { cpw crash 4444 } -- chkpass { cpw crash 3333 } -- } -- verbose {old_keys [ ->2222 ]} -- -- delprinc crash -- delpol crashpol -- -- stop_kerberos_daemons --} -diff --git a/src/tests/t_changepw.py b/src/tests/t_changepw.py -index 573bdbd49..bf8e3a9eb 100755 ---- a/src/tests/t_changepw.py -+++ b/src/tests/t_changepw.py -@@ -1,23 +1,24 @@ - from k5test import * - --# This file is intended to cover any password-changing mechanism. For --# now it only contains a regression test for #7868. -- - realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True) -+realm.prep_kadmin() - - # Mark a principal as expired and change its password through kinit. -+mark('password change via kinit') - realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) - pwinput = password('user') + '\nabcd\nabcd\n' - realm.run([kinit, realm.user_princ], input=pwinput) - --# Do the same thing with FAST, with tracing turned on. --realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) -+# Regression test for #7868 (preauth options ignored when -+# krb5_get_init_creds_password() initiates a password change). This -+# time use the REQUIRES_PWCHANGE bit instead of the password -+# expiration time. -+mark('password change via kinit with FAST') -+realm.run([kadminl, 'modprinc', '+needchange', 'user']) - pwinput = 'abcd\nefgh\nefgh\n' - out, trace = realm.run([kinit, '-T', realm.ccache, realm.user_princ], - input=pwinput, return_trace=True) -- --# Read the trace and check that FAST was used when getting the --# kadmin/changepw ticket. -+# Check that FAST was used when getting the kadmin/changepw ticket. - getting_changepw = fast_used_for_changepw = False - for line in trace.splitlines(): - if 'Getting initial credentials for user@' in line: -@@ -29,4 +30,21 @@ for line in trace.splitlines(): - if not fast_used_for_changepw: - fail('FAST was not used to get kadmin/changepw ticket') - -+# Test that passwords specified via kadmin and kpasswd are usable with -+# kinit. -+mark('password change usability by kinit') -+realm.run([kadminl, 'addprinc', '-pw', 'pw1', 'testprinc']) -+# Run kpasswd with an active cache to exercise automatic FAST use. -+realm.kinit('testprinc', 'pw1') -+realm.run([kpasswd, 'testprinc'], input='pw1\npw2\npw2\n') -+realm.kinit('testprinc', 'pw2') -+realm.run([kdestroy]) -+realm.run([kpasswd, 'testprinc'], input='pw2\npw3\npw3\n') -+realm.kinit('testprinc', 'pw3') -+realm.run([kdestroy]) -+realm.run_kadmin(['cpw', '-pw', 'pw4', 'testprinc']) -+realm.kinit('testprinc', 'pw4') -+realm.run([kdestroy]) -+realm.run([kadminl, 'delprinc', 'testprinc']) -+ - success('Password change tests') -diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py -new file mode 100644 -index 000000000..fe6a3cc2e ---- /dev/null -+++ b/src/tests/t_kadmin.py -@@ -0,0 +1,54 @@ -+from k5test import * -+ -+realm = K5Realm(start_kadmind=True) -+ -+# Create a principal. Test -q option and keyboard entry of the admin -+# password and principal password. Verify creation with kadmin.local. -+realm.run([kadmin, '-q', 'addprinc princ/pw'], -+ input=password('admin') + '\npw1\npw1\n') -+realm.run([kadminl, 'getprinc', 'princ/pw'], -+ expected_msg='Principal: princ/pw@KRBTEST.COM') -+ -+# Run the remaining tests with a cache for efficiency. -+realm.prep_kadmin() -+ -+realm.run_kadmin(['addpol', 'standardpol']) -+realm.run_kadmin(['listpols'], expected_msg='standardpol') -+realm.run_kadmin(['modpol', '-minlength', '5', 'standardpol']) -+realm.run_kadmin(['getpol', 'standardpol'], -+ expected_msg='Minimum password length: 5') -+ -+realm.run_kadmin(['addprinc', '-randkey', 'princ/random']) -+realm.run([kadminl, 'getprinc', 'princ/random'], -+ expected_msg='Principal: princ/random@KRBTEST.COM') -+ -+realm.run_kadmin(['cpw', 'princ/pw'], input='newpw\nnewpw\n') -+realm.run_kadmin(['cpw', '-randkey', 'princ/random']) -+ -+realm.run_kadmin(['modprinc', '-allow_tix', 'princ/random']) -+realm.run_kadmin(['modprinc', '+allow_tix', 'princ/random']) -+realm.run_kadmin(['modprinc', '-policy', 'standardpol', 'princ/random']) -+ -+realm.run_kadmin(['listprincs'], expected_msg='princ/random@KRBTEST.COM') -+ -+realm.run_kadmin(['ktadd', 'princ/pw']) -+ -+realm.run_kadmin(['delprinc', 'princ/random']) -+realm.run([kadminl, 'getprinc', 'princ/random'], expected_code=1, -+ expected_msg='Principal does not exist') -+realm.run_kadmin(['delprinc', 'princ/pw']) -+realm.run([kadminl, 'getprinc', 'princ/pw'], expected_code=1, -+ expected_msg='Principal does not exist') -+ -+realm.run_kadmin(['delpol', 'standardpol']) -+realm.run([kadminl, 'getpol', 'standardpol'], expected_code=1, -+ expected_msg='Policy does not exist') -+ -+# Regression test for #2877 (fixed-sized GSSRPC buffers can't -+# accomodate large listprinc results). -+mark('large listprincs result') -+for i in range(200): -+ realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) -+realm.run_kadmin(['listprincs'], expected_msg='foo199') -+ -+success('kadmin and kpasswd tests') -diff --git a/src/tests/t_policy.py b/src/tests/t_policy.py -index 5a0c06b86..2bb4f5f18 100755 ---- a/src/tests/t_policy.py -+++ b/src/tests/t_policy.py -@@ -25,6 +25,68 @@ realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1, - realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser']) - realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser']) - -+# Regression test for #929 (kadmind crash with more historical -+# passwords in a principal entry than current policy history setting). -+mark('password history (policy value reduced below current array size)') -+realm.run([kadminl, 'addpol', '-history', '5', 'histpol']) -+realm.addprinc('histprinc', 'first') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'second', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'third', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'fourth', 'histprinc']) -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', 'fifth', 'histprinc']) -+realm.run([kadminl, 'delprinc', 'histprinc']) -+ -+# Regression test for #2841 (heap buffer overflow when policy history -+# value is reduced to match the number of historical passwords for a -+# principal). -+mark('password history (policy value reduced to current array size)') -+def histfail(*pwlist): -+ for pw in pwlist: -+ realm.run([kadminl, 'cpw', '-pw', pw, 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.addprinc('histprinc', '1111') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+histfail('2222', '1111') -+realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+ -+# Test that the history array is properly resized if the policy -+# history value is increased after the array is filled. -+mark('password history (policy value increase)') -+realm.run([kadminl, 'delprinc', 'histprinc']) -+realm.addprinc('histprinc', '1111') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+histfail('2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'cpw', '-pw', '1111', 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+histfail('3333', '2222', '1111') -+realm.run([kadminl, 'modpol', '-history', '4', 'histpol']) -+histfail('3333', '2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '4444', 'histprinc']) -+histfail('4444', '3333', '2222', '1111') -+ -+# Test that when the policy history value is reduced, all currently -+# known old passwords still fail until the next password change, after -+# which the new number of old passwords fails (but no more). -+mark('password history (policy value reduction)') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+histfail('4444', '3333', '2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '5555', 'histprinc']) -+histfail('5555', '3333', '3333') -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) -+histfail('2222', '5555', '4444') -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+ - # Test references to nonexistent policies. - mark('nonexistent policy references') - realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser']) diff --git a/Read-GSS-configuration-files-with-mtime-0.patch b/Read-GSS-configuration-files-with-mtime-0.patch deleted file mode 100644 index 5bcae39..0000000 --- a/Read-GSS-configuration-files-with-mtime-0.patch +++ /dev/null @@ -1,71 +0,0 @@ -From f8747c22fd159ad3556fdf6ec4f269c754c1eadb Mon Sep 17 00:00:00 2001 -From: Simo Sorce -Date: Thu, 19 May 2022 12:27:40 -0400 -Subject: [PATCH] Read GSS configuration files with mtime 0 - -There is at least one case (with flatpaks) where configuration files -in the special read-only /etc all have an mtime of 0. Using an -initial last modified time of 0 in g_initialize.c causes these files -to never be read. - -Change the initial high value to the be the "invalid" value -(time_t)-1. Since the C and POSIX standards do not require time_t to -be signed, special-case the checks in load_if_changed() and -updateMechList() to treat all mod times as newer than -1. - -[ghudson@mit.edu: edited commit message; slightly modified approach] - -ticket: 9060 (new) -target_version: 1.20 -tags: pullup ---- - src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c -index 6d49700a5..857d4a4f2 100644 ---- a/src/lib/gssapi/mechglue/g_initialize.c -+++ b/src/lib/gssapi/mechglue/g_initialize.c -@@ -93,7 +93,7 @@ static void free_mechSet(void); - static gss_mech_info g_mechList = NULL; - static gss_mech_info g_mechListTail = NULL; - static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; --static time_t g_confFileModTime = (time_t)0; -+static time_t g_confFileModTime = (time_t)-1; - static time_t g_confLastCall = (time_t)0; - - static gss_OID_set_desc g_mechSet = { 0, NULL }; -@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) - mtime = check_link_mtime(pathname, &mtime); - if (mtime == (time_t)-1) - return; -- if (mtime > *highest) -+ if (mtime > *highest || *highest == (time_t)-1) - *highest = mtime; -- if (mtime > last) -+ if (mtime > last || last == (time_t)-1) - loadConfigFile(pathname); - } - -@@ -482,7 +482,7 @@ static void - loadConfigFiles() - { - glob_t globbuf; -- time_t highest = 0, now; -+ time_t highest = (time_t)-1, now; - char **path; - const char *val; - -@@ -522,7 +522,8 @@ updateMechList(void) - - #if defined(_WIN32) - time_t lastConfModTime = getRegConfigModTime(MECH_KEY); -- if (g_confFileModTime >= lastConfModTime) -+ if (g_confFileModTime >= lastConfModTime && -+ g_confFileModTime != (time_t)-1) - return; - g_confFileModTime = lastConfModTime; - loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); --- -2.35.3 - diff --git a/Remove-TCL-based-libkadm5-API-tests.patch b/Remove-TCL-based-libkadm5-API-tests.patch deleted file mode 100644 index 7819198..0000000 --- a/Remove-TCL-based-libkadm5-API-tests.patch +++ /dev/null @@ -1,18229 +0,0 @@ -From ddb189ff95350afc0e3e063016a0f0dd5213dc4c Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 16 Apr 2021 10:24:04 -0400 -Subject: [PATCH] Remove TCL-based libkadm5 API tests - -[antorres@redhat.com: remove diff for .gitignore] ---- - .gitignore | 20 - - doc/kadm5/api-unit-test.tex | 2680 ----------------- - src/config/pre.in | 18 +- - src/configure.ac | 31 +- - src/kadmin/Makefile.in | 2 +- - src/kadmin/testing/Makefile.in | 8 - - src/kadmin/testing/deps | 1 - - src/kadmin/testing/proto/kdc.conf.proto | 16 - - src/kadmin/testing/proto/krb5.conf.proto | 32 - - src/kadmin/testing/proto/ovsec_adm.dict | 3 - - src/kadmin/testing/scripts/Makefile.in | 18 - - src/kadmin/testing/scripts/deps | 1 - - src/kadmin/testing/scripts/env-setup.shin | 104 - - src/kadmin/testing/scripts/init_db | 229 -- - src/kadmin/testing/scripts/start_servers | 69 - - .../testing/scripts/start_servers_local | 157 - - src/kadmin/testing/scripts/stop_servers | 60 - - src/kadmin/testing/scripts/stop_servers_local | 44 - - src/kadmin/testing/tcl/util.t | 58 - - src/kadmin/testing/util/Makefile.in | 42 - - src/kadmin/testing/util/bsddb_dump.c | 65 - - src/kadmin/testing/util/deps | 16 - - src/kadmin/testing/util/tcl_kadm5.c | 2566 ---------------- - src/kadmin/testing/util/tcl_kadm5.h | 3 - - src/kadmin/testing/util/tcl_kadm5_syntax | 57 - - src/kadmin/testing/util/tcl_krb5_hash.c | 167 - - src/kadmin/testing/util/test.c | 38 - - src/lib/kadm5/Makefile.in | 3 +- - src/lib/kadm5/unit-test/Makefile.in | 143 - - src/lib/kadm5/unit-test/api.2/crte-policy.exp | 927 ------ - src/lib/kadm5/unit-test/api.2/get-policy.exp | 199 -- - src/lib/kadm5/unit-test/api.2/mod-policy.exp | 675 ----- - .../api.current/chpass-principal-v2.exp | 68 - - .../api.current/chpass-principal.exp | 176 -- - .../unit-test/api.current/crte-policy.exp | 927 ------ - .../unit-test/api.current/crte-principal.exp | 1336 -------- - .../kadm5/unit-test/api.current/destroy.exp | 203 -- - .../unit-test/api.current/dlte-policy.exp | 208 -- - .../unit-test/api.current/dlte-principal.exp | 253 -- - .../unit-test/api.current/get-policy.exp | 199 -- - .../api.current/get-principal-v2.exp | 250 -- - .../unit-test/api.current/get-principal.exp | 346 --- - .../kadm5/unit-test/api.current/init-v2.exp | 506 ---- - src/lib/kadm5/unit-test/api.current/init.exp | 699 ----- - .../unit-test/api.current/mod-policy.exp | 711 ----- - .../api.current/mod-principal-v2.exp | 115 - - .../unit-test/api.current/mod-principal.exp | 1606 ---------- - .../api.current/randkey-principal-v2.exp | 61 - - .../api.current/randkey-principal.exp | 297 -- - src/lib/kadm5/unit-test/config/unix.exp | 222 -- - src/lib/kadm5/unit-test/deps | 86 - - src/lib/kadm5/unit-test/destroy-test.c | 48 - - src/lib/kadm5/unit-test/diff-files/destroy-1 | 2 - - src/lib/kadm5/unit-test/diff-files/no-diffs | 2 - - src/lib/kadm5/unit-test/handle-test.c | 140 - - src/lib/kadm5/unit-test/init-test.c | 39 - - src/lib/kadm5/unit-test/iter-test.c | 51 - - src/lib/kadm5/unit-test/lib/lib.t | 306 -- - src/lib/kadm5/unit-test/lock-test.c | 105 - - src/lib/kadm5/unit-test/randkey-test.c | 42 - - src/lib/kadm5/unit-test/setkey-test.c | 246 -- - src/lib/kadm5/unit-test/site.exp | 2 - - 62 files changed, 7 insertions(+), 17697 deletions(-) - delete mode 100644 doc/kadm5/api-unit-test.tex - delete mode 100644 src/kadmin/testing/Makefile.in - delete mode 100644 src/kadmin/testing/deps - delete mode 100644 src/kadmin/testing/proto/kdc.conf.proto - delete mode 100644 src/kadmin/testing/proto/krb5.conf.proto - delete mode 100644 src/kadmin/testing/proto/ovsec_adm.dict - delete mode 100644 src/kadmin/testing/scripts/Makefile.in - delete mode 100644 src/kadmin/testing/scripts/deps - delete mode 100755 src/kadmin/testing/scripts/env-setup.shin - delete mode 100755 src/kadmin/testing/scripts/init_db - delete mode 100755 src/kadmin/testing/scripts/start_servers - delete mode 100755 src/kadmin/testing/scripts/start_servers_local - delete mode 100755 src/kadmin/testing/scripts/stop_servers - delete mode 100755 src/kadmin/testing/scripts/stop_servers_local - delete mode 100644 src/kadmin/testing/tcl/util.t - delete mode 100644 src/kadmin/testing/util/Makefile.in - delete mode 100644 src/kadmin/testing/util/bsddb_dump.c - delete mode 100644 src/kadmin/testing/util/deps - delete mode 100644 src/kadmin/testing/util/tcl_kadm5.c - delete mode 100644 src/kadmin/testing/util/tcl_kadm5.h - delete mode 100644 src/kadmin/testing/util/tcl_kadm5_syntax - delete mode 100644 src/kadmin/testing/util/tcl_krb5_hash.c - delete mode 100644 src/kadmin/testing/util/test.c - delete mode 100644 src/lib/kadm5/unit-test/Makefile.in - delete mode 100644 src/lib/kadm5/unit-test/api.2/crte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.2/get-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.2/mod-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/destroy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/init-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/init.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/config/unix.exp - delete mode 100644 src/lib/kadm5/unit-test/deps - delete mode 100644 src/lib/kadm5/unit-test/destroy-test.c - delete mode 100644 src/lib/kadm5/unit-test/diff-files/destroy-1 - delete mode 100644 src/lib/kadm5/unit-test/diff-files/no-diffs - delete mode 100644 src/lib/kadm5/unit-test/handle-test.c - delete mode 100644 src/lib/kadm5/unit-test/init-test.c - delete mode 100644 src/lib/kadm5/unit-test/iter-test.c - delete mode 100644 src/lib/kadm5/unit-test/lib/lib.t - delete mode 100644 src/lib/kadm5/unit-test/lock-test.c - delete mode 100644 src/lib/kadm5/unit-test/randkey-test.c - delete mode 100644 src/lib/kadm5/unit-test/setkey-test.c - delete mode 100644 src/lib/kadm5/unit-test/site.exp - -diff --git a/doc/kadm5/api-unit-test.tex b/doc/kadm5/api-unit-test.tex -deleted file mode 100644 -index 014242037..000000000 ---- a/doc/kadm5/api-unit-test.tex -+++ /dev/null -@@ -1,2680 +0,0 @@ --% This document is included for historical purposes only, and does not --% apply to krb5 today. -- --\documentstyle[times,fullpage]{article} -- --%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% --%% Make _ actually generate an _, and allow line-breaking after it. --\let\underscore=\_ --\catcode`_=13 --\def_{\underscore\penalty75\relax} --%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -- --\newcommand{\test}[1]{\begin{description} --\setlength{\itemsep}{0pt} --#1 --\end{description} -- --} -- --\newcommand{\numtest}[2]{\begin{description} --\setlength{\itemsep}{0pt} --\Number{#1} --#2 --\end{description} -- --} -- --\newcommand{\Number}[1]{\item[Number:] #1} --\newcommand{\Reason}[1]{\item[Reason:] #1} --\newcommand{\Expected}[1]{\item[Expected:] #1} --\newcommand{\Conditions}[1]{\item[Conditions:] #1} --\newcommand{\Priority}[1]{\item[Priority:] #1} --\newcommand{\Status}[1]{\item[Status:] #1} --\newcommand{\Vtwonote}[1]{\item[V2 note:] #1} --\newcommand{\Version}[1]{\item[Version:] #1} --\newcommand{\Call}[1]{} --%\newcommand{\Call}[1]{\item[Call:] #1} --%\newcommand{\Number}[1]{} --%\newcommand{\Reason}[1]{} --%\newcommand{\Expected}[1]{} --%\newcommand{\Conditions}[1]{} --%\newcommand{\Priority}[1]{} -- --\title{KADM5 Admin API\\ --Unit Test Description} --\author{Jonathan I. Kamens} -- --\begin{document} -- --\maketitle -- --%\tableofcontents -- --\section{Introduction} -- --The following is a description of a black-box unit test of the KADM5 --API. Each API function is listed, followed by the tests that should be --performed on it. -- --The tests described here are based on the ``Kerberos Administration --System KADM5 API Functional Specifications'', revision 1.68. This --document was originally written based on the OpenVision API functional --specifications, version 1.41, dated August 18, 1994, and many --indications of the original version remain. -- --All tests which test for success should verify, using some means other --than the return value of the function being tested, that the requested --operation was successfully performed. For example: for init, test --that other operations can be performed after init; for destroy, test --that other operations can't be performed after destroy; for modify --functions, verify that all modifications to the database which should --have taken place did, and that the new, modified data is in effect; --for get operations, verify that the data retrieved is the data that --should actually be in the database. -- --The tests would be better if they compared the actual contents of the --database before and after each test, rather than relying on the KADM5 --API to report the results of changes. -- --Similarly, all tests which test for failure should verify that the --no component of the requested operation took place. For example: if --init fails, other operations should not work. If a modify fails, all --data in the database should be the same as it was before the attempt --to modify, and the old data should still be what is enforced. --Furthermore, tests which test for failure should verify that the --failure code returned is correct for the specific failure condition --tested. -- --Most of the tests listed below should be run twice -- once locally on --the server after linking against the server API library, and once --talking to the server via authenticated Sun RPC after linking against --the client API library. Tests which should only be run locally or via --RPC are labelled with a ``local'' or ``RPC''. -- --Furthermore, in addition to the tests labelled below, a test should be --implemented to verify that a client can't perform operations on the --server through the client API library when it's linked against --standard Sun RPC instead of OpenV*Secure's authenticated Sun RPC. --This will require a client with a modified version of ovsec_kadm_init --which doesn't call auth_gssapi_create. This client should call this --modified ovsec_kadm_init and then call some other admin API function, --specifying arguments to both functions that would work if the --authenticated Sun RPC had been used, but shouldn't if authentication --wasn't used. The test should verify that the API function call after --the init doesn't succeed. -- --There is also another test to see if all the API functions handle getting an --invalid server handle correctly. This is not done as part of the tests that --are run through the TCL program cause the TCL program has no way of --invalidating a server handle. So there is a program that calls init and --changes the handle magic number, and then attempts to call each API function --with the corrupted server handle. -- --A number of tests have been added or changed to correspond with KADM5 --API version 2. Tests which are only performed against the newer --version specify the version number in the test description. -- --\section{ovsec_kadm_init} -- --\numtest{1}{ --\Reason{An empty string realm is rejected.} --\Status{Implemented} --\Vtwonote{The empty string is now passed as the realm field of the --parameters structure.} --} -- --\numtest{2}{ --\Reason{A realm containing invalid characters is rejected.} --\Status{Implemented} --\Vtwonote{The invalid character is now passed as the realm field of the --parameters structure.} --} -- --\numtest{2.5}{ --\Reason{A non-existent realm is rejected.} --\Status{Implemented} --\Vtwonote{The non-existent realm is now passed as the realm field of the --parameters structure.} --} -- --\numtest{3}{ --\Reason{A bad service name representing an existing principal -- (different from the client principal) is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{A bad service name representing a non-existent -- principal is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{A bad service name identical to the (existing) client -- name is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{A null password causes password prompting.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{An empty-string causes password prompting} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{An incorrect password which is the password of another -- user is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{An incorrect password which isn't the password of any -- user is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{A null client_name is rejected.} --\Status{Implemented} --} -- --% Empty string client name is legal. --%\numtest{11}{ --%\Reason{An empty-string client_name is rejected.} --%} -- --\numtest{12}{ --\Reason{A client_name referring to a non-existent principal in -- the default realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{A client_name referring to a non-existent principal -- with the local realm specified explicitly is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{A client_name referring to a non-existent principal in -- a nonexistent realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Reason{A client_name referring to an existing principal in a -- nonexistent realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{17}{ --\Reason{Valid invocation (explicit client realm).} --\Status{Implemented} --} -- --\numtest{18}{ --\Reason{Valid invocation (CHANGEPW_SERVICE).} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Valid invocation (explicit service realm).} --\Status{Implemented} --\Vtwonote{The explicit realm is now passed as the realm field of the --configuration parameters.} --} -- --\numtest{20}{ --\Reason{Valid invocation (database access allowed after init).} --\Status{Implemented} --} -- --%\numtest{21}{ --%\Reason{Init fails when called twice in a row.} --%\Status{Implemented} --%} -- --\numtest{22}{ --\Reason{A null password causes master-key prompting.} --\Conditions{local} --\Status{Implemented} --\Vtwonote{Obsolete.} --} -- --\numtest{22.5}{ --\Reason{A empty string password causes master-key prompting.} --\Conditions{local} --\Status{Implemented} --\Vtwonote{Obsolete.} --} -- --%\numtest{23}{ --%\Reason{A non-null password causes reading from the kstash.} --%\Conditions{local} --%\Status{Implemented} --%} -- --\numtest{24}{ --\Reason{Null service name is ignored in local invocation.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{25}{ --\Reason{Non-null service name is ignored in local invocation.} --\Conditions{local} --\Status{Implemented} --} -- --%\numtest{26}{ --%\Reason{Can't do ``get'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{27}{ --%\Reason{Can't do ``add'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{28}{ --%\Reason{Can't do ``modify'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{29}{ --%\Reason{Can't do ``delete'' operation before calling init.} --%\Status{Implemented} --%} -- --\numtest{30}{ --\Reason{Can init after failed init attempt.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{High} --\Reason{Return BAD_STRUCT_VERSION when the mask bits are set to invalid values} --\Status{Implemented} --} -- --\numtest{32}{ --\Priority{High} --\Reason{Return BAD_STRUCT_VERSION when the mask bits are not set} --\Status{Implemented} --} -- --\numtest{33}{ --\Priority{High} --\Reason{Return OLD_STRUCT_VERSION when attempting to use an old/unsupported -- structure version} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{High} --\Reason{Return NEW_STRUCT_VERSION when attempting to use a newer version of -- of the structure then what is supported} --\Status{Implemented} --} -- --\numtest{35}{ --\Priority{High} --\Reason{Return BAD_API_VERSION when the mask bits are set to invalid values} --\Status{Implemented} --} -- --\numtest{36}{ --\Priority{High} --\Reason{Return BAD_API_VERSION when the mask bits are not set} --\Status{Implemented} --} -- --\numtest{37}{ --\Priority{High} --\Reason{Return OLD_LIB_API_VERSION when using an old/unsuppored -- api version number} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Return OLD_SERVER_API_VERSION attempting to use an -- old/unsupported api version number} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Return NEW_LIB_API_VERSION when using a newer api -- version number then supported} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{40}{ --\Priority{High} --\Reason{Return NEW_SERVER_API_VERSION when using a newer api version -- number then supported} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Return BAD_XXX_VERSION when the API and the structure -- version numbers are reversed} --\Status{Implemented} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Succeeds when using valid api and struct version numbers and masks} --\Status{Implemented} --} -- --\numtest{43}{ --\Priority{Low} --\Reason{Returns two different server handle when called twice with same info} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Returns two different server handles when called twice with -- different info} --} -- --\numtest{45}{ --\Priority{Bug fix, secure-install/3390} --\Reason{Returns SECURE_PRINC_MISSING when ADMIN_SERVICE does not --exist.} --\Status{Implemented} --} -- --\numtest{46}{ --\Priority{Bug fix, secure-install/3390} --\Reason{Returns SECURE_PRINC_MISSING when CHANGEPW_SERVICE does not --exist.} --\Status{Implemented} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the profile field of the configuration parameters, if --set.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the kadmind_port field of the configuration parameters, --if set.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_server field of the configuration parameters, --if set with only an admin server name.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102.5}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_server field of the configuration parameters, --if set with a host name and port number.} --\Conditions{RPC} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the dbname field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{104}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_dbname field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{105}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_lockfile field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{106}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the mkey_from_kbd field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{107}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the stash_file field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{108}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the mkey_name field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{109}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the max_life field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{110}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the max_rlife field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{111}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the expiration field of the configuration parameters, if --set.} --\Status{Implemented} --\Conditions{local} --} -- --\numtest{112}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the flags field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{113}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the keysalts and num_keysalts field of the configuration --parameters, if set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{114}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_SERVER_PARAMS if any client-only parameters --are specified to server-side init.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{115}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_CLIENT_PARAMS if any client-only parameters --are specified to server-side init.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{116}{ --\Version{KADM5_API_VERSION_2} --\Reason{Two calls to init with clients having different privileges --succeeds, and both clients maintain their correct privileges.} --\Priority{Bug fix} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{117}{ --\Version{KADM5_API_VERSION_2} --\Reason{The max_life field defaults to value specified in the API --Functional Specification when kdc.conf is unreadable.} --\Priority{Bug fix, krb5-admin/18} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{150}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds works when given an open ccache with a valid --credential for ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{151}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds works when given an open ccache with a valid --credential for CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{152}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds fails with KRB5_FCC_NOFILE (was -- KADM5_GSS_ERROR) when given an open --ccache with no credentials.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{153}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds fails with KRB5_CC_NOTFOUND (was -- KADM5_GSS_ERROR) when given an open --ccache without credentials for ADMIN_SERVICE or CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{154}{ --\Version{KADM5_API_VERSION_2} --\Reason{If the KRB5_KDC_PROFILE environment variable is set to a filename --that does not exist, init fails with ENOENT.} --\Conditions{RPC} --\Status{Implemented} --} -- --\section{ovsec_kadm_destroy} -- --\numtest{1}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --%\numtest{2}{ --%\Reason{Valid invocation (``get'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{3}{ --%\Reason{Valid invocation (``add'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{4}{ --%\Reason{Valid invocation (``modify'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{5}{ --%\Reason{Valid invocation (``delete'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{6}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --%\numtest{7}{ --%\Reason{Fails if invoked twice in a row.} --%\Status{Implemented} --%} -- --\numtest{8}{ --\Reason{Database can be reinitialized after destroy.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{client} --} -- --\section{ovsec_kadm_create_principal} -- --%In the tests below, ``getu'' refers to a user who has only ``get'' access, --%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to --%a user who has only ``modify'' access, and ``deleteu'' refers to a user --%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and --%''modify'' access. ``new_princ'' refers to a principal entry structure --%filled in as follows: --% --% krb5_parse_name("newuser", \&new_princ.principal); --% krb5_timeofday(\&new_princ.princ_expire_time); --% new_princ.princ_expire_time += 130; --% krb5_timeofday(\&new_princ.last_pwd_change); --% new_princ.last_pwd_change += 140; --% krb5_timeofday(\&new_princ.pw_expiration); --% new_princ.pw_expiration += 150; --% new_princ.max_life = 160; --% krb5_parse_name("usera", \&new_princ.mod_name); --% krb5_timeofday(\&new_princ.mod_date); --% new_princ.mod_date += 170; --% new_princ.attributes = 0xabcdabcd; --% new_princ.kvno = 180; --% new_princ.mkvno = 190; --% new_princ.policy = null; --% new_princ.aux_attributes = 0xdeadbeef; --% --%The offsets of 130 through 190 above are used to ensure that the --%fields are all known to be different from each other, so that --%accidentally switched fields can be detected. Some of the fields in --%this structure may be changed by the tests, but they should clean up --%after themselves. -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Reason{Fails on null princ argument.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails on null password argument.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails on empty-string password argument.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails when mask contains undefined bit.} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails when mask contains LAST_PWD_CHANGE bit.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails when mask contains MOD_TIME bit.} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails when mask contains MOD_NAME bit.} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{Fails when mask contains MKVNO bit.} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails when mask contains AUX_ATTRIBUTES bit.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Fails when mask contains POLICY_CLR bit.} --\Status{Implemented} --} -- --\numtest{12}{ --\Reason{Fails for caller with no access bits.} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{Fails when caller has ``get'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{Fails when caller has ``modify'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Reason{Fails when caller has ``delete'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Fails when caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{17}{ --\Reason{Fails on attempt to create existing principal.} --\Status{Implemented} --} -- --\numtest{18}{ --\Reason{Fails when password is too short.} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Fails when password has too few classes.} --\Status{Implemented} --} -- --\numtest{20}{ --\Reason{Fails when password is in dictionary.} --\Status{Implemented} --} -- --\numtest{21}{ --\Reason{Nonexistent policy is rejected.} --\Status{Implemented} --} -- --\numtest{22}{ --\Reason{Fails on invalid principal name.} --\Status{Implemented} --} -- --\numtest{23}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Succeeds when caller has ``add'' access and another one.} --\Status{Implemented} --} -- --%\numtest{25}{ --%\Reason{Fails when password is too short, when override_qual is true.} --%} -- --%\numtest{26}{ --%\Reason{Fails when password has too few classes, when --% override_qual is true.} --%} -- --%\numtest{27}{ --%\Reason{Fails when password is in dictionary, when override_qual is --% true.} --%} -- --\numtest{28}{ --\Reason{Succeeds when assigning policy.} --\Status{Implemented} --} -- --\numtest{29}{ --\Priority{High} --\Reason{Allows 0 (never) for princ_expire_time.} --\Status{Implemented} --} -- --\numtest{30}{ --\Reason{Allows 0 (never) for pw_expiration when there's no policy.} --\Status{Implemented} --} -- --\numtest{31}{ --\Reason{Allows 0 (never) for pw_expiration when there's a policy with -- 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{32}{ --\Reason{Accepts 0 (never) for pw_expiration when there's a policy with -- non-zero pw_max_life, and sets pw_expiration to zero.} --\Status{Implemented} --} -- --\numtest{33}{ --\Reason{Accepts and sets non-zero pw_expiration when no policy.} --\Status{Implemented} --} -- --\numtest{34}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{35}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with pw_max_life later than the specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{36}{ --\Reason{Accepts and sets non-zero pw_expiration greater than now_pw_max_life.} --\Status{Implemented} --} -- --\numtest{37}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if there's no policy and no -- specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the -- policy has a 0 (never) pw_max_life.} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified -- and the policy has a non-zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{40}{ --\Priority{High} --\Reason{Allows 0 (forever) for max_life.} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on success.} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on failure.} --} -- --\numtest{43}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_delete_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Reason{Fails on null principal.} --\Status{Implemented} --} -- --% Empty string principal is legal. --%\numtest{3}{ --%\Reason{Fails on empty-string principal.} --%} -- --% There is not invalid principal names --%\numtest{4}{ --%\Reason{Fails on invalid principal name.} --%} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails on nonexistent principal.} --\Status{Implemented} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails when caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails if caller has ``add'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails if caller has ``modify'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Fails if caller has ``get'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Fails if caller has no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Valid invocation (on principal with policy).} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_modify_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if user connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails on mask with undefined bit set.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails on mask with PRINCIPAL set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails on mask with LAST_PWD_CHANGE set.} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails on mask with MOD_TIME set.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails on mask with MOD_NAME set.} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails on mask with MKVNO set.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Fails on mask with AUX_ATTRIBUTES set.} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails on nonexistent principal.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for user with ``get'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Fails for user with ``add'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Fails for user with ``delete'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Succeeds for user with ``modify'' and another access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Fails when nonexistent policy is specified.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Succeeds when existent policy is specified.} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Updates policy count when setting policy from none.} --\Status{Implemented} --} -- --\numtest{20}{ --\Reason{Updates policy count when clearing policy from set.} --\Status{Implemented} --} -- --\numtest{21}{ --\Reason{Updates policy count when setting policy from other policy.} --\Status{Implemented} --} -- --\numtest{21.5}{ --\Reason{Policy reference count remains unchanged when policy is -- changed to itself.} --\Status{Implemented.} --} -- --\numtest{22}{ --\Reason{Allows 0 (never) for pw_expiration when there's no policy.} --\Status{Implemented} --} -- --\numtest{23}{ --\Reason{Allows 0 (never) for pw_expiration when there's a policy with -- 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Accepts 0 (never) for pw_expiration when there's a policy with -- non-zero pw_max_life, but actually sets pw_expiration to -- last_pwd_change + pw_max_life.} --\Status{Implemented} --} -- --\numtest{25}{ --\Reason{Accepts and sets non-zero pw_expiration when no policy.} --\Status{Implemented} --} -- --\numtest{26}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with pw_max_life later than the specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{28}{ --\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change + -- pw_max_life when it's later than last_pwd_change + non-zero -- pw_max_life in policy.} --\Status{Implemented} --} -- --\numtest{29}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) when a policy is cleared and --no pw_expiration is specified.} --\Status{Implemented} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the -- new policy has a 0 (never) pw_max_life.} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{High} --\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified -- and the new policy has a non-zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{32}{ --\Priority{High} --\Reason{Accepts princ_expire_time change.} --\Status{Implemented} --} -- -- -- --\numtest{33}{ --\Priority{High} --\Reason{Accepts attributes change.} --\Status{Implemented} --} -- --\numtest{33.25}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_KDB_REQUIRES_PW_CHANGE).} --\Status{Implemented} --} -- --\numtest{33.5}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_DISALLOW_TGT_BASE).} --\Status{Implemented} --} -- --\numtest{33.75}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_PW_CHANGE_SERVICE).} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{High} --\Reason{Accepts max_life change.} --\Status{Implemented} --} -- --\numtest{35}{ --\Priority{High} --\Reason{Accepts kvno change.} --\Status{Implemented} --} -- --\numtest{36}{ --\Reason{Behaves correctly when policy is set to the same as it was -- before.} --\Status{Implemented} --} -- --\numtest{37}{ --\Reason{Behaves properly when POLICY_CLR is specified and there was no -- policy before.} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Accepts 0 (never) for princ_expire_time.} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Accepts 0 for max_life.} --\Status{Implemented} --} -- --\numtest{40}{ --\Reason{Rejects null principal argument.} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on success.} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on failure.} --} -- --\numtest{43}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Priority{bug-fix} --\Reason{Accepts max_rlife change.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects last_success change.} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects last_failed change.} --\Status{Implemented} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects fail_auth_count change.} --\Status{Implemented} --} -- --\numtest{103.5}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects key_data change.} --\Status{Implemented} --} -- --\numtest{104}{ --\Version{KADM5_API_VERSION_2} --\Reason{Accepts tl_data change when all types are greater than 256.} --\Status{Implemented} --} -- --\numtest{105}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_TL_TYPE when given tl_data with a type less --than 256.} --\Status{Implemented} --} -- --\section{ovsec_kadm_rename_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if user connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails for user with ``modify'' access and not ``add'' or --``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for user with ``get'' access and not ``add'' or --``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not -- ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but -- not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Fails for user with ``delete'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Succeeds for user with ``add'' and ``delete'', when that user --has non-name-based salt.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Fails if target principal name exists.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{18}{ --\Priority{bug fix} --\Reason{Returns NO_RENAME_SALT when asked to rename a principal whose --salt depends on the principal name.} --\Status{Implemented} --} -- --\section{ovsec_kadm_chpass_principal} --\label{ovseckadmchpassprincipal} -- --\subsection{Quality/history enforcement tests} -- --This section lists a series of tests which will be run a number of --times, with various parameter settings (e.g., which access bits user --has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE, --etc.). The table following the --list of tests gives the various parameter settings under which the --tests should be run, as well which should succeed and which should --fail for each choice of parameter settings. -- --\subsubsection{List of tests} -- --The test number of each of these tests is an offset from the base --given in the table below. -- --\numtest{1}{ --\Priority{High} --\Reason{With history setting of 1, change password to itself.} --} -- --\numtest{2}{ --\Reason{With history setting of 2 but no password changes since -- principal creation, change password to itself.} --} -- --\numtest{3}{ --\Reason{With history setting of 2 and one password change since -- principal creation, change password to itself -- and directly previous password.} --} -- --\numtest{4}{ --\Priority{High} --\Reason{With a history setting of 3 and no password changes, -- change password to itself.} --} -- --\numtest{5}{ --\Priority{High} --\Reason{With a history setting of 3 and 1 password change, -- change password to itself or previous password.} --} -- --\numtest{6}{ --\Priority{High} --\Reason{With a history setting of 3 and 2 password changes, -- change password to itself and the two previous passwords.} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Change to previously unused password when now - -- last_pwd_change $<$ pw_min_life.} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Change to previously unused password that doesn't contain enough -- character classes.} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Change to previously unused password that's too short.} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Change to previously unused password that's in the dictionary.} --} -- --\subsubsection{List of parameter settings} -- --In the table below, ``7 passes'' means that test 7 above passes and --the rest of the tests fail. -- --\begin{tabular}{llllll} --Base & Modify access? & Own password? & Service & Pass/Fail \\ \hline --0 & No & Yes & ADMIN & all fail \\ --20 & No & Yes & CHANGEPW & all fail \\ --40 & No & No & ADMIN & all fail \\ --60 & No & No & CHANGEPW & all fail \\ --80 & Yes & Yes & ADMIN & 7 passes \\ --100 & Yes & Yes & CHANGEPW & all fail \\ --120 & Yes & No & ADMIN & 7 passes \\ --140 & Yes & No & CHANGEPW & all fail \\ --\end{tabular} -- --\subsection{Other quality/history tests} -- --\numtest{161}{ --\Priority{High} --\Reason{With history of 1, can change password to anything other than -- itself that doesn't conflict with other quality -- rules.} --} -- --\numtest{162}{ --\Reason{With history of 2 and 2 password changes, can change password -- to original password.} --} -- --\numtest{163}{ --\Priority{High} --\Reason{With history of 3 and 3 password changes, can change password -- to original password.} --} -- --\numtest{164}{ --\Priority{High} --\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.} --} -- --\numtest{165}{ --\Priority{High} --\Reason{Can change password when it contains exactly the number of -- classes required by the policy.} --} -- --\numtest{166}{ --\Priority{High} --\Reason{Can change password when it is exactly the length required by -- the policy.} --} -- --\numtest{167}{ --\Priority{High} --\Reason{Can change password to a word that isn't in the dictionary.} --} -- -- --\subsection{Other tests} -- --%\numtest{168}{ --%\Reason{Fails if database not initialized.} --%} -- --\numtest{169}{ --\Reason{Fails for non-existent principal.} --} -- --\numtest{170}{ --\Reason{Fails for null password.} --} -- --\numtest{171}{ --\Priority{High} --\Reason{Fails for empty-string password.} --} -- --\numtest{172}{ --\Priority{High} --\Reason{Pw_expiration is set to now + max_pw_life if policy exists and -- has non-zero max_pw_life.} --} -- --\numtest{173}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if policy exists and has zero -- max_pw_life.} --} -- --\numtest{174}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if no policy.} --} -- --\numtest{175}{ --\Priority{High} --\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is -- successfully changed.} --} -- --\numtest{176}{ --\Priority{High} --\Reason{Fails for user with no access bits, on other's password.} --} -- --\numtest{177}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{178}{ --\Reason{Fails for user with ``delete'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{179}{ --\Reason{Fails for user with ``add'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{180}{ --\Reason{Succeeds for user with ``get'' and ``modify'' access, on -- other's password.} --\Status{Implemented} --} -- --\numtest{180.5}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' but not ``get'' access, on -- other's password.} --\Conditions{RPC} --\Status{Implemented} --} --\numtest{180.625}{ --\Priority{High} --\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE on -- others password} --\Conditions{RPC} --\Status{Implemented} --} --\numtest{180.75}{ --\Priority{High} --\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE -- on other's password which has expired} --\Conditions{RPC} --\Status{Implemented} --} -- --%\numtest{181}{ --%\Reason{Password that would succeed if override_qual were false fails --% if override_qual is true.} --%\Expected{Returns CANNOT_OVERRIDE.} --%} -- --\numtest{182}{ --\Priority{High} --\Reason{Can not change key of ovsec_adm/history principal.} --\Status{Implemented} --} -- --\numtest{183}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{184}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{200}{ --\Version{KADM5_API_VERSION_2} --\Reason{Creates a key for the principal for each unique encryption --type/salt type in use.} --\Status{Implemented} --} -- --\section{ovsec_kadm_chpass_principal_util} -- --Rerun all the tests listed for ovsec_kadm_chpass_principal above in --Section \ref{ovseckadmchpassprincipal}. Verify that they succeed --and fail in the same circumstances. Also verify that in each failure --case, the error message returned in msg_ret is as specified in the --functional specification. -- --Also, run the following additional tests. -- --\numtest{1}{ --\Reason{Null msg_ret is rejected.} --} -- --\numtest{2}{ --\Priority{High} --\Reason{New password is put into pw_ret, when it's prompted for.} --} -- --\numtest{3}{ --\Priority{High} --Reason{New password is put into pw_ret, when it's supplied by the -- caller.} --} -- --\numtest{4}{ --\Priority{High} --\Reason{Successful invocation when pw_ret is null.} --} -- -- -- --\section{ovsec_kadm_randkey_principal} -- --\subsection{TOOSOON enforcement tests} -- --This test should be run a number of times, as indicated in the table --following it. The table also indicates the expected result of each --run of the test. -- --\test{ --\Reason{Change key when now - last_pwd_change $<$ pw_min_life.} --} -- --\subsubsection{List of parameter settings} -- --\begin{tabular}{llllll} --Number & Modify Access? & Own Key? & Service & Pass/Fail & Implemented? \\ \hline --1 & No & Yes & ADMIN & fail & Yes \\ --3 & No & Yes & CHANGEPW & fail & Yes \\ --5 & No & No & ADMIN & fail \\ --7 & No & No & CHANGEPW & fail \\ --9 & Yes & Yes & ADMIN & pass \\ --11 & Yes & Yes & CHANGEPW & fail \\ --13 & Yes & No & ADMIN & pass & Yes \\ --15 & Yes & No & CHANGEPW & fail & Yes \\ --\end{tabular} -- --\subsection{Other tests} -- --\numtest{17}{ --\Reason{Fails if database not initialized.} --} -- --\numtest{18}{ --\Reason{Fails for non-existent principal.} --} -- --\numtest{19}{ --\Reason{Fails for null keyblock pointer.} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Pw_expiration is set to now + max_pw_life if policy exists and -- has non-zero max_pw_life.} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if policy exists and has zero -- max_pw_life.} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if no policy.} --} -- --\numtest{23}{ --\Priority{High} --\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is -- successfully changed.} --} -- --\numtest{24}{ --\Priority{High} --\Reason{Fails for user with no access bits, on other's password.} --} -- --\numtest{25}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{26}{ --\Reason{Fails for user with ``delete'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{27}{ --\Reason{Fails for user with ``add'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28}{ --\Reason{Succeeds for user with ``get'' and ``modify'' access, on -- other's password.} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28.25}{ --\Priority{High} --\Reason{Fails for user with get and modify access on others password -- When conneceted with CHANGEPW_SERVICE} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28.5}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' but not ``get'' access, on -- other's password.} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{29}{ --\Reason{The new key that's assigned is truly random. XXX not sure how -- to test this.} --} -- --\numtest{30}{ --\Reason{Succeeds for own key, no other access bits when connecting with CHANGEPW service} --\Status{Implemented} --} --\numtest{31}{ --\Reason{Succeeds for own key, no other access bits when connecting with ADMIM service} --\Status{Implemented} --} -- --\numtest{32}{ --\Reason{Cannot change ovsec_adm/history key} --\Status{Implemented} --} -- --\numtest{33}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns a key for each unique encryption type specified in the --keysalts.} --} -- --\section{ovsec_kadm_get_principal} -- --\numtest{1}{ --\Reason{Fails for null ent.} --\Status{Implemented} --} -- --\numtest{2}{ --\Reason{Fails for non-existent principal.} --\Status{Implemented} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for user with no access bits, retrieving other principal.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``get'', getting principal -- other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for user with ``modify'' but not ``get'', getting -- principal other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails for user with ``delete'' but not ``get'', getting -- principal other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for user with ``delete'' but not ``get'', getting -- principal other than his own, using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for user with ``get'', getting principal other than his -- own, using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Succeeds for user without ``get'', retrieving self, using -- ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Succeeds for user without ``get'', retrieving self, using -- CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Succeeds for user with ``get'', retrieving self, using -- ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{12}{ --\Reason{Succeeds for user with ``get'', retrieving self, using -- CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Succeeds for user with ``get'', retrieving other user, using -- ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{Succeeds for user with ``get'' and ``modify'', retrieving -- other principal, using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_PRINCIPAL_NORMAL_MASK is specified, the key_data and --tl_data fields are NULL/zero.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain --data but the contents are all NULL.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain --data and the contents are all non-NULL.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_TL_DATA is specified, the tl_data field contains the --correct tl_data and no entries whose type is less than 256.} --\Status{Implemented} --} -- -- --\section{ovsec_kadm_create_policy} -- --\numtest{1}{ --\Reason{Fails for mask with undefined bit set.} --\Status{Implemented - untested} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for mask without POLICY bit set.} --\Status{Implemented - untested} --} -- --\numtest{4}{ --\Reason{Fails for mask with REF_COUNT bit set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for invalid policy name.} --\Status{Implemented - untested} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for existing policy name.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for null policy name.} --\Status{Implemented - untested} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_life.} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_life.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Accepts 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Accepts non-zero for pw_max_life.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_length.} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_length.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Accepts 1 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Accepts 4 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Rejects 5 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{19}{ --\Priority{High} --\Reason{Rejects 0 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Accepts 1 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Accepts 10 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21.5}{ --\Reason{Rejects 11 for pw_history_num.} --\Status{Implemented - untested} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{23}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Fails for user with ``modify'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented - untested} --} -- --\numtest{25}{ --\Reason{Fails for user with ``delete'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented - untested} --} -- --\numtest{26}{ --\Priority{High} --\Reason{Succeeds for user with ``add.''} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Succeeds for user with ``get'' and ``add.''} --\Status{Implemented - untested} --} -- --\numtest{28}{ --\Reason{Rejects null policy argument.} --\Status{Implemented - untested} --} -- --\numtest{29}{ --\Reason{Rejects pw_min_life greater than pw_max_life.} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_delete_policy} -- --\numtest{1}{ --\Reason{Fails for null policy name.} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{4}{ --\Reason{Fails for bad policy name.} --} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``modify'' but not ``delete''.} --\Conditions{RPC} --} -- --\numtest{9}{ --\Reason{Fails for user with ``get'' but not ``delete.''} --\Conditions{RPC} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Succeeds for user with only ``delete''.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Succeeds for user with ``delete'' and ``add''.} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for policy with non-zero reference count.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_modify_policy} -- --\numtest{1}{ --\Reason{Fails for mask with undefined bit set.} --\Conditions{RPC} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for mask with POLICY bit set.} --} -- --\numtest{4}{ --\Reason{Fails for mask with REF_COUNT bit set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for invalid policy name.} --} -- --\numtest{6}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{7}{ --\Reason{Fails for null policy name.} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_life.} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_life.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Accepts 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Accepts non-zero for pw_max_life.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_length.} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_length.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Accepts 1 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Accepts 4 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Rejects 5 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{19}{ --\Priority{High} --\Reason{Rejects 0 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Accepts 1 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Accepts 10 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{23}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Fails for user with ``add'' but not ``modify.''} --\Conditions{RPC} --} -- --\numtest{25}{ --\Reason{Fails for user with ``delete'' but not ``modify.''} --\Conditions{RPC} --} -- --\numtest{26}{ --\Priority{High} --\Reason{Succeeds for user with ``modify.''} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Succeeds for user with ``get'' and ``modify.''} --} -- --\numtest{28}{ --\Reason{Rejects null policy argument.} --} -- --\numtest{29}{ --\Reason{Rejects change which makes pw_min_life greater than -- pw_max_life.} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\section{ovsec_kadm_get_policy} -- --\numtest{1}{ --\Reason{Fails for null policy.} --} -- --\numtest{2}{ --\Reason{Fails for invalid policy name.} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{5}{ --\Reason{Fails for null ent.} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for user with no access bits trying to get other's -- policy, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``modify'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --} -- --\numtest{9}{ --\Reason{Fails for user with ``delete'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --} -- --\numtest{10}{ --\Reason{Fails for user with ``delete'' but not ``get'' trying to get -- other's policy, using CHANGEPW_SERVICE.} --\Conditions{RPC} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Succeeds for user with only ``get'', trying to get own policy, -- using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Succeeds for user with only ``get'', trying to get own policy, -- using CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{Succeeds for user with ``add'' and ``get'', trying to get own -- policy, using ADMIN_SERVICE.} --} -- --\numtest{14}{ --\Reason{Succeeds for user with ``add'' and ``get'', trying to get own -- policy, using CHANGEPW_SERVICE.} --} -- --\numtest{15}{ --\Reason{Succeeds for user without ``get'', trying to get own policy, -- using ADMIN_SERVICE.} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Succeeds for user without ``get'', trying to get own policy, -- using CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Succeeds for user with ``get'', trying to get other's policy, -- using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Fails for user with ``get'', trying to get other's policy, -- using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Succeeds for user with ``modify'' and ``get'', trying to get -- other's policy, using ADMIN_SERVICE.} --} -- --\numtest{20}{ --\Reason{Fails for user with ``modify'' and ``get'', trying to get -- other's policy, using CHANGEPW_SERVICE.} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{22}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_free_principal_ent} -- --In addition to the tests listed here, a memory-leak detector such as --TestCenter, Purify or dbmalloc should be used to verify that the --memory freed by this function is really freed. -- --\numtest{1}{ --\Reason{Null princ succeeds.} --} -- --\numtest{2}{ --\Reason{Non-null princ succeeds.} --} -- -- --\section{ovsec_kadm_free_policy_ent} -- --In addition to the tests listed here, a memory-leak detector such as --TestCenter, Purify or dbmalloc should be used to verify that the --memory freed by this function is really freed. -- --\numtest{1}{ --\Reason{Null policy succeeds.} --} -- --\numtest{2}{ --\Reason{Non-null policy succeeds.} --} -- -- -- --\section{ovsec_kadm_get_privs} -- --\numtest{1}{ --\Reason{Fails for null pointer argument.} --} -- --This test should be run with the 16 possible combinations of access --bits (since there are 4 access bits, there are $2^4 = 16$ possible --combinations of them): -- --\numtest{2}{ --\Priority{High} --\Reason{Returns correct bit mask for access bits of user.} --\Conditions{RPC} --} -- --This test should be run locally: -- --\numtest{3}{ --\Priority{High} --\Reason{Returns 0x0f.} --\Conditions{local} --} -- --\end{document} -diff --git a/src/config/pre.in b/src/config/pre.in -index 3752174c7..b2d17b077 100644 ---- a/src/config/pre.in -+++ b/src/config/pre.in -@@ -228,16 +228,8 @@ KRB5_INCSUBDIRS = \ - $(KRB5_INCDIR)/gssapi \ - $(KRB5_INCDIR)/gssrpc - --# --# Macros used by the KADM5 (OV-based) unit test system. --# XXX check which of these are actually used! --# - SKIPTESTS = $(BUILDTOP)/skiptests --TESTDIR = $(BUILDTOP)/kadmin/testing --STESTDIR = $(top_srcdir)/kadmin/testing --ENV_SETUP = $(TESTDIR)/scripts/env-setup.sh --CLNTTCL = $(TESTDIR)/util/kadm5_clnt_tcl --SRVTCL = $(TESTDIR)/util/kadm5_srv_tcl -+ - # Dejagnu variables. - # We have to set the host with --host so that setup_xfail will work. - # If we don't set it, then the host type used is "native", which -@@ -249,14 +241,6 @@ RUNTEST = runtest $(DEJAFLAGS) - RUNPYTEST = PYTHONPATH=$(top_srcdir)/util VALGRIND="$(VALGRIND)" \ - $(PYTHON) - --START_SERVERS = $(STESTDIR)/scripts/start_servers $(TEST_SERVER) $(TEST_PATH) --START_SERVERS_LOCAL = $(STESTDIR)/scripts/start_servers_local -- --STOP_SERVERS = $(STESTDIR)/scripts/stop_servers $(TEST_SERVER) $(TEST_PATH) --STOP_SERVERS_LOCAL = $(STESTDIR)/scripts/stop_servers_local --# --# End of macros for the KADM5 unit test system. --# - - transform = @program_transform_name@ - -diff --git a/src/configure.ac b/src/configure.ac -index 61778dcd0..4f16fee45 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -991,33 +991,9 @@ ath_compat= - AC_ARG_ENABLE([athena], - [ --enable-athena build with MIT Project Athena configuration], - ath_compat=compat,) --# The following are tests for the presence of programs required for --# kadmin testing. --AC_CHECK_PROG(have_RUNTEST,runtest,runtest) --AC_CHECK_PROG(have_PERL,perl,perl) --if test "$have_PERL" = perl -a "$have_RUNTEST" = runtest -a "$TCL_LIBS" != ""; then -- DO_TEST=ok --fi --AC_SUBST(DO_TEST) -- --# The following are substituted into kadmin/testing/scripts/env-setup.sh --RBUILD=`pwd` --AC_SUBST(RBUILD) --case "$srcdir" in --/*) S_TOP=$srcdir ;; --*) S_TOP=`pwd`/$srcdir ;; --esac --AC_SUBST(S_TOP) --AC_PATH_PROG(EXPECT,expect) --# For kadmin/testing/util/Makefile.in --if test "$TCL_LIBS" != "" ; then -- DO_ALL=tcl --fi --AC_SUBST(DO_ALL) -+ - KRB5_AC_PRIOCNTL_HACK --K5_GEN_FILE(kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin) --# for lib/kadm5 --AC_CHECK_PROG(RUNTEST,runtest,runtest) -+ - AC_CHECK_PROG(PERL,perl,perl) - - # lib/gssapi -@@ -1552,7 +1528,7 @@ V5_AC_OUTPUT_MAKEFILE(. - - lib/rpc lib/rpc/unit-test - -- lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test -+ lib/kadm5 lib/kadm5/clnt lib/kadm5/srv - lib/krad - lib/apputils - -@@ -1588,7 +1564,6 @@ V5_AC_OUTPUT_MAKEFILE(. - clients/kdestroy clients/kpasswd clients/ksu clients/kswitch - - kadmin kadmin/cli kadmin/dbutil kadmin/ktutil kadmin/server -- kadmin/testing kadmin/testing/scripts kadmin/testing/util - - appl - appl/sample appl/sample/sclient appl/sample/sserver -diff --git a/src/kadmin/Makefile.in b/src/kadmin/Makefile.in -index f4061f4f7..87cfa43fd 100644 ---- a/src/kadmin/Makefile.in -+++ b/src/kadmin/Makefile.in -@@ -1,6 +1,6 @@ - mydir=kadmin - BUILDTOP=$(REL).. --SUBDIRS = cli dbutil ktutil server testing -+SUBDIRS = cli dbutil ktutil server - - all: - -diff --git a/src/kadmin/testing/Makefile.in b/src/kadmin/testing/Makefile.in -deleted file mode 100644 -index 5b803cb23..000000000 ---- a/src/kadmin/testing/Makefile.in -+++ /dev/null -@@ -1,8 +0,0 @@ --mydir=kadmin$(S)testing --BUILDTOP=$(REL)..$(S).. --SUBDIRS = scripts util -- --all: -- --clean: -- -$(RM) -r krb5-test-root admin_* init-* *.rcache2 ovsec-* -diff --git a/src/kadmin/testing/deps b/src/kadmin/testing/deps -deleted file mode 100644 -index 2feac3c9d..000000000 ---- a/src/kadmin/testing/deps -+++ /dev/null -@@ -1 +0,0 @@ --# No dependencies here. -diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto -deleted file mode 100644 -index 8a4b87de1..000000000 ---- a/src/kadmin/testing/proto/kdc.conf.proto -+++ /dev/null -@@ -1,16 +0,0 @@ --[kdcdefaults] -- kdc_listen = 1750 -- kdc_tcp_listen = 1750 -- --[realms] -- __REALM__ = { -- profile = __K5ROOT__/krb5.conf -- database_name = __K5ROOT__/kdb5 -- key_stash_file = __K5ROOT__/.k5.__REALM__ -- acl_file = __K5ROOT__/ovsec_adm.acl -- dict_file = __K5ROOT__/ovsec_adm.dict -- kadmind_port = 1751 -- kpasswd_port = 1752 -- master_key_type = des3-hmac-sha1 -- supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal -- } -diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto -deleted file mode 100644 -index a1c57119c..000000000 ---- a/src/kadmin/testing/proto/krb5.conf.proto -+++ /dev/null -@@ -1,32 +0,0 @@ --[libdefaults] -- default_realm = __REALM__ -- default_keytab_name = FILE:__K5ROOT__/keytab -- dns_fallback = no -- dns_canonicalize_hostname = fallback -- qualify_shortname = "" -- plugin_base_dir = __PLUGIN_DIR__ -- allow_weak_crypto = true -- --[realms] -- __REALM__ = { -- kdc = __HOSTNAME__:1750 -- admin_server = __HOSTNAME__:1751 -- database_module = foobar_db2_module_blah -- } -- --[domain_realm] -- __HOSTNAME__ = __REALM__ -- --[logging] -- admin_server = FILE:__K5ROOT__/syslog -- kdc = FILE:__K5ROOT__/syslog -- default = FILE:__K5ROOT__/syslog -- -- --# THIS SHOULD BE IN KDC.CONF INSTEAD! --[dbmodules] -- db_module_dir = __MODDIR__ -- foobar_db2_module_blah = { -- db_library = db2 -- database_name = __K5ROOT__/kdb5 -- } -diff --git a/src/kadmin/testing/proto/ovsec_adm.dict b/src/kadmin/testing/proto/ovsec_adm.dict -deleted file mode 100644 -index b54e3a85e..000000000 ---- a/src/kadmin/testing/proto/ovsec_adm.dict -+++ /dev/null -@@ -1,3 +0,0 @@ --Abyssinia --Discordianism --foo -diff --git a/src/kadmin/testing/scripts/Makefile.in b/src/kadmin/testing/scripts/Makefile.in -deleted file mode 100644 -index 635930511..000000000 ---- a/src/kadmin/testing/scripts/Makefile.in -+++ /dev/null -@@ -1,18 +0,0 @@ --mydir=kadmin$(S)testing$(S)scripts --BUILDTOP=$(REL)..$(S)..$(S).. -- --all: env-setup.sh runenv.sh $(GEN_SCRIPTS) -- --# Should only rebuild env_setup.sh here (use CONFIG_FILES=), but the weird krb5 --# makefile post-processing is unconditional and would trash the makefile. --env-setup.sh: env-setup.stamp --env-setup.stamp: $(srcdir)/env-setup.shin $(BUILDTOP)/config.status \ -- Makefile -- (cd $(BUILDTOP) && \ -- CONFIG_FILES=$(mydir)/env-setup.sh:$(mydir)/env-setup.shin $(SHELL) \ -- config.status) -- chmod +x env-setup.sh -- touch env-setup.stamp -- --clean: -- -rm -f env-setup.sh env-setup.stamp -diff --git a/src/kadmin/testing/scripts/deps b/src/kadmin/testing/scripts/deps -deleted file mode 100644 -index 2feac3c9d..000000000 ---- a/src/kadmin/testing/scripts/deps -+++ /dev/null -@@ -1 +0,0 @@ --# No dependencies here. -diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin -deleted file mode 100755 -index 88f8ad1aa..000000000 ---- a/src/kadmin/testing/scripts/env-setup.shin -+++ /dev/null -@@ -1,104 +0,0 @@ --#!/bin/sh --# --# The KADM5 unit tests were developed to work under gmake. As a --# result, they expect to inherit a number of environment variables. --# Rather than rewrite the tests, we simply use this script as an --# execution wrapper that sets all the necessary environment variables --# before running the program specified on its command line. --# --# The variable settings all came from OV's config.mk. --# --# Usage: env-setup.sh --# -- --TOP=@RBUILD@/kadmin --STOP=@S_TOP@/kadmin --export TOP --export STOP --# These two may be needed in case $libdir references them. --prefix=@prefix@ --exec_prefix=@exec_prefix@ --libdir=@libdir@ ; eval "libdir=$libdir"; export libdir -- --# The shared library run time setup --TOPLIBD=@RBUILD@/lib --PROG_LIBPATH=-L@RBUILD@/lib --BUILDTOP=@RBUILD@ --# XXX kludge! --PROG_RPATH=@RBUILD@/lib --# This converts $(TOPLIBD) to $TOPLIBD --cat > /tmp/env_setup$$ <<\EOF --@KRB5_RUN_ENV@ --EOF -- --foo=`sed -e 's/(//g' -e 's/)//g' -e 's/\\\$\\\$/\$/g' /tmp/env_setup$$` --eval $foo --export @KRB5_RUN_VARS@ -- --# This will get put in setup.csh for convenience --KRB5_RUN_ENV_CSH=`eval echo "$foo" | \ -- sed -e 's/\([^=]*\)=\(.*\)/setenv \1 \2/g'` --export KRB5_RUN_ENV_CSH --rm /tmp/env_setup$$ -- --TESTDIR=$TOP/testing; export TESTDIR --STESTDIR=$STOP/testing; export STESTDIR --if [ "$K5ROOT" = "" ]; then -- K5ROOT="`cd $TESTDIR; pwd`/krb5-test-root" -- export K5ROOT --fi -- --# If $VERBOSE_TEST is non-null, enter verbose mode. Set $VERBOSE to --# true or false so its exit status identifies the mode. --if test x$VERBOSE_TEST = x; then -- VERBOSE=false --else -- VERBOSE=true --fi --export VERBOSE -- --REALM=SECURE-TEST.OV.COM; export REALM -- --if test x$EXPECT = x; then -- EXPECT=@EXPECT@; export EXPECT --fi -- --COMPARE_DUMP=$TESTDIR/scripts/compare_dump.pl; export COMPARE_DUMP --INITDB=$STESTDIR/scripts/init_db; export INITDB --SIMPLE_DUMP=$TESTDIR/scripts/simple_dump.pl; export SIMPLE_DUMP --TCLUTIL=$STESTDIR/tcl/util.t; export TCLUTIL --BSDDB_DUMP=$TESTDIR/util/bsddb_dump; export BSDDB_DUMP --CLNTTCL=$TESTDIR/util/kadm5_clnt_tcl; export CLNTTCL --SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL -- --HOSTNAME=`hostname | tr '[A-Z]' '[a-z]'` --export HOSTNAME -- --KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG --KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE --KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME --KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME --KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME --GSS_MECH_CONFIG=$K5ROOT/mech.conf; export GSS_MECH_CONFIG -- --# Make sure we don't get confused by translated messages --# or localized times. --LC_ALL=C; export LC_ALL -- --if [ "x$PS_ALL" = "x" ]; then -- if ps auxww >/dev/null 2>&1; then -- PS_ALL="ps auxww" -- PS_PID="ps uwwp" -- elif ps -ef >/dev/null 2>&1; then -- PS_ALL="ps -ef" -- PS_PID="ps -fp" -- else -- PS_ALL="ps auxww" -- PS_PID="ps uwwp" -- echo "WARNING! Cannot auto-detect ps type, assuming BSD." -- fi -- -- export PS_ALL PS_PID --fi -- --exec ${1+"$@"} -diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db -deleted file mode 100755 -index 216f62793..000000000 ---- a/src/kadmin/testing/scripts/init_db -+++ /dev/null -@@ -1,229 +0,0 @@ --#!/bin/sh -- --if $VERBOSE; then -- REDIRECT= --else -- REDIRECT='>/dev/null' --fi -- --# Requires that $K5ROOT, /etc/krb.conf, and .k5.$REALM be world-writeable. -- --if [ "$TOP" = "" ]; then -- echo "init_db: Environment variable \$TOP must point to top of build tree" 1>&2 -- exit 1 --fi -- --if [ "$STOP" = "" ]; then -- echo "init_db: Environment variable \$STOP must point to top of source tree" 1>&2 -- exit 1 --fi -- --if [ "$libdir" = "" ]; then -- echo "init_db: Environment variable \$libdir must point to library install directory" 1>&2 -- exit 1 --fi -- --IROOT=$TOP/.. --ADMIN=$TOP/dbutil --BIN=$IROOT/bin --ETC=$IROOT/etc --MODDIR=$TOP/../plugins/kdb --SBIN=$TOP/keytab:$TOP/server --DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM -- --. ./runenv.sh -- --if [ ! -d $MODDIR ]; then -- echo "+++" 1>&2 -- echo "+++ Error! $MODDIR does not exist!" 1>&2 -- echo "+++ The MODDIR variable should point to the directory in which" 1>&2 -- echo "+++ database modules have been installed for testing." 1>&2 -- echo "+++" 1>&2 -- exit 1 --fi -- --DUMMY=${TESTDIR=$TOP/testing}; export TESTDIR --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL --DUMMY=${TCLUTIL=$STESTDIR/tcl/util.t}; export TCLUTIL -- --PATH=$ADMIN:$BIN:$ETC:$SBIN:$PATH; export PATH -- --if [ ! -x $SRVTCL ]; then -- echo "+++" 1>&2 -- echo "+++ Error! $SRVTCL does not exist!" 1>&2 -- echo "+++ It was probably not compiled because TCL was not available. If you" 1>&2 -- echo "+++ now have TCL installed, cd into that directory, re-run configure" 1>&2 -- echo "+++ with the --with-tcl option, and then re-run make." 1>&2 -- echo "+++" 1>&2 -- -- exit 1 --fi -- --rm -rf $K5ROOT/* --if [ -d $K5ROOT ]; then -- true --else -- mkdir $K5ROOT --fi -- --# touch $K5ROOT/syslog --# for pid in `$PS_ALL | awk '/syslogd/ && !/awk/ {print $2}'` ; do --# case "$pid" in --# xxx) ;; --# *) --# if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi --# kill -1 $pid --# ;; --# esac --# done -- --sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__HOSTNAME__/$HOSTNAME/g" \ -- -e "s#__MODDIR__#$MODDIR#g" \ -- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf --sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- < $STESTDIR/proto/kdc.conf.proto > $K5ROOT/kdc.conf -- --eval kdb5_util -r $REALM create -W -P mrroot -s $REDIRECT || exit 1 -- --cp $STESTDIR/proto/ovsec_adm.dict $K5ROOT/ovsec_adm.dict -- --cat - > /tmp/init_db$$ <<\EOF --source $env(TCLUTIL) --set r $env(REALM) --if {[info exists env(USER)]} { -- set whoami $env(USER) --} else { -- set whoami [exec whoami] --} -- --set cmds { -- {kadm5_init $env(SRVTCL) mrroot null \ -- [config_params {KADM5_CONFIG_REALM} $r] $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle} -- -- {kadm5_create_policy $server_handle "test-pol 0 10000 8 2 3 0 2 90 180" \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH KADM5_PW_MIN_CLASSES KADM5_PW_MAX_LIFE KADM5_PW_HISTORY_NUM KADM5_PW_MAX_FAILURE KADM5_PW_FAILURE_COUNT_INTERVAL KADM5_PW_LOCKOUT_DURATION}} -- {kadm5_create_policy $server_handle "once-a-min 10 0 0 0 0 0 0 0 0" \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE}} -- {kadm5_create_policy $server_handle "dict-only 0 0 0 0 0 0 0 0 0" \ -- {KADM5_POLICY}} -- {kadm5_create_policy $server_handle [simple_policy test-pol-nopw] \ -- {KADM5_POLICY}} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal testuser@$r] {KADM5_PRINCIPAL} notathena} -- {kadm5_create_principal $server_handle \ -- [simple_principal test1@$r] {KADM5_PRINCIPAL} test1} -- {kadm5_create_principal $server_handle \ -- [simple_principal test2@$r] {KADM5_PRINCIPAL} test2} -- {kadm5_create_principal $server_handle \ -- [simple_principal test3@$r] {KADM5_PRINCIPAL} test3} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/modify@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/delete@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/none@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/rename@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/mod-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/mod-delete@$r] {KADM5_PRINCIPAL} \ -- admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-delete@$r] {KADM5_PRINCIPAL} \ -- admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-mod@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/no-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/no-delete@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol1@$r test-pol] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol111111} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol2@$r once-a-min] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol222222} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol3@$r dict-only] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol333333} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol admin/get-pol@$r test-pol-nopw] \ -- {KADM5_PRINCIPAL KADM5_POLICY} StupidAdmin} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol admin/pol@$r test-pol-nopw] {KADM5_PRINCIPAL \ -- KADM5_POLICY} StupidAdmin} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal changepw/kerberos] \ -- {KADM5_PRINCIPAL} {XXX THIS IS WRONG}} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal $whoami] \ -- {KADM5_PRINCIPAL} $whoami} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal testkeys@$r] {KADM5_PRINCIPAL} testkeys} -- -- {kadm5_destroy $server_handle} --} -- --foreach cmd $cmds { -- if {[catch $cmd output]} { -- puts stderr "Error! Command: $cmd\nError: $output" -- exit 1 -- } else { -- puts stdout $output -- } --} --EOF --eval "$SRVTCL < /tmp/init_db$$ $REDIRECT" --rm /tmp/init_db$$ -- --if [ $? -ne 0 ]; then -- echo "Error in $SRVTCL!" 1>&2 -- exit 1 --fi -- --cat > $K5ROOT/ovsec_adm.acl < $K5ROOT/setup.csh <&2 -- exit 1 -- fi -- -- local=0 -- hostname=$1 -- if [ $# = 1 ]; then -- rempath=`sh -c "cd $TOP && pwd"` -- else -- rempath=$2 -- fi --fi -- --if [ $local = 0 ]; then -- -- # Fix up the local krb5.conf to point to the remote -- sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__HOSTNAME__/$HOSTNAME/g" \ -- -e "s#__MODDIR__#$TOP/../plugins/kdb#g"\ -- -e "s#__PLUGIN_DIR__#$TOP/../plugins#g"\ -- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf -- --# Using /usr/ucb/rsh and getting rid of "-k $REALM" until we get --# around to fixing the fact that Kerberos rsh doesn't strip out "-k --# REALM" when falling back. -- -- START_SERVERS_LOCAL=`echo $START_SERVERS_LOCAL|sed "s%$TOP%$rempath%"` -- CMD="$RSH_CMD $hostname -n \ -- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ -- $rempath/testing/scripts/env-setup.sh \ -- $START_SERVERS_LOCAL $rempath'\"" -- -- if $VERBOSE; then -- echo "+++" -- echo "+++ Begin execution of start_servers_local on $hostname" -- echo "+++" -- echo $CMD -- fi -- eval $CMD -- if $VERBOSE; then -- echo "+++" -- echo "+++ End execution of start_servers_local on $hostname" -- echo "+++" -- fi --else -- $START_SERVERS_LOCAL --fi -- -diff --git a/src/kadmin/testing/scripts/start_servers_local b/src/kadmin/testing/scripts/start_servers_local -deleted file mode 100755 -index 858e88031..000000000 ---- a/src/kadmin/testing/scripts/start_servers_local -+++ /dev/null -@@ -1,157 +0,0 @@ --#!/bin/sh -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${INITDB=$STESTDIR/scripts/init_db} --DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL --DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} --DUMMY=${KRB5RCACHEDIR=$TESTDIR} ; export KRB5RCACHEDIR -- --. ./runenv.sh -- --if [ -d /usr/tmp ]; then -- usrtmp=/usr/tmp --else -- usrtmp=/var/tmp --fi -- --$STOP_SERVERS_LOCAL -start_servers -- --if $VERBOSE; then -- REDIRECT= --else -- REDIRECT='>/dev/null' --fi -- --while :; do -- case $1 in -- -keysalt) -- shift -- if [ $# -gt 0 ]; then -- keysalts="$keysalts $1" -- else -- break -- fi -- ;; -- -kdcport) -- shift -- if [ $# -gt 0 ]; then -- kdcport=$1 -- else -- break -- fi -- ;; -- *) -- break -- ;; -- esac -- shift --done -- --if [ $# -gt 1 ]; then -- echo "Usage: $0 [-kdcport port] [-keysalts tuple] ... [top]" 1>&2 -- exit 1 --elif [ $# = 1 ]; then -- TOP=$1 -- export TOP --fi -- --# create a fresh db -- --$INITDB "$keysalts" || exit 1 -- --# Post-process the config files based on our arguments --if [ "$keysalts" != "" ]; then -- sedcmd="s/\([ ]*supported_enctypes =\).*/\1 $keysalts/" -- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new -- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf --fi --if [ "$kdcport" != "" ] ; then -- sedcmd="s/\(kdc_ports = .*\)[ ]*/\1, $kdcport/" -- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new -- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf --fi -- --# allow admin to krlogin as root (for cleanup) --DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM -- --cat - > /tmp/start_servers_local$$ <<\EOF --if { [catch { -- source $env(STOP)/testing/tcl/util.t -- set r $env(REALM) -- set q $env(HOSTNAME) -- puts stdout [kadm5_init $env(SRVTCL) mrroot null \ -- [config_params {KADM5_CONFIG_REALM} $r] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle] -- puts stdout [kadm5_create_principal $server_handle \ -- [simple_principal host/$q@$r] {KADM5_PRINCIPAL} notathena] -- puts stdout [kadm5_destroy $server_handle] --} err]} { -- puts stderr "initialization error: $err" -- exit 1 --} --exit 0 --EOF --eval "$SRVTCL < /tmp/start_servers_local$$ $REDIRECT" --x=$? --rm /tmp/start_servers_local$$ --if test $x != 0 ; then exit 1 ; fi -- --# run the servers (from the build tree) -- --adm_start_file=/tmp/adm_server_start.$$ --kdc_start_file=/tmp/kdc_server_start.$$ -- --rm -f $kdc_start_file -- --if test "x$USER" = x ; then -- USER=$LOGNAME ; export USER --fi -- --kdc_args="-R dfl:kdc_rcache.$USER" -- --(trap "" 2; $TOP/../kdc/krb5kdc $kdc_args; touch $kdc_start_file) \ -- < /dev/null > $usrtmp/kdc-log.$USER 2>&1 & -- --s=1 --max_s=60 --sofar_s=0 --timewait_s=300 -- --ovadm_args=-W -- --rm -f $adm_start_file -- --(sleep 1; $TOP/server/kadmind $ovadm_args; \ -- touch $adm_start_file) < /dev/null > $usrtmp/kadm-log.$USER 2>&1 & -- --# wait until they start -- --while [ $sofar_s -le $max_s ]; do -- if $VERBOSE; then -- echo "Sleeping for $s seconds to allow servers" \ -- "to start..." -- fi -- -- sofar_s=`expr $sofar_s + $s` -- -- sleep $s -- -- if [ -f $adm_start_file -a -f $kdc_start_file ]; then -- break -- fi --done -- --if [ $sofar_s -gt $max_s ]; then -- echo "Admin server or KDC failed to start after $sofar_s" \ -- "seconds." 1>&2 -- if [ ! -f $adm_start_file ]; then -- echo " No admin server start file $adm_start_file." 1>&2 -- fi -- if [ ! -f $kdc_start_file ]; then -- echo " No KDC start file $adm_start_file." 1>&2 -- fi -- exit 1 --fi -- --rm -f $kdc_start_file $adm_start_file -diff --git a/src/kadmin/testing/scripts/stop_servers b/src/kadmin/testing/scripts/stop_servers -deleted file mode 100755 -index b7f8384ca..000000000 ---- a/src/kadmin/testing/scripts/stop_servers -+++ /dev/null -@@ -1,60 +0,0 @@ --#!/bin/sh --# --# Usage: stop_servers [hostname [path]] --# --# This script turns a host into a OpenV*Secure primary server for the --# realm SECURE-TEST.OV.COM. If no arguments are specified, --# the local host is affected. Otherwise, the host hostname is --# affected; the path argument is the top of the Secure install tree on --# that host, and if it is not specified the current canonical value of --# TOP is used. -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} --# This'll be wrong sometimes --DUMMY=${RSH_CMD=rsh} -- --local=1 -- --if [ $# -gt 0 ]; then -- if [ $# != 1 -a $# != 2 ]; then -- echo "Usage: $0 [hostname [path]]" 1>&2 -- exit 1 -- fi -- -- local=0 -- hostname=$1 -- if [ $# = 1 ]; then -- rempath=`sh -c "cd $TOP && pwd"` -- else -- rempath=$2 -- fi --fi -- --if [ $local = 0 ]; then -- if $VERBOSE; then -- echo "+++ Stopping servers on remote host $hostname..." -- fi -- -- STOP_SERVERS_LOCAL=`echo $STOP_SERVERS_LOCAL | sed "s%$TOP%$rempath%"` -- CMD="$RSH_CMD $hostname -n \ -- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ -- $rempath/testing/scripts/env-setup.sh \ -- $STOP_SERVERS_LOCAL $rempath'\"" -- -- if $VERBOSE; then -- echo "+++" -- echo "+++ Begin execution of stop_servers_local on $hostname" -- echo "+++" -- echo $CMD -- fi -- eval $CMD -- if $VERBOSE; then -- echo "+++" -- echo "+++ End execution of stop_servers_local on $hostname" -- echo "+++" -- fi --else -- $STOP_SERVERS_LOCAL --fi -diff --git a/src/kadmin/testing/scripts/stop_servers_local b/src/kadmin/testing/scripts/stop_servers_local -deleted file mode 100755 -index 24a9de7b3..000000000 ---- a/src/kadmin/testing/scripts/stop_servers_local -+++ /dev/null -@@ -1,44 +0,0 @@ --#!/bin/sh -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${KRB5RCACHEDIR=$TESTDIR} -- --while [ $# -gt 0 ] ; do -- case $1 in -- -start_servers) -- start_servers=$1 -- ;; -- *) -- TOP=$1 -- export TOP -- ;; -- esac -- shift --done -- --# kill any running servers. -- --if $VERBOSE; then echo "Killing servers:"; fi -- --for pid in xxx \ -- `$PS_ALL | grep krb5kdc | grep -v grep | awk '{print $2}'` \ -- `$PS_ALL | grep kadmind | grep -v grep | awk '{print $2}'` \ -- ; do -- case "$pid" in -- xxx) -- ;; -- *) -- if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi -- kill $pid -- ;; -- esac --done -- --# Destroy the kdc replay cache so we don't lose if we try to run the --# KDC as another unix user. --if test "x$USER" = x ; then -- USER=$LOGNAME --fi --rm -f $KRB5RCACHEDIR/krb5kdc_rcache.$USER -- --exit 0 -diff --git a/src/kadmin/testing/tcl/util.t b/src/kadmin/testing/tcl/util.t -deleted file mode 100644 -index 6751f89e6..000000000 ---- a/src/kadmin/testing/tcl/util.t -+++ /dev/null -@@ -1,58 +0,0 @@ --proc simple_principal {name} { -- return "{$name} 0 0 0 0 {$name} 0 0 0 0 null 0" --} -- --proc princ_w_pol {name policy} { -- return "{$name} 0 0 0 0 {$name} 0 0 0 0 {$policy} 0" --} -- --proc simple_policy {name} { -- return "{$name} 0 0 0 0 0 0 0 0 0" --} -- --proc config_params {masks values} { -- if {[llength $masks] != [llength $values]} { -- error "config_params: length of mask and values differ" -- } -- -- set params [list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}] -- for {set i 0} {$i < [llength $masks]} {incr i} { -- set mask [lindex $masks $i] -- set value [lindex $values $i] -- switch -glob -- $mask { -- "KADM5_CONFIG_REALM" {set params [lreplace $params 1 1 $value]} -- "KADM5_CONFIG_KADMIND_PORT" { -- set params [lreplace $params 2 2 $value]} -- "KADM5_CONFIG_ADMIN_SERVER" { -- set params [lreplace $params 3 3 $value]} -- "KADM5_CONFIG_DBNAME" {set params [lreplace $params 4 4 $value]} -- "KADM5_CONFIG_ADBNAME" {set params [lreplace $params 5 5 $value]} -- "KADM5_CONFIG_ADB_LOCKFILE" { -- set params [lreplace $params 6 6 $value]} -- "KADM5_CONFIG_ACL_FILE" {set params [lreplace $params 8 8 $value]} -- "KADM5_CONFIG_DICT_FILE" { -- set params [lreplace $params 9 9 $value]} -- "KADM5_CONFIG_MKEY_FROM_KBD" { -- set params [lreplace $params 10 10 $value]} -- "KADM5_CONFIG_STASH_FILE" { -- set params [lreplace $params 11 11 $value]} -- "KADM5_CONFIG_MKEY_NAME" { -- set params [lreplace $params 12 12 $value]} -- "KADM5_CONFIG_ENCTYPE" {set params [lreplace $params 13 13 $value]} -- "KADM5_CONFIG_MAX_LIFE" { -- set params [lreplace $params 14 14 $value]} -- "KADM5_CONFIG_MAX_RLIFE" { -- set params [lreplace $params 15 15 $value]} -- "KADM5_CONFIG_EXPIRATION" { -- set params [lreplace $params 16 16 $value]} -- "KADM5_CONFIG_FLAGS" {set params [lreplace $params 17 17 $value]} -- "KADM5_CONFIG_ENCTYPES" { -- set params [lreplace $params 18 19 [llength $value] $value]} -- "*" {error "config_params: unknown mask $mask"} -- } -- } -- return $params --} -- -- -- -diff --git a/src/kadmin/testing/util/Makefile.in b/src/kadmin/testing/util/Makefile.in -deleted file mode 100644 -index 7785c742e..000000000 ---- a/src/kadmin/testing/util/Makefile.in -+++ /dev/null -@@ -1,42 +0,0 @@ --mydir=kadmin$(S)testing$(S)util --BUILDTOP=$(REL)..$(S)..$(S).. --LOCALINCLUDES = $(TCL_INCLUDES) -I$(BUILDTOP)/lib/kdb/ --# Force Tcl headers to use stdarg.h, because krb5 does too, and if --# Tcl uses varargs.h it'll just mess things up. --DEFINES= -DHAS_STDARG --KRB5_PTHREAD_LIB=$(THREAD_LINKOPTS) -- --PROG_LIBPATH=-L$(TOPLIBD) $(TCL_LIBPATH) --PROG_RPATH=$(KRB5_LIBDIR)$(TCL_RPATH) -- --SRCS = $(srcdir)/tcl_kadm5.c $(srcdir)/test.c --OBJS = tcl_kadm5.o test.o -- --CLNTPROG= kadm5_clnt_tcl --SRVPROG = kadm5_srv_tcl -- --DO_ALL=@DO_ALL@ -- --all: all-$(DO_ALL) -- --all-: -- @echo "+++" -- @echo "+++ WARNING: Tcl not available. The kadm5 tests will not be run." -- @echo "+++" -- @echo 'Skipped kadm5 tests: Tcl not found' >> $(SKIPTESTS) -- --all-tcl: $(CLNTPROG) $(SRVPROG) -- --$(SRVPROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o $(SRVPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ -- $(KADMSRV_LIBS) $(KRB5_PTHREAD_LIB) $(KRB5_BASE_LIBS) $(TCL_LIBS) -- --$(CLNTPROG): $(OBJS) $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o $(CLNTPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ -- $(KRB5_PTHREAD_LIB) $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) $(TCL_LIBS) -- --bsddb_dump: bsddb_dump.o -- $(CC_LINK) -o bsddb_dump bsddb_dump.o $(KADMSRV_LIBS) -- --clean: -- $(RM) $(CLNTPROG) $(SRVPROG) -diff --git a/src/kadmin/testing/util/bsddb_dump.c b/src/kadmin/testing/util/bsddb_dump.c -deleted file mode 100644 -index 5dbe7ae9c..000000000 ---- a/src/kadmin/testing/util/bsddb_dump.c -+++ /dev/null -@@ -1,65 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* -- * $Id$ -- */ -- --#include --#include --#include --#include -- --main(int argc, char *argv[]) --{ -- char *file; -- DB *db; -- DBT dbkey, dbdata; -- int code, i; -- -- HASHINFO info; -- -- info.hash = NULL; -- info.bsize = 256; -- info.ffactor = 8; -- info.nelem = 25000; -- info.lorder = 0; -- -- if (argc != 2) { -- fprintf(stderr, "usage: argv[0] dbfile\n"); -- exit(2); -- } -- -- file = argv[1]; -- -- if((db = dbopen(file, O_RDWR, 0666, DB_HASH, &info)) == NULL) { -- perror("Opening db file"); -- exit(1); -- } -- -- if ((code = (*db->seq)(db, &dbkey, &dbdata, R_FIRST)) == -1) { -- perror("starting db iteration"); -- exit(1); -- } -- -- while (code == 0) { -- for (i=0; iseq)(db, &dbkey, &dbdata, R_NEXT); -- } -- -- if (code == -1) { -- perror("during db iteration"); -- exit(1); -- } -- -- if ((*db->close)(db) == -1) { -- perror("closing db"); -- exit(1); -- } -- -- exit(0); --} -diff --git a/src/kadmin/testing/util/deps b/src/kadmin/testing/util/deps -deleted file mode 100644 -index ca828a85c..000000000 ---- a/src/kadmin/testing/util/deps -+++ /dev/null -@@ -1,16 +0,0 @@ --# --# Generated makefile dependencies follow. --# --$(OUTPRE)tcl_kadm5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(BUILDTOP)/lib/kdb/adb_err.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h tcl_kadm5.c tcl_kadm5.h --$(OUTPRE)test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- tcl_kadm5.h test.c -diff --git a/src/kadmin/testing/util/tcl_kadm5.c b/src/kadmin/testing/util/tcl_kadm5.c -deleted file mode 100644 -index 864a929c8..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5.c -+++ /dev/null -@@ -1,2566 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include "autoconf.h" --#include --#include --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#define USE_KADM5_API_VERSION 2 --#include --#include --#include --#include --#include --#include "tcl_kadm5.h" -- --struct flagval { -- char *name; -- krb5_flags val; --}; -- --/* XXX This should probably be in the hash table like server_handle */ --static krb5_context context; -- --static struct flagval krb5_flags_array[] = { -- {"KRB5_KDB_DISALLOW_POSTDATED", KRB5_KDB_DISALLOW_POSTDATED}, -- {"KRB5_KDB_DISALLOW_FORWARDABLE", KRB5_KDB_DISALLOW_FORWARDABLE}, -- {"KRB5_KDB_DISALLOW_TGT_BASED", KRB5_KDB_DISALLOW_TGT_BASED}, -- {"KRB5_KDB_DISALLOW_RENEWABLE", KRB5_KDB_DISALLOW_RENEWABLE}, -- {"KRB5_KDB_DISALLOW_PROXIABLE", KRB5_KDB_DISALLOW_PROXIABLE}, -- {"KRB5_KDB_DISALLOW_DUP_SKEY", KRB5_KDB_DISALLOW_DUP_SKEY}, -- {"KRB5_KDB_DISALLOW_ALL_TIX", KRB5_KDB_DISALLOW_ALL_TIX}, -- {"KRB5_KDB_REQUIRES_PRE_AUTH", KRB5_KDB_REQUIRES_PRE_AUTH}, -- {"KRB5_KDB_REQUIRES_HW_AUTH", KRB5_KDB_REQUIRES_HW_AUTH}, -- {"KRB5_KDB_REQUIRES_PWCHANGE", KRB5_KDB_REQUIRES_PWCHANGE}, -- {"KRB5_KDB_DISALLOW_SVR", KRB5_KDB_DISALLOW_SVR}, -- {"KRB5_KDB_PWCHANGE_SERVICE", KRB5_KDB_PWCHANGE_SERVICE} --}; -- --static struct flagval aux_attributes[] = { -- {"KADM5_POLICY", KADM5_POLICY} --}; -- --static struct flagval principal_mask_flags[] = { -- {"KADM5_PRINCIPAL", KADM5_PRINCIPAL}, -- {"KADM5_PRINC_EXPIRE_TIME", KADM5_PRINC_EXPIRE_TIME}, -- {"KADM5_PW_EXPIRATION", KADM5_PW_EXPIRATION}, -- {"KADM5_LAST_PWD_CHANGE", KADM5_LAST_PWD_CHANGE}, -- {"KADM5_ATTRIBUTES", KADM5_ATTRIBUTES}, -- {"KADM5_MAX_LIFE", KADM5_MAX_LIFE}, -- {"KADM5_MOD_TIME", KADM5_MOD_TIME}, -- {"KADM5_MOD_NAME", KADM5_MOD_NAME}, -- {"KADM5_KVNO", KADM5_KVNO}, -- {"KADM5_MKVNO", KADM5_MKVNO}, -- {"KADM5_AUX_ATTRIBUTES", KADM5_AUX_ATTRIBUTES}, -- {"KADM5_POLICY", KADM5_POLICY}, -- {"KADM5_POLICY_CLR", KADM5_POLICY_CLR}, -- {"KADM5_MAX_RLIFE", KADM5_MAX_RLIFE}, -- {"KADM5_LAST_SUCCESS", KADM5_LAST_SUCCESS}, -- {"KADM5_LAST_FAILED", KADM5_LAST_FAILED}, -- {"KADM5_FAIL_AUTH_COUNT", KADM5_FAIL_AUTH_COUNT}, -- {"KADM5_KEY_DATA", KADM5_KEY_DATA}, -- {"KADM5_TL_DATA", KADM5_TL_DATA}, -- {"KADM5_PRINCIPAL_NORMAL_MASK", KADM5_PRINCIPAL_NORMAL_MASK} --}; -- --static struct flagval policy_mask_flags[] = { -- {"KADM5_POLICY", KADM5_POLICY}, -- {"KADM5_PW_MAX_LIFE", KADM5_PW_MAX_LIFE}, -- {"KADM5_PW_MIN_LIFE", KADM5_PW_MIN_LIFE}, -- {"KADM5_PW_MIN_LENGTH", KADM5_PW_MIN_LENGTH}, -- {"KADM5_PW_MIN_CLASSES", KADM5_PW_MIN_CLASSES}, -- {"KADM5_PW_HISTORY_NUM", KADM5_PW_HISTORY_NUM}, -- {"KADM5_REF_COUNT", KADM5_REF_COUNT}, -- {"KADM5_PW_MAX_FAILURE", KADM5_PW_MAX_FAILURE}, -- {"KADM5_PW_FAILURE_COUNT_INTERVAL", KADM5_PW_FAILURE_COUNT_INTERVAL}, -- {"KADM5_PW_LOCKOUT_DURATION", KADM5_PW_LOCKOUT_DURATION}, --}; -- --static struct flagval config_mask_flags[] = { -- {"KADM5_CONFIG_REALM", KADM5_CONFIG_REALM}, -- {"KADM5_CONFIG_DBNAME", KADM5_CONFIG_DBNAME}, -- {"KADM5_CONFIG_MKEY_NAME", KADM5_CONFIG_MKEY_NAME}, -- {"KADM5_CONFIG_MAX_LIFE", KADM5_CONFIG_MAX_LIFE}, -- {"KADM5_CONFIG_MAX_RLIFE", KADM5_CONFIG_MAX_RLIFE}, -- {"KADM5_CONFIG_EXPIRATION", KADM5_CONFIG_EXPIRATION}, -- {"KADM5_CONFIG_FLAGS", KADM5_CONFIG_FLAGS}, -- {"KADM5_CONFIG_STASH_FILE", KADM5_CONFIG_STASH_FILE}, -- {"KADM5_CONFIG_ENCTYPE", KADM5_CONFIG_ENCTYPE}, -- {"KADM5_CONFIG_ADBNAME", KADM5_CONFIG_ADBNAME}, -- {"KADM5_CONFIG_ADB_LOCKFILE", KADM5_CONFIG_ADB_LOCKFILE}, -- {"KADM5_CONFIG_ACL_FILE", KADM5_CONFIG_ACL_FILE}, -- {"KADM5_CONFIG_KADMIND_PORT", KADM5_CONFIG_KADMIND_PORT}, -- {"KADM5_CONFIG_ENCTYPES", KADM5_CONFIG_ENCTYPES}, -- {"KADM5_CONFIG_ADMIN_SERVER", KADM5_CONFIG_ADMIN_SERVER}, -- {"KADM5_CONFIG_DICT_FILE", KADM5_CONFIG_DICT_FILE}, -- {"KADM5_CONFIG_MKEY_FROM_KBD", KADM5_CONFIG_MKEY_FROM_KBD}, --}; -- --static struct flagval priv_flags[] = { -- {"KADM5_PRIV_GET", KADM5_PRIV_GET}, -- {"KADM5_PRIV_ADD", KADM5_PRIV_ADD}, -- {"KADM5_PRIV_MODIFY", KADM5_PRIV_MODIFY}, -- {"KADM5_PRIV_DELETE", KADM5_PRIV_DELETE} --}; -- -- --static char *arg_error = "wrong # args"; -- --static Tcl_HashTable *struct_table = 0; -- --static int put_server_handle(Tcl_Interp *interp, void *handle, char **name) --{ -- int i = 1, newPtr = 0; -- static char buf[20]; -- Tcl_HashEntry *entry; -- -- if (! struct_table) { -- if (! (struct_table = -- malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- do { -- sprintf(buf, "kadm5_handle%d", i); -- entry = Tcl_CreateHashEntry(struct_table, buf, &newPtr); -- i++; -- } while (! newPtr); -- -- Tcl_SetHashValue(entry, handle); -- -- *name = buf; -- -- return TCL_OK; --} -- --static int get_server_handle(Tcl_Interp *interp, const char *name, -- void **handle) --{ -- Tcl_HashEntry *entry; -- -- if(!strcasecmp(name, "null")) -- *handle = 0; -- else { -- if (! (struct_table && -- (entry = Tcl_FindHashEntry(struct_table, name)))) { -- Tcl_AppendResult(interp, "unknown server handle ", name, 0); -- return TCL_ERROR; -- } -- *handle = (void *) Tcl_GetHashValue(entry); -- } -- return TCL_OK; --} -- --static int remove_server_handle(Tcl_Interp *interp, const char *name) --{ -- Tcl_HashEntry *entry; -- -- if (! (struct_table && -- (entry = Tcl_FindHashEntry(struct_table, name)))) { -- Tcl_AppendResult(interp, "unknown server handle ", name, 0); -- return TCL_ERROR; -- } -- -- Tcl_SetHashValue(entry, NULL); -- return TCL_OK; --} -- --#define GET_HANDLE(num_args, ignored) \ -- void *server_handle; \ -- const char *whoami = argv[0]; \ -- argv++, argc--; \ -- if (argc != num_args + 1) { \ -- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); \ -- return TCL_ERROR; \ -- } \ -- { \ -- int ltcl_ret; \ -- if ((ltcl_ret = get_server_handle(interp, argv[0], &server_handle)) \ -- != TCL_OK) { \ -- return ltcl_ret; \ -- } \ -- } \ -- argv++, argc--; -- --static Tcl_HashTable *create_flag_table(struct flagval *flags, int size) --{ -- Tcl_HashTable *table; -- Tcl_HashEntry *entry; -- int i; -- -- if (! (table = (Tcl_HashTable *) malloc(sizeof(Tcl_HashTable)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_InitHashTable(table, TCL_STRING_KEYS); -- -- for (i = 0; i < size; i++) { -- int newPtr; -- -- if (! (entry = Tcl_CreateHashEntry(table, flags[i].name, &newPtr))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_SetHashValue(entry, &flags[i].val); -- } -- -- return table; --} -- -- --static Tcl_DString *unparse_str(char *in_str) --{ -- Tcl_DString *str; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- if (! in_str) { -- Tcl_DStringAppend(str, "null", -1); -- } -- else { -- Tcl_DStringAppend(str, in_str, -1); -- } -- -- return str; --} -- -- -- --static int parse_str(Tcl_Interp *interp, const char *in_str, char **out_str) --{ -- if (! in_str) { -- *out_str = 0; -- } -- else if (! strcasecmp(in_str, "null")) { -- *out_str = 0; -- } -- else { -- *out_str = (char *) in_str; -- } -- return TCL_OK; --} -- -- --static void set_ok(Tcl_Interp *interp, char *string) --{ -- Tcl_SetResult(interp, "OK", TCL_STATIC); -- Tcl_AppendElement(interp, "KADM5_OK"); -- Tcl_AppendElement(interp, string); --} -- -- -- --static Tcl_DString *unparse_err(kadm5_ret_t code) --{ -- char *code_string; -- const char *error_string; -- Tcl_DString *dstring; -- -- switch (code) { -- case KADM5_FAILURE: code_string = "KADM5_FAILURE"; break; -- case KADM5_AUTH_GET: code_string = "KADM5_AUTH_GET"; break; -- case KADM5_AUTH_ADD: code_string = "KADM5_AUTH_ADD"; break; -- case KADM5_AUTH_MODIFY: -- code_string = "KADM5_AUTH_MODIFY"; break; -- case KADM5_AUTH_DELETE: -- code_string = "KADM5_AUTH_DELETE"; break; -- case KADM5_AUTH_INSUFFICIENT: -- code_string = "KADM5_AUTH_INSUFFICIENT"; break; -- case KADM5_BAD_DB: code_string = "KADM5_BAD_DB"; break; -- case KADM5_DUP: code_string = "KADM5_DUP"; break; -- case KADM5_RPC_ERROR: code_string = "KADM5_RPC_ERROR"; break; -- case KADM5_NO_SRV: code_string = "KADM5_NO_SRV"; break; -- case KADM5_BAD_HIST_KEY: -- code_string = "KADM5_BAD_HIST_KEY"; break; -- case KADM5_NOT_INIT: code_string = "KADM5_NOT_INIT"; break; -- case KADM5_INIT: code_string = "KADM5_INIT"; break; -- case KADM5_BAD_PASSWORD: -- code_string = "KADM5_BAD_PASSWORD"; break; -- case KADM5_UNK_PRINC: code_string = "KADM5_UNK_PRINC"; break; -- case KADM5_UNK_POLICY: code_string = "KADM5_UNK_POLICY"; break; -- case KADM5_BAD_MASK: code_string = "KADM5_BAD_MASK"; break; -- case KADM5_BAD_CLASS: code_string = "KADM5_BAD_CLASS"; break; -- case KADM5_BAD_LENGTH: code_string = "KADM5_BAD_LENGTH"; break; -- case KADM5_BAD_POLICY: code_string = "KADM5_BAD_POLICY"; break; -- case KADM5_BAD_HISTORY: code_string = "KADM5_BAD_HISTORY"; break; -- case KADM5_BAD_PRINCIPAL: -- code_string = "KADM5_BAD_PRINCIPAL"; break; -- case KADM5_BAD_AUX_ATTR: -- code_string = "KADM5_BAD_AUX_ATTR"; break; -- case KADM5_PASS_Q_TOOSHORT: -- code_string = "KADM5_PASS_Q_TOOSHORT"; break; -- case KADM5_PASS_Q_CLASS: -- code_string = "KADM5_PASS_Q_CLASS"; break; -- case KADM5_PASS_Q_DICT: -- code_string = "KADM5_PASS_Q_DICT"; break; -- case KADM5_PASS_REUSE: code_string = "KADM5_PASS_REUSE"; break; -- case KADM5_PASS_TOOSOON: -- code_string = "KADM5_PASS_TOOSOON"; break; -- case KADM5_POLICY_REF: -- code_string = "KADM5_POLICY_REF"; break; -- case KADM5_PROTECT_PRINCIPAL: -- code_string = "KADM5_PROTECT_PRINCIPAL"; break; -- case KADM5_BAD_SERVER_HANDLE: -- code_string = "KADM5_BAD_SERVER_HANDLE"; break; -- case KADM5_BAD_STRUCT_VERSION: -- code_string = "KADM5_BAD_STRUCT_VERSION"; break; -- case KADM5_OLD_STRUCT_VERSION: -- code_string = "KADM5_OLD_STRUCT_VERSION"; break; -- case KADM5_NEW_STRUCT_VERSION: -- code_string = "KADM5_NEW_STRUCT_VERSION"; break; -- case KADM5_BAD_API_VERSION: -- code_string = "KADM5_BAD_API_VERSION"; break; -- case KADM5_OLD_LIB_API_VERSION: -- code_string = "KADM5_OLD_LIB_API_VERSION"; break; -- case KADM5_OLD_SERVER_API_VERSION: -- code_string = "KADM5_OLD_SERVER_API_VERSION"; break; -- case KADM5_NEW_LIB_API_VERSION: -- code_string = "KADM5_NEW_LIB_API_VERSION"; break; -- case KADM5_NEW_SERVER_API_VERSION: -- code_string = "KADM5_NEW_SERVER_API_VERSION"; break; -- case KADM5_SECURE_PRINC_MISSING: -- code_string = "KADM5_SECURE_PRINC_MISSING"; break; -- case KADM5_NO_RENAME_SALT: -- code_string = "KADM5_NO_RENAME_SALT"; break; -- case KADM5_BAD_CLIENT_PARAMS: -- code_string = "KADM5_BAD_CLIENT_PARAMS"; break; -- case KADM5_BAD_SERVER_PARAMS: -- code_string = "KADM5_BAD_SERVER_PARAMS"; break; -- case KADM5_AUTH_LIST: -- code_string = "KADM5_AUTH_LIST"; break; -- case KADM5_AUTH_CHANGEPW: -- code_string = "KADM5_AUTH_CHANGEPW"; break; -- case KADM5_GSS_ERROR: code_string = "KADM5_GSS_ERROR"; break; -- case KADM5_BAD_TL_TYPE: code_string = "KADM5_BAD_TL_TYPE"; break; -- case KADM5_MISSING_CONF_PARAMS: -- code_string = "KADM5_MISSING_CONF_PARAMS"; break; -- case KADM5_BAD_SERVER_NAME: -- code_string = "KADM5_BAD_SERVER_NAME"; break; -- case KADM5_MISSING_KRB5_CONF_PARAMS: -- code_string = "KADM5_MISSING_KRB5_CONF_PARAMS"; break; -- case KADM5_XDR_FAILURE: code_string = "KADM5_XDR_FAILURE"; break; -- case KADM5_CANT_RESOLVE: code_string = "KADM5_CANT_RESOLVE"; break; -- -- -- case OSA_ADB_DUP: code_string = "OSA_ADB_DUP"; break; -- case OSA_ADB_NOENT: code_string = "ENOENT"; break; -- case OSA_ADB_DBINIT: code_string = "OSA_ADB_DBINIT"; break; -- case OSA_ADB_BAD_POLICY: code_string = "Bad policy name"; break; -- case OSA_ADB_BAD_PRINC: code_string = "Bad principal name"; break; -- case OSA_ADB_BAD_DB: code_string = "Invalid database."; break; -- case OSA_ADB_XDR_FAILURE: code_string = "OSA_ADB_XDR_FAILURE"; break; -- case OSA_ADB_BADLOCKMODE: code_string = "OSA_ADB_BADLOCKMODE"; break; -- case OSA_ADB_CANTLOCK_DB: code_string = "OSA_ADB_CANTLOCK_DB"; break; -- case OSA_ADB_NOTLOCKED: code_string = "OSA_ADB_NOTLOCKED"; break; -- case OSA_ADB_NOLOCKFILE: code_string = "OSA_ADB_NOLOCKFILE"; break; -- case OSA_ADB_NOEXCL_PERM: code_string = "OSA_ADB_NOEXCL_PERM"; break; -- -- case KRB5_KDB_INUSE: code_string = "KRB5_KDB_INUSE"; break; -- case KRB5_KDB_UK_SERROR: code_string = "KRB5_KDB_UK_SERROR"; break; -- case KRB5_KDB_UK_RERROR: code_string = "KRB5_KDB_UK_RERROR"; break; -- case KRB5_KDB_UNAUTH: code_string = "KRB5_KDB_UNAUTH"; break; -- case KRB5_KDB_NOENTRY: code_string = "KRB5_KDB_NOENTRY"; break; -- case KRB5_KDB_ILL_WILDCARD: code_string = "KRB5_KDB_ILL_WILDCARD"; break; -- case KRB5_KDB_DB_INUSE: code_string = "KRB5_KDB_DB_INUSE"; break; -- case KRB5_KDB_DB_CHANGED: code_string = "KRB5_KDB_DB_CHANGED"; break; -- case KRB5_KDB_TRUNCATED_RECORD: -- code_string = "KRB5_KDB_TRUNCATED_RECORD"; break; -- case KRB5_KDB_RECURSIVELOCK: -- code_string = "KRB5_KDB_RECURSIVELOCK"; break; -- case KRB5_KDB_NOTLOCKED: code_string = "KRB5_KDB_NOTLOCKED"; break; -- case KRB5_KDB_BADLOCKMODE: code_string = "KRB5_KDB_BADLOCKMODE"; break; -- case KRB5_KDB_DBNOTINITED: code_string = "KRB5_KDB_DBNOTINITED"; break; -- case KRB5_KDB_DBINITED: code_string = "KRB5_KDB_DBINITED"; break; -- case KRB5_KDB_ILLDIRECTION: code_string = "KRB5_KDB_ILLDIRECTION"; break; -- case KRB5_KDB_NOMASTERKEY: code_string = "KRB5_KDB_NOMASTERKEY"; break; -- case KRB5_KDB_BADMASTERKEY: code_string = "KRB5_KDB_BADMASTERKEY"; break; -- case KRB5_KDB_INVALIDKEYSIZE: -- code_string = "KRB5_KDB_INVALIDKEYSIZE"; break; -- case KRB5_KDB_CANTREAD_STORED: -- code_string = "KRB5_KDB_CANTREAD_STORED"; break; -- case KRB5_KDB_BADSTORED_MKEY: -- code_string = "KRB5_KDB_BADSTORED_MKEY"; break; -- case KRB5_KDB_CANTLOCK_DB: code_string = "KRB5_KDB_CANTLOCK_DB"; break; -- case KRB5_KDB_DB_CORRUPT: code_string = "KRB5_KDB_DB_CORRUPT"; break; -- -- case KRB5_PARSE_ILLCHAR: code_string = "KRB5_PARSE_ILLCHAR"; break; -- case KRB5_PARSE_MALFORMED: code_string = "KRB5_PARSE_MALFORMED"; break; -- case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN"; break; -- case KRB5_REALM_UNKNOWN: code_string = "KRB5_REALM_UNKNOWN"; break; -- case KRB5_KDC_UNREACH: code_string = "KRB5_KDC_UNREACH"; break; -- case KRB5_KDCREP_MODIFIED: code_string = "KRB5_KDCREP_MODIFIED"; break; -- case KRB5KRB_AP_ERR_BAD_INTEGRITY: code_string = "KRB5KRB_AP_ERR_BAD_INTEGRITY"; break; -- case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN"; break; -- case KRB5_CONFIG_BADFORMAT: code_string = "KRB5_CONFIG_BADFORMAT"; break; -- -- case KRB5_CC_NOTFOUND: code_string = "KRB5_CC_NOTFOUND"; break; -- case KRB5_FCC_NOFILE: code_string = "KRB5_FCC_NOFILE"; break; -- -- case EINVAL: code_string = "EINVAL"; break; -- case ENOENT: code_string = "ENOENT"; break; -- -- default: -- fprintf(stderr, "**** CODE %ld (%s) ***\n", (long) code, -- error_message (code)); -- code_string = "UNKNOWN"; -- break; -- } -- -- error_string = error_message(code); -- -- if (! (dstring = (Tcl_DString *) malloc(sizeof(Tcl_DString)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX Do we really want to exit? Ok if this is */ -- /* just a test program, but what about if it gets */ -- /* used for other things later? */ -- } -- -- Tcl_DStringInit(dstring); -- -- if (! (Tcl_DStringAppendElement(dstring, "ERROR") && -- Tcl_DStringAppendElement(dstring, code_string) && -- Tcl_DStringAppendElement(dstring, error_string))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- return dstring; --} -- -- -- --static void stash_error(Tcl_Interp *interp, krb5_error_code code) --{ -- Tcl_DString *dstring = unparse_err(code); -- Tcl_DStringResult(interp, dstring); -- Tcl_DStringFree(dstring); -- free(dstring); --} -- --static Tcl_DString *unparse_key_data(krb5_key_data *key_data, int n_key_data) --{ -- Tcl_DString *str; -- char buf[2048]; -- int i, j; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- for (i = 0; i < n_key_data; i++) { -- krb5_key_data *key = &key_data[i]; -- -- Tcl_DStringStartSublist(str); -- sprintf(buf, "%d", key->key_data_type[0]); -- Tcl_DStringAppendElement(str, buf); -- sprintf(buf, "%d", key->key_data_ver > 1 ? -- key->key_data_type[1] : -1); -- Tcl_DStringAppendElement(str, buf); -- if (key->key_data_contents[0]) { -- sprintf(buf, "0x"); -- for (j = 0; j < key->key_data_length[0]; j++) { -- sprintf(buf + 2*(j+1), "%02x", -- key->key_data_contents[0][j]); -- } -- } else *buf = '\0'; -- Tcl_DStringAppendElement(str, buf); -- Tcl_DStringEndSublist(str); -- } -- -- return str; --} -- --static Tcl_DString *unparse_tl_data(krb5_tl_data *tl_data, int n_tl_data) --{ -- Tcl_DString *str; -- char buf[2048]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- Tcl_DStringStartSublist(str); -- for (; tl_data; tl_data = tl_data->tl_data_next) { -- Tcl_DStringStartSublist(str); -- sprintf(buf, "%d", tl_data->tl_data_type); -- Tcl_DStringAppendElement(str, buf); -- sprintf(buf, "%d", tl_data->tl_data_length); -- Tcl_DStringAppendElement(str, buf); -- Tcl_DStringAppend(str, " ", 1); -- Tcl_DStringAppend(str, (char *) tl_data->tl_data_contents, -- tl_data->tl_data_length); -- Tcl_DStringEndSublist(str); -- } -- Tcl_DStringEndSublist(str); -- -- return str; --} -- --static Tcl_DString *unparse_flags(struct flagval *array, int size, -- krb5_int32 flags) --{ -- int i; -- Tcl_DString *str; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- for (i = 0; i < size; i++) { -- if (flags & array[i].val) { -- Tcl_DStringAppendElement(str, array[i].name); -- } -- } -- -- return str; --} -- -- --static int parse_flags(Tcl_Interp *interp, Tcl_HashTable *table, -- struct flagval *array, int size, const char *str, -- krb5_flags *flags) --{ -- int tmp, argc, i, retcode = TCL_OK; -- const char **argv; -- Tcl_HashEntry *entry; -- -- if (Tcl_GetInt(interp, str, &tmp) == TCL_OK) { -- *flags = tmp; -- return TCL_OK; -- } -- Tcl_ResetResult(interp); -- -- if (Tcl_SplitList(interp, str, &argc, &argv) != TCL_OK) { -- return TCL_ERROR; -- } -- -- if (! table) { -- table = create_flag_table(array, size); -- } -- -- *flags = 0; -- -- for (i = 0; i < argc; i++) { -- if (! (entry = Tcl_FindHashEntry(table, argv[i]))) { -- Tcl_AppendResult(interp, "unknown krb5 flag ", argv[i], 0); -- retcode = TCL_ERROR; -- break; -- } -- *flags |= *(krb5_flags *) Tcl_GetHashValue(entry); -- } -- -- Tcl_Free((char *) argv); -- return(retcode); --} -- --static Tcl_DString *unparse_privs(krb5_flags flags) --{ -- return unparse_flags(priv_flags, sizeof(priv_flags) / -- sizeof(struct flagval), flags); --} -- -- --static Tcl_DString *unparse_krb5_flags(krb5_flags flags) --{ -- return unparse_flags(krb5_flags_array, sizeof(krb5_flags_array) / -- sizeof(struct flagval), flags); --} -- --static int parse_krb5_flags(Tcl_Interp *interp, const char *str, -- krb5_flags *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, krb5_flags_array, -- sizeof(krb5_flags_array) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static Tcl_DString *unparse_aux_attributes(krb5_int32 flags) --{ -- return unparse_flags(aux_attributes, sizeof(aux_attributes) / -- sizeof(struct flagval), flags); --} -- -- --static int parse_aux_attributes(Tcl_Interp *interp, const char *str, -- long *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, aux_attributes, -- sizeof(aux_attributes) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static int parse_principal_mask(Tcl_Interp *interp, const char *str, -- krb5_int32 *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, principal_mask_flags, -- sizeof(principal_mask_flags) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static int parse_policy_mask(Tcl_Interp *interp, const char *str, -- krb5_int32 *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, policy_mask_flags, -- sizeof(policy_mask_flags) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- -- --static Tcl_DString *unparse_principal_ent(kadm5_principal_ent_t princ, -- krb5_int32 mask) --{ -- Tcl_DString *str, *tmp_dstring; -- char *tmp; -- char buf[20]; -- krb5_error_code krb5_ret; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- tmp = 0; /* It looks to me from looking at the library source */ -- /* code for krb5_parse_name that the pointer passed into */ -- /* it should be initialized to 0 if I want it do be */ -- /* allocated automatically. */ -- if (mask & KADM5_PRINCIPAL) { -- krb5_ret = krb5_unparse_name(context, princ->principal, &tmp); -- if (krb5_ret) { -- /* XXX Do we want to return an error? Not sure. */ -- Tcl_DStringAppendElement(str, "[unparsable principal]"); -- } -- else { -- Tcl_DStringAppendElement(str, tmp); -- free(tmp); -- } -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%u", (unsigned int)princ->princ_expire_time); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_pwd_change); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->pw_expiration); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->max_life); -- Tcl_DStringAppendElement(str, buf); -- -- tmp = 0; -- if (mask & KADM5_MOD_NAME) { -- if ((krb5_ret = krb5_unparse_name(context, princ->mod_name, &tmp))) { -- /* XXX */ -- Tcl_DStringAppendElement(str, "[unparsable principal]"); -- } -- else { -- Tcl_DStringAppendElement(str, tmp); -- free(tmp); -- } -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%u", (unsigned int)princ->mod_date); -- Tcl_DStringAppendElement(str, buf); -- -- if (mask & KADM5_ATTRIBUTES) { -- tmp_dstring = unparse_krb5_flags(princ->attributes); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%d", princ->kvno); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->mkvno); -- Tcl_DStringAppendElement(str, buf); -- -- /* XXX This may be dangerous, because the contents of the policy */ -- /* field are undefined if the POLICY bit isn't set. However, I */ -- /* think it's a bug for the field not to be null in that case */ -- /* anyway, so we should assume that it will be null so that we'll */ -- /* catch it if it isn't. */ -- -- tmp_dstring = unparse_str(princ->policy); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- tmp_dstring = unparse_aux_attributes(princ->aux_attributes); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- sprintf(buf, "%d", princ->max_renewable_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_success); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_failed); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->fail_auth_count); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->n_key_data); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->n_tl_data); -- Tcl_DStringAppendElement(str, buf); -- -- tmp_dstring = unparse_key_data(princ->key_data, princ->n_key_data); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- tmp_dstring = unparse_tl_data(princ->tl_data, princ->n_tl_data); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- return str; --} -- --static int parse_keysalts(Tcl_Interp *interp, const char *list, -- krb5_key_salt_tuple **keysalts, -- int num_keysalts) --{ -- const char **argv, **argv1 = NULL; -- int i, tmp, argc, argc1, retcode; -- -- *keysalts = NULL; -- if (list == NULL) -- return TCL_OK; -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != num_keysalts) { -- Tcl_SetResult(interp, "wrong number of keysalts", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- *keysalts = (krb5_key_salt_tuple *) -- malloc(sizeof(krb5_key_salt_tuple)*num_keysalts); -- for (i = 0; i < num_keysalts; i++) { -- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != -- TCL_OK) { -- goto finished; -- } -- if (argc1 != 2) { -- Tcl_SetResult(interp, "wrong # of fields in keysalt", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- /* XXX this used to be argv1[1] too! */ -- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing ks_enctype"); -- retcode = TCL_ERROR; -- goto finished; -- } -- (*keysalts)[i].ks_enctype = tmp; -- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing ks_salttype"); -- goto finished; -- } -- (*keysalts)[i].ks_salttype = tmp; -- -- Tcl_Free((char *) argv1); -- argv1 = NULL; -- } -- --finished: -- if (argv1) { -- Tcl_Free((char *) argv1); -- } -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_key_data(Tcl_Interp *interp, const char *list, -- krb5_key_data **key_data, -- int n_key_data) --{ -- const char **argv = NULL; -- int argc, retcode; -- -- *key_data = NULL; -- if (list == NULL) { -- if (n_key_data != 0) { -- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } else -- return TCL_OK; -- } -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != n_key_data) { -- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (argc != 0) { -- Tcl_SetResult(interp, "cannot parse key_data yet", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- --finished: -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_tl_data(Tcl_Interp *interp, const char *list, -- krb5_tl_data **tlp, -- int n_tl_data) --{ -- krb5_tl_data *tl, *tl2; -- const char **argv = NULL, **argv1 = NULL; -- int i, tmp, argc, argc1, retcode; -- -- *tlp = NULL; -- if (list == NULL) { -- if (n_tl_data != 0) { -- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } else -- return TCL_OK; -- } -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != n_tl_data) { -- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- tl = tl2 = NULL; -- for (i = 0; i < n_tl_data; i++) { -- tl2 = (krb5_tl_data *) malloc(sizeof(krb5_tl_data)); -- memset(tl2, 0, sizeof(krb5_tl_data)); -- tl2->tl_data_next = tl; -- tl = tl2; -- } -- tl2 = tl; -- -- for (i = 0; i < n_tl_data; i++) { -- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != -- TCL_OK) { -- goto finished; -- } -- if (argc1 != 3) { -- Tcl_SetResult(interp, "wrong # of fields in tl_data", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data_type"); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_type = tmp; -- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data_length"); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_length = tmp; -- if (tl->tl_data_length != strlen(argv1[2])) { -- Tcl_SetResult(interp, "length != string length", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_contents = (krb5_octet *) strdup(argv1[2]); -- -- Tcl_Free((char *) argv1); -- argv1 = NULL; -- tl = tl->tl_data_next; -- } -- if (tl != NULL) { -- Tcl_SetResult(interp, "tl is not NULL!", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- *tlp = tl2; -- --finished: -- if (argv1) { -- Tcl_Free((char *) argv1); -- } -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_config_params(Tcl_Interp *interp, char *list, -- kadm5_config_params *params) --{ -- static Tcl_HashTable *table = 0; -- const char **argv = NULL; -- int tmp, argc, retcode; -- -- memset(params, 0, sizeof(kadm5_config_params)); -- if (list == NULL) -- return TCL_OK; -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- -- if (argc != 20) { -- Tcl_SetResult(interp, "wrong # args in config params structure", -- TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((retcode = parse_flags(interp, table, config_mask_flags, -- sizeof(config_mask_flags) / -- sizeof(struct flagval), -- argv[0], &tmp)) != TCL_OK) { -- goto finished; -- } -- params->mask = tmp; -- -- if ((retcode = parse_str(interp, argv[1], ¶ms->realm)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing realm name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing kadmind_port"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->kadmind_port = tmp; -- if ((retcode = parse_str(interp, argv[3], ¶ms->admin_server)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing profile name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[4], ¶ms->dbname)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing profile name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- /* Ignore argv[5], which used to set the admin_dbname field. */ -- /* Ignore argv[6], which used to set the admin_lockfile field. */ -- /* Ignore argv[7], which used to set the admin_keytab field. */ -- if ((retcode = parse_str(interp, argv[8], ¶ms->acl_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing acl_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[9], ¶ms->dict_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing dict_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[10], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkey_from_kbd"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->mkey_from_kbd = tmp; -- if ((retcode = parse_str(interp, argv[11], ¶ms->stash_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing stash_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[12], ¶ms->mkey_name)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkey_name name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[13], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing enctype"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->enctype = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[14], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->max_life = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[15], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_rlife"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->max_rlife = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[16], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing expiration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->expiration = tmp; -- if ((retcode = parse_krb5_flags(interp, argv[17], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing flags"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->flags = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[18], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing num_keysalts"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->num_keysalts = tmp; -- if ((retcode = parse_keysalts(interp, argv[19], ¶ms->keysalts, -- params->num_keysalts)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keysalts"); -- retcode = TCL_ERROR; -- goto finished; -- } -- --finished: -- return retcode; --} -- --static int parse_principal_ent(Tcl_Interp *interp, char *list, -- kadm5_principal_ent_t *out_princ) --{ -- kadm5_principal_ent_t princ = 0; -- krb5_error_code krb5_ret; -- int tcl_ret; -- int argc; -- const char **argv; -- int tmp; -- int retcode = TCL_OK; -- -- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return tcl_ret; -- } -- -- if (argc != 12 && argc != 20) { -- Tcl_SetResult(interp, "wrong # args in principal structure", -- TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (! (princ = malloc(sizeof *princ))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- memset(princ, 0, sizeof(*princ)); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ->principal)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- /* -- * All of the numerical values parsed here are parsed into an -- * "int" and then assigned into the structure in case the actual -- * width of the field in the Kerberos structure is different from -- * the width of an integer. -- */ -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing princ_expire_time"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->princ_expire_time = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_pwd_change"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_pwd_change = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_expiration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->pw_expiration = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->max_life = tmp; -- -- if ((krb5_ret = krb5_parse_name(context, argv[5], &princ->mod_name)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing mod_name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mod_date"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->mod_date = tmp; -- -- if ((tcl_ret = parse_krb5_flags(interp, argv[7], &princ->attributes)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing attributes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing kvno"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->kvno = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkvno"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->mkvno = tmp; -- -- if ((tcl_ret = parse_str(interp, argv[10], &princ->policy)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if(princ->policy != NULL) { -- if(!(princ->policy = strdup(princ->policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); -- } -- } -- -- if ((tcl_ret = parse_aux_attributes(interp, argv[11], -- &princ->aux_attributes)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing aux_attributes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (argc == 12) goto finished; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[12], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_renewable_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->max_renewable_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[13], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_success"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_success = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[14], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_failed"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_failed = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[15], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing fail_auth_count"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->fail_auth_count = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[16], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing n_key_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_key_data = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[17], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing n_tl_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_tl_data = tmp; -- -- if ((tcl_ret = parse_key_data(interp, argv[18], -- &princ->key_data, -- princ->n_key_data)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing key_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = parse_tl_data(interp, argv[19], -- &princ->tl_data, -- princ->n_tl_data)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_tl_data = tmp; -- --finished: -- Tcl_Free((char *) argv); -- *out_princ = princ; -- return retcode; --} -- -- --static void free_principal_ent(kadm5_principal_ent_t *princ) --{ -- krb5_free_principal(context, (*princ)->principal); -- krb5_free_principal(context, (*princ)->mod_name); -- free((*princ)->policy); -- free(*princ); -- *princ = 0; --} -- --static Tcl_DString *unparse_policy_ent(kadm5_policy_ent_t policy) --{ -- Tcl_DString *str, *tmp_dstring; -- char buf[20]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- tmp_dstring = unparse_str(policy->policy); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- sprintf(buf, "%ld", policy->pw_min_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_max_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_min_length); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_min_classes); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_history_num); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->policy_refcnt); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_max_fail); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_failcnt_interval); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_lockout_duration); -- Tcl_DStringAppendElement(str, buf); -- -- return str; --} -- -- -- --static int parse_policy_ent(Tcl_Interp *interp, char *list, -- kadm5_policy_ent_t *out_policy) --{ -- kadm5_policy_ent_t policy = 0; -- int tcl_ret; -- int argc; -- const char **argv; -- int tmp; -- int retcode = TCL_OK; -- -- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return tcl_ret; -- } -- -- if (argc != 7 && argc != 10) { -- Tcl_SetResult(interp, "wrong # args in policy structure", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (! (policy = malloc(sizeof *policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy->policy)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if(policy->policy != NULL) { -- if (! (policy->policy = strdup(policy->policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- } -- -- /* -- * All of the numerical values parsed here are parsed into an -- * "int" and then assigned into the structure in case the actual -- * width of the field in the Kerberos structure is different from -- * the width of an integer. -- */ -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_max_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_length"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_length = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_classes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_classes = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[5], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_history_num"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_history_num = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy_refcnt"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->policy_refcnt = tmp; -- -- if (argc == 7) goto finished; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[7], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_max_fail"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_max_fail = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_failcnt_interval"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_failcnt_interval = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_lockout_duration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_lockout_duration = tmp; -- --finished: -- Tcl_Free((char *) argv); -- *out_policy = policy; -- return retcode; --} -- -- --static void free_policy_ent(kadm5_policy_ent_t *policy) --{ -- free((*policy)->policy); -- free(*policy); -- *policy = 0; --} -- --static Tcl_DString *unparse_keytype(krb5_enctype enctype) --{ -- Tcl_DString *str; -- char buf[50]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- switch (enctype) { -- /* XXX is this right? */ -- case ENCTYPE_NULL: Tcl_DStringAppend(str, "ENCTYPE_NULL", -1); break; -- default: -- sprintf(buf, "UNKNOWN KEYTYPE (0x%x)", enctype); -- Tcl_DStringAppend(str, buf, -1); -- break; -- } -- -- return str; --} -- -- --static Tcl_DString *unparse_keyblocks(krb5_keyblock *keyblocks, int num_keys) --{ -- Tcl_DString *str; -- Tcl_DString *keytype; -- unsigned int i; -- int j; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- for (j = 0; j < num_keys; j++) { -- krb5_keyblock *keyblock = &keyblocks[j]; -- -- Tcl_DStringStartSublist(str); -- -- keytype = unparse_keytype(keyblock->enctype); -- Tcl_DStringAppendElement(str, keytype->string); -- Tcl_DStringFree(keytype); -- free(keytype); -- if (keyblock->length == 0) { -- Tcl_DStringAppendElement(str, "0x00"); -- } -- else { -- Tcl_DStringAppendElement(str, "0x"); -- for (i = 0; i < keyblock->length; i++) { -- char buf[3]; -- sprintf(buf, "%02x", (int) keyblock->contents[i]); -- Tcl_DStringAppend(str, buf, -1); -- } -- } -- -- Tcl_DStringEndSublist(str); -- } -- -- -- return str; --} -- --enum init_type { INIT_NONE, INIT_PASS, INIT_CREDS }; -- --static int _tcl_kadm5_init_any(enum init_type init_type, ClientData clientData, -- Tcl_Interp *interp, int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- char *client_name, *pass, *service_name; -- int tcl_ret; -- krb5_ui_4 struct_version, api_version; -- const char *handle_var; -- void *server_handle; -- char *handle_name, *params_str; -- const char *whoami = argv[0]; -- kadm5_config_params params; -- -- argv++, argc--; -- -- kadm5_init_krb5_context(&context); -- -- if (argc != 7) { -- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); -- return TCL_ERROR; -- } -- -- if (((tcl_ret = parse_str(interp, argv[0], &client_name)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[1], &pass)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[2], &service_name)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[3], ¶ms_str)) != TCL_OK) || -- ((tcl_ret = parse_config_params(interp, params_str, ¶ms)) -- != TCL_OK) || -- ((tcl_ret = Tcl_GetInt(interp, argv[4], (int *) &struct_version)) != -- TCL_OK) || -- ((tcl_ret = Tcl_GetInt(interp, argv[5], (int *) &api_version)) != -- TCL_OK)) { -- return tcl_ret; -- } -- -- handle_var = argv[6]; -- -- if (! (handle_var && *handle_var)) { -- Tcl_SetResult(interp, "must specify server handle variable name", -- TCL_STATIC); -- return TCL_ERROR; -- } -- -- if (init_type == INIT_CREDS) { -- krb5_ccache cc; -- -- if (pass == NULL) { -- if ((ret = krb5_cc_default(context, &cc))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- } else { -- if ((ret = krb5_cc_resolve(context, pass, &cc))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- } -- -- ret = kadm5_init_with_creds(context, client_name, cc, service_name, -- ¶ms, struct_version, -- api_version, NULL, &server_handle); -- -- (void) krb5_cc_close(context, cc); -- } else -- ret = kadm5_init(context, client_name, pass, service_name, ¶ms, -- struct_version, api_version, NULL, &server_handle); -- -- /* The string fields of params are aliases into argv[3], but -- * params.keysalts is allocated, so clean it up. */ -- free(params.keysalts); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- -- if ((tcl_ret = put_server_handle(interp, server_handle, &handle_name)) -- != TCL_OK) { -- return tcl_ret; -- } -- -- if (! Tcl_SetVar(interp, handle_var, handle_name, TCL_LEAVE_ERR_MSG)) { -- return TCL_ERROR; -- } -- -- set_ok(interp, "KADM5 API initialized."); -- return TCL_OK; --} -- --static int tcl_kadm5_init(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- return _tcl_kadm5_init_any(INIT_PASS, clientData, interp, argc, argv); --} -- --static int tcl_kadm5_init_with_creds(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- return _tcl_kadm5_init_any(INIT_CREDS, clientData, interp, argc, argv); --} -- --static int tcl_kadm5_destroy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- int tcl_ret; -- -- GET_HANDLE(0, 0); -- -- ret = kadm5_destroy(server_handle); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- -- if ((tcl_ret = remove_server_handle(interp, argv[-1])) != TCL_OK) { -- return tcl_ret; -- } -- -- set_ok(interp, "KADM5 API deinitialized."); -- return TCL_OK; --} -- --static int tcl_kadm5_create_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- int tcl_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- char *princ_string; -- kadm5_principal_ent_t princ = 0; -- krb5_int32 mask; -- char *pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- -- GET_HANDLE(3, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal"); -- return tcl_ret; -- } -- -- if (princ_string && -- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } -- -- if ((tcl_ret = parse_str(interp, argv[2], &pw)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } --#ifdef OVERRIDE -- if ((tcl_ret = Tcl_GetBoolean(interp, argv[3], &override_qual)) != -- TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } --#endif -- --#ifdef OVERRIDE -- ret = kadm5_create_principal(server_handle, princ, mask, pw, -- override_qual); --#else -- ret = kadm5_create_principal(server_handle, princ, mask, pw); --#endif -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- goto finished; -- } -- else { -- set_ok(interp, "Principal created."); -- } -- --finished: -- if (princ) { -- free_principal_ent(&princ); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_delete_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int tcl_ret; -- char *name; -- -- GET_HANDLE(1, 0); -- -- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) -- return tcl_ret; -- if(name != NULL) { -- if ((krb5_ret = krb5_parse_name(context, name, &princ))) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal"); -- return TCL_ERROR; -- } -- } else princ = NULL; -- ret = kadm5_delete_principal(server_handle, princ); -- -- if(princ != NULL) -- krb5_free_principal(context, princ); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- set_ok(interp, "Principal deleted."); -- return TCL_OK; -- } --} -- -- -- --static int tcl_kadm5_modify_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *princ_string; -- kadm5_principal_ent_t princ = 0; -- int tcl_ret; -- krb5_int32 mask; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal"); -- return tcl_ret; -- } -- -- if (princ_string && -- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_modify_principal(server_handle, princ, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- else { -- set_ok(interp, "Principal modified."); -- } -- --finished: -- if (princ) { -- free_principal_ent(&princ); -- } -- return retcode; --} -- -- --static int tcl_kadm5_rename_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal source, target; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(2, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &source)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing source"); -- return TCL_ERROR; -- } -- -- if ((krb5_ret = krb5_parse_name(context, argv[1], &target)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing target"); -- krb5_free_principal(context, source); -- return TCL_ERROR; -- } -- -- ret = kadm5_rename_principal(server_handle, source, target); -- -- if (ret == KADM5_OK) { -- set_ok(interp, "Principal renamed."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- -- krb5_free_principal(context, source); -- krb5_free_principal(context, target); -- return retcode; --} -- -- -- --static int tcl_kadm5_chpass_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- char *pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- krb5_error_code krb5_ret; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &pw) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing password"); -- retcode = TCL_ERROR; -- goto finished; -- } -- --#ifdef OVERRIDE -- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing override_qual"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_chpass_principal(server_handle, -- princ, pw, override_qual); --#else -- ret = kadm5_chpass_principal(server_handle, princ, pw); --#endif -- -- if (ret == KADM5_OK) { -- set_ok(interp, "Password changed."); -- goto finished; -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- return retcode; --} -- -- -- --static int tcl_kadm5_chpass_principal_util(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- char *new_pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- char *pw_ret, *pw_ret_var; -- char msg_ret[1024], *msg_ret_var; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(4, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &new_pw) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing new password"); -- retcode = TCL_ERROR; -- goto finished; -- } --#ifdef OVERRIDE -- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing override_qual"); -- retcode = TCL_ERROR; -- goto finished; -- } --#endif -- if (parse_str(interp, argv[3], &pw_ret_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_ret variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (parse_str(interp, argv[4], &msg_ret_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing msg_ret variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_chpass_principal_util(server_handle, princ, new_pw, --#ifdef OVERRIDE -- override_qual, --#endif -- pw_ret_var ? &pw_ret : 0, -- msg_ret_var ? msg_ret : 0, -- msg_ret_var ? sizeof(msg_ret) : 0); -- -- if (ret == KADM5_OK) { -- if (pw_ret_var && -- (! Tcl_SetVar(interp, pw_ret_var, pw_ret, -- TCL_LEAVE_ERR_MSG))) { -- Tcl_AppendElement(interp, "while setting pw_ret variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if (msg_ret_var && -- (! Tcl_SetVar(interp, msg_ret_var, msg_ret, -- TCL_LEAVE_ERR_MSG))) { -- Tcl_AppendElement(interp, -- "while setting msg_ret variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Password changed."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- return retcode; --} -- -- -- --static int tcl_kadm5_randkey_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- krb5_keyblock *keyblocks; -- int num_keys; -- char *keyblock_var, *num_var, buf[50]; -- Tcl_DString *keyblock_dstring = 0; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(3, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &keyblock_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keyblock variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if (parse_str(interp, argv[2], &num_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keyblock variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_randkey_principal(server_handle, -- princ, keyblock_var ? &keyblocks : 0, -- &num_keys); -- -- if (ret == KADM5_OK) { -- if (keyblock_var) { -- keyblock_dstring = unparse_keyblocks(keyblocks, num_keys); -- if (! Tcl_SetVar(interp, keyblock_var, -- keyblock_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting keyblock variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- } -- if (num_var) { -- sprintf(buf, "%d", num_keys); -- if (! Tcl_SetVar(interp, num_var, buf, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting num_keys variable"); -- } -- } -- set_ok(interp, "Key randomized."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- if (keyblock_dstring) { -- Tcl_DStringFree(keyblock_dstring); -- free(keyblock_dstring); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_get_principal(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- kadm5_principal_ent_rec ent; -- Tcl_DString *ent_dstring = 0; -- char *ent_var; -- char *name; -- krb5_error_code krb5_ret; -- int tcl_ret; -- kadm5_ret_t ret = -1; -- krb5_int32 mask; -- int retcode = TCL_OK; -- -- GET_HANDLE(3, 1); -- -- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) -- return tcl_ret; -- if(name != NULL) { -- if ((krb5_ret = krb5_parse_name(context, name, &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- } else princ = NULL; -- -- if ((tcl_ret = parse_str(interp, argv[1], &ent_var)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((tcl_ret = parse_principal_mask(interp, argv[2], &mask)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal mask"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_get_principal(server_handle, princ, ent_var ? &ent : 0, -- mask); -- -- if (ret == KADM5_OK) { -- if (ent_var) { -- ent_dstring = unparse_principal_ent(&ent, mask); -- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting entry variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Principal retrieved."); -- } -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- if (ent_dstring) { -- Tcl_DStringFree(ent_dstring); -- free(ent_dstring); -- } -- if(princ != NULL) -- krb5_free_principal(context, princ); -- if (ret == KADM5_OK && ent_var && -- (ret = kadm5_free_principal_ent(server_handle, &ent)) && -- (retcode == TCL_OK)) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- return retcode; --} -- --static int tcl_kadm5_create_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- int tcl_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- char *policy_string; -- kadm5_policy_ent_t policy = 0; -- krb5_int32 mask; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- return tcl_ret; -- } -- -- if (policy_string && -- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } -- -- ret = kadm5_create_policy(server_handle, policy, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- goto finished; -- } -- else { -- set_ok(interp, "Policy created."); -- } -- --finished: -- if (policy) { -- free_policy_ent(&policy); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_delete_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- char *policy; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &policy) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_delete_policy(server_handle, policy); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- set_ok(interp, "Policy deleted."); -- return TCL_OK; -- } --} -- -- -- --static int tcl_kadm5_modify_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *policy_string; -- kadm5_policy_ent_t policy = 0; -- int tcl_ret; -- krb5_int32 mask; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- return tcl_ret; -- } -- -- if (policy_string && -- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_modify_policy(server_handle, policy, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- else { -- set_ok(interp, "Policy modified."); -- } -- --finished: -- if (policy) { -- free_policy_ent(&policy); -- } -- return retcode; --} -- -- --static int tcl_kadm5_get_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_policy_ent_rec ent; -- Tcl_DString *ent_dstring = 0; -- char *policy; -- char *ent_var; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(2, 1); -- -- if (parse_str(interp, argv[0], &policy) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &ent_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry variable name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_get_policy(server_handle, policy, ent_var ? &ent : 0); -- -- if (ret == KADM5_OK) { -- if (ent_var) { -- ent_dstring = unparse_policy_ent(&ent); -- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting entry variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Policy retrieved."); -- } -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- if (ent_dstring) { -- Tcl_DStringFree(ent_dstring); -- free(ent_dstring); -- } -- if (ent_var && ret == KADM5_OK && -- (ret = kadm5_free_policy_ent(server_handle, &ent)) && -- (retcode == TCL_OK)) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_free_principal_ent(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *ent_name; -- kadm5_principal_ent_t ent; -- kadm5_ret_t ret; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry name"); -- return TCL_ERROR; -- } -- -- if ((! ent_name) && -- (ret = kadm5_free_principal_ent(server_handle, 0))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- Tcl_HashEntry *entry; -- -- if (strncmp(ent_name, "principal", sizeof("principal")-1)) { -- Tcl_AppendResult(interp, "invalid principal handle \"", -- ent_name, "\"", 0); -- return TCL_ERROR; -- } -- if (! struct_table) { -- if (! (struct_table = malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { -- Tcl_AppendResult(interp, "principal handle \"", ent_name, -- "\" not found", 0); -- return TCL_ERROR; -- } -- -- ent = (kadm5_principal_ent_t) Tcl_GetHashValue(entry); -- -- ret = kadm5_free_principal_ent(server_handle, ent); -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- Tcl_DeleteHashEntry(entry); -- } -- set_ok(interp, "Principal freed."); -- return TCL_OK; --} -- -- --static int tcl_kadm5_free_policy_ent(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *ent_name; -- kadm5_policy_ent_t ent; -- kadm5_ret_t ret; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry name"); -- return TCL_ERROR; -- } -- -- if ((! ent_name) && -- (ret = kadm5_free_policy_ent(server_handle, 0))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- Tcl_HashEntry *entry; -- -- if (strncmp(ent_name, "policy", sizeof("policy")-1)) { -- Tcl_AppendResult(interp, "invalid principal handle \"", -- ent_name, "\"", 0); -- return TCL_ERROR; -- } -- if (! struct_table) { -- if (! (struct_table = malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { -- Tcl_AppendResult(interp, "policy handle \"", ent_name, -- "\" not found", 0); -- return TCL_ERROR; -- } -- -- ent = (kadm5_policy_ent_t) Tcl_GetHashValue(entry); -- -- if ((ret = kadm5_free_policy_ent(server_handle, ent)) != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- Tcl_DeleteHashEntry(entry); -- } -- set_ok(interp, "Policy freed."); -- return TCL_OK; --} -- -- --static int tcl_kadm5_get_privs(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- const char *set_ret; -- kadm5_ret_t ret; -- char *priv_var; -- long privs; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &priv_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing privs variable name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_get_privs(server_handle, priv_var ? &privs : 0); -- -- if (ret == KADM5_OK) { -- if (priv_var) { -- Tcl_DString *str = unparse_privs(privs); -- set_ret = Tcl_SetVar(interp, priv_var, str->string, -- TCL_LEAVE_ERR_MSG); -- Tcl_DStringFree(str); -- free(str); -- if (! set_ret) { -- Tcl_AppendElement(interp, "while setting priv variable"); -- return TCL_ERROR; -- } -- } -- set_ok(interp, "Privileges retrieved."); -- return TCL_OK; -- } -- else { -- stash_error(interp, ret); -- return TCL_ERROR; -- } --} -- -- --void Tcl_kadm5_init(Tcl_Interp *interp) --{ -- char buf[20]; -- -- Tcl_SetVar(interp, "KADM5_ADMIN_SERVICE", -- KADM5_ADMIN_SERVICE, TCL_GLOBAL_ONLY); -- Tcl_SetVar(interp, "KADM5_CHANGEPW_SERVICE", -- KADM5_CHANGEPW_SERVICE, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION); -- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_2); -- Tcl_SetVar(interp, "KADM5_API_VERSION_2", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_3); -- Tcl_SetVar(interp, "KADM5_API_VERSION_3", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_4); -- Tcl_SetVar(interp, "KADM5_API_VERSION_4", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_MASK); -- Tcl_SetVar(interp, "KADM5_API_VERSION_MASK", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION_MASK); -- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION_MASK", buf, -- TCL_GLOBAL_ONLY); -- -- Tcl_CreateCommand(interp, "kadm5_init", tcl_kadm5_init, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_init_with_creds", -- tcl_kadm5_init_with_creds, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_destroy", tcl_kadm5_destroy, 0, -- 0); -- Tcl_CreateCommand(interp, "kadm5_create_principal", -- tcl_kadm5_create_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_delete_principal", -- tcl_kadm5_delete_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_modify_principal", -- tcl_kadm5_modify_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_rename_principal", -- tcl_kadm5_rename_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_chpass_principal", -- tcl_kadm5_chpass_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_chpass_principal_util", -- tcl_kadm5_chpass_principal_util, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_randkey_principal", -- tcl_kadm5_randkey_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_principal", -- tcl_kadm5_get_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_create_policy", -- tcl_kadm5_create_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_delete_policy", -- tcl_kadm5_delete_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_modify_policy", -- tcl_kadm5_modify_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_policy", -- tcl_kadm5_get_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_free_principal_ent", -- tcl_kadm5_free_principal_ent, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_free_policy_ent", -- tcl_kadm5_free_policy_ent, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_privs", -- tcl_kadm5_get_privs, 0, 0); --} -diff --git a/src/kadmin/testing/util/tcl_kadm5.h b/src/kadmin/testing/util/tcl_kadm5.h -deleted file mode 100644 -index 1f91a11a1..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5.h -+++ /dev/null -@@ -1,3 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -- --void Tcl_kadm5_init(Tcl_Interp *interp); -diff --git a/src/kadmin/testing/util/tcl_kadm5_syntax b/src/kadmin/testing/util/tcl_kadm5_syntax -deleted file mode 100644 -index 5f16e58e0..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5_syntax -+++ /dev/null -@@ -1,57 +0,0 @@ --Here's a brief summary of the syntax of the tcl versions of the --kadm5 functions: -- --string Can be a string or "null" which will turn into a null pointer --principal_ent A 12-field list in the order of the principal_ent -- structure: {string number number number number string -- number mask number number string mask} -- It can also be "null", like a string, to indicate that -- a null structure pointer should be used. --mask Either a number, representing the actual value of the -- mask, or a sequence of symbols in a list. Example: -- {PRINCIPAL ATTRIBUTES} is a valid principal mask. --boolean "1", "0", "true", "false", etc. --varname The name of a Tcl variable, or "null" to not assign. --policy_ent Similar to principal_ent, but with seven fields, -- instead of 12. The first is a string, and the rest -- are numbers. -- --init -- client_name:string pass:string service_name:string -- realm:string struct_version:int api_version:int -- server_handle_ret:varname --destroy -- server_handle:string --create_principal -- server_handle:string principal:principal_ent -- mask:principal_mask password:string --delete_principal -- server_handle:string name:string --modify_principal -- server_handle:string principal_principal_ent -- mask:principal_mask --rename_principal -- server_handle:string source:string target:string --chpass_principal -- server_handle:string name:string password:string --chpass_principal_util -- server_handle:string name:string password:string -- pw_ret:varname msg_ret:varname --randkey_principal -- server_handle:string name:string keyblock_var:varname --get_principal [-struct] -- server_handle:string name:string princ_var:varname --create_policy -- server_handle:string policy:policy_ent mask:policy_mask --delete_policy -- server_handle:string name:string --modify_policy -- server_handle:string policy:policy_ent mask:policy_mask --get_policy [-struct] -- server_handle:string name:string policy_var:varname --free_principal_ent -- server_handle:string handle:string --free_policy_ent -- server_handle:string handle:string --get_privs -- server_handle:string privs:priv_var -diff --git a/src/kadmin/testing/util/tcl_krb5_hash.c b/src/kadmin/testing/util/tcl_krb5_hash.c -deleted file mode 100644 -index 35c6bb0b3..000000000 ---- a/src/kadmin/testing/util/tcl_krb5_hash.c -+++ /dev/null -@@ -1,167 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* -- * All of the TCL krb5 functions which return (or place into output -- * variables) structures or pointers to structures that can't be -- * represented as tcl native types, do so by returning a handle for -- * the appropriate structure. The handle is a string of the form -- * "type$id", where "type" is the type of datum represented by the -- * handle and "id" is a unique identifier for it. This handle can -- * then be used later by the caller to refer to the object, and -- * internally to retrieve the actually datum from the appropriate hash -- * table. -- * -- * The functions in this file do four things: -- * -- * 1) Given a pointer to a datum and a string representing the type of -- * datum to which the pointer refers, create a new handle for the -- * datum, store the datum in the hash table using the new handle as -- * its key, and return the new handle. -- * -- * 2) Given a handle, locate and return the appropriate hash table -- * datum. -- * -- * 3) Given a handle, look through a table of types and unparse -- * functions to figure out what function to call to get a string -- * representation of the datum, call it with the appropriate pointer -- * (obtained from the hash table) as an argument, and return the -- * resulting string as the unparsed form of the datum. -- * -- * 4) Given a handle, remove that handle and its associated datum from -- * the hash table (but don't free it -- it's assumed to have already -- * been freed by the caller). -- */ -- --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#include -- --#define SEP_STR "$" -- --static char *memory_error = "out of memory"; -- --/* -- * Right now, we're only using one hash table. However, at some point -- * in the future, we might decide to use a separate hash table for -- * every type. Therefore, I'm putting this function in as an -- * abstraction so it's the only thing we'll have to change if we -- * decide to do that. -- * -- * Also, this function allows us to put in just one place the code for -- * checking to make sure that the hash table exists and initializing -- * it if it doesn't. -- */ -- --static TclHashTable *get_hash_table(Tcl_Interp *interp, -- char *type) --{ -- static Tcl_HashTable *hash_table = 0; -- -- if (! hash_table) { -- if (! (hash_table = malloc(sizeof(*hash_table)))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- Tcl_InitHashTable(hash_table, TCL_STRING_KEYS); -- } -- return hash_table; --} -- --#define MAX_ID 999999999 --#define ID_BUF_SIZE 10 -- --static Tcl_HashEntry *get_new_handle(Tcl_Interp *interp, -- char *type) --{ -- static unsigned long int id_counter = 0; -- Tcl_DString *handle; -- char int_buf[ID_BUF_SIZE]; -- -- if (! (handle = malloc(sizeof(*handle)))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- Tcl_DStringInit(handle); -- -- assert(id_counter <= MAX_ID); -- -- sprintf(int_buf, "%d", id_counter++); -- -- Tcl_DStringAppend(handle, type, -1); -- Tcl_DStringAppend(handle, SEP_STR, -1); -- Tcl_DStringAppend(handle, int_buf, -1); -- -- return handle; --} -- -- --Tcl_DString *tcl_krb5_create_object(Tcl_Interp *interp, -- char *type, -- ClientData datum) --{ -- Tcl_HashTable *table; -- Tcl_DString *handle; -- Tcl_HashEntry *entry; -- int entry_created = 0; -- -- if (! (table = get_hash_table(interp, type))) { -- return 0; -- } -- -- if (! (handle = get_new_handle(interp, type))) { -- return 0; -- } -- -- if (! (entry = Tcl_CreateHashEntry(table, handle, &entry_created))) { -- Tcl_SetResult(interp, "error creating hash entry", TCL_STATIC); -- Tcl_DStringFree(handle); -- return TCL_ERROR; -- } -- -- assert(entry_created); -- -- Tcl_SetHashValue(entry, datum); -- -- return handle; --} -- --ClientData tcl_krb5_get_object(Tcl_Interp *interp, -- char *handle) --{ -- char *myhandle, *id_ptr; -- Tcl_HashTable *table; -- Tcl_HashEntry *entry; -- -- if (! (myhandle = strdup(handle))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- -- if (! (id_ptr = index(myhandle, *SEP_STR))) { -- free(myhandle); -- Tcl_ResetResult(interp); -- Tcl_AppendResult(interp, "malformatted handle \"", handle, -- "\"", 0); -- return 0; -- } -- -- *id_ptr = '\0'; -- -- if (! (table = get_hash_table(interp, myhandle))) { -- free(myhandle); -- return 0; -- } -- -- free(myhandle); -- -- if (! (entry = Tcl_FindHashEntry(table, handle))) { -- Tcl_ResetResult(interp); -- Tcl_AppendResult(interp, "no object corresponding to handle \"", -- handle, "\"", 0); -- return 0; -- } -- -- return(Tcl_GetHashValue(entry)); --} -diff --git a/src/kadmin/testing/util/test.c b/src/kadmin/testing/util/test.c -deleted file mode 100644 -index 37e49d680..000000000 ---- a/src/kadmin/testing/util/test.c -+++ /dev/null -@@ -1,38 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include "autoconf.h" --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#include "tcl_kadm5.h" -- --#define _TCL_MAIN ((TCL_MAJOR_VERSION * 100 + TCL_MINOR_VERSION) >= 704) -- --#if _TCL_MAIN --int --main(argc, argv) -- int argc; /* Number of command-line arguments. */ -- char **argv; /* Values of command-line arguments. */ --{ -- Tcl_Main(argc, argv, Tcl_AppInit); -- return 0; /* Needed only to prevent compiler warning. */ --} --#else --/* -- * The following variable is a special hack that allows applications -- * to be linked using the procedure "main" from the Tcl library. The -- * variable generates a reference to "main", which causes main to -- * be brought in from the library (and all of Tcl with it). -- */ -- --extern int main(); --int *tclDummyMainPtr = (int *) main; --#endif -- --int Tcl_AppInit(Tcl_Interp *interp) --{ -- Tcl_kadm5_init(interp); -- -- return(TCL_OK); --} -diff --git a/src/lib/kadm5/Makefile.in b/src/lib/kadm5/Makefile.in -index f94c0a7da..3ff71c42b 100644 ---- a/src/lib/kadm5/Makefile.in -+++ b/src/lib/kadm5/Makefile.in -@@ -1,6 +1,6 @@ - mydir=lib$(S)kadm5 - BUILDTOP=$(REL)..$(S).. --SUBDIRS = clnt srv unit-test -+SUBDIRS = clnt srv - - ##DOSBUILDTOP = ..\.. - -@@ -98,6 +98,7 @@ generate-files-mac-prerecurse: includes - check-windows: - - clean-unix:: clean-libobjs -+ $(RM) t_kadm5clnt t_kadm5srv t_kadm5.o - - clean-windows:: - -diff --git a/src/lib/kadm5/unit-test/Makefile.in b/src/lib/kadm5/unit-test/Makefile.in -deleted file mode 100644 -index 68fa097ff..000000000 ---- a/src/lib/kadm5/unit-test/Makefile.in -+++ /dev/null -@@ -1,143 +0,0 @@ --mydir=lib$(S)kadm5$(S)unit-test --BUILDTOP=$(REL)..$(S)..$(S).. --KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS) -- --SRCS= init-test.c destroy-test.c handle-test.c iter-test.c setkey-test.c \ -- randkey-test.c lock-test.c -- --# --# The client-side test programs. --# -- --init-test: init-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o init-test init-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --destroy-test: destroy-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o destroy-test destroy-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-handle-test: client-handle-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-handle-test client-handle-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-handle-test.o: handle-test.c -- $(CC) $(ALL_CFLAGS) -DCLIENT_TEST -o client-handle-test.o -c $(srcdir)/handle-test.c -- --client-iter-test: iter-test.o $(KADMLCNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-iter-test iter-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-setkey-test: setkey-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-setkey-test setkey-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --# --# The server-side test programs. --# -- --randkey-test: randkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o randkey-test randkey-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-handle-test: handle-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-handle-test handle-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --lock-test: lock-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o lock-test lock-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-iter-test: iter-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-iter-test iter-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-setkey-test: setkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-setkey-test setkey-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --runenv.exp: Makefile -- $(RUN_SETUP); for i in $(RUN_VARS); do \ -- eval echo "set env\($$i\) \$$$$i"; done > runenv.exp -- --# --# The unit-test targets --# -- --check: check-@DO_TEST@ -- --check-: -- @echo "+++" -- @echo "+++ WARNING: lib/kadm5 unit tests not run." -- @echo "+++ Either tcl, runtest, or Perl is unavailable." -- @echo "+++" -- --check-ok unit-test: unit-test-client unit-test-server -- --unit-test-client: unit-test-client-setup unit-test-client-body \ -- unit-test-client-cleanup -- --unit-test-server: unit-test-server-setup unit-test-server-body \ -- unit-test-server-cleanup -- --test-randkey: randkey-test -- $(ENV_SETUP) $(VALGRIND) ./randkey-test -- --test-handle-server: server-handle-test -- $(ENV_SETUP) $(VALGRIND) ./server-handle-test -- --test-handle-client: client-handle-test -- $(ENV_SETUP) $(VALGRIND) ./client-handle-test -- --test-noauth: init-test -- $(ENV_SETUP) $(VALGRIND) ./init-test -- --test-destroy: destroy-test -- $(ENV_SETUP) $(VALGRIND) ./destroy-test -- --test-setkey-client: client-setkey-test -- $(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin -- --unit-test-client-setup: runenv.sh -- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) -- --unit-test-client-cleanup: -- $(ENV_SETUP) $(STOP_SERVERS) -- --unit-test-server-setup: runenv.sh -- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL) -- --unit-test-server-cleanup: -- $(ENV_SETUP) $(STOP_SERVERS_LOCAL) -- --unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \ -- test-setkey-client runenv.exp -- $(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \ -- KINIT=$(BUILDTOP)/clients/kinit/kinit \ -- KDESTROY=$(BUILDTOP)/clients/kdestroy/kdestroy \ -- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ -- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ -- $(RUNTESTFLAGS) -- -mv api.log capi.log -- -mv api.sum capi.sum -- --unit-test-server-body: site.exp test-handle-server lock-test -- $(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \ -- LOCKTEST=./lock-test \ -- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ -- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ -- $(RUNTESTFLAGS) -- -mv api.log sapi.log -- -mv api.sum sapi.sum -- --clean: -- $(RM) init-test client_init.o init-test.o -- $(RM) destroy-test destroy-test.o -- $(RM) client-handle-test handle-test.o client-handle-test.o -- $(RM) client-iter-test iter-test.o -- $(RM) randkey-test randkey-test.o -- $(RM) server-handle-test handle-test.o -- $(RM) lock-test lock-test.o -- $(RM) server-iter-test iter-test.o -- $(RM) server-setkey-test client-setkey-test setkey-test.o -- $(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp -diff --git a/src/lib/kadm5/unit-test/api.2/crte-policy.exp b/src/lib/kadm5/unit-test/api.2/crte-policy.exp -deleted file mode 100644 -index 4902ea59f..000000000 ---- a/src/lib/kadm5/unit-test/api.2/crte-policy.exp -+++ /dev/null -@@ -1,927 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --# Description: (1) Fails for mask with undefined bit set. --# 01/24/94: pshuang: untried. --test "create-policy 1" --proc test1 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0xF01000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. --test "create-policy 2" --proc test2 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy"; -- return -- } --} --if {$RPC} { test2 } -- --# Description: (3) Fails for mask without POLICY bit set. --# 01/24/94: pshuang: untried. --test "create-policy 3" --proc test3 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0x000000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --# Description: (5) Fails for invalid policy name. --# 01/24/94: pshuang: untried. --test "create-policy 5" --proc test5 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/"] \ -- {KADM5_POLICY} -- } $test] "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --# Description: (6) Fails for existing policy name. --test "create-policy 6" --proc test6 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy test-pol] \ -- {KADM5_POLICY} -- } "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --# Description: (7) Fails for null policy name. --# 01/24/94: pshuang: untried. --test "create-policy 7" --proc test7 {} { -- global test --# set prms_id 1977 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy null] \ -- {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --# Description: (8) Fails for empty-string policy name. --test "create-policy 8" --proc test8 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy ""] \ -- {KADM5_POLICY} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --# Description: (9) Accepts 0 for pw_min_life. --test "create-policy 9" --proc test9 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test: create failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --# Description: (10) Accepts non-zero for pw_min_life. --test "create-policy 10" --proc test10 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --# Description: (11) Accepts 0 for pw_max_life. --test "create-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --# Description: (12) Accepts non-zero for pw_max_life. --test "create-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --# Description: (13) Rejects 0 for pw_min_length. --test "create-policy 13" --proc test13 {} { -- global test -- global prompt -- -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --# Description: (14) Accepts non-zero for pw_min_length. --test "create-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --# Description: (15) Rejects 0 for pw_min_classes. --test "create-policy 15" --proc test15 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --# Description: (16) Accepts 1 for pw_min_classes. --test "create-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --# Description: (17) Accepts 4 for pw_min_classes. --test "create-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --# Description: (18) Rejects 5 for pw_min_classes. --test "create-policy 18" --proc test18 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --# Description: (19) Rejects 0 for pw_history_num. --test "create-policy 19" --proc test19 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --# Description: (20) Accepts 1 for pw_history_num. --test "create-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --# Description: (21) Accepts 10 for pw_history_num. --test "create-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --# Description: (22) Fails for user with no access bits. --test "create-policy 22" --proc test22 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --# Description: (23) Fails for user with "get" but not "add". --test "create-policy 23" --proc test23 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --# Description: (24) Fails for user with "modify" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 24" --proc test24 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test24 -- --# Description: (25) Fails for user with "delete" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 25" --proc test25 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test25 -- --# Description: Succeeds for user with "add". --test "create-policy 26" --proc test26 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --# Description: Succeeds for user with "get" and "add". --# 01/24/94: pshuang: untried. --test "create-policy 27" --proc test27 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --# Description: (28) Rejects null policy argument. --# 01/24/94: pshuang: untried. --test "create-policy 28" --proc test28 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle null {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-policy 30" --proc test30 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_policy null [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.2/get-policy.exp b/src/lib/kadm5/unit-test/api.2/get-policy.exp -deleted file mode 100644 -index 83aef80e8..000000000 ---- a/src/lib/kadm5/unit-test/api.2/get-policy.exp -+++ /dev/null -@@ -1,199 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-policy 3" --proc test3 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --test "get-policy 6" --proc test6 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test6 -- --test "get-policy 7" --proc test7 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test7 -- --test "get-policy 11" --proc test11 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-policy 12" --proc test12 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin \ -- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_2 server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-policy 15" --proc test15 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "get-policy 16" --proc test16 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "get-policy 17" --proc test17 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "get-policy 18" --proc test18 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test18 -- --test "get-policy 21" --proc test21 {} { -- global test -- -- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" --} --test21 -diff --git a/src/lib/kadm5/unit-test/api.2/mod-policy.exp b/src/lib/kadm5/unit-test/api.2/mod-policy.exp -deleted file mode 100644 -index 904edca8a..000000000 ---- a/src/lib/kadm5/unit-test/api.2/mod-policy.exp -+++ /dev/null -@@ -1,675 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-policy 2" --proc test2 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-policy 8" --proc test8 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_policy $server_handle [simple_policy ""] \ -- {KADM5_PW_MAX_LIFE} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-policy 9" --proc test9 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-policy 10" --proc test10 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0} \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- -- --test "modify-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "modify-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0} \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "modify-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "modify-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0} \ -- {KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "modify-policy 15" --proc test15 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "modify-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-policy 18" --proc test18 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --test "modify-policy 19" --proc test19 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --test "modify-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --test "modify-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --test "modify-policy 22" --proc test22 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --test "modify-policy 23" --proc test23 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --test "modify-policy 26" --proc test26 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-policy 30" --proc test30 {} { -- global test -- -- one_line_fail_test [format { -- kadm5_modify_policy null [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -deleted file mode 100644 -index 740425c69..000000000 ---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -+++ /dev/null -@@ -1,68 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "chpass-principal 200" --proc test200 {} { -- global test prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- # I'd like to specify a long list of keysalt tuples and make sure -- # that chpass does the right thing, but we can only use those -- # enctypes that krbtgt has a key for: the AES enctypes, according to -- # the prototype kdc.conf. -- if {! [cmd [format { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_chpass_principal $server_handle "%s/a" newpassword -- } $test]]} { -- perror "$test: unexpected failure in chpass_principal" -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- } $test]]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- -- # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -- pass "$test" -- } else { -- fail "$test: $num_keys keys, should be 5" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test200 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal.exp -deleted file mode 100644 -index 47a19dc20..000000000 ---- a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp -+++ /dev/null -@@ -1,176 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "chpass-principal 180" --proc test180 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_chpass_principal $server_handle "%s/a" FoobarBax -- } $test] -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test180 } -- --test "chpass-principal 180.5" --proc test1805 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_chpass_principal $server_handle "%s/a" FoobarBax -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test1805 } -- --# --# admin with changepw service tickets try to change other principals --# password, fails with AUTH error --test "chpass-principal 180.625" --proc test180625 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal $server_handle "%s/a" password -- } $test] "AUTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test180625 } -- --test "chpass-principal 180.75" --proc test18075 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal $server_handle "%s/a" Foobar -- } $test] "AUTH_CHANGEPW" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test18075 } -- --test "chpass-principal 182" --proc test182 {} { -- global test -- -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_chpass_principal $server_handle kadmin/history password -- } "PROTECT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test182 -- --test "chpass-principal 183" --proc test183 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal null "%s/a" password -- } $test] "BAD_SERVER_HANDLE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test183 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/crte-policy.exp b/src/lib/kadm5/unit-test/api.current/crte-policy.exp -deleted file mode 100644 -index 7e1eda63f..000000000 ---- a/src/lib/kadm5/unit-test/api.current/crte-policy.exp -+++ /dev/null -@@ -1,927 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --# Description: (1) Fails for mask with undefined bit set. --# 01/24/94: pshuang: untried. --test "create-policy 1" --proc test1 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0xF01000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. --test "create-policy 2" --proc test2 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy"; -- return -- } --} --if {$RPC} { test2 } -- --# Description: (3) Fails for mask without POLICY bit set. --# 01/24/94: pshuang: untried. --test "create-policy 3" --proc test3 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0x000000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --# Description: (5) Fails for invalid policy name. --# 01/24/94: pshuang: untried. --test "create-policy 5" --proc test5 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/"] \ -- {KADM5_POLICY} -- } $test] "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --# Description: (6) Fails for existing policy name. --test "create-policy 6" --proc test6 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy test-pol] \ -- {KADM5_POLICY} -- } "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --# Description: (7) Fails for null policy name. --# 01/24/94: pshuang: untried. --test "create-policy 7" --proc test7 {} { -- global test --# set prms_id 1977 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy null] \ -- {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --# Description: (8) Fails for empty-string policy name. --test "create-policy 8" --proc test8 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy ""] \ -- {KADM5_POLICY} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --# Description: (9) Accepts 0 for pw_min_life. --test "create-policy 9" --proc test9 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test: create failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --# Description: (10) Accepts non-zero for pw_min_life. --test "create-policy 10" --proc test10 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --# Description: (11) Accepts 0 for pw_max_life. --test "create-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --# Description: (12) Accepts non-zero for pw_max_life. --test "create-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --# Description: (13) Rejects 0 for pw_min_length. --test "create-policy 13" --proc test13 {} { -- global test -- global prompt -- -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --# Description: (14) Accepts non-zero for pw_min_length. --test "create-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --# Description: (15) Rejects 0 for pw_min_classes. --test "create-policy 15" --proc test15 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --# Description: (16) Accepts 1 for pw_min_classes. --test "create-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --# Description: (17) Accepts 4 for pw_min_classes. --test "create-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --# Description: (18) Rejects 5 for pw_min_classes. --test "create-policy 18" --proc test18 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --# Description: (19) Rejects 0 for pw_history_num. --test "create-policy 19" --proc test19 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --# Description: (20) Accepts 1 for pw_history_num. --test "create-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --# Description: (21) Accepts 10 for pw_history_num. --test "create-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --# Description: (22) Fails for user with no access bits. --test "create-policy 22" --proc test22 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --# Description: (23) Fails for user with "get" but not "add". --test "create-policy 23" --proc test23 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --# Description: (24) Fails for user with "modify" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 24" --proc test24 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test24 -- --# Description: (25) Fails for user with "delete" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 25" --proc test25 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test25 -- --# Description: Succeeds for user with "add". --test "create-policy 26" --proc test26 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --# Description: Succeeds for user with "get" and "add". --# 01/24/94: pshuang: untried. --test "create-policy 27" --proc test27 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --# Description: (28) Rejects null policy argument. --# 01/24/94: pshuang: untried. --test "create-policy 28" --proc test28 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle null {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-policy 30" --proc test30 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_policy null [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/crte-principal.exp b/src/lib/kadm5/unit-test/api.current/crte-principal.exp -deleted file mode 100644 -index d6d6809ec..000000000 ---- a/src/lib/kadm5/unit-test/api.current/crte-principal.exp -+++ /dev/null -@@ -1,1336 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --#test "create-principal 1" --# --#proc test1 {} { --# global test --# begin_dump --# one_line_fail_test [format { --# kadm5_create_principal $server_handle \ --# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test1 -- --# v2 create-principal 3 test, to avoid name conflict --test "create-principal 1" --proc test1 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} null -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test1 -- --test "create-principal 2" -- --proc test2 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_principal $server_handle null \ -- {KADM5_PRINCIPAL} testpass -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test2 -- --test "create-principal 4" --proc test4 {} { -- global test -- -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} "" -- } $test] "_Q_TOOSHORT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test4 -- --test "create-principal 5" --proc test5 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [simple_principal "%s/a"] {0x100001} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test5 -- --test "create-principal 6" --proc test6 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_PWD_CHANGE} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test6 -- --test "create-principal 7" --proc test7 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_TIME} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test7 -- --test "create-principal 8" --proc test8 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_NAME} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test8 -- --test "create-principal 9" --proc test9 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MKVNO} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test9 -- --test "create-principal 10" --proc test10 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_AUX_ATTRIBUTES} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test10 -- --test "create-principal 11" --proc test11 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test11 -- --test "create-principal 12" --proc test12 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" -- --} --if {$RPC} { test12 } -- --test "create-principal 13" --proc test13 {} { -- global test -- begin_dump -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test13 } -- --test "create-principal 14" --proc test14 {} { -- global test -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test14 } -- --test "create-principal 15" --proc test15 {} { -- global test -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test15 } -- --test "create-principal 16" --proc test16 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test16 } -- --test "create-principal 17" --proc test17 {} { -- global test -- -- begin_dump -- if {! (( [principal_exists "$test/a"]) || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test17 -- --test "create-principal 18" --proc test18 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} tP -- } $test] "_Q_TOOSHORT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test18 -- --test "create-principal 19" --proc test19 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} testpassword -- } $test] "_Q_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test19 -- --test "create-principal 20" --proc test20 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} Abyssinia -- } $test] "_Q_DICT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test20 -- --test "create-principal 21" --proc test21 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" non-existant-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test21 -- --test "create-principal 23" --proc test23 {} { -- global test -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- one_line_succeed_test \ -- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test23 -- --test "create-principal 24" --proc test24 {} { -- global test -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/rename admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- one_line_succeed_test \ -- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test24 } -- -- --test "create-principal 28" --proc test28 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return -- } -- send "lindex \$principal 10\n" -- expect { -- -re "test-pol.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-principal 29" --proc test29 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PRINC_EXPIRE_TIME} \ -- inTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 1\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test29 -- --test "create-principal 30" --proc test30 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "create-principal 31" --proc test31 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol-nopw] \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "create-principal 32" --proc test32 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 0 } { -- fail "$test: pw_expire $pw_expire should be 0" -- return -- } else { -- pass "$test" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test32 -- --test "create-principal 33" --proc test33 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 1234 0 null 0 0 0 0 null 0} \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test33 -- --test "create-principal 34" --proc test34 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- { "%s/a" 0 0 1234 0 null 0 0 0 0 test-pol-nopw 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test34 -- --test "create-principal 35" --proc test35 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 1234 0 null 0 0 0 0 test-pol 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test35 -- --test "create-principal 36" --proc test36 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 999999999 0 null 0 0 0 0 test-pol 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy} ]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 999999999 } { -- fail "$test: pw_expire is wrong" -- return -- } else { -- pass "$test" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test36 -- --test "create-principal 37" --proc test37 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test37 -- --test "create-principal 38" --proc test38 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol-nopw] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test38 -- --test "create-principal 39" --proc test39 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if { ! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: cannot not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { [expr "$mod_date + $pw_max_life - $pw_expire"] > 5 } { -- fail "$test: pw_expire is wrong" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test39 -- --test "create-principal 40" --proc test40 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 4\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test40 -- --test "create-principal 43" --proc test43 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_principal null \ -- [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" -- } $test $test] "BAD_SERVER_HANDLE" --} --test43 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/destroy.exp b/src/lib/kadm5/unit-test/api.current/destroy.exp -deleted file mode 100644 -index a3e2bfc59..000000000 ---- a/src/lib/kadm5/unit-test/api.current/destroy.exp -+++ /dev/null -@@ -1,203 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "destroy 1" -- --proc test1 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_destroy $server_handle} -- end_dump_compare "no-diffs" --} --test1 -- --#test "destroy 2" --# --#proc test2 {} { --# global test --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test \ --# {kadm5_get_principal $server_handle admin principal} \ --# "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test2 -- --#test "destroy 3" --#proc test3 {} { --# global test --# --# begin_dump --# if {! (( ! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { --# error_and_restart "$test couldn't delete principal \"$test/a\"" --# return --# } --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_create_principal $server_handle \ --# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test3 -- --#test "destroy 4" --#proc test4 {} { --# global test prompt --# --# if {! (([principal_exists "$test/a"]) || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! ([cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }] && --# [cmd [format { --# kadm5_get_principal $server_handle "%s/a" principal --# } $test]])} { --# error_and_restart "$test: error getting principal" --# return; --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle \ --# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} --# } $test "77"] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test4 -- --#test "destroy 5" --# --#proc test5 {} { --# global test --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test5 -- --#test "destroy 6" --# --#proc test6 {} { --# global test --# begin_dump --# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test6 -- -- --#test "destroy 7" --# --#proc test7 {} { --# global test --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure in init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test7 -- --test "destroy 8" --proc test8 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } -- end_dump_compare "no-diffs" --} --test8 -- --test "destroy 9" --proc test9 {} { -- global test -- one_line_fail_test {kadm5_destroy null} "BAD_SERVER_HANDLE" --} --test9 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp b/src/lib/kadm5/unit-test/api.current/dlte-policy.exp -deleted file mode 100644 -index ad2863d0f..000000000 ---- a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp -+++ /dev/null -@@ -1,208 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "delete-policy 2" --proc test2 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_delete_policy $server_handle ""} "BAD_POL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "delete-policy 5" --proc test5 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} test5 -- --test "delete-policy 6" --proc test6 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} test6 -- --test "delete-policy 7" --proc test7 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test7 -- --test "delete-policy 10" --proc test10 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test]]} { -- fail "$test" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if { [policy_exists "$test/a"]} { -- fail "$test" -- return -- } --} --test10 -- --test "delete-policy 12" --proc test12 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- "%s/a"] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "delete-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy null "%s/a" -- } $test] "BAD_SERVER_HANDLE" --} --test13 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp b/src/lib/kadm5/unit-test/api.current/dlte-principal.exp -deleted file mode 100644 -index 660468534..000000000 ---- a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp -+++ /dev/null -@@ -1,253 +0,0 @@ --load_lib lib.t -- --api_exit --api_start -- --#test "delete-principal 1" --#proc test1 {} { --# global test --# one_line_fail_test [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test] "NOT_INIT" --#} --#test1 -- --test "delete-principal 2" --proc test2 {} { -- global test -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_delete_principal $server_handle null} "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "delete-principal 5" --proc test5 {} { -- global test -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --test "delete-principal 6" --proc test6 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" test-pol])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test6 } -- -- --test "delete-principal 7" --proc test7 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test7 } -- -- --test "delete-principal 8" --proc test8 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test8 } -- --test "delete-principal 9" --proc test9 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test9 } -- --test "delete-principal 10" --proc test10 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test10 } -- --test "delete-principal 11" --proc test11 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test]]} { -- fail "$test: delete failed" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if { [principal_exists "$test/a"] } { -- fail "$test" -- return -- } --} --test11 -- --test "delete-principal 13" --proc test13 {} { -- global test -- one_line_fail_test [format { -- kadm5_delete_principal null "%s/a" -- } $test] "BAD_SERVER_HANDLE" --} --test13 -- --return "" -- -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/get-policy.exp b/src/lib/kadm5/unit-test/api.current/get-policy.exp -deleted file mode 100644 -index c15ef0ca2..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-policy.exp -+++ /dev/null -@@ -1,199 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-policy 3" --proc test3 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --test "get-policy 6" --proc test6 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test6 -- --test "get-policy 7" --proc test7 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test7 -- --test "get-policy 11" --proc test11 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-policy 12" --proc test12 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin \ -- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-policy 15" --proc test15 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "get-policy 16" --proc test16 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "get-policy 17" --proc test17 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "get-policy 18" --proc test18 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test18 -- --test "get-policy 21" --proc test21 {} { -- global test -- -- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" --} --test21 -diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -deleted file mode 100644 -index 3ea1ba29b..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -+++ /dev/null -@@ -1,250 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-principal 100" --proc test100 {} { -- global test prompt -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd { -- kadm5_get_principal $server_handle testuser p \ -- {KADM5_PRINCIPAL_NORMAL_MASK} -- }]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- send "lindex \$p 17\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_tl" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_tl" -- return -- } -- } -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting key_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting key_data" -- return -- } -- } -- send "lindex \$p 19\n" -- expect { -- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } -- -re "\n$prompt" { set tl_data {} } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- -- set failed 0 -- if {$num_keys != 0} { -- fail "$test: num_keys $num_keys should be 0" -- set failed 1 -- } -- if {$num_tl != 0} { -- fail "$test: num_tl $num_tl should be 0" -- set failed 1 -- } -- if {$key_data != {}} { -- fail "$test: key_data $key_data should be {}" -- set failed 1 -- } -- if {$tl_data != "{}"} { -- fail "$test: tl_data $tl_data should be empty" -- set failed 1 -- } -- if {$failed == 0} { -- pass "$test" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100 -- --proc test101_102 {rpc} { -- global test prompt -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd { -- kadm5_get_principal $server_handle testuser p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- }]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting key_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting key_data" -- return -- } -- } -- -- set failed 0 -- if {$num_keys != 5} { -- fail "$test: num_keys $num_keys should be 5" -- set failed 1 -- } -- for {set i 0} {$i < $num_keys} {incr i} { -- set key "[lindex [lindex $key_data $i] 2]" -- if {($rpc && [string compare $key ""] != 0) || -- ((! $rpc) && [string compare $key ""] == 0)} { -- fail "$test: key_data $key is wrong" -- set failed 1 -- -- } -- } -- if {$failed == 0} { pass "$test" } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test "get-principal 101" --if {$RPC} {test101_102 $RPC} --test "get-principal 102" --if {! $RPC} {test101_102 $RPC} -- --test "get-principal 103" --proc test103 {} { -- global test prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{999 6 foobar}}" \ -- {KADM5_TL_DATA} -- } $test $test]]} { -- fail "$test: cannot set TL_DATA" -- return -- } -- -- if {! [cmd [format { -- kadm5_get_principal $server_handle {%s/a} p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} -- } $test]]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 17\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_tl" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_tl" -- return -- } -- } -- send "lindex \$p 19\n" -- expect { -- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } -- -re "\n$prompt" { set tl_data {} } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- -- if {$num_tl == 0} { -- fail "$test: num_tl $num_tl should not be 0" -- } elseif {$tl_data == "{{999 6 foobar}}"} { -- pass "$test" -- } else { -- fail "$test: tl_data $tl_data should be {{999 6 foobar}}" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test103 -- --return "" -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/get-principal.exp b/src/lib/kadm5/unit-test/api.current/get-principal.exp -deleted file mode 100644 -index a33fdfe8c..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-principal.exp -+++ /dev/null -@@ -1,346 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-principal 1" --proc test1 {} { -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_get_principal $server_handle null p KADM5_PRINCIPAL_NORMAL_MASK} "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --test "get-principal 2" --proc test2 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "get-principal 3" --proc test3 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test3 } -- --test "get-principal 4" --proc test4 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test4 } -- --test "get-principal 5" --proc test5 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test5 } -- --test "get-principal 6" --proc test6 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test6 } -- --test "get-principal 7" --proc test7 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test7 } -- -- --test "get-principal 8" --proc test8 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test8 } -- -- --test "get-principal 9" --proc test9 {} { -- global test -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "get-principal 10" --proc test10 {} { -- global test -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --test "get-principal 11" --proc test11 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-principal 12" --proc test12 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-principal 13" --proc test13 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "get-principal 14" --proc test14 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get-mod admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "get-principal 15" --proc test15 {} { -- one_line_fail_test \ -- {kadm5_get_principal null "admin" p KADM5_PRINCIPAL_NORMAL_MASK} "BAD_SERVER_HANDLE" --} --test15 -- --return "" -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/unit-test/api.current/init-v2.exp -deleted file mode 100644 -index 47764c212..000000000 ---- a/src/lib/kadm5/unit-test/api.current/init-v2.exp -+++ /dev/null -@@ -1,506 +0,0 @@ --load_lib lib.t -- --api_exit --api_start -- --proc get_hostname { } { -- global hostname -- -- if {[info exists hostname]} { -- return 1 -- } -- -- catch "exec hostname >myname" exec_output -- if ![string match "" $exec_output] { -- send_log "$exec_output\n" -- verbose $exec_output -- send_error "ERROR: can't get hostname\n" -- return 0 -- } -- set file [open myname r] -- if { [ gets $file hostname ] == -1 } { -- send_error "ERROR: no output from hostname\n" -- return 0 -- } -- close $file -- catch "exec rm -f myname" exec_output -- -- set hostname [string tolower $hostname] -- verbose "hostname: $hostname" -- -- return 1 --} -- -- --test "init 101" --proc test101 {} { -- global test -- global hostname -- -- get_hostname -- tcl_cmd "set hostname $hostname" -- -- # XXX Fix to work with a remote TEST_SERVER. For now, make sure -- # it fails in that case. -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 1751]] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 4]] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "RPC_ERROR" --} --if {$RPC} test101 -- --test "init 102" --proc test102 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER} does.not.exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "CANT_RESOLVE" --} --if {$RPC} test102 -- --test "init 103" --proc test103 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_DBNAME} /does-not-exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "ENOENT" --} --#if {! $RPC} test103 --if {! $RPC} { -- send_user "UNTESTED: test103: test needs updating for DAL changes (see MIT RT ticket 3202)\n" -- untested "test103: test needs updating for DAL changes (see MIT RT ticket 3202)" --} -- -- --test "init 106" --proc test106 {} { -- global test prompt -- -- set prompting 0 -- send [string trim { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MKEY_FROM_KBD} 1] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }] -- send "\n" -- expect { -- -re "\n\[^\n\]+:\[^\n\]*$" { set prompting 1} -- -re "\nOK .*$prompt$" { fail "$test: premature success" } -- -re "\nERROR .*$prompt$" { fail "$test: premature failure" } -- timeout { fail "$test: timeout" } -- eof { fail "$test: eof" } -- } -- if {$prompting} { -- one_line_succeed_test mrroot -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} test106 -- --test "init 107" --proc test107 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_STASH_FILE} /does-not-exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KDB_CANTREAD_STORED" --} --if {! $RPC} test107 -- --test "init 108" --proc test108 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MKEY_NAME} does/not/exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_KDB_CANTREAD_STORED" --} --if {! $RPC} test108 -- --test "init 109-113" --proc test109 {} { -- global test prompt -- -- delete_principal "$test/a" -- -- # I'd like to specify flags explicitly and check them, as in the -- # following config_params, but tcl gets mighty confused if I do and -- # I have no idea why. --# [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_FLAGS KADM5_CONFIG_ENCTYPES} {10 20 30 KRB5_KDB_DISALLOW_TGT_BASED {}} ] -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_ENCTYPES} {10 20 30 {}} ] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- fail "$test: cannot init with max_life" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- } $test]]} { -- fail "$test: can not get principal" -- return; -- } -- send "puts \$p\n" -- expect { -- -re "$prompt" { } -- timeout { -- error_and_restart "$test: timeout getting prompt" -- return -- } -- eof { -- error_and_restart "$test: eof getting prompt" -- return -- } -- } -- send "lindex \$p 4\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_life" -- return -- } -- } -- send "lindex \$p 12\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_rlife $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_rlife" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_rlife" -- return -- } -- } -- send "lindex \$p 1\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set expiration $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting expiration" -- return -- } -- eof { -- error_and_restart "$test: eof getting expiration" -- return -- } -- } -- send "lindex \$p 7\n" -- expect { -- -re "(\[A-Z_\]*)\n$prompt" {set flags $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting flags" -- return -- } -- eof { -- error_and_restart "$test: eof getting flags" -- return -- } -- } -- # This sorta worries me. Since the test is setting ENCTYPES to -- # nothing, the principal has no keys. That means that nothing is -- # printed for the keys in the correct case; but it feels too -- # likely that nothing will be printed in the case of some problem. -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting flags" -- return -- } -- eof { -- error_and_restart "$test: eof getting flags" -- return -- } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if {$max_life == 10} { -- pass "$test" -- } else { -- fail "$test: $max_life is not 10" -- } -- if {$max_rlife == 20} { -- pass "$test" -- } else { -- fail "$test: $max_rlife is not 20" -- } -- if {$expiration == 30} { -- pass "$test" -- } else { -- fail "$test: $expiration is not 30" -- } -- if {$flags == ""} { -- pass "$test" -- } else { -- fail "$test: flags $flags are wrong" -- } -- if {$key_data == {}} { -- pass "$test" -- } else { -- fail "$test: key_data $key_data is wrong" -- } --} --if {! $RPC} test109 -- --test "init 116" --proc test116 {} { -- global test -- -- delete_principal "$test/a" -- -- if {! [cmd {kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- get_add_handle}]} { -- error_and_restart "$test: couldn't init with admin/get-add" -- } -- -- if {! [cmd {kadm5_init admin/mod-delete admin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- mod_delete_handle}]} { -- error_and_restart "$test: couldn't init with admin/get-add" -- } -- -- one_line_succeed_test { -- kadm5_get_principal $get_add_handle testuser p \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } -- one_line_succeed_test [format { -- kadm5_create_principal $get_add_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] -- one_line_fail_test { -- kadm5_modify_principal $get_add_handle [simple_principal testuser] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } "AUTH_MODIFY" -- one_line_fail_test { -- kadm5_delete_principal $get_add_handle testuser -- } "AUTH_DELETE" -- -- one_line_fail_test { -- kadm5_get_principal $mod_delete_handle testuser p \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } "AUTH_GET" -- one_line_fail_test [format { -- kadm5_create_principal $mod_delete_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- one_line_succeed_test { -- kadm5_modify_principal $mod_delete_handle [simple_principal testuser] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } -- one_line_succeed_test [format { -- kadm5_delete_principal $mod_delete_handle "%s/a" -- } $test] -- -- if {! [cmd {kadm5_destroy $get_add_handle}]} { -- error_and_restart "$test: couldn't close get_add_handle" -- } -- if {! [cmd {kadm5_destroy $mod_delete_handle}]} { -- error_and_restart "$test: couldn't close mod_delete_handle" -- } --} --if {$RPC} test116 -- --test "init 117" --proc test117 {} { -- global test env prompt -- -- if {[catch "exec grep max_life $env(KRB5_KDC_PROFILE)"] != 1} { -- warning \ -- "$test: max_life in $env(KRB5_KDC_PROFILE), cannot perform test" -- return -- } -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- fail "$test: unexpected failure in init" -- return -- } -- -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} "%s/a" -- } $test $test]]} { -- perror "$test: unexpected failure creating principal" -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_MAX_LIFE -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_life" -- return -- } -- } -- -- if {$max_life == 86400} { -- pass "$test" -- } else { -- fail "$test: max_life $max_life should be 86400" -- } -- -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close server_handle" -- } --} --test117 -- --send "puts \$KADM5_ADMIN_SERVICE\n" --expect { -- -re "(\[a-zA-Z/@\]+)\n$prompt" { -- set KADM5_ADMIN_SERVICE $expect_out(1,string) -- } -- default { -- error_and_restart "$test: timeout/eof getting admin_service" -- return -- } --} -- --send "puts \$KADM5_CHANGEPW_SERVICE\n" --expect { -- -re "(\[a-zA-Z/@\]+)\n$prompt" { -- set KADM5_CHANGEPW_SERVICE $expect_out(1,string) -- } -- default { -- error_and_restart "$test: timeout/eof getting changepw_service" -- return -- } --} -- --test "init 150" --proc test150 {} { -- global test KADM5_ADMIN_SERVICE -- -- kdestroy -- kinit testuser notathena "-S $KADM5_ADMIN_SERVICE" -- one_line_succeed_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- kdestroy --} --if {$RPC} test150 -- --test "init 151" --proc test151 {} { -- global test KADM5_CHANGEPW_SERVICE -- -- kdestroy -- kinit testuser notathena "-S $KADM5_CHANGEPW_SERVICE" -- one_line_succeed_test { -- kadm5_init_with_creds testuser null $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- kdestroy --} --if {$RPC} test151 -- --test "init 152" --proc test152 {} { -- global test KADM5_ADMIN_SERVICE -- -- kdestroy -- one_line_fail_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_FCC_NOFILE" --} --if {$RPC} test152 -- --test "init 153" --proc test153 {} { -- global test KADM5_ADMIN_SERVICE -- -- kinit testuser notathena -- one_line_fail_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_CC_NOTFOUND" --} --if {$RPC} test153 -- --test "init 154" --proc test154 {} { -- global test env -- -- set orig $env(KRB5_KDC_PROFILE) -- set env(KRB5_KDC_PROFILE) /does-not-exist -- api_exit; api_start -- set env(KRB5_KDC_PROFILE) $orig -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "ENOENT" -- -- api_exit; lib_start_api --} --if {0 && ! $RPC} test154 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/unit-test/api.current/init.exp -deleted file mode 100644 -index 8390b9cfa..000000000 ---- a/src/lib/kadm5/unit-test/api.current/init.exp -+++ /dev/null -@@ -1,699 +0,0 @@ --load_lib lib.t -- --# Assumptions: --# --# Principal "admin" exists, with "get", "add", "modify" and "delete" --# access bits and password "admin". --# The string "not-the-password" isn't the password of any user in the database. --# Database master password is "mrroot". -- --api_exit --api_start --test "init 1" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {""}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 2" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {@}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 2.5" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {BAD.REALM}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 3" -- --proc test3 {} { -- global test -- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- one_line_fail_test_nochk [format { -- kadm5_init admin admin "%s/a" null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } $test] --} --if {$RPC} { test3 } -- --test "init 4" -- --proc test4 {} { -- global test -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- one_line_fail_test_nochk [format { -- kadm5_init admin admin "%s/a" null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test4 } -- --test "init 5" -- --if {$RPC} { -- one_line_fail_test_nochk { -- kadm5_init admin admin admin null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } --} -- --test "init 6" -- --proc test6 {} { -- global test -- -- send "kadm5_init admin null \$KADM5_ADMIN_SERVICE null \$KADM5_STRUCT_VERSION \$KADM5_API_VERSION_3 server_handle\n" -- -- expect { -- -re "assword\[^\r\n\]*:" { } -- eof { -- fail "$test: eof instead of password prompt" -- api_exit -- api_start -- return -- } -- timeout { -- fail "$test: timeout instead of password prompt" -- return -- } -- } -- one_line_succeed_test "admin" -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if { $RPC } { test6 } -- --test "init 8" -- --proc test8 {} { -- global test -- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test8 } -- --test "init 9" -- --if {$RPC} { -- global test -- one_line_fail_test_nochk { -- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} -- --test "init 10" -- --proc test10 {} { -- global test --# set prms_id 562 --# setup_xfail {*-*-*} $prms_id -- one_line_fail_test_nochk { -- kadm5_init null admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} --test10 -- --#test "init 11" --# --#proc test11 {} { --# global test --# set prms_id 563 --# setup_xfail {*-*-*} $prms_id --# one_line_fail_test_nochk { --# kadm5_init "" admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# } --#} --#test11 -- --test "init 12" -- --proc test12 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test12 } -- --test "init 13" -- --proc test13 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a@SECURE-TEST.OV.COM" admin \ -- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } $test] --} --if {$RPC} { test13 } -- --test "init 14" -- --proc test14 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a@BAD.REALM" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test14 } -- --test "init 15" -- --if {$RPC} { -- one_line_fail_test_nochk { -- kadm5_init admin@BAD.REALM admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} -- --test "init 16" -- --proc test16 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test16 -- --test "init 17" -- --proc test17 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin@SECURE-TEST.OV.COM admin \ -- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test17 -- --test "init 18" -- --proc test18 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test18 -- --test "init 19" -- --proc test19 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin@SECURE-TEST.OV.COM admin \ -- $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {SECURE-TEST.OV.COM}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test19 -- --test "init 20" -- --proc test20 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: couldn't init database" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin principal KADM5_PRINCIPAL_NORMAL_MASK} -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test20 -- --#test "init 21" --# --#proc test21 {} { --# global test --# if {! [cmd { --# kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# error_and_restart "$test: couldn't init database" --# return --# } --# one_line_fail_test_nochk { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --#} --#test21 -- -- --# proc test22 {} { --# global test prompt --# set prompting 0 --# send [string trim { --# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ --# $KADM5_API_VERSION_3 server_handle --# }] --# send "\n" --# expect { --# -re ":$" { set prompting 1} --# -re "\nOK .*$prompt$" { fail "$test: premature success" } --# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } --# timeout { fail "$test: timeout" } --# eof { fail "$test: eof" } --# } --# if {$prompting} { --# one_line_succeed_test mrroot --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# } --# if {! $RPC} { test22 } --# --# test "init 22.5" --# proc test225 {} { --# global test prompt --# set prompting 0 --# send [string trim { --# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ --# $KADM5_API_VERSION_3 server_handle --# }] --# send "\n" --# expect { --# -re ":$" { set prompting 1} --# -re "\nOK .*$prompt$" { fail "$test: premature success" } --# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } --# timeout { fail "$test: timeout" } --# eof { fail "$test: eof" } --# } --# if {$prompting} { --# one_line_succeed_test mrroot --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# } --# if {! $RPC} { test225 } -- --test "init 23" -- --proc test23 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test23 } -- --test "init 24" -- --proc test24 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin null null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test24 } -- --test "init 25" -- --proc test25 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin foobar null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test25 } -- --test "init 26" -- --#proc test26 {} { --# global test --# --# api_exit --# api_start --# one_line_fail_test_nochk { --# kadm5_get_principal $server_handle admin principal --# } --#} --#test26 -- --#test "init 27" --# --#proc test27 {} { --# global test --# --# if {! ((! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { --# error_and_restart "$test: couldn't delete principal \"$test/a\"" --# return --# } --# begin_dump --# if {[cmd [format { --# kadm5_create_principal $server_handle [simple_principal \ --# "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test]]} { --# fail "$test: unexpected success in add" --# return --# } --# end_dump_compare "no-diffs" --#} --#test27 -- --#test "init 28" --# --#proc test28 {} { --# global test prompt --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! ([cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }] && [cmd [format { --# kadm5_get_principal $server_handle "%s/a" principal --# } $test]])} { --# error_and_restart "$test: error getting principal" --# return; --# } --# send "lindex \$principal 8\n" --# expect { --# -re "\n(\[0-9\]+).*$prompt$" {set kvno $expect_out(1,string) } --# timeout { --# error_and_restart "$test: timeout getting principal kvno" --# return --# } --# eof { --# error_and_restart "$test: eof getting principal kvno" --# return --# } --# } --# api_exit --# api_start --# set new_kvno [expr "$kvno + 1"] --# if {[cmd [format { --# kadm5_modify_principal $server_handle \ --# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} --# } $test $new_kvno]]} { --# fail "$test: unexpected success in modify" --# return; --# } --# end_dump_compare "no-diffs" --#} --#test28 -- --#test "init 29" --# --#proc test29 {} { --# global test --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {[cmd [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test]]} { --# fail "$test: unexpected success in delete" --# return --# } --# end_dump_compare "no-diffs" --#} --#test29 -- --test "init 30" --proc test30 {} { -- global test -- if {[cmd { -- kadm5_init admin foobar $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: unexpected success" -- return -- } -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if ${RPC} { test30 } -- --test "init 31" --proc test31 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $bad_struct_version_mask $KADM5_API_VERSION_3 \ -- server_handle -- } "BAD_STRUCT_VERSION" --} --test31 -- --test "init 32" --proc test32 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $no_struct_version_mask $KADM5_API_VERSION_3 \ -- server_handle -- } "BAD_STRUCT_VERSION" --} --test32 -- --test "init 33" --proc test33 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $old_struct_version $KADM5_API_VERSION_3 \ -- server_handle -- } "OLD_STRUCT_VERSION" --} --test33 -- --test "init 34" --proc test34 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $new_struct_version $KADM5_API_VERSION_3 \ -- server_handle -- } "NEW_STRUCT_VERSION" --} --test34 -- --test "init 35" --proc test35 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $bad_api_version_mask \ -- server_handle -- } "BAD_API_VERSION" --} --test35 -- --test "init 36" --proc test36 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $no_api_version_mask \ -- server_handle -- } "BAD_API_VERSION" --} --test36 -- --test "init 37" --proc test37 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $old_api_version \ -- server_handle -- } "OLD_LIB_API_VERSION" --} --if { $RPC } test37 -- --test "init 38" --proc test38 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $old_api_version \ -- server_handle -- } "OLD_SERVER_API_VERSION" --} --if { ! $RPC } test38 -- --test "init 39" --proc test39 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $new_api_version \ -- server_handle -- } "NEW_LIB_API_VERSION" --} --if { $RPC } test39 -- --test "init 40" --proc test40 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $new_api_version \ -- server_handle -- } "NEW_SERVER_API_VERSION" --} --if { ! $RPC } test40 -- --test "init 41" --proc test41 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_API_VERSION_3 $KADM5_STRUCT_VERSION \ -- server_handle -- } "BAD_" --} --test41 -- --test "init 42" --proc test42 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test42 -- -- --proc test45_46 {service} { -- global test kadmin_local env -- -- spawn $kadmin_local -q "delprinc -force $service" -- expect { -- -re "Principal .* deleted." {} -- default { -- perror "kadmin.local delprinc failed\n"; -- } -- } -- expect eof -- wait -- -- one_line_fail_test [concat {kadm5_init admin admin } \ -- $service \ -- { null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle}] "SECURE_PRINC_MISSING" -- -- # this leaves the keytab with an incorrect entry -- spawn $kadmin_local -q "ank -randkey $service" -- expect eof -- wait -- -- # restart the api so it gets a new ccache -- api_exit -- api_start --} -- --if {$RPC} { -- test "init 45" -- -- test45_46 kadmin/admin -- -- test "init 46" -- -- test45_46 kadmin/changepw --} -- --return "" -- -diff --git a/src/lib/kadm5/unit-test/api.current/mod-policy.exp b/src/lib/kadm5/unit-test/api.current/mod-policy.exp -deleted file mode 100644 -index 1bf00b524..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-policy.exp -+++ /dev/null -@@ -1,711 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-policy 2" --proc test2 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-policy 8" --proc test8 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_policy $server_handle [simple_policy ""] \ -- {KADM5_PW_MAX_LIFE} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-policy 9" --proc test9 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-policy 10" --proc test10 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0 0 0 0} \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- -- --test "modify-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "modify-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0 0 0 0} \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "modify-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "modify-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0 0 0 0} \ -- {KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "modify-policy 15" --proc test15 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "modify-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-policy 18" --proc test18 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --test "modify-policy 19" --proc test19 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --test "modify-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0 0 0 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --test "modify-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0 0 0 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --test "modify-policy 22" --proc test22 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --test "modify-policy 23" --proc test23 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --test "modify-policy 26" --proc test26 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-policy 30" --proc test30 {} { -- global test -- -- one_line_fail_test [format { -- kadm5_modify_policy null [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --test "modify-policy 31" --proc test31 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 0 0 2 0 0} \ -- {KADM5_PW_MAX_FAILURE} -- } $test] -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 90 0} \ -- {KADM5_PW_FAILURE_COUNT_INTERVAL} -- } $test] -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 180} \ -- {KADM5_PW_LOCKOUT_DURATION} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp -deleted file mode 100644 -index 4abbeb52d..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp -+++ /dev/null -@@ -1,115 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-principal 100-105" --proc test100_104 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- set origtest "$test" -- -- test "modify-principal 100" -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MAX_RLIFE} -- } $origtest] -- -- test "modify-principal 101" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_SUCCESS} -- } $origtest] "BAD_MASK" -- -- test "modify-principal 102" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_FAILED} -- } $origtest] "BAD_MASK" -- --# This is now permitted to reset lockout count --# test "modify-principal 103" --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ --# {KADM5_FAIL_AUTH_COUNT} --# } $origtest] "BAD_MASK" -- -- test "modify-principal 103.5" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_KEY_DATA} -- } $origtest] "BAD_MASK" -- -- test "modify-principal 105" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{1 1 x}}" \ -- {KADM5_TL_DATA} -- } $origtest $origtest] "BAD_TL_TYPE" -- -- test "modify-principal 100,104" -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 88 0 0 0 0 1 {} {{990 6 foobar}}" \ -- {KADM5_MAX_RLIFE KADM5_TL_DATA} -- } $origtest $origtest]]} { -- fail "$test: cannot set MAX_RLIFE or TL_DATA" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} -- } $origtest]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 12\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set rlife $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting rlife" -- return -- } -- eof { -- error_and_restart "$test: eof getting rlife" -- return -- } -- } -- send "lindex \$principal 19\n" -- expect { -- -re "\(\{.*\}\)\n$prompt$" {set tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- if {($rlife == 88) && ($tl == "{{990 6 foobar}}")} { -- pass "$test" -- } else { -- fail "$test: $rlife should be 88, $tl should be {{990 6 foobar}}" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100_104 -diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal.exp b/src/lib/kadm5/unit-test/api.current/mod-principal.exp -deleted file mode 100644 -index ac9f96845..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-principal.exp -+++ /dev/null -@@ -1,1606 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --#test "modify-principal 1" --#proc test1 {} { --# global test --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle [simple_principal \ --# "%s/a"] {KADM5_PW_EXPIRATION} --# } $test] "NOT_INIT" --#} --#test1 -- --test "modify-principal 2" --proc test2 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-principal 4" --proc test4 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test4 -- -- --test "modify-principal 5" --proc test5 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_PWD_CHANGE} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --test "modify-principal 6" --proc test6 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_TIME} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --test "modify-principal 7" --proc test7 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_NAME} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --test "modify-principal 8" --proc test8 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MKVNO} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-principal 9" --proc test9 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_AUX_ATTRIBUTES} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-principal 10" --proc test10 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --test "modify-principal 11" --proc test11 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test11 } -- --test "modify-principal 12" --proc test12 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test12 } -- --test "modify-principal 13" --proc test13 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test13 } -- --test "modify-principal 14" --proc test14 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test14 } -- --test "modify-principal 15" --proc test15 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-principal 17" --proc test17 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- no-policy] {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-principal 21.5" --proc test21.5 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal_pol "$test/a" "test-pol"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol old_p1}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$old_p1 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set old_p1_ref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- -- if { ! [cmd {kadm5_get_policy $server_handle test-pol new_p1}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- -- send "lindex \$new_p1 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set new_p1_ref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- -- if {$old_p1_ref != $new_p1_ref} { -- fail "$test: policy reference count changed ($old_p1_ref to $new_p1_ref)" -- return -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21.5 -- --test "modify-principal 22" --proc test22 {} { -- global test -- global prompt -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test22 -- --test "modify-principal 23" --proc test23 {} { -- global test -- global prompt -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" test-pol-nopw])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test23 -- --test "modify-principal 24" --proc test24 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: could not modify principal" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd [format { -- kadm5_get_policy $server_handle %s policy -- } test-pol]]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 0 } { -- fail "$test: pw_expire $pw_expire should be 0" -- return -- } else { -- pass "$test" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test24 -- --test "modify-principal 25" --proc test25 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test25 -- --test "modify-principal 26" --proc test26 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol-nopw" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-principal 27" --proc test27 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --test "modify-principal 28" --proc test28 {} { -- global test -- global prompt --# set prms_id 1358 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 999999999 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 999999999 } { -- fail "$test: pw_expire $pw_expire should be 999999999" -- return -- } -- pass "$test" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "modify-principal 29" --proc test29 {} { -- global test -- global prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { ! ([create_principal_pol "$test/a" test-pol])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test29 -- --test "modify-principal 30" --proc test30 {} { -- global test -- global prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal_pol "$test/a" test-pol])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol-nopw] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "modify-principal 31" --proc test31 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { [expr "$pw_mod_date + $pw_max_life"] != $pw_expire } { -- fail "$test: pw_expire is wrong" -- return -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "modify-principal 32" --proc test32 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 1234 0 0 0 0 0 0 0 0 0 0} \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 1\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test32 -- --test "modify-principal 33" --proc test33 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_ALL_TIX 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_DISALLOW_ALL_TIX.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test33 -- --test "modify-principal 33.25" --proc test3325 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_REQUIRES_PWCHANGE 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_REQUIRES_PWCHANGE.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3325 -- --test "modify-principal 33.5" --proc test335 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_TGT_BASED 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_DISALLOW_TGT_BASED.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test335 -- -- --test "modify-principal 34" --proc test34 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 3456 0 0 0 0 0 0 0} {KADM5_MAX_LIFE} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "3456\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test34 -- --test "modify-principal 35" --proc test35 {} { -- global prompt -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 0 7 0 0 0} {KADM5_KVNO} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 8\n" -- expect { -- -re "7\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test35 -- --test "modify-principal 36" --proc test36 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal_pol "$test/a" "test-pol"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 10\n" -- expect { -- -re "test-pol\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- send "lindex \$pol 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set oldref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol2}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- send "lindex \$pol2 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set newref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- if { $oldref != $newref } { -- fail "$test: policy reference count is wrong" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test36 -- --test "modify-principal 37" --proc test37 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal "$test/a"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test37 -- --test "modify-principal 38" --proc test38 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test38 -- --test "modify-principal 39" --proc test39 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MAX_LIFE} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test39 -- --test "modify-principal 40" --proc test40 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_principal $server_handle null \ -- {KADM5_PRINC_EXPIRE_TIME} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test40 -- --test "modify-principal 43" --proc test43 {} { -- global test -- one_line_fail_test [format { -- kadm5_modify_principal null [simple_principal \ -- "%s/a"] {KADM5_PW_EXPIRATION} -- } $test] "BAD_SERVER_HANDLE" --} --test43 -- --test "modify-principal 44" --proc test44 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- # setting fail auth count to a non-zero value must fail -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1234 0 0 {} {}} {KADM5_FAIL_AUTH_COUNT} -- } $test] "BAD_SERVER_PARAMS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test44 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -deleted file mode 100644 -index 2925c1c43..000000000 ---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -+++ /dev/null -@@ -1,61 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "randkey-principal 100" --proc test100 {} { -- global test prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- # I'd like to specify a long list of keysalt tuples and make sure that -- # randkey does the right thing, but we can only use those enctypes that -- # krbtgt has a key for: 3DES and AES, according to the prototype kdc.conf. -- if {! [cmd [format { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test]]} { -- perror "$test: unexpected failure in randkey_principal" -- } -- send "puts \$num_keys\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- -- # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -- pass "$test" -- } else { -- fail "$test: $num_keys keys, should be 5" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal.exp -deleted file mode 100644 -index 1484901fa..000000000 ---- a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp -+++ /dev/null -@@ -1,297 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "randkey-principal 1" --proc test1 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "PASS_TOOSOON" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test1 } -- --test "randkey-principal 3" --proc test3 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "PASS_TOOSOON" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} { test3 } -- --test "randkey-principal 13" --proc test13 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- once-a-min] KADM5_POLICY -- } $test]]} { -- perror "$test: failed modify" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "randkey-principal 15" --proc test15 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "AUTH_CHANGEPW" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test15 } -- --test "randkey-principal 28" --proc test28 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "randkey-principal 28.25" --proc test2825 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "AUTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2825 } -- --test "randkey-principal 28.5" --proc test285 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test285 -- --test "randkey-principal 30" --proc test30 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "randkey-principal 31" --proc test31 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "randkey-principal 33" --proc test33 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal null "%s/a" keys num_keys -- } $test] "BAD_SERVER_HANDLE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} -- --test33 -- --return "" -diff --git a/src/lib/kadm5/unit-test/config/unix.exp b/src/lib/kadm5/unit-test/config/unix.exp -deleted file mode 100644 -index d7706ec53..000000000 ---- a/src/lib/kadm5/unit-test/config/unix.exp -+++ /dev/null -@@ -1,222 +0,0 @@ --source runenv.exp -- --set prompt "% " --set stty_init {-onlcr -opost intr \^C kill \^U} --set kadmin_local $KADMIN_LOCAL -- --# Backward compatibility until we're using expect 5 everywhere --if {[info exists exp_version_4]} { -- global wait_error_index wait_errno_index wait_status_index -- set wait_error_index 0 -- set wait_errno_index 1 -- set wait_status_index 1 --} else { -- set wait_error_index 2 -- set wait_errno_index 3 -- set wait_status_index 3 --} -- --if { [string length $VALGRIND] } { -- rename spawn valgrind_aux_spawn -- proc spawn { args } { -- global VALGRIND -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- # Only run valgrind for local programs, not -- # system ones. --#&&![string match "/bin/sh" $arg] sh is used to start kadmind! -- if [string match "/" [string index $arg 0]]&&![string match "/bin/ls" $arg]&&![regexp {/kshd$} $arg] { -- set newargs [concat $newargs $VALGRIND] -- } -- } -- lappend newargs $arg -- } -- set pid [eval valgrind_aux_spawn $newargs] -- return $pid -- } --} -- --# Hack around Solaris 9 kernel race condition that causes last output --# from a pty to get dropped. --if { $PRIOCNTL_HACK } { -- catch {exec priocntl -s -c FX -m 30 -p 30 -i pid [getpid]} -- rename spawn oldspawn -- proc spawn { args } { -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- set newargs [concat $newargs {priocntl -e -c FX -p 0}] -- } -- lappend newargs $arg -- } -- set pid [eval oldspawn $newargs] -- return $pid -- } --} -- --# Variables for keeping track of api process state --set api_pid "0" -- --proc api_exit {} { -- global spawn_id -- global api_pid -- --# puts stdout "Starting api_exit (spawn_id $spawn_id)." -- catch {close} errMsg -- catch {wait} errMsg --# puts stdout "Finishing api_exit for $api_pid." -- set api_pid "0" --} -- --proc api_isrunning {pid} { -- global api_pid -- --# puts stdout "testing $pid, api_pid is $api_pid" -- if {$pid == $api_pid} { -- return 1; -- } else { -- return 0; -- } --} -- --proc api_version {} { --} -- --proc api_start {} { -- global API -- global env -- global spawn_id -- global prompt -- global api_pid -- -- set pid [spawn $API] -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- if {! [info exists env(TCLUTIL)]} { -- perror "TCLUTIL environment variable isn't set" -- } -- # tcl 8.4 for some reason screws up autodetection of output -- # EOL translation. Work around it for now. -- send "if { \[info commands fconfigure\] ne \"\" } { fconfigure stdout -translation lf }\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- send "source $env(TCLUTIL)\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- send "set current_struct_version \[expr \$KADM5_STRUCT_VERSION &~ \$KADM5_STRUCT_VERSION_MASK\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set current_api_version \[expr \$KADM5_API_VERSION_3 &~ \$KADM5_API_VERSION_MASK\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set bad_struct_version_mask \[expr 0x65432100 | \$current_struct_version\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set bad_api_version_mask \[expr 0x65432100 | \$current_api_version\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set no_api_version_mask \$current_api_version\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set no_struct_version_mask \$current_struct_version\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set old_api_version \[expr \$KADM5_API_VERSION_MASK | 0x00\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set old_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0x00\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set new_api_version \[expr \$KADM5_API_VERSION_MASK | 0xca\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set new_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0xca\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- -- set api_pid $pid --# puts stdout "Finishing api_start (spawn_id $spawn_id, pid $api_pid)." -- return $pid --} --api_start -- -diff --git a/src/lib/kadm5/unit-test/deps b/src/lib/kadm5/unit-test/deps -deleted file mode 100644 -index cf54f475b..000000000 ---- a/src/lib/kadm5/unit-test/deps -+++ /dev/null -@@ -1,86 +0,0 @@ --# --# Generated makefile dependencies follow. --# --$(OUTPRE)init-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h init-test.c --$(OUTPRE)destroy-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/admin_internal.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/client_internal.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h destroy-test.c --$(OUTPRE)handle-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/kadm5/server_internal.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/plugin.h \ -- handle-test.c --$(OUTPRE)iter-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h iter-test.c --$(OUTPRE)setkey-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- setkey-test.c --$(OUTPRE)randkey-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h randkey-test.c --$(OUTPRE)lock-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h lock-test.c -diff --git a/src/lib/kadm5/unit-test/destroy-test.c b/src/lib/kadm5/unit-test/destroy-test.c -deleted file mode 100644 -index 738cfeb86..000000000 ---- a/src/lib/kadm5/unit-test/destroy-test.c -+++ /dev/null -@@ -1,48 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#define TEST_NUM 25 -- --int main() --{ -- kadm5_ret_t ret; -- char *cp; -- int x; -- void *server_handle; -- kadm5_server_handle_t handle; -- krb5_context context; -- -- ret = kadm5_init_krb5_context(&context); -- if (ret != 0) { -- com_err("test", ret, "context init"); -- exit(2); -- } -- for(x = 0; x < TEST_NUM; x++) { -- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, 0, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- handle = (kadm5_server_handle_t) server_handle; -- cp = strdup(strchr(handle->cache_name, ':') + 1); -- kadm5_destroy(server_handle); -- if(access(cp, F_OK) == 0) { -- puts("ticket cache not destroyed"); -- exit(2); -- } -- free(cp); -- } -- krb5_free_context(context); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/diff-files/destroy-1 b/src/lib/kadm5/unit-test/diff-files/destroy-1 -deleted file mode 100644 -index 593d67320..000000000 ---- a/src/lib/kadm5/unit-test/diff-files/destroy-1 -+++ /dev/null -@@ -1,2 +0,0 @@ --##! nochanges -- -diff --git a/src/lib/kadm5/unit-test/diff-files/no-diffs b/src/lib/kadm5/unit-test/diff-files/no-diffs -deleted file mode 100644 -index 593d67320..000000000 ---- a/src/lib/kadm5/unit-test/diff-files/no-diffs -+++ /dev/null -@@ -1,2 +0,0 @@ --##! nochanges -- -diff --git a/src/lib/kadm5/unit-test/handle-test.c b/src/lib/kadm5/unit-test/handle-test.c -deleted file mode 100644 -index 29bd2c9a1..000000000 ---- a/src/lib/kadm5/unit-test/handle-test.c -+++ /dev/null -@@ -1,140 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include --#include --#ifdef CLIENT_TEST --#include --#else --#include --#include --#endif -- --int main(int argc, char *argv[]) --{ -- kadm5_ret_t ret; -- void *server_handle; -- kadm5_server_handle_t handle; -- kadm5_server_handle_rec orig_handle; -- kadm5_policy_ent_rec pol; -- kadm5_principal_ent_t princ; -- kadm5_principal_ent_rec kprinc; -- krb5_keyblock *key; -- krb5_principal tprinc; -- krb5_context context; -- -- -- kadm5_init_krb5_context(&context); -- -- ret = kadm5_init(context, "admin/none", "admin", KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- handle = (kadm5_server_handle_t) server_handle; -- orig_handle = *handle; -- handle->magic_number = KADM5_STRUCT_VERSION; -- krb5_parse_name(context, "testuser", &tprinc); -- ret = kadm5_get_principal(server_handle, tprinc, &kprinc, -- KADM5_PRINCIPAL_NORMAL_MASK); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "get-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_get_policy(server_handle, "pol1", &pol); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "get-policy", -- error_message(ret)); -- exit(1); -- } -- -- princ = &kprinc; -- ret = kadm5_create_principal(server_handle, princ, KADM5_PRINCIPAL, "pass"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "create-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_create_policy(server_handle, &pol, KADM5_POLICY); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "create-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_modify_principal(server_handle, princ, KADM5_PW_EXPIRATION); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "modify-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_modify_policy(server_handle, &pol, KADM5_PW_MAX_LIFE); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "modify-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_delete_principal(server_handle, tprinc); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "delete-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_delete_policy(server_handle, "pol1"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "delete-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_chpass_principal(server_handle, tprinc, "FooBar"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "chpass", -- error_message(ret)); -- exit(1); -- } -- ret = kadm5_randkey_principal(server_handle, tprinc, &key, NULL); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "randkey", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_rename_principal(server_handle, tprinc, tprinc); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "rename", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_destroy(server_handle); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "destroy", -- error_message(ret)); -- exit(1); -- } -- -- *handle = orig_handle; -- ret = kadm5_destroy(server_handle); -- if (ret != KADM5_OK) { -- fprintf(stderr, "valid %s -- returned -- %s\n", "destroy", -- error_message(ret)); -- exit(1); -- } -- -- krb5_free_principal(context, tprinc); -- krb5_free_context(context); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/init-test.c b/src/lib/kadm5/unit-test/init-test.c -deleted file mode 100644 -index 9f06621e8..000000000 ---- a/src/lib/kadm5/unit-test/init-test.c -+++ /dev/null -@@ -1,39 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include -- --int main() --{ -- kadm5_ret_t ret; -- void *server_handle; -- kadm5_config_params params; -- krb5_context context; -- -- memset(¶ms, 0, sizeof(params)); -- params.mask |= KADM5_CONFIG_NO_AUTH; -- ret = kadm5_init_krb5_context(&context); -- if (ret != 0) { -- com_err("init-test", ret, "while initializing krb5 context"); -- exit(1); -- } -- ret = kadm5_init(context, "admin", "admin", NULL, ¶ms, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if (!ret) -- (void)kadm5_destroy(server_handle); -- krb5_free_context(context); -- if (ret == KADM5_RPC_ERROR) { -- exit(0); -- } -- else if (ret != 0) { -- com_err("init-test", ret, "while initializing without auth"); -- exit(1); -- } else { -- fprintf(stderr, "Unexpected success while initializing without auth!\n"); -- exit(1); -- } --} -diff --git a/src/lib/kadm5/unit-test/iter-test.c b/src/lib/kadm5/unit-test/iter-test.c -deleted file mode 100644 -index cd85ebe4d..000000000 ---- a/src/lib/kadm5/unit-test/iter-test.c -+++ /dev/null -@@ -1,51 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include -- --int main(int argc, char **argv) --{ -- kadm5_ret_t ret; -- void *server_handle; -- char **names; -- int count, princ, i; -- krb5_context context; -- -- if (argc != 3) { -- fprintf(stderr, "Usage: %s [-princ|-pol] exp\n", argv[0]); -- exit(1); -- } -- princ = (strcmp(argv[1], "-princ") == 0); -- -- ret = kadm5_init_krb5_context(&context); -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while initializing context"); -- exit(1); -- } -- ret = kadm5_init("admin", "admin", KADM5_ADMIN_SERVICE, 0, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while initializing"); -- exit(1); -- } -- -- if (princ) -- ret = kadm5_get_principals(server_handle, argv[2], &names, &count); -- else -- ret = kadm5_get_policies(server_handle, argv[2], &names, &count); -- -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while retrieving list"); -- exit(1); -- } -- -- for (i = 0; i < count; i++) -- printf("%d: %s\n", i, names[i]); -- -- kadm5_free_name_list(server_handle, names, count); -- -- (void) kadm5_destroy(server_handle); -- -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/lib/lib.t b/src/lib/kadm5/unit-test/lib/lib.t -deleted file mode 100644 -index 3444775cf..000000000 ---- a/src/lib/kadm5/unit-test/lib/lib.t -+++ /dev/null -@@ -1,306 +0,0 @@ --global timeout --set timeout 60 -- --set lib_pid 0 -- --# --# The functions in this library used to be responsible for bazillions --# of wasted api_starts. Now, they all just use their own library --# handle so they are not interrupted when the main tests call init or --# destroy. They have to keep track of when the api exists and --# restarts, though, since the lib_handle needs to be re-opened in that --# case. --# --proc lib_start_api {} { -- global spawn_id lib_pid test -- -- if {! [api_isrunning $lib_pid]} { -- api_exit -- set lib_pid [api_start] -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- lib_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- verbose "+++ restarted api ($lib_pid) for lib" -- } else { -- verbose "+++ api $lib_pid already running for lib" -- } --} -- --proc cmd {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "OK .*$prompt$" { return 1 } -- -re "ERROR .*$prompt$" { return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc tcl_cmd {command} { -- global prompt spawn_id test -- -- send "[string trim $command]\n" -- expect { -- -re "$prompt$" { return 1} -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { error_and_restart "timeout" } -- eof { api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_succeed_test {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "OK .*$prompt$" { pass "$test"; return 1 } -- -re "ERROR .*$prompt$" { -- fail "$test: $expect_out(buffer)"; return 0 -- } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_fail_test {command code} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "ERROR .*$code.*$prompt$" { pass "$test"; return 1 } -- -re "ERROR .*$prompt$" { fail "$test: bad failure"; return 0 } -- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_fail_test_nochk {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "ERROR .*$prompt$" { pass "$test:"; return 1 } -- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc resync {} { -- global prompt spawn_id test -- -- expect { -- -re "$prompt$" {} -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- eof { api_exit; lib_start_api } -- } --} -- --proc create_principal {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_principal $lib_handle [simple_principal \ -- "%s"] {KADM5_PRINCIPAL} "%s" -- } $name $name]] -- -- return $ret --} -- --proc create_policy {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_policy $lib_handle [simple_policy "%s"] \ -- {KADM5_POLICY} -- } $name $name]] -- -- return $ret --} -- --proc create_principal_pol {name policy} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_principal $lib_handle [princ_w_pol "%s" \ -- "%s"] {KADM5_PRINCIPAL KADM5_POLICY} "%s" -- } $name $policy $name]] -- -- return $ret --} -- --proc delete_principal {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_delete_principal $lib_handle "%s" -- } $name]] -- -- return $ret --} -- --proc delete_policy {name} { -- lib_start_api -- -- set ret [cmd [format {kadm5_delete_policy $lib_handle "%s"} $name]] -- -- return $ret --} -- --proc principal_exists {name} { --# puts stdout "Starting principal_exists." -- -- lib_start_api -- -- set ret [cmd [format { -- kadm5_get_principal $lib_handle "%s" principal \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } $name]] -- --# puts stdout "Finishing principal_exists." -- -- return $ret --} -- --proc policy_exists {name} { -- lib_start_api -- --# puts stdout "Starting policy_exists." -- -- set ret [cmd [format { -- kadm5_get_policy $lib_handle "%s" policy -- } $name]] -- --# puts stdout "Finishing policy_exists." -- -- return $ret --} -- --proc error_and_restart {error} { -- api_exit -- api_start -- perror $error --} -- --proc test {name} { -- global test verbose -- -- set test $name -- if {$verbose >= 1} { -- puts stdout "At $test" -- } --} -- --proc begin_dump {} { -- global TOP -- global RPC -- -- if { ! $RPC } { --# exec $env(SIMPLE_DUMP) > /tmp/dump.before -- } --} -- --proc end_dump_compare {name} { -- global file -- global TOP -- global RPC -- -- if { ! $RPC } { --# set file $TOP/admin/lib/unit-test/diff-files/$name --# exec $env(SIMPLE_DUMP) > /tmp/dump.after --# exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file -- } --} -- --proc kinit { princ pass {opts ""} } { -- global env; -- global KINIT -- -- eval spawn $KINIT -5 $opts $princ -- expect { -- -re {Password for .*: $} -- {send "$pass\n"} -- timeout {puts "Timeout waiting for prompt" ; close } -- } -- -- # this necessary so close(1) in the child will not sleep waiting for -- # the parent, which is us, to read pending data. -- -- expect { -- "when initializing cache" { perror "kinit failed: $expect_out(buffer)" } -- eof {} -- } -- wait --} -- --proc kdestroy {} { -- global KDESTROY -- global errorCode errorInfo -- global env -- -- if {[info exists errorCode]} { -- set saveErrorCode $errorCode -- } -- if {[info exists errorInfo]} { -- set saveErrorInfo $errorInfo -- } -- catch "exec $KDESTROY -5 2>/dev/null" -- if {[info exists saveErrorCode]} { -- set errorCode $saveErrorCode -- } elseif {[info exists errorCode]} { -- unset errorCode -- } -- if {[info exists saveErrorInfo]} { -- set errorInfo $saveErrorInfo -- } elseif {[info exists errorInfo]} { -- unset errorInfo -- } --} -- --proc create_principal_with_keysalts {name keysalts} { -- global kadmin_local -- -- spawn $kadmin_local -e "$keysalts" -- expect { -- "kadmin.local:" {} -- default { perror "waiting for kadmin.local prompt"; return 1} -- } -- send "ank -pw \"$name\" \"$name\"\n" -- expect { -- -re "Principal \"$name.*\" created." {} -- "kadmin.local:" { -- perror "expecting principal created message"; -- return 1 -- } -- default { perror "waiting for principal created message"; return 1 } -- } -- expect { -- "kadmin.local:" {} -- default { perror "waiting for kadmin.local prompt"; return 1 } -- } -- close -- wait -- return 0 --} -- -- -diff --git a/src/lib/kadm5/unit-test/lock-test.c b/src/lib/kadm5/unit-test/lock-test.c -deleted file mode 100644 -index 59f9d2609..000000000 ---- a/src/lib/kadm5/unit-test/lock-test.c -+++ /dev/null -@@ -1,105 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include -- --char *whoami; -- --static void usage() --{ -- fprintf(stderr, -- "Usage: %s {shared|exclusive|permanent|release|" -- "get name|wait} ...\n", whoami); -- exit(1); --} -- --int main(int argc, char **argv) --{ -- krb5_error_code ret; -- osa_policy_ent_t entry; -- krb5_context context; -- kadm5_config_params params; -- krb5_error_code kret; -- -- whoami = argv[0]; -- -- kret = kadm5_init_krb5_context(&context); -- if (kret) { -- com_err(whoami, kret, "while initializing krb5"); -- exit(1); -- } -- -- params.mask = 0; -- ret = kadm5_get_config_params(context, 1, ¶ms, ¶ms); -- if (ret) { -- com_err(whoami, ret, "while retrieving configuration parameters"); -- exit(1); -- } -- if (! (params.mask & KADM5_CONFIG_ADBNAME)) { -- com_err(whoami, KADM5_BAD_SERVER_PARAMS, -- "while retrieving configuration parameters"); -- exit(1); -- } -- -- ret = krb5_db_open( context, NULL, KRB5_KDB_OPEN_RW); -- if (ret) { -- com_err(whoami, ret, "while opening database"); -- exit(1); -- } -- -- argc--; argv++; -- while (argc) { -- if (strcmp(*argv, "shared") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_SHARED); -- if (ret) -- com_err(whoami, ret, "while getting shared lock"); -- else -- printf("shared\n"); -- } else if (strcmp(*argv, "exclusive") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); -- if (ret) -- com_err(whoami, ret, "while getting exclusive lock"); -- else -- printf("exclusive\n"); -- } else if (strcmp(*argv, "permanent") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); -- if (ret) -- com_err(whoami, ret, "while getting permanent lock"); -- else -- printf("permanent\n"); -- } else if (strcmp(*argv, "release") == 0) { -- ret = krb5_db_unlock(context); -- if (ret) -- com_err(whoami, ret, "while releasing lock"); -- else -- printf("released\n"); -- } else if (strcmp(*argv, "get") == 0) { -- argc--; argv++; -- if (!argc) usage(); -- if ((ret = krb5_db_get_policy(context, *argv, &entry))) { -- com_err(whoami, ret, "while getting policy"); -- } else { -- printf("retrieved\n"); -- krb5_db_free_policy(context, entry); -- } -- } else if (strcmp(*argv, "wait") == 0) { -- getchar(); -- } else { -- fprintf(stderr, "%s: Invalid argument \"%s\"\n", -- whoami, *argv); -- usage(); -- } -- -- argc--; argv++; -- } -- -- ret = krb5_db_fini(context); -- if (ret) { -- com_err(whoami, ret, "while closing database"); -- exit(1); -- } -- -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/randkey-test.c b/src/lib/kadm5/unit-test/randkey-test.c -deleted file mode 100644 -index dbef88ac8..000000000 ---- a/src/lib/kadm5/unit-test/randkey-test.c -+++ /dev/null -@@ -1,42 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include -- --#define TEST_NUM 1000 -- --int main() --{ -- kadm5_ret_t ret; -- krb5_keyblock *keys[TEST_NUM]; -- krb5_principal tprinc; -- krb5_keyblock *newkey; -- krb5_context context; -- void *server_handle; -- -- int x, i; -- -- kadm5_init_krb5_context(&context); -- -- krb5_parse_name(context, "testuser", &tprinc); -- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- for(x = 0; x < TEST_NUM; x++) { -- kadm5_randkey_principal(server_handle, tprinc, &keys[x], NULL); -- for(i = 0; i < x; i++) { -- if (!memcmp(newkey->contents, keys[i]->contents, newkey->length)) -- puts("match found"); -- } -- } -- kadm5_destroy(server_handle); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/unit-test/setkey-test.c -deleted file mode 100644 -index 8e7df96e9..000000000 ---- a/src/lib/kadm5/unit-test/setkey-test.c -+++ /dev/null -@@ -1,246 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include -- --#if HAVE_SRAND48 --#define RAND() lrand48() --#define SRAND(a) srand48(a) --#define RAND_TYPE long --#elif HAVE_SRAND --#define RAND() rand() --#define SRAND(a) srand(a) --#define RAND_TYPE int --#elif HAVE_SRANDOM --#define RAND() random() --#define SRAND(a) srandom(a) --#define RAND_TYPE long --#else /* no random */ --need a random number generator --#endif /* no random */ -- --krb5_keyblock test1[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; --krb5_keyblock test2[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; --krb5_keyblock test3[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; -- --krb5_keyblock *tests[] = { -- test1, test2, test3, NULL --}; -- --krb5_data tgtname = { -- 0, -- KRB5_TGS_NAME_SIZE, -- KRB5_TGS_NAME --}; -- --krb5_enctype ktypes[] = { 0, 0 }; -- --extern krb5_kt_ops krb5_ktf_writable_ops; -- --int --main(int argc, char **argv) --{ -- krb5_context context; -- krb5_keytab kt; -- krb5_keytab_entry ktent; -- krb5_encrypt_block eblock; -- krb5_creds my_creds; -- krb5_get_init_creds_opt *opt; -- kadm5_principal_ent_rec princ_ent; -- krb5_principal princ, server; -- char pw[16]; -- char *whoami, *principal, *authprinc, *authpwd; -- krb5_data pwdata; -- void *handle; -- int ret, test, encnum; -- unsigned int i; -- -- whoami = argv[0]; -- -- if (argc < 2 || argc > 4) { -- fprintf(stderr, "Usage: %s principal [authuser] [authpwd]\n", whoami); -- exit(1); -- } -- principal = argv[1]; -- authprinc = (argc > 2) ? argv[2] : argv[0]; -- authpwd = (argc > 3) ? argv[3] : NULL; -- -- /* -- * Setup. Initialize data structures, open keytab, open connection -- * to kadm5 server. -- */ -- -- memset(&context, 0, sizeof(context)); -- kadm5_init_krb5_context(&context); -- -- ret = krb5_parse_name(context, principal, &princ); -- if (ret) { -- com_err(whoami, ret, "while parsing principal name %s", principal); -- exit(1); -- } -- -- if((ret = krb5_build_principal_ext(context, &server, -- krb5_princ_realm(kcontext, princ)->length, -- krb5_princ_realm(kcontext, princ)->data, -- tgtname.length, tgtname.data, -- krb5_princ_realm(kcontext, princ)->length, -- krb5_princ_realm(kcontext, princ)->data, -- 0))) { -- com_err(whoami, ret, "while building server name"); -- exit(1); -- } -- -- ret = krb5_kt_default(context, &kt); -- if (ret) { -- com_err(whoami, ret, "while opening keytab"); -- exit(1); -- } -- -- ret = kadm5_init(context, authprinc, authpwd, KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &handle); -- if (ret) { -- com_err(whoami, ret, "while initializing connection"); -- exit(1); -- } -- -- /* these pw's don't need to be secure, just different every time */ -- SRAND((RAND_TYPE)time((void *) NULL)); -- pwdata.data = pw; -- pwdata.length = sizeof(pw); -- -- /* -- * For each test: -- * -- * For each enctype in the test, construct a random password/key. -- * Assign all keys to principal with kadm5_setkey_principal. Add -- * each key to the keytab, and acquire an initial ticket with the -- * keytab (XXX can I specify the kvno explicitly?). If -- * krb5_get_init_creds_keytab succeeds, then the keys were set -- * successfully. -- */ -- for (test = 0; tests[test] != NULL; test++) { -- krb5_keyblock *testp = tests[test]; -- kadm5_key_data *extracted; -- int n_extracted, match; -- printf("+ Test %d:\n", test); -- -- for (encnum = 0; testp[encnum].magic != -1; encnum++) { -- for (i = 0; i < sizeof(pw); i++) -- pw[i] = (RAND() % 26) + '0'; /* XXX */ -- -- krb5_use_enctype(context, &eblock, testp[encnum].enctype); -- ret = krb5_string_to_key(context, &eblock, &testp[encnum], -- &pwdata, NULL); -- if (ret) { -- com_err(whoami, ret, "while converting string to key"); -- exit(1); -- } -- } -- -- /* now, encnum == # of keyblocks in testp */ -- ret = kadm5_setkey_principal(handle, princ, testp, encnum); -- if (ret) { -- com_err(whoami, ret, "while setting keys"); -- exit(1); -- } -- -- ret = kadm5_get_principal(handle, princ, &princ_ent, KADM5_KVNO); -- if (ret) { -- com_err(whoami, ret, "while retrieving principal"); -- exit(1); -- } -- -- ret = kadm5_get_principal_keys(handle, princ, 0, &extracted, -- &n_extracted); -- if (ret) { -- com_err(whoami, ret, "while extracting keys"); -- exit(1); -- } -- -- for (encnum = 0; testp[encnum].magic != -1; encnum++) { -- printf("+ enctype %d\n", testp[encnum].enctype); -- -- for (match = 0; match < n_extracted; match++) { -- if (extracted[match].key.enctype == testp[encnum].enctype) -- break; -- } -- if (match >= n_extracted) { -- com_err(whoami, KRB5_WRONG_ETYPE, "while matching enctypes"); -- exit(1); -- } -- if (extracted[match].key.length != testp[encnum].length || -- memcmp(extracted[match].key.contents, testp[encnum].contents, -- testp[encnum].length) != 0) { -- com_err(whoami, KRB5_KDB_NO_MATCHING_KEY, "verifying keys"); -- exit(1); -- } -- -- memset(&ktent, 0, sizeof(ktent)); -- ktent.principal = princ; -- ktent.key = testp[encnum]; -- ktent.vno = princ_ent.kvno; -- -- ret = krb5_kt_add_entry(context, kt, &ktent); -- if (ret) { -- com_err(whoami, ret, "while adding keytab entry"); -- exit(1); -- } -- -- memset(&my_creds, 0, sizeof(my_creds)); -- my_creds.client = princ; -- my_creds.server = server; -- -- ktypes[0] = testp[encnum].enctype; -- ret = krb5_get_init_creds_opt_alloc(context, &opt); -- if (ret) { -- com_err(whoami, ret, "while allocating gic opts"); -- exit(1); -- } -- krb5_get_init_creds_opt_set_etype_list(opt, ktypes, 1); -- ret = krb5_get_init_creds_keytab(context, &my_creds, princ, -- kt, 0, NULL /* in_tkt_service */, -- opt); -- krb5_get_init_creds_opt_free(context, opt); -- if (ret) { -- com_err(whoami, ret, "while acquiring initial ticket"); -- exit(1); -- } -- krb5_free_cred_contents(context, &my_creds); -- -- /* since I can't specify enctype explicitly ... */ -- ret = krb5_kt_remove_entry(context, kt, &ktent); -- if (ret) { -- com_err(whoami, ret, "while removing keytab entry"); -- exit(1); -- } -- } -- -- (void)kadm5_free_kadm5_key_data(context, n_extracted, extracted); -- } -- -- ret = krb5_kt_close(context, kt); -- if (ret) { -- com_err(whoami, ret, "while closing keytab"); -- exit(1); -- } -- -- ret = kadm5_destroy(handle); -- if (ret) { -- com_err(whoami, ret, "while closing kadmin connection"); -- exit(1); -- } -- -- krb5_free_principal(context, princ); -- krb5_free_principal(context, server); -- krb5_free_context(context); -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/site.exp b/src/lib/kadm5/unit-test/site.exp -deleted file mode 100644 -index 7fe397463..000000000 ---- a/src/lib/kadm5/unit-test/site.exp -+++ /dev/null -@@ -1,2 +0,0 @@ --set tool kadm5_srv_tcl --set prompt "% " --- -2.31.1 - diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch deleted file mode 100644 index 3c90b97..0000000 --- a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch +++ /dev/null @@ -1,150 +0,0 @@ -From c99ecf1bb49e2fbd0bf30a7b357cf06407b9588a Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 18:04:58 -0400 -Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11 - -Rewrite add_pubkey_info() in terms of the EVP_PKEY interface. In this -process, fix its unchecked allocations and fail fast for non-RSA keys. - -(cherry picked from commit d6bf42279675100e3e4fe7c6e08eef74d49624cb) -(cherry picked from commit 5072bfdfaddae762680d0f9d97afa6dbf8274760) ---- - src/configure.ac | 1 + - src/tests/softpkcs11/main.c | 106 ++++++++++++++++++++++++------------ - 2 files changed, 72 insertions(+), 35 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 3e1052db7..eb6307468 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -1114,6 +1114,7 @@ int i = 1; - ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)]) - old_LIBS="$LIBS" - AC_CHECK_LIB(crypto, PKCS7_get_signer_info) -+ AC_CHECK_FUNCS(EVP_PKEY_get_bn_param) - LIBS="$old_LIBS" - fi - if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then -diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c -index caa537b68..86b4ef711 100644 ---- a/src/tests/softpkcs11/main.c -+++ b/src/tests/softpkcs11/main.c -@@ -413,47 +413,83 @@ add_object_attribute(struct st_object *o, - return CKR_OK; - } - -+#ifdef HAVE_EVP_PKEY_GET_BN_PARAM -+ -+/* Declare owner pointers since EVP_PKEY_get_bn_param() gives us copies. */ -+#define DECLARE_BIGNUM(name) BIGNUM *name = NULL -+#define RELEASE_BIGNUM(bn) BN_clear_free(bn) - static CK_RV --add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) -+get_bignums(EVP_PKEY *key, BIGNUM **n, BIGNUM **e) - { -- switch (key_type) { -- case CKK_RSA: { -- CK_BYTE *modulus = NULL; -- size_t modulus_len = 0; -- CK_ULONG modulus_bits = 0; -- CK_BYTE *exponent = NULL; -- size_t exponent_len = 0; -- const RSA *rsa; -- const BIGNUM *n, *e; -+ if (EVP_PKEY_get_bn_param(key, "n", n) == 0 || -+ EVP_PKEY_get_bn_param(key, "e", e) == 0) -+ return CKR_DEVICE_ERROR; - -- rsa = EVP_PKEY_get0_RSA(key); -- RSA_get0_key(rsa, &n, &e, NULL); -- modulus_bits = BN_num_bits(n); -- -- modulus_len = BN_num_bytes(n); -- modulus = malloc(modulus_len); -- BN_bn2bin(n, modulus); -- -- exponent_len = BN_num_bytes(e); -- exponent = malloc(exponent_len); -- BN_bn2bin(e, exponent); -- -- add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); -- add_object_attribute(o, 0, CKA_MODULUS_BITS, -- &modulus_bits, sizeof(modulus_bits)); -- add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, -- exponent, exponent_len); -- -- free(modulus); -- free(exponent); -- } -- default: -- /* XXX */ -- break; -- } - return CKR_OK; - } - -+#else -+ -+/* Declare const pointers since the old API gives us aliases. */ -+#define DECLARE_BIGNUM(name) const BIGNUM *name -+#define RELEASE_BIGNUM(bn) -+static CK_RV -+get_bignums(EVP_PKEY *key, const BIGNUM **n, const BIGNUM **e) -+{ -+ const RSA *rsa; -+ -+ rsa = EVP_PKEY_get0_RSA(key); -+ RSA_get0_key(rsa, n, e, NULL); -+ -+ return CKR_OK; -+} -+ -+#endif -+ -+static CK_RV -+add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) -+{ -+ CK_BYTE *modulus = NULL, *exponent = 0; -+ size_t modulus_len = 0, exponent_len = 0; -+ CK_ULONG modulus_bits = 0; -+ CK_RV ret; -+ DECLARE_BIGNUM(n); -+ DECLARE_BIGNUM(e); -+ -+ if (key_type != CKK_RSA) -+ abort(); -+ -+ ret = get_bignums(key, &n, &e); -+ if (ret != CKR_OK) -+ goto done; -+ -+ modulus_bits = BN_num_bits(n); -+ modulus_len = BN_num_bytes(n); -+ exponent_len = BN_num_bytes(e); -+ -+ modulus = malloc(modulus_len); -+ exponent = malloc(exponent_len); -+ if (modulus == NULL || exponent == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto done; -+ } -+ -+ BN_bn2bin(n, modulus); -+ BN_bn2bin(e, exponent); -+ -+ add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); -+ add_object_attribute(o, 0, CKA_MODULUS_BITS, &modulus_bits, -+ sizeof(modulus_bits)); -+ add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, exponent, exponent_len); -+ -+ ret = CKR_OK; -+done: -+ free(modulus); -+ free(exponent); -+ RELEASE_BIGNUM(n); -+ RELEASE_BIGNUM(e); -+ return ret; -+} - - static int - pem_callback(char *buf, int num, int w, void *key) diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch deleted file mode 100644 index cd7450c..0000000 --- a/Support-host-based-GSS-initiator-names.patch +++ /dev/null @@ -1,578 +0,0 @@ -From 818a777822658d44ce647fe975011a5ea25e8250 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 15 Jan 2021 13:51:34 -0500 -Subject: [PATCH] Support host-based GSS initiator names - -When checking if we can get initial credentials in the GSS krb5 mech, -use krb5_kt_have_match() to support fallback iteration. When scanning -the ccache or getting initial credentials, rewrite cred->name->princ -to the canonical client name. When a name check is necessary (such as -when the caller specifies both a name and ccache), use a new internal -API k5_sname_compare() to support fallback iteration. Add fallback -iteration to krb5_cc_cache_match() to allow host-based names to be -canonicalized against the cache collection. - -Create and store the matching principal for acceptor names in -acquire_accept_cred() so that it isn't affected by changes in -cred->name->princ during acquire_init_cred(). - -ticket: 8978 (new) -(cherry picked from commit c374ab40dd059a5938ffc0440d87457ac5da3a46) ---- - src/include/k5-int.h | 9 +++ - src/include/k5-trace.h | 3 + - src/lib/gssapi/krb5/accept_sec_context.c | 15 +--- - src/lib/gssapi/krb5/acquire_cred.c | 89 ++++++++++++++---------- - src/lib/gssapi/krb5/gssapiP_krb5.h | 1 + - src/lib/gssapi/krb5/rel_cred.c | 1 + - src/lib/krb5/ccache/cccursor.c | 57 +++++++++++---- - src/lib/krb5/libkrb5.exports | 1 + - src/lib/krb5/os/sn2princ.c | 23 +++++- - src/lib/krb5_32.def | 1 + - src/tests/gssapi/t_client_keytab.py | 44 ++++++++++++ - src/tests/gssapi/t_credstore.py | 32 +++++++++ - 12 files changed, 214 insertions(+), 62 deletions(-) - -diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index efb523689..46f2ce2d3 100644 ---- a/src/include/k5-int.h -+++ b/src/include/k5-int.h -@@ -2411,4 +2411,13 @@ void k5_change_error_message_code(krb5_context ctx, krb5_error_code oldcode, - #define k5_prependmsg krb5_prepend_error_message - #define k5_wrapmsg krb5_wrap_error_message - -+/* -+ * Like krb5_principal_compare(), but with canonicalization of sname if -+ * fallback is enabled. This function should be avoided if multiple matches -+ * are required, since repeated canonicalization is inefficient. -+ */ -+krb5_boolean -+k5_sname_compare(krb5_context context, krb5_const_principal sname, -+ krb5_const_principal princ); -+ - #endif /* _KRB5_INT_H */ -diff --git a/src/include/k5-trace.h b/src/include/k5-trace.h -index b3e039dc8..79b5a7a85 100644 ---- a/src/include/k5-trace.h -+++ b/src/include/k5-trace.h -@@ -105,6 +105,9 @@ void krb5int_trace(krb5_context context, const char *fmt, ...); - - #endif /* DISABLE_TRACING */ - -+#define TRACE_CC_CACHE_MATCH(c, princ, ret) \ -+ TRACE(c, "Matching {princ} in collection with result: {kerr}", \ -+ princ, ret) - #define TRACE_CC_DESTROY(c, cache) \ - TRACE(c, "Destroying ccache {ccache}", cache) - #define TRACE_CC_GEN_NEW(c, cache) \ -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index fcf2c2152..a1d7e0d96 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -683,7 +683,6 @@ kg_accept_krb5(minor_status, context_handle, - krb5_flags ap_req_options = 0; - krb5_enctype negotiated_etype; - krb5_authdata_context ad_context = NULL; -- krb5_principal accprinc = NULL; - krb5_ap_req *request = NULL; - - code = krb5int_accessor (&kaccess, KRB5INT_ACCESS_VERSION); -@@ -849,17 +848,9 @@ kg_accept_krb5(minor_status, context_handle, - } - } - -- if (!cred->default_identity) { -- if ((code = kg_acceptor_princ(context, cred->name, &accprinc))) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- } -- -- code = krb5_rd_req_decoded(context, &auth_context, request, accprinc, -- cred->keytab, &ap_req_options, NULL); -- -- krb5_free_principal(context, accprinc); -+ code = krb5_rd_req_decoded(context, &auth_context, request, -+ cred->acceptor_mprinc, cred->keytab, -+ &ap_req_options, NULL); - if (code) { - major_status = GSS_S_FAILURE; - goto fail; -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index 632ee7def..e226a0269 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -123,11 +123,11 @@ gss_krb5int_register_acceptor_identity(OM_uint32 *minor_status, - /* Try to verify that keytab contains at least one entry for name. Return 0 if - * it does, KRB5_KT_NOTFOUND if it doesn't, or another error as appropriate. */ - static krb5_error_code --check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) -+check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name, -+ krb5_principal mprinc) - { - krb5_error_code code; - krb5_keytab_entry ent; -- krb5_principal accprinc = NULL; - char *princname; - - if (name->service == NULL) { -@@ -141,21 +141,15 @@ check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) - if (kt->ops->start_seq_get == NULL) - return 0; - -- /* Get the partial principal for the acceptor name. */ -- code = kg_acceptor_princ(context, name, &accprinc); -- if (code) -- return code; -- -- /* Scan the keytab for host-based entries matching accprinc. */ -- code = k5_kt_have_match(context, kt, accprinc); -+ /* Scan the keytab for host-based entries matching mprinc. */ -+ code = k5_kt_have_match(context, kt, mprinc); - if (code == KRB5_KT_NOTFOUND) { -- if (krb5_unparse_name(context, accprinc, &princname) == 0) { -+ if (krb5_unparse_name(context, mprinc, &princname) == 0) { - k5_setmsg(context, code, _("No key table entry found matching %s"), - princname); - free(princname); - } - } -- krb5_free_principal(context, accprinc); - return code; - } - -@@ -202,8 +196,14 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, - } - - if (cred->name != NULL) { -+ code = kg_acceptor_princ(context, cred->name, &cred->acceptor_mprinc); -+ if (code) { -+ major = GSS_S_FAILURE; -+ goto cleanup; -+ } -+ - /* Make sure we have keys matching the desired name in the keytab. */ -- code = check_keytab(context, kt, cred->name); -+ code = check_keytab(context, kt, cred->name, cred->acceptor_mprinc); - if (code) { - if (code == KRB5_KT_NOTFOUND) { - k5_change_error_message_code(context, code, KG_KEYTAB_NOMATCH); -@@ -324,7 +324,6 @@ static krb5_boolean - can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) - { - krb5_error_code code; -- krb5_keytab_entry entry; - - if (cred->password != NULL) - return TRUE; -@@ -336,20 +335,21 @@ can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) - if (cred->name == NULL) - return !krb5_kt_have_content(context, cred->client_keytab); - -- /* Check if we have a keytab key for the client principal. */ -- code = krb5_kt_get_entry(context, cred->client_keytab, cred->name->princ, -- 0, 0, &entry); -- if (code) { -- krb5_clear_error_message(context); -- return FALSE; -- } -- krb5_free_keytab_entry_contents(context, &entry); -- return TRUE; -+ /* -+ * Check if we have a keytab key for the client principal. This is a bit -+ * more permissive than we really want because krb5_kt_have_match() -+ * supports wildcarding and obeys ignore_acceptor_hostname, but that should -+ * generally be harmless. -+ */ -+ code = k5_kt_have_match(context, cred->client_keytab, cred->name->princ); -+ return code == 0; - } - --/* Scan cred->ccache for name, expiry time, impersonator, refresh time. */ -+/* Scan cred->ccache for name, expiry time, impersonator, refresh time. If -+ * check_name is true, verify the cache name against the credential name. */ - static krb5_error_code --scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) -+scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred, -+ krb5_boolean check_name) - { - krb5_error_code code; - krb5_ccache ccache = cred->ccache; -@@ -365,23 +365,31 @@ scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) - if (code) - return code; - -- /* Credentials cache principal must match the initiator name. */ - code = krb5_cc_get_principal(context, ccache, &ccache_princ); - if (code != 0) - goto cleanup; -- if (cred->name != NULL && -- !krb5_principal_compare(context, ccache_princ, cred->name->princ)) { -- code = KG_CCACHE_NOMATCH; -- goto cleanup; -- } - -- /* Save the ccache principal as the credential name if not already set. */ -- if (!cred->name) { -+ if (cred->name == NULL) { -+ /* Save the ccache principal as the credential name. */ - code = kg_init_name(context, ccache_princ, NULL, NULL, NULL, - KG_INIT_NAME_NO_COPY, &cred->name); - if (code) - goto cleanup; - ccache_princ = NULL; -+ } else { -+ /* Check against the desired name if needed. */ -+ if (check_name) { -+ if (!k5_sname_compare(context, cred->name->princ, ccache_princ)) { -+ code = KG_CCACHE_NOMATCH; -+ goto cleanup; -+ } -+ } -+ -+ /* Replace the credential name principal with the canonical client -+ * principal, retaining acceptor_mprinc if set. */ -+ krb5_free_principal(context, cred->name->princ); -+ cred->name->princ = ccache_princ; -+ ccache_princ = NULL; - } - - assert(cred->name->princ != NULL); -@@ -447,7 +455,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) - assert(cred->name != NULL && cred->ccache == NULL); - #ifdef USE_LEASH - code = get_ccache_leash(context, cred->name->princ, &cred->ccache); -- return code ? code : scan_ccache(context, cred); -+ return code ? code : scan_ccache(context, cred, TRUE); - #else - /* Check first whether we can acquire tickets, to avoid overwriting the - * extended error message from krb5_cc_cache_match. */ -@@ -456,7 +464,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) - /* Look for an existing cache for the client principal. */ - code = krb5_cc_cache_match(context, cred->name->princ, &cred->ccache); - if (code == 0) -- return scan_ccache(context, cred); -+ return scan_ccache(context, cred, FALSE); - if (code != KRB5_CC_NOTFOUND || !can_get) - return code; - krb5_clear_error_message(context); -@@ -633,6 +641,13 @@ get_initial_cred(krb5_context context, const struct verify_params *verify, - kg_cred_set_initial_refresh(context, cred, &creds.times); - cred->have_tgt = TRUE; - cred->expire = creds.times.endtime; -+ -+ /* Steal the canonical client principal name from creds and save it in the -+ * credential name, retaining acceptor_mprinc if set. */ -+ krb5_free_principal(context, cred->name->princ); -+ cred->name->princ = creds.client; -+ creds.client = NULL; -+ - krb5_free_cred_contents(context, &creds); - cleanup: - krb5_get_init_creds_opt_free(context, opt); -@@ -721,7 +736,7 @@ acquire_init_cred(krb5_context context, OM_uint32 *minor_status, - - if (cred->ccache != NULL) { - /* The caller specified a ccache; check what's in it. */ -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, TRUE); - if (code == KRB5_FCC_NOFILE) { - /* See if we can get initial creds. If the caller didn't specify - * a name, pick one from the client keytab. */ -@@ -984,7 +999,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, - } - } - if (cred->ccache != NULL) { -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, FALSE); - if (code) - goto kerr; - } -@@ -996,7 +1011,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, - code = krb5int_cc_default(context, &cred->ccache); - if (code) - goto kerr; -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, FALSE); - if (code == KRB5_FCC_NOFILE) { - /* Default ccache doesn't exist; fall through to client keytab. */ - krb5_cc_close(context, cred->ccache); -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index 3bacdcd35..fd7abbd77 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -175,6 +175,7 @@ typedef struct _krb5_gss_cred_id_rec { - /* name/type of credential */ - gss_cred_usage_t usage; - krb5_gss_name_t name; -+ krb5_principal acceptor_mprinc; - krb5_principal impersonator; - unsigned int default_identity : 1; - unsigned int iakerb_mech : 1; -diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c -index a9515daf7..0da6c1b95 100644 ---- a/src/lib/gssapi/krb5/rel_cred.c -+++ b/src/lib/gssapi/krb5/rel_cred.c -@@ -72,6 +72,7 @@ krb5_gss_release_cred(minor_status, cred_handle) - if (cred->name) - kg_release_name(context, &cred->name); - -+ krb5_free_principal(context, cred->acceptor_mprinc); - krb5_free_principal(context, cred->impersonator); - - if (cred->req_enctypes) -diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c -index 8f5872116..760216d05 100644 ---- a/src/lib/krb5/ccache/cccursor.c -+++ b/src/lib/krb5/ccache/cccursor.c -@@ -30,6 +30,7 @@ - - #include "cc-int.h" - #include "../krb/int-proto.h" -+#include "../os/os-proto.h" - - #include - -@@ -141,18 +142,18 @@ krb5_cccol_cursor_free(krb5_context context, - return 0; - } - --krb5_error_code KRB5_CALLCONV --krb5_cc_cache_match(krb5_context context, krb5_principal client, -- krb5_ccache *cache_out) -+static krb5_error_code -+match_caches(krb5_context context, krb5_const_principal client, -+ krb5_ccache *cache_out) - { - krb5_error_code ret; - krb5_cccol_cursor cursor; - krb5_ccache cache = NULL; - krb5_principal princ; -- char *name; - krb5_boolean eq; - - *cache_out = NULL; -+ - ret = krb5_cccol_cursor_new(context, &cursor); - if (ret) - return ret; -@@ -169,20 +170,52 @@ krb5_cc_cache_match(krb5_context context, krb5_principal client, - krb5_cc_close(context, cache); - } - krb5_cccol_cursor_free(context, &cursor); -+ - if (ret) - return ret; -- if (cache == NULL) { -- ret = krb5_unparse_name(context, client, &name); -- if (ret == 0) { -- k5_setmsg(context, KRB5_CC_NOTFOUND, -+ if (cache == NULL) -+ return KRB5_CC_NOTFOUND; -+ -+ *cache_out = cache; -+ return 0; -+} -+ -+krb5_error_code KRB5_CALLCONV -+krb5_cc_cache_match(krb5_context context, krb5_principal client, -+ krb5_ccache *cache_out) -+{ -+ krb5_error_code ret; -+ struct canonprinc iter = { client, .subst_defrealm = TRUE }; -+ krb5_const_principal canonprinc = NULL; -+ krb5_ccache cache = NULL; -+ char *name; -+ -+ *cache_out = NULL; -+ -+ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && -+ canonprinc != NULL) { -+ ret = match_caches(context, canonprinc, &cache); -+ if (ret != KRB5_CC_NOTFOUND) -+ break; -+ } -+ free_canonprinc(&iter); -+ -+ if (ret == 0 && canonprinc == NULL) { -+ ret = KRB5_CC_NOTFOUND; -+ if (krb5_unparse_name(context, client, &name) == 0) { -+ k5_setmsg(context, ret, - _("Can't find client principal %s in cache collection"), - name); - krb5_free_unparsed_name(context, name); - } -- ret = KRB5_CC_NOTFOUND; -- } else -- *cache_out = cache; -- return ret; -+ } -+ -+ TRACE_CC_CACHE_MATCH(context, client, ret); -+ if (ret) -+ return ret; -+ -+ *cache_out = cache; -+ return 0; - } - - /* Store the error state for code from context into errsave, but only if code -diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index adbfa332b..df6e2ffbe 100644 ---- a/src/lib/krb5/libkrb5.exports -+++ b/src/lib/krb5/libkrb5.exports -@@ -181,6 +181,7 @@ k5_size_authdata_context - k5_size_context - k5_size_keyblock - k5_size_principal -+k5_sname_compare - k5_unmarshal_cred - k5_unmarshal_princ - k5_unwrap_cammac_svc -diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c -index 8b7214189..c99b7da17 100644 ---- a/src/lib/krb5/os/sn2princ.c -+++ b/src/lib/krb5/os/sn2princ.c -@@ -277,7 +277,8 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, - - /* If we're not doing fallback, the input principal is canonical. */ - if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || -- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2) { -+ iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || -+ iter->princ->data[1].length == 0) { - *princ_out = (step == 1) ? iter->princ : NULL; - return 0; - } -@@ -288,6 +289,26 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, - return canonicalize_princ(context, iter, step == 2, princ_out); - } - -+krb5_boolean -+k5_sname_compare(krb5_context context, krb5_const_principal sname, -+ krb5_const_principal princ) -+{ -+ krb5_error_code ret; -+ struct canonprinc iter = { sname, .subst_defrealm = TRUE }; -+ krb5_const_principal canonprinc = NULL; -+ krb5_boolean match = FALSE; -+ -+ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && -+ canonprinc != NULL) { -+ if (krb5_principal_compare(context, canonprinc, princ)) { -+ match = TRUE; -+ break; -+ } -+ } -+ free_canonprinc(&iter); -+ return match; -+} -+ - krb5_error_code KRB5_CALLCONV - krb5_sname_to_principal(krb5_context context, const char *hostname, - const char *sname, krb5_int32 type, -diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def -index 60b8dd311..cf690dbe4 100644 ---- a/src/lib/krb5_32.def -+++ b/src/lib/krb5_32.def -@@ -507,3 +507,4 @@ EXPORTS - ; new in 1.20 - krb5_marshal_credentials @472 - krb5_unmarshal_credentials @473 -+ k5_sname_compare @474 ; PRIVATE GSSAPI -diff --git a/src/tests/gssapi/t_client_keytab.py b/src/tests/gssapi/t_client_keytab.py -index 7847b3ecd..9a61d53b8 100755 ---- a/src/tests/gssapi/t_client_keytab.py -+++ b/src/tests/gssapi/t_client_keytab.py -@@ -141,5 +141,49 @@ msgs = ('Getting initial credentials for user/admin@KRBTEST.COM', - '/Matching credential not found') - realm.run(['./t_ccselect', phost], expected_code=1, - expected_msg='Ticket expired', expected_trace=msgs) -+realm.run([kdestroy, '-A']) -+ -+# Test 19: host-based initiator name -+mark('host-based initiator name') -+hsvc = 'h:svc@' + hostname -+svcprinc = 'svc/%s@%s' % (hostname, realm.realm) -+realm.addprinc(svcprinc) -+realm.extract_keytab(svcprinc, realm.client_keytab) -+# On the first run we match against the keytab while getting tickets, -+# substituting the default realm. -+msgs = ('/Can\'t find client principal svc/%s@ in' % hostname, -+ 'Getting initial credentials for svc/%s@' % hostname, -+ 'Found entries for %s in keytab' % svcprinc, -+ 'Retrieving %s from FILE:%s' % (svcprinc, realm.client_keytab), -+ 'Storing %s -> %s in' % (svcprinc, realm.krbtgt_princ), -+ 'Retrieving %s -> %s from' % (svcprinc, realm.krbtgt_princ), -+ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) -+realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) -+# On the second run we match against the collection. -+msgs = ('Matching svc/%s@ in collection with result: 0' % hostname, -+ 'Getting credentials %s -> %s' % (svcprinc, realm.host_princ), -+ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) -+realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) -+realm.run([kdestroy, '-A']) -+ -+# Test 20: host-based initiator name with fallback -+mark('host-based fallback initiator name') -+canonname = canonicalize_hostname(hostname) -+if canonname != hostname: -+ hfsvc = 'h:fsvc@' + hostname -+ canonprinc = 'fsvc/%s@%s' % (canonname, realm.realm) -+ realm.addprinc(canonprinc) -+ realm.extract_keytab(canonprinc, realm.client_keytab) -+ msgs = ('/Can\'t find client principal fsvc/%s@ in' % hostname, -+ 'Found entries for %s in keytab' % canonprinc, -+ 'authenticator for %s -> %s' % (canonprinc, realm.host_princ)) -+ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) -+ msgs = ('Matching fsvc/%s@ in collection with result: 0' % hostname, -+ 'Getting credentials %s -> %s' % (canonprinc, realm.host_princ)) -+ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) -+ realm.run([kdestroy, '-A']) -+else: -+ skipped('GSS initiator name fallback test', -+ '%s does not canonicalize to a different name' % hostname) - - success('Client keytab tests') -diff --git a/src/tests/gssapi/t_credstore.py b/src/tests/gssapi/t_credstore.py -index c11975bf5..9be57bb82 100644 ---- a/src/tests/gssapi/t_credstore.py -+++ b/src/tests/gssapi/t_credstore.py -@@ -15,6 +15,38 @@ msgs = ('Storing %s -> %s in %s' % (service_cs, realm.krbtgt_princ, - realm.run(['./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache, - 'keytab', servicekeytab], expected_trace=msgs) - -+mark('matching') -+scc = 'FILE:' + os.path.join(realm.testdir, 'service_cache') -+realm.kinit(realm.host_princ, flags=['-k', '-c', scc]) -+realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'p:wrong', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+realm.run(['./t_credstore', '-i', 'h:svc', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+ -+mark('matching (fallback)') -+canonname = canonicalize_hostname(hostname) -+if canonname != hostname: -+ canonprinc = 'host/%s@%s' % (canonname, realm.realm) -+ realm.addprinc(canonprinc) -+ realm.extract_keytab(canonprinc, realm.keytab) -+ realm.kinit(canonprinc, flags=['-k', '-c', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host@' + canonname, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'p:' + canonprinc, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+ realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+else: -+ skipped('fallback matching test', -+ '%s does not canonicalize to a different name' % hostname) -+ - mark('rcache') - # t_credstore -r should produce a replay error normally, but not with - # rcache set to "none:". diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch deleted file mode 100644 index 875ed9c..0000000 --- a/Try-harder-to-avoid-password-change-replay-errors.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 1f706852ee759160e763c355a3053ad5e045fa06 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 4 Mar 2022 00:45:00 -0500 -Subject: [PATCH] Try harder to avoid password change replay errors - -Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed -change_set_password() to prefer TCP. However, because UDP_LAST falls -back to UDP after one second, we can still get a replay error due to a -dropped packet, before the TCP layer has a chance to retry. - -Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after -TCP fails completely without reaching a server. In sendto_kdc.c, -implement an ONLY_UDP transport strategy to allow the UDP fallback. - -ticket: 9037 ---- - src/lib/krb5/os/changepw.c | 9 ++++++++- - src/lib/krb5/os/os-proto.h | 1 + - src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- - 3 files changed, 17 insertions(+), 5 deletions(-) - -diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c -index 9f968da7f..c59232586 100644 ---- a/src/lib/krb5/os/changepw.c -+++ b/src/lib/krb5/os/changepw.c -@@ -255,9 +255,16 @@ change_set_password(krb5_context context, - callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; - krb5_free_data_contents(callback_ctx.context, &chpw_rep); - -+ /* UDP retransmits may be seen as replays. Only try UDP after other -+ * transports fail completely. */ - code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, -- &sl, UDP_LAST, &callback_info, &chpw_rep, -+ &sl, NO_UDP, &callback_info, &chpw_rep, - ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); -+ if (code == KRB5_KDC_UNREACH) { -+ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, -+ &sl, ONLY_UDP, &callback_info, &chpw_rep, -+ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); -+ } - if (code) - goto cleanup; - -diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h -index a985f2aec..91d2791ce 100644 ---- a/src/lib/krb5/os/os-proto.h -+++ b/src/lib/krb5/os/os-proto.h -@@ -49,6 +49,7 @@ typedef enum { - UDP_FIRST = 0, - UDP_LAST, - NO_UDP, -+ ONLY_UDP - } k5_transport_strategy; - - /* A single server hostname or address. */ -diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c -index 0eedec175..c7f5d861a 100644 ---- a/src/lib/krb5/os/sendto_kdc.c -+++ b/src/lib/krb5/os/sendto_kdc.c -@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm, - int err, result; - char portbuf[PORT_LENGTH]; - -- /* Skip UDP entries if we don't want UDP. */ -+ /* Skip entries excluded by the strategy. */ - if (strategy == NO_UDP && entry->transport == UDP) - return 0; -+ if (strategy == ONLY_UDP && entry->transport != UDP && -+ entry->transport != TCP_OR_UDP) -+ return 0; - -- transport = (strategy == UDP_FIRST) ? UDP : TCP; -+ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; - if (entry->hostname == NULL) { - /* Added by a module, so transport is either TCP or UDP. */ - ai.ai_socktype = socktype_for_transport(entry->transport); -@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm, - } - - /* For TCP_OR_UDP entries, add each address again with the non-preferred -- * transport, unless we are avoiding UDP. Flag these as deferred. */ -- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { -+ * transport, if there is one. Flag these as deferred. */ -+ if (retval == 0 && entry->transport == TCP_OR_UDP && -+ (strategy == UDP_FIRST || strategy == UDP_LAST)) { - transport = (strategy == UDP_FIRST) ? TCP : UDP; - for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { - a->ai_socktype = socktype_for_transport(transport); --- -2.35.1 - diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch deleted file mode 100644 index 2af5676..0000000 --- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch +++ /dev/null @@ -1,235 +0,0 @@ -From 336f744403baa5dfaffcc5bd226fdd8f14a0200b Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 26 Mar 2021 23:38:54 -0400 -Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client - -In kcm_retrieve(), try KCM_OP_RETRIEVE. Fall back to iteration if the -server doesn't implement it, or if we can an answer incompatible with -KRB5_TC_SUPPORTED_KTYPES. - -In kcmserver.py, implement partial decoding for creds and cred tags so -that we can do a basic principal name match. - -ticket: 8997 (new) -(cherry picked from commit 795ebba8c039be172ab93cd41105c73ffdba0fdb) ---- - src/include/kcm.h | 2 +- - src/lib/krb5/ccache/cc_kcm.c | 52 +++++++++++++++++++++++++++++++++--- - src/tests/kcmserver.py | 44 +++++++++++++++++++++++++++--- - src/tests/t_ccache.py | 11 +++++--- - 4 files changed, 99 insertions(+), 10 deletions(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index 9b66f1cbd..85c20d345 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -87,7 +87,7 @@ typedef enum kcm_opcode { - KCM_OP_INITIALIZE, /* (name, princ) -> () */ - KCM_OP_DESTROY, /* (name) -> () */ - KCM_OP_STORE, /* (name, cred) -> () */ -- KCM_OP_RETRIEVE, -+ KCM_OP_RETRIEVE, /* (name, flags, credtag) -> (cred) */ - KCM_OP_GET_PRINCIPAL, /* (name) -> (princ) */ - KCM_OP_GET_CRED_UUID_LIST, /* (name) -> (uuid, ...) */ - KCM_OP_GET_CRED_BY_UUID, /* (name, uuid) -> (cred) */ -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 46705f1da..23fcf13ea 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV - kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, - krb5_creds *mcred, krb5_creds *cred_out) - { -- /* There is a KCM opcode for retrieving creds, but Heimdal's client doesn't -- * use it. It causes the KCM daemon to actually make a TGS request. */ -- return k5_cc_retrieve_cred_default(context, cache, flags, mcred, cred_out); -+ krb5_error_code ret; -+ struct kcmreq req = EMPTY_KCMREQ; -+ krb5_creds cred; -+ krb5_enctype *enctypes = NULL; -+ -+ memset(&cred, 0, sizeof(cred)); -+ -+ /* Include KCM_GC_CACHED in flags to prevent Heimdal's sssd from making a -+ * TGS request itself. */ -+ kcmreq_init(&req, KCM_OP_RETRIEVE, cache); -+ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags) | KCM_GC_CACHED); -+ k5_marshal_mcred(&req.reqbuf, mcred); -+ ret = cache_call(context, cache, &req); -+ -+ /* Fall back to iteration if the server does not support retrieval. */ -+ if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, -+ cred_out); -+ goto cleanup; -+ } -+ if (ret) -+ goto cleanup; -+ -+ ret = k5_unmarshal_cred(req.reply.ptr, req.reply.len, 4, &cred); -+ if (ret) -+ goto cleanup; -+ -+ /* In rare cases we might retrieve a credential with a session key this -+ * context can't support, in which case we must retry using iteration. */ -+ if (flags & KRB5_TC_SUPPORTED_KTYPES) { -+ ret = krb5_get_tgs_ktypes(context, cred.server, &enctypes); -+ if (ret) -+ goto cleanup; -+ if (!k5_etypes_contains(enctypes, cred.keyblock.enctype)) { -+ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, -+ cred_out); -+ goto cleanup; -+ } -+ } -+ -+ *cred_out = cred; -+ memset(&cred, 0, sizeof(cred)); -+ -+cleanup: -+ kcmreq_free(&req); -+ krb5_free_cred_contents(context, &cred); -+ free(enctypes); -+ /* Heimdal's KCM returns KRB5_CC_END if no cred is found. */ -+ return (ret == KRB5_CC_END) ? KRB5_CC_NOTFOUND : map_invalid(ret); - } - - static krb5_error_code KRB5_CALLCONV -diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py -index 8c5e66ff1..25e6f2bbe 100644 ---- a/src/tests/kcmserver.py -+++ b/src/tests/kcmserver.py -@@ -40,6 +40,7 @@ class KCMOpcodes(object): - INITIALIZE = 4 - DESTROY = 5 - STORE = 6 -+ RETRIEVE = 7 - GET_PRINCIPAL = 8 - GET_CRED_UUID_LIST = 9 - GET_CRED_BY_UUID = 10 -@@ -54,6 +55,7 @@ class KCMOpcodes(object): - - - class KRB5Errors(object): -+ KRB5_CC_NOTFOUND = -1765328243 - KRB5_CC_END = -1765328242 - KRB5_CC_NOSUPP = -1765328137 - KRB5_FCC_NOFILE = -1765328189 -@@ -86,11 +88,29 @@ def get_cache(name): - return cache - - -+def unpack_data(argbytes): -+ dlen, = struct.unpack('>L', argbytes[:4]) -+ return argbytes[4:dlen+4], argbytes[dlen+4:] -+ -+ - def unmarshal_name(argbytes): - offset = argbytes.find(b'\0') - return argbytes[0:offset], argbytes[offset+1:] - - -+def unmarshal_princ(argbytes): -+ # Ignore the type at argbytes[0:4]. -+ ncomps, = struct.unpack('>L', argbytes[4:8]) -+ realm, rest = unpack_data(argbytes[8:]) -+ comps = [] -+ for i in range(ncomps): -+ comp, rest = unpack_data(rest) -+ comps.append(comp) -+ # Asssume no quoting is needed. -+ princ = b'/'.join(comps) + b'@' + realm -+ return princ, rest -+ -+ - def op_gen_new(argbytes): - # Does not actually check for uniqueness. - global next_unique -@@ -126,6 +146,22 @@ def op_store(argbytes): - return 0, b'' - - -+def op_retrieve(argbytes): -+ name, rest = unmarshal_name(argbytes) -+ # Ignore the flags at rest[0:4] and the header at rest[4:8]. -+ # Assume there are client and server creds in the tag and match -+ # only against them. -+ cprinc, rest = unmarshal_princ(rest[8:]) -+ sprinc, rest = unmarshal_princ(rest) -+ cache = get_cache(name) -+ for cred in (cache.creds[u] for u in cache.cred_uuids): -+ cred_cprinc, rest = unmarshal_princ(cred) -+ cred_sprinc, rest = unmarshal_princ(rest) -+ if cred_cprinc == cprinc and cred_sprinc == sprinc: -+ return 0, cred -+ return KRB5Errors.KRB5_CC_NOTFOUND, b'' -+ -+ - def op_get_principal(argbytes): - name, rest = unmarshal_name(argbytes) - cache = get_cache(name) -@@ -199,6 +235,7 @@ ophandlers = { - KCMOpcodes.INITIALIZE : op_initialize, - KCMOpcodes.DESTROY : op_destroy, - KCMOpcodes.STORE : op_store, -+ KCMOpcodes.RETRIEVE : op_retrieve, - KCMOpcodes.GET_PRINCIPAL : op_get_principal, - KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list, - KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid, -@@ -243,10 +280,11 @@ def service_request(s): - return True - - parser = optparse.OptionParser() --parser.add_option('-c', '--credlist', action='store_true', dest='credlist', -- default=False, help='Support KCM_OP_GET_CRED_LIST') -+parser.add_option('-f', '--fallback', action='store_true', dest='fallback', -+ default=False, help='Do not support RETRIEVE/GET_CRED_LIST') - (options, args) = parser.parse_args() --if not options.credlist: -+if options.fallback: -+ del ophandlers[KCMOpcodes.RETRIEVE] - del ophandlers[KCMOpcodes.GET_CRED_LIST] - - server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) -diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py -index 90040fb7b..6ea9fb969 100755 ---- a/src/tests/t_ccache.py -+++ b/src/tests/t_ccache.py -@@ -25,7 +25,7 @@ from k5test import * - kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm') - conf = {'libdefaults': {'kcm_socket': kcm_socket_path, - 'kcm_mach_service': '-'}} --realm = K5Realm(create_host=False, krb5_conf=conf) -+realm = K5Realm(krb5_conf=conf) - - keyctl = which('keyctl') - out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1) -@@ -71,6 +71,11 @@ def collection_test(realm, ccname): - realm.kinit('alice', password('alice')) - realm.run([klist], expected_msg='Default principal: alice@') - realm.run([klist, '-A', '-s']) -+ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') -+ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') -+ out = realm.run([klist]) -+ if out.count(realm.host_princ) != 1: -+ fail('Wrong number of service tickets in cache') - realm.run([kdestroy]) - output = realm.run([klist], expected_code=1) - if 'No credentials cache' not in output and 'not found' not in output: -@@ -126,14 +131,14 @@ def collection_test(realm, ccname): - - collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) - --# Test KCM without and with GET_CRED_LIST support. -+# Test KCM with and without RETRIEVE and GET_CRED_LIST support. - kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') - kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') - stop_daemon(kcmd) - os.remove(kcm_socket_path) --realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], -+realm.start_server([sys.executable, kcmserver_path, '-f', kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') - diff --git a/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch b/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch deleted file mode 100644 index 927b506..0000000 --- a/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch +++ /dev/null @@ -1,482 +0,0 @@ -From 21e3b9a4463f1d1aeb71de8a27c298f1307d186b Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 4 Oct 2019 14:49:29 -0400 -Subject: [PATCH] Use OpenSSL's KBKDF and KRB5KDF for deriving long-term keys - -If supported, use OpenSSL-provided KBKDF (aes-sha2 and camellia) and -KRB5KDF (3des and aes-sha1). We already use OpenSSL's PBKDF2 where -appropriate. OpenSSL added support for these KDFs in 3.0. - -(cherry picked from commit ef8d11f6fb1232201c9efd2ae2ed567023fb85d2) -[rharwood@redhat.com: 3des removal] ---- - src/lib/crypto/krb/derive.c | 409 ++++++++++++++++++++++++++++-------- - 1 file changed, 324 insertions(+), 85 deletions(-) - -diff --git a/src/lib/crypto/krb/derive.c b/src/lib/crypto/krb/derive.c -index 6707a7308..8e474b38e 100644 ---- a/src/lib/crypto/krb/derive.c -+++ b/src/lib/crypto/krb/derive.c -@@ -27,6 +27,12 @@ - - #include "crypto_int.h" - -+#ifdef HAVE_EVP_KDF_FETCH -+#include -+#include -+#include -+#endif -+ - static krb5_key - find_cached_dkey(struct derived_key *list, const krb5_data *constant) - { -@@ -77,55 +83,251 @@ cleanup: - return ENOMEM; - } - -+#ifdef HAVE_EVP_KDF_FETCH - static krb5_error_code --derive_random_rfc3961(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+openssl_kbdkf_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, const krb5_data *context) - { -- size_t blocksize, keybytes, n; - krb5_error_code ret; -- krb5_data block = empty_data(); -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[6]; -+ size_t i = 0; -+ char *digest; - -- blocksize = enc->block_size; -- keybytes = enc->keybytes; -+ /* On NULL hash, preserve default behavior for pbkdf2_string_to_key(). */ -+ if (hash == NULL || !strcmp(hash->hash_name, "SHA1")) { -+ digest = "SHA1"; -+ } else if (!strcmp(hash->hash_name, "SHA-256")) { -+ digest = "SHA256"; -+ } else if (!strcmp(hash->hash_name, "SHA-384")) { -+ digest = "SHA384"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } - -- if (blocksize == 1) -- return KRB5_BAD_ENCTYPE; -- if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); -+ if (!kdf) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, -+ digest, 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, -+ "HMAC", 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, -+ context->data, -+ context->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, -+ label->data, -+ label->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_kbkdf_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[7]; -+ size_t i = 0; -+ char *cipher; -+ static unsigned char zeroes[16]; -+ -+ memset(zeroes, 0, sizeof(zeroes)); -+ -+ if (!memcmp(enc, &krb5int_enc_camellia128, sizeof(*enc))) { -+ cipher = "CAMELLIA-128-CBC"; -+ } else if (!memcmp(enc, &krb5int_enc_camellia256, sizeof(*enc))) { -+ cipher = "CAMELLIA-256-CBC"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); -+ if (!kdf) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, -+ "FEEDBACK", 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, -+ "CMAC", 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, -+ cipher, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, -+ in_constant->data, -+ in_constant->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, -+ zeroes, sizeof(zeroes)); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_krb5kdf(const struct krb5_enc_provider *enc, krb5_key inkey, -+ krb5_data *outrnd, const krb5_data *in_constant) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[4]; -+ size_t i = 0; -+ char *cipher; -+ -+ if (inkey->keyblock.length != enc->keylength || -+ outrnd->length != enc->keybytes) { -+ return KRB5_CRYPTO_INTERNAL; -+ } -+ -+ if (!memcmp(enc, &krb5int_enc_aes128, sizeof(*enc))) { -+ cipher = "AES-128-CBC"; -+ } else if (!memcmp(enc, &krb5int_enc_aes256, sizeof(*enc))) { -+ cipher = "AES-256-CBC"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL); -+ if (kdf == NULL) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (kctx == NULL) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, -+ cipher, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT, -+ in_constant->data, -+ in_constant->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+#else /* HAVE_EVP_KDF_FETCH */ -+ -+/* -+ * NIST SP800-108 KDF in counter mode (section 5.1). -+ * Parameters: -+ * - HMAC (with hash as the hash provider) is the PRF. -+ * - A block counter of four bytes is used. -+ * - Four bytes are used to encode the output length in the PRF input. -+ * -+ * There are no uses requiring more than a single PRF invocation. -+ */ -+static krb5_error_code -+builtin_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, -+ const krb5_data *context) -+{ -+ krb5_crypto_iov iov[5]; -+ krb5_error_code ret; -+ krb5_data prf; -+ unsigned char ibuf[4], lbuf[4]; -+ -+ if (hash == NULL || outrnd->length > hash->hashsize) - return KRB5_CRYPTO_INTERNAL; - - /* Allocate encryption data buffer. */ -- ret = alloc_data(&block, blocksize); -+ ret = alloc_data(&prf, hash->hashsize); - if (ret) - return ret; - -- /* Initialize the input block. */ -- if (in_constant->length == blocksize) { -- memcpy(block.data, in_constant->data, blocksize); -- } else { -- krb5int_nfold(in_constant->length * 8, -- (unsigned char *) in_constant->data, -- blocksize * 8, (unsigned char *) block.data); -- } -+ /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -+ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[0].data = make_data(ibuf, sizeof(ibuf)); -+ store_32_be(1, ibuf); -+ /* Label */ -+ iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[1].data = *label; -+ /* 0x00: separator byte */ -+ iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[2].data = make_data("", 1); -+ /* Context */ -+ iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[3].data = *context; -+ /* [L]2: four-byte big-endian binary string giving the output length */ -+ iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[4].data = make_data(lbuf, sizeof(lbuf)); -+ store_32_be(outrnd->length * 8, lbuf); - -- /* Loop encrypting the blocks until enough key bytes are generated. */ -- n = 0; -- while (n < keybytes) { -- ret = encrypt_block(enc, inkey, &block); -- if (ret) -- goto cleanup; -- -- if ((keybytes - n) <= blocksize) { -- memcpy(outrnd->data + n, block.data, (keybytes - n)); -- break; -- } -- -- memcpy(outrnd->data + n, block.data, blocksize); -- n += blocksize; -- } -- --cleanup: -- zapfree(block.data, blocksize); -+ ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -+ if (!ret) -+ memcpy(outrnd->data, prf.data, outrnd->length); -+ zapfree(prf.data, prf.length); - return ret; - } - -@@ -139,9 +341,9 @@ cleanup: - * - Four bytes are used to encode the output length in the PRF input. - */ - static krb5_error_code --derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+builtin_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) - { - size_t blocksize, keybytes, n; - krb5_crypto_iov iov[6]; -@@ -204,56 +406,94 @@ cleanup: - return ret; - } - --/* -- * NIST SP800-108 KDF in counter mode (section 5.1). -- * Parameters: -- * - HMAC (with hash as the hash provider) is the PRF. -- * - A block counter of four bytes is used. -- * - Four bytes are used to encode the output length in the PRF input. -- * -- * There are no uses requiring more than a single PRF invocation. -- */ -+static krb5_error_code -+builtin_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ size_t blocksize, keybytes, n; -+ krb5_error_code ret; -+ krb5_data block = empty_data(); -+ -+ blocksize = enc->block_size; -+ keybytes = enc->keybytes; -+ -+ if (blocksize == 1) -+ return KRB5_BAD_ENCTYPE; -+ if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ return KRB5_CRYPTO_INTERNAL; -+ -+ /* Allocate encryption data buffer. */ -+ ret = alloc_data(&block, blocksize); -+ if (ret) -+ return ret; -+ -+ /* Initialize the input block. */ -+ if (in_constant->length == blocksize) { -+ memcpy(block.data, in_constant->data, blocksize); -+ } else { -+ krb5int_nfold(in_constant->length * 8, -+ (unsigned char *) in_constant->data, -+ blocksize * 8, (unsigned char *) block.data); -+ } -+ -+ /* Loop encrypting the blocks until enough key bytes are generated. */ -+ n = 0; -+ while (n < keybytes) { -+ ret = encrypt_block(enc, inkey, &block); -+ if (ret) -+ goto cleanup; -+ -+ if ((keybytes - n) <= blocksize) { -+ memcpy(outrnd->data + n, block.data, (keybytes - n)); -+ break; -+ } -+ -+ memcpy(outrnd->data + n, block.data, blocksize); -+ n += blocksize; -+ } -+ -+cleanup: -+ zapfree(block.data, blocksize); -+ return ret; -+} -+#endif /* HAVE_EVP_KDF_FETCH */ -+ - krb5_error_code - k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, - krb5_key inkey, krb5_data *outrnd, - const krb5_data *label, const krb5_data *context) - { -- krb5_crypto_iov iov[5]; -- krb5_error_code ret; -- krb5_data prf; -- unsigned char ibuf[4], lbuf[4]; -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_kbdkf_counter_hmac(hash, inkey, outrnd, label, context); -+#else -+ return builtin_sp800_108_counter_hmac(hash, inkey, outrnd, label, -+ context); -+#endif -+} - -- if (hash == NULL || outrnd->length > hash->hashsize) -- return KRB5_CRYPTO_INTERNAL; -+static krb5_error_code -+sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_kbkdf_feedback_cmac(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); -+#endif -+} - -- /* Allocate encryption data buffer. */ -- ret = alloc_data(&prf, hash->hashsize); -- if (ret) -- return ret; -- -- /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data = make_data(ibuf, sizeof(ibuf)); -- store_32_be(1, ibuf); -- /* Label */ -- iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[1].data = *label; -- /* 0x00: separator byte */ -- iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[2].data = make_data("", 1); -- /* Context */ -- iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[3].data = *context; -- /* [L]2: four-byte big-endian binary string giving the output length */ -- iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[4].data = make_data(lbuf, sizeof(lbuf)); -- store_32_be(outrnd->length * 8, lbuf); -- -- ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -- if (!ret) -- memcpy(outrnd->data, prf.data, outrnd->length); -- zapfree(prf.data, prf.length); -- return ret; -+static krb5_error_code -+derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_krb5kdf(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+#endif - } - - krb5_error_code -@@ -268,8 +508,7 @@ krb5int_derive_random(const struct krb5_enc_provider *enc, - case DERIVE_RFC3961: - return derive_random_rfc3961(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_CMAC: -- return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd, -- in_constant); -+ return sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_HMAC: - return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, - &empty); diff --git a/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch b/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch deleted file mode 100644 index 0a9cde1..0000000 --- a/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch +++ /dev/null @@ -1,408 +0,0 @@ -From 8bbb492f2be1418e1e4bb2cf197414810dac9589 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 20 Sep 2019 17:20:59 -0400 -Subject: [PATCH] Use OpenSSL's SSKDF in PKINIT when available - -Starting in 3.0, OpenSSL implements SSKDF, which is the basis of our -id-pkinit-kdf (RFC 8636). Factor out common setup code around -other_info. Adjust code to comply to existing style. - -(cherry picked from commit 4376a22e41fb639be31daf81275a332d3f930996) ---- - .../preauth/pkinit/pkinit_crypto_openssl.c | 294 +++++++++++------- - 1 file changed, 181 insertions(+), 113 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e1153344e..350c2118a 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -38,6 +38,12 @@ - #include - #include - -+#ifdef HAVE_EVP_KDF_FETCH -+#include -+#include -+#include -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2294,15 +2300,16 @@ cleanup: - } - - --/** -+/* - * Given an algorithm_identifier, this function returns the hash length - * and EVP function associated with that algorithm. -+ * -+ * RFC 8636 defines a SHA384 variant, but we don't use it. - */ - static krb5_error_code --pkinit_alg_values(krb5_context context, -- const krb5_data *alg_id, -- size_t *hash_bytes, -- const EVP_MD *(**func)(void)) -+pkinit_alg_values(krb5_context context, const krb5_data *alg_id, -+ size_t *hash_bytes, const EVP_MD *(**func)(void), -+ char **hash_name) - { - *hash_bytes = 0; - *func = NULL; -@@ -2311,18 +2318,21 @@ pkinit_alg_values(krb5_context context, - krb5_pkinit_sha1_oid_len))) { - *hash_bytes = 20; - *func = &EVP_sha1; -+ *hash_name = strdup("SHA1"); - return 0; - } else if ((alg_id->length == krb5_pkinit_sha256_oid_len) && - (0 == memcmp(alg_id->data, krb5_pkinit_sha256_oid, - krb5_pkinit_sha256_oid_len))) { - *hash_bytes = 32; - *func = &EVP_sha256; -+ *hash_name = strdup("SHA256"); - return 0; - } else if ((alg_id->length == krb5_pkinit_sha512_oid_len) && - (0 == memcmp(alg_id->data, krb5_pkinit_sha512_oid, - krb5_pkinit_sha512_oid_len))) { - *hash_bytes = 64; - *func = &EVP_sha512; -+ *hash_name = strdup("SHA512"); - return 0; - } else { - krb5_set_error_message(context, KRB5_ERR_BAD_S2K_PARAMS, -@@ -2331,11 +2341,60 @@ pkinit_alg_values(krb5_context context, - } - } /* pkinit_alg_values() */ - -+#ifdef HAVE_EVP_KDF_FETCH -+static krb5_error_code -+openssl_sskdf(krb5_context context, size_t hash_bytes, krb5_data *key, -+ krb5_data *info, char *out, size_t out_len, char *digest) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[4]; -+ size_t i = 0; - --/* pkinit_alg_agility_kdf() -- -- * This function generates a key using the KDF described in -- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt. The algorithm is -- * described as follows: -+ if (digest == NULL) { -+ ret = oerr(context, ENOMEM, -+ _("Failed to allocate space for digest algorithm name")); -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL); -+ if (kdf == NULL) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, _("Failed to fetch SSKDF")); -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, -+ _("Failed to instantiate SSKDF")); -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, -+ digest, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ key->data, key->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, -+ info->data, info->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)out, out_len, params) <= 0) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, -+ _("Failed to derive key using SSKDF")); -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+#else -+/* -+ * Generate a key using the KDF described in RFC 8636, also known as SSKDF -+ * (single-step kdf). Our caller precomputes `reps`, but otherwise the -+ * algorithm is as follows: - * - * 1. reps = keydatalen (K) / hash length (H) - * -@@ -2349,95 +2408,16 @@ pkinit_alg_values(krb5_context context, - * - * 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. - */ --krb5_error_code --pkinit_alg_agility_kdf(krb5_context context, -- krb5_data *secret, -- krb5_data *alg_oid, -- krb5_const_principal party_u_info, -- krb5_const_principal party_v_info, -- krb5_enctype enctype, -- krb5_data *as_req, -- krb5_data *pk_as_rep, -- krb5_keyblock *key_block) -+static krb5_error_code -+builtin_sskdf(krb5_context context, unsigned int reps, size_t hash_len, -+ const EVP_MD *(*EVP_func)(void), krb5_data *secret, -+ krb5_data *other_info, char *out, size_t out_len) - { -- krb5_error_code retval = 0; -+ krb5_error_code ret = 0; - -- unsigned int reps = 0; -- uint32_t counter = 1; /* Does this type work on Windows? */ -+ uint32_t counter = 1; - size_t offset = 0; -- size_t hash_len = 0; -- size_t rand_len = 0; -- size_t key_len = 0; -- krb5_data random_data; -- krb5_sp80056a_other_info other_info_fields; -- krb5_pkinit_supp_pub_info supp_pub_info_fields; -- krb5_data *other_info = NULL; -- krb5_data *supp_pub_info = NULL; -- krb5_algorithm_identifier alg_id; - EVP_MD_CTX *ctx = NULL; -- const EVP_MD *(*EVP_func)(void); -- -- /* initialize random_data here to make clean-up safe */ -- random_data.length = 0; -- random_data.data = NULL; -- -- /* allocate and initialize the key block */ -- key_block->magic = 0; -- key_block->enctype = enctype; -- if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len, -- &key_len))) -- goto cleanup; -- -- random_data.length = rand_len; -- key_block->length = key_len; -- -- if (NULL == (key_block->contents = malloc(key_block->length))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- memset (key_block->contents, 0, key_block->length); -- -- /* If this is anonymous pkinit, use the anonymous principle for party_u_info */ -- if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info, -- krb5_anonymous_principal())) -- party_u_info = (krb5_principal)krb5_anonymous_principal(); -- -- if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func))) -- goto cleanup; -- -- /* 1. reps = keydatalen (K) / hash length (H) */ -- reps = key_block->length/hash_len; -- -- /* ... and round up, if necessary */ -- if (key_block->length > (reps * hash_len)) -- reps++; -- -- /* Allocate enough space in the random data buffer to hash directly into -- * it, even if the last hash will make it bigger than the key length. */ -- if (NULL == (random_data.data = malloc(reps * hash_len))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- /* Encode the ASN.1 octet string for "SuppPubInfo" */ -- supp_pub_info_fields.enctype = enctype; -- supp_pub_info_fields.as_req = *as_req; -- supp_pub_info_fields.pk_as_rep = *pk_as_rep; -- if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -- &supp_pub_info)))) -- goto cleanup; -- -- /* Now encode the ASN.1 octet string for "OtherInfo" */ -- memset(&alg_id, 0, sizeof alg_id); -- alg_id.algorithm = *alg_oid; /*alias*/ -- -- other_info_fields.algorithm_identifier = alg_id; -- other_info_fields.party_u_info = (krb5_principal) party_u_info; -- other_info_fields.party_v_info = (krb5_principal) party_v_info; -- other_info_fields.supp_pub_info = *supp_pub_info; -- if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info))) -- goto cleanup; - - /* 2. Initialize a 32-bit, big-endian bit string counter as 1. - * 3. For i = 1 to reps by 1, do the following: -@@ -2450,7 +2430,7 @@ pkinit_alg_agility_kdf(krb5_context context, - - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) { -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -@@ -2458,7 +2438,7 @@ pkinit_alg_agility_kdf(krb5_context context, - if (!EVP_DigestInit(ctx, EVP_func())) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestInit() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -@@ -2467,15 +2447,16 @@ pkinit_alg_agility_kdf(krb5_context context, - !EVP_DigestUpdate(ctx, other_info->data, other_info->length)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -- /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */ -- if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) { -+ /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K -+ * bytes. */ -+ if (!EVP_DigestFinal(ctx, (unsigned char *)out + offset, &s)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - offset += s; -@@ -2484,26 +2465,113 @@ pkinit_alg_agility_kdf(krb5_context context, - EVP_MD_CTX_free(ctx); - ctx = NULL; - } -- -- retval = krb5_c_random_to_key(context, enctype, &random_data, -- key_block); -- - cleanup: - EVP_MD_CTX_free(ctx); -+ return ret; -+} /* builtin_sskdf() */ -+#endif /* HAVE_EVP_KDF_FETCH */ - -- /* If this has been an error, free the allocated key_block, if any */ -- if (retval) { -- krb5_free_keyblock_contents(context, key_block); -+/* id-pkinit-kdf family, as specified by RFC 8636. */ -+krb5_error_code -+pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret, -+ krb5_data *alg_oid, krb5_const_principal party_u_info, -+ krb5_const_principal party_v_info, -+ krb5_enctype enctype, krb5_data *as_req, -+ krb5_data *pk_as_rep, krb5_keyblock *key_block) -+{ -+ krb5_error_code ret; -+ size_t hash_len = 0, rand_len = 0, key_len = 0; -+ const EVP_MD *(*EVP_func)(void); -+ krb5_sp80056a_other_info other_info_fields; -+ krb5_pkinit_supp_pub_info supp_pub_info_fields; -+ krb5_data *other_info = NULL, *supp_pub_info = NULL; -+ krb5_data random_data = empty_data(); -+ krb5_algorithm_identifier alg_id; -+ unsigned int reps; -+ char *hash_name = NULL; -+ -+ /* Allocate and initialize the key block. */ -+ key_block->magic = 0; -+ key_block->enctype = enctype; -+ -+ /* Use separate variables to avoid alignment restriction problems. */ -+ ret = krb5_c_keylengths(context, enctype, &rand_len, &key_len); -+ if (ret) -+ goto cleanup; -+ random_data.length = rand_len; -+ key_block->length = key_len; -+ -+ key_block->contents = k5calloc(key_block->length, 1, &ret); -+ if (key_block->contents == NULL) -+ goto cleanup; -+ -+ /* If this is anonymous pkinit, use the anonymous principle for -+ * party_u_info. */ -+ if (party_u_info && -+ krb5_principal_compare_any_realm(context, party_u_info, -+ krb5_anonymous_principal())) { -+ party_u_info = (krb5_principal)krb5_anonymous_principal(); - } - -- /* free other allocated resources, either way */ -- if (random_data.data) -- free(random_data.data); -+ ret = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func, -+ &hash_name); -+ if (ret) -+ goto cleanup; -+ -+ /* 1. reps = keydatalen (K) / hash length (H) */ -+ reps = key_block->length / hash_len; -+ -+ /* ... and round up, if necessary. */ -+ if (key_block->length > (reps * hash_len)) -+ reps++; -+ -+ /* Allocate enough space in the random data buffer to hash directly into -+ * it, even if the last hash will make it bigger than the key length. */ -+ random_data.data = k5alloc(reps * hash_len, &ret); -+ if (random_data.data == NULL) -+ goto cleanup; -+ -+ /* Encode the ASN.1 octet string for "SuppPubInfo". */ -+ supp_pub_info_fields.enctype = enctype; -+ supp_pub_info_fields.as_req = *as_req; -+ supp_pub_info_fields.pk_as_rep = *pk_as_rep; -+ ret = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -+ &supp_pub_info); -+ if (ret) -+ goto cleanup; -+ -+ /* Now encode the ASN.1 octet string for "OtherInfo". */ -+ memset(&alg_id, 0, sizeof(alg_id)); -+ alg_id.algorithm = *alg_oid; -+ other_info_fields.algorithm_identifier = alg_id; -+ other_info_fields.party_u_info = (krb5_principal)party_u_info; -+ other_info_fields.party_v_info = (krb5_principal)party_v_info; -+ other_info_fields.supp_pub_info = *supp_pub_info; -+ ret = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info); -+ if (ret) -+ goto cleanup; -+ -+#ifdef HAVE_EVP_KDF_FETCH -+ ret = openssl_sskdf(context, hash_len, secret, other_info, -+ random_data.data, key_block->length, hash_name); -+#else -+ ret = builtin_sskdf(context, reps, hash_len, EVP_func, secret, -+ other_info, random_data.data, key_block->length); -+#endif -+ if (ret) -+ goto cleanup; -+ -+ ret = krb5_c_random_to_key(context, enctype, &random_data, key_block); -+cleanup: -+ if (ret) -+ krb5_free_keyblock_contents(context, key_block); -+ -+ free(hash_name); -+ zapfree(random_data.data, random_data.length); - krb5_free_data(context, other_info); - krb5_free_data(context, supp_pub_info); -- -- return retval; --} /*pkinit_alg_agility_kdf() */ -+ return ret; -+} - - /* Call DH_compute_key() and ensure that we left-pad short results instead of - * leaving junk bytes at the end of the buffer. */ diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch deleted file mode 100644 index ace4da9..0000000 --- a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 538be893707e2306e89f5e5ca92c0db0ee305e3e Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Fri, 11 Mar 2022 11:33:56 +0100 -Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest - -Various organizations including NIST have been strongly recommending to -stop using SHA-1 for digital signatures for some years already. CMS -digest is used to generate such signatures, hence it should be upgraded -to use SHA-256. ---- - .../preauth/pkinit/pkinit_crypto_openssl.c | 27 ++++++++++--------- - 1 file changed, 14 insertions(+), 13 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 42e5c581d..2a6ef4aaa 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -1240,7 +1240,7 @@ cms_signeddata_create(krb5_context context, - /* will not fill-out EVP_PKEY because it's on the smartcard */ - - /* Set digest algs */ -- p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1); -+ p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256); - - if (p7si->digest_alg->parameter != NULL) - ASN1_TYPE_free(p7si->digest_alg->parameter); -@@ -1251,17 +1251,17 @@ cms_signeddata_create(krb5_context context, - /* Set sig algs */ - if (p7si->digest_enc_alg->parameter != NULL) - ASN1_TYPE_free(p7si->digest_enc_alg->parameter); -- p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption); -+ p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption); - if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new())) - goto cleanup; - p7si->digest_enc_alg->parameter->type = V_ASN1_NULL; - - /* add signed attributes */ -- /* compute sha1 digest over the EncapsulatedContentInfo */ -+ /* compute sha256 digest over the EncapsulatedContentInfo */ - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) - goto cleanup; -- EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); -+ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); - EVP_DigestUpdate(ctx, data, data_len); - md_tmp = EVP_MD_CTX_md(ctx); - EVP_DigestFinal_ex(ctx, md_data, &md_len); -@@ -1289,9 +1289,10 @@ cms_signeddata_create(krb5_context context, - goto cleanup2; - - #ifndef WITHOUT_PKCS11 -- /* Some tokens can only do RSAEncryption without sha1 hash */ -- /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash -- * function and the hash value into an ASN.1 value of type DigestInfo -+ /* Some tokens can only do RSAEncryption without sha256 hash */ -+ /* to compute sha256WithRSAEncryption, encode the algorithm ID for the -+ * hash function and the hash value into an ASN.1 value of type -+ * DigestInfo - * DigestInfo::=SEQUENCE { - * digestAlgorithm AlgorithmIdentifier, - * digest OCTET STRING } -@@ -1310,7 +1311,7 @@ cms_signeddata_create(krb5_context context, - alg = X509_ALGOR_new(); - if (alg == NULL) - goto cleanup2; -- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL); -+ X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); - alg_len = i2d_X509_ALGOR(alg, NULL); - - digest = ASN1_OCTET_STRING_new(); -@@ -1339,7 +1340,7 @@ cms_signeddata_create(krb5_context context, - #endif - { - pkiDebug("mech = %s\n", -- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS"); -+ id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); - retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, - &sig, &sig_len); - } -@@ -4189,7 +4190,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len, - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) - return ENOMEM; -- EVP_SignInit(ctx, EVP_sha1()); -+ EVP_SignInit(ctx, EVP_sha256()); - EVP_SignUpdate(ctx, data, data_len); - *sig_len = EVP_PKEY_size(pkey); - if ((*sig = malloc(*sig_len)) == NULL) -@@ -4663,10 +4664,10 @@ pkinit_get_certs_pkcs11(krb5_context context, - - #ifndef PKINIT_USE_MECH_LIST - /* -- * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but -+ * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but - * many cards seems to be confused about whether they are capable of - * this or not. The safe thing seems to be to ignore the mechanism list, -- * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves. -+ * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves. - */ - - id_cryptoctx->mech = CKM_RSA_PKCS; -@@ -4694,7 +4695,7 @@ pkinit_get_certs_pkcs11(krb5_context context, - if (mechp[i] == CKM_RSA_PKCS) { - /* This seems backwards... */ - id_cryptoctx->mech = -- (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS; -+ (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS; - } - } - free(mechp); --- -2.35.1 - diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch deleted file mode 100644 index 4964d2f..0000000 --- a/Use-asan-in-one-of-the-CI-builds.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 37e1fe755c6e976253a7f40ec7a9e740e4329789 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 21 Jun 2021 19:15:26 -0400 -Subject: [PATCH] Use asan in one of the CI builds - -(cherry picked from commit 7368354bcd0b58480a88b1fb81e63bd6aae7edf2) ---- - .github/workflows/build.yml | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml -index 8d1042b7b..06a35b7b9 100644 ---- a/.github/workflows/build.yml -+++ b/.github/workflows/build.yml -@@ -17,6 +17,7 @@ jobs: - os: ubuntu-18.04 - compiler: clang - makevars: CPPFLAGS=-Werror -+ configureopts: --enable-asan - - name: linux-clang-openssl - os: ubuntu-18.04 - compiler: clang diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch deleted file mode 100644 index 4a9f664..0000000 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ /dev/null @@ -1,752 +0,0 @@ -From 86d606e33439fd0511c5154be7f32b0df2c72e54 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 15 Nov 2019 20:05:16 +0000 -Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF - interface - -Last-updated: krb5-1.17 ---- - src/configure.ac | 4 + - src/lib/crypto/krb/derive.c | 356 +++++++++++++----- - .../preauth/pkinit/pkinit_crypto_openssl.c | 257 ++++++++----- - 3 files changed, 428 insertions(+), 189 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 3e1052db7..ea708491b 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) - AC_SUBST(CRYPTO_IMPL_CFLAGS) - AC_SUBST(CRYPTO_IMPL_LIBS) - -+AC_CHECK_FUNCS(EVP_KDF_CTX_new_id EVP_KDF_ctrl EVP_KDF_derive, -+ AC_DEFINE(OSSL_KDFS, 1, [Define if using OpenSSL KDFs]), -+ AC_MSG_ERROR([backported OpenSSL KDFs not found])) -+ - AC_ARG_WITH([prng-alg], - AC_HELP_STRING([--with-prng-alg=ALG], [use specified PRNG algorithm. @<:@fortuna@:>@]), - [PRNG_ALG=$withval -diff --git a/src/lib/crypto/krb/derive.c b/src/lib/crypto/krb/derive.c -index 6707a7308..915a173dd 100644 ---- a/src/lib/crypto/krb/derive.c -+++ b/src/lib/crypto/krb/derive.c -@@ -27,6 +27,13 @@ - - #include "crypto_int.h" - -+#ifdef OSSL_KDFS -+#include -+#include -+#else -+#error "Refusing to build without OpenSSL KDFs!" -+#endif -+ - static krb5_key - find_cached_dkey(struct derived_key *list, const krb5_data *constant) - { -@@ -77,55 +84,193 @@ cleanup: - return ENOMEM; - } - -+#ifdef OSSL_KDFS - static krb5_error_code --derive_random_rfc3961(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+openssl_kbdkf_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, const krb5_data *context) - { -- size_t blocksize, keybytes, n; -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_MD *digest; -+ -+ if (!strcmp(hash->hash_name, "SHA1")) -+ digest = EVP_sha1(); -+ else if (!strcmp(hash->hash_name, "SHA-256")) -+ digest = EVP_sha256(); -+ else if (!strcmp(hash->hash_name, "SHA-384")) -+ digest = EVP_sha384(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KB); -+ if (!ctx) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE, -+ EVP_KDF_KB_MAC_TYPE_HMAC) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ (context->length > 0 && -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_INFO, context->data, -+ context->length) != 1) || -+ (label->length > 0 && -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SALT, label->data, -+ label->length) != 1) || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_kbkdf_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_CIPHER *cipher; -+ static unsigned char zeroes[16]; -+ -+ memset(zeroes, 0, sizeof(zeroes)); -+ -+ if (enc->keylength == 16) -+ cipher = EVP_camellia_128_cbc(); -+ else if (enc->keylength == 32) -+ cipher = EVP_camellia_256_cbc(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KB); -+ if (!ctx) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MODE, -+ EVP_KDF_KB_MODE_FEEDBACK) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE, -+ EVP_KDF_KB_MAC_TYPE_CMAC) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_CIPHER, cipher) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SALT, in_constant->data, -+ in_constant->length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_SEED, zeroes, -+ sizeof(zeroes)) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_krb5kdf(const struct krb5_enc_provider *enc, krb5_key inkey, -+ krb5_data *outrnd, const krb5_data *in_constant) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_CIPHER *cipher; -+ -+ if (inkey->keyblock.length != enc->keylength || -+ outrnd->length != enc->keybytes) { -+ return KRB5_CRYPTO_INTERNAL; -+ } -+ -+ if (enc->encrypt == krb5int_aes_encrypt && enc->keylength == 16) -+ cipher = EVP_aes_128_cbc(); -+ else if (enc->encrypt == krb5int_aes_encrypt && enc->keylength == 32) -+ cipher = EVP_aes_256_cbc(); -+ else if (enc->keylength == 24) -+ cipher = EVP_des_ede3_cbc(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KRB5KDF); -+ if (ctx == NULL) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_CIPHER, cipher) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KRB5KDF_CONSTANT, -+ in_constant->data, in_constant->length) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+#else /* OSSL_KDFS */ -+ -+/* -+ * NIST SP800-108 KDF in counter mode (section 5.1). -+ * Parameters: -+ * - HMAC (with hash as the hash provider) is the PRF. -+ * - A block counter of four bytes is used. -+ * - Four bytes are used to encode the output length in the PRF input. -+ * -+ * There are no uses requiring more than a single PRF invocation. -+ */ -+static krb5_error_code -+builtin_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, -+ const krb5_data *context) -+{ -+ krb5_crypto_iov iov[5]; - krb5_error_code ret; -- krb5_data block = empty_data(); -+ krb5_data prf; -+ unsigned char ibuf[4], lbuf[4]; - -- blocksize = enc->block_size; -- keybytes = enc->keybytes; -- -- if (blocksize == 1) -- return KRB5_BAD_ENCTYPE; -- if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ if (hash == NULL || outrnd->length > hash->hashsize) - return KRB5_CRYPTO_INTERNAL; - - /* Allocate encryption data buffer. */ -- ret = alloc_data(&block, blocksize); -+ ret = alloc_data(&prf, hash->hashsize); - if (ret) - return ret; - -- /* Initialize the input block. */ -- if (in_constant->length == blocksize) { -- memcpy(block.data, in_constant->data, blocksize); -- } else { -- krb5int_nfold(in_constant->length * 8, -- (unsigned char *) in_constant->data, -- blocksize * 8, (unsigned char *) block.data); -- } -+ /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -+ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[0].data = make_data(ibuf, sizeof(ibuf)); -+ store_32_be(1, ibuf); -+ /* Label */ -+ iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[1].data = *label; -+ /* 0x00: separator byte */ -+ iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[2].data = make_data("", 1); -+ /* Context */ -+ iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[3].data = *context; -+ /* [L]2: four-byte big-endian binary string giving the output length */ -+ iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[4].data = make_data(lbuf, sizeof(lbuf)); -+ store_32_be(outrnd->length * 8, lbuf); - -- /* Loop encrypting the blocks until enough key bytes are generated. */ -- n = 0; -- while (n < keybytes) { -- ret = encrypt_block(enc, inkey, &block); -- if (ret) -- goto cleanup; -- -- if ((keybytes - n) <= blocksize) { -- memcpy(outrnd->data + n, block.data, (keybytes - n)); -- break; -- } -- -- memcpy(outrnd->data + n, block.data, blocksize); -- n += blocksize; -- } -- --cleanup: -- zapfree(block.data, blocksize); -+ ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -+ if (!ret) -+ memcpy(outrnd->data, prf.data, outrnd->length); -+ zapfree(prf.data, prf.length); - return ret; - } - -@@ -139,9 +284,9 @@ cleanup: - * - Four bytes are used to encode the output length in the PRF input. - */ - static krb5_error_code --derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+builtin_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) - { - size_t blocksize, keybytes, n; - krb5_crypto_iov iov[6]; -@@ -204,56 +349,94 @@ cleanup: - return ret; - } - --/* -- * NIST SP800-108 KDF in counter mode (section 5.1). -- * Parameters: -- * - HMAC (with hash as the hash provider) is the PRF. -- * - A block counter of four bytes is used. -- * - Four bytes are used to encode the output length in the PRF input. -- * -- * There are no uses requiring more than a single PRF invocation. -- */ -+static krb5_error_code -+builtin_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ size_t blocksize, keybytes, n; -+ krb5_error_code ret; -+ krb5_data block = empty_data(); -+ -+ blocksize = enc->block_size; -+ keybytes = enc->keybytes; -+ -+ if (blocksize == 1) -+ return KRB5_BAD_ENCTYPE; -+ if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ return KRB5_CRYPTO_INTERNAL; -+ -+ /* Allocate encryption data buffer. */ -+ ret = alloc_data(&block, blocksize); -+ if (ret) -+ return ret; -+ -+ /* Initialize the input block. */ -+ if (in_constant->length == blocksize) { -+ memcpy(block.data, in_constant->data, blocksize); -+ } else { -+ krb5int_nfold(in_constant->length * 8, -+ (unsigned char *) in_constant->data, -+ blocksize * 8, (unsigned char *) block.data); -+ } -+ -+ /* Loop encrypting the blocks until enough key bytes are generated. */ -+ n = 0; -+ while (n < keybytes) { -+ ret = encrypt_block(enc, inkey, &block); -+ if (ret) -+ goto cleanup; -+ -+ if ((keybytes - n) <= blocksize) { -+ memcpy(outrnd->data + n, block.data, (keybytes - n)); -+ break; -+ } -+ -+ memcpy(outrnd->data + n, block.data, blocksize); -+ n += blocksize; -+ } -+ -+cleanup: -+ zapfree(block.data, blocksize); -+ return ret; -+} -+#endif /* OSSL_KDFS */ -+ - krb5_error_code - k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, - krb5_key inkey, krb5_data *outrnd, - const krb5_data *label, const krb5_data *context) - { -- krb5_crypto_iov iov[5]; -- krb5_error_code ret; -- krb5_data prf; -- unsigned char ibuf[4], lbuf[4]; -+#ifdef OSSL_KDFS -+ return openssl_kbdkf_counter_hmac(hash, inkey, outrnd, label, context); -+#else -+ return builtin_sp800_108_counter_hmac(hash, inkey, outrnd, label, -+ context); -+#endif -+} - -- if (hash == NULL || outrnd->length > hash->hashsize) -- return KRB5_CRYPTO_INTERNAL; -+static krb5_error_code -+k5_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef OSSL_KDFS -+ return openssl_kbkdf_feedback_cmac(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); -+#endif -+} - -- /* Allocate encryption data buffer. */ -- ret = alloc_data(&prf, hash->hashsize); -- if (ret) -- return ret; -- -- /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data = make_data(ibuf, sizeof(ibuf)); -- store_32_be(1, ibuf); -- /* Label */ -- iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[1].data = *label; -- /* 0x00: separator byte */ -- iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[2].data = make_data("", 1); -- /* Context */ -- iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[3].data = *context; -- /* [L]2: four-byte big-endian binary string giving the output length */ -- iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[4].data = make_data(lbuf, sizeof(lbuf)); -- store_32_be(outrnd->length * 8, lbuf); -- -- ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -- if (!ret) -- memcpy(outrnd->data, prf.data, outrnd->length); -- zapfree(prf.data, prf.length); -- return ret; -+static krb5_error_code -+k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef OSSL_KDFS -+ return openssl_krb5kdf(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+#endif - } - - krb5_error_code -@@ -266,10 +449,9 @@ krb5int_derive_random(const struct krb5_enc_provider *enc, - - switch (alg) { - case DERIVE_RFC3961: -- return derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+ return k5_derive_random_rfc3961(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_CMAC: -- return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd, -- in_constant); -+ return k5_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_HMAC: - return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, - &empty); -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e1153344e..911e74fd9 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -38,6 +38,13 @@ - #include - #include - -+#ifdef OSSL_KDFS -+#include -+#include -+#else -+#error "Refusing to build without OpenSSL KDFs!" -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2331,11 +2338,51 @@ pkinit_alg_values(krb5_context context, - } - } /* pkinit_alg_values() */ - -+#ifdef OSSL_KDFS -+static krb5_error_code -+openssl_sskdf(krb5_context context, size_t hash_bytes, krb5_data *key, -+ krb5_data *info, char *out, size_t out_len) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_MD *digest; - --/* pkinit_alg_agility_kdf() -- -- * This function generates a key using the KDF described in -- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt. The algorithm is -- * described as follows: -+ /* RFC 8636 defines a SHA384 variant, but we don't use it. */ -+ if (hash_bytes == 20) { -+ digest = EVP_sha1(); -+ } else if (hash_bytes == 32) { -+ digest = EVP_sha256(); -+ } else if (hash_bytes == 64) { -+ digest = EVP_sha512(); -+ } else { -+ krb5_set_error_message(context, ret, "Bad hash type for SSKDF"); -+ goto done; -+ } -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_SS); -+ if (!ctx) { -+ oerr(context, ret, _("Failed to instantiate SSKDF")); -+ goto done; -+ } -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key->data, -+ key->length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSKDF_INFO, info->data, -+ info->length) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)out, out_len) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+#else -+/* -+ * Generate a key using the KDF described in RFC 8636, also known as SSKDF -+ * (single-step kdf). Our caller precomputes `reps`, but otherwise the -+ * algorithm is as follows: - * - * 1. reps = keydatalen (K) / hash length (H) - * -@@ -2349,95 +2396,16 @@ pkinit_alg_values(krb5_context context, - * - * 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. - */ --krb5_error_code --pkinit_alg_agility_kdf(krb5_context context, -- krb5_data *secret, -- krb5_data *alg_oid, -- krb5_const_principal party_u_info, -- krb5_const_principal party_v_info, -- krb5_enctype enctype, -- krb5_data *as_req, -- krb5_data *pk_as_rep, -- krb5_keyblock *key_block) -+static krb5_error_code -+builtin_sskdf(krb5_context context, unsigned int reps, size_t hash_len, -+ const EVP_MD *(*EVP_func)(void), krb5_data *secret, -+ krb5_data *other_info, char *out, size_t out_len) - { - krb5_error_code retval = 0; - -- unsigned int reps = 0; -- uint32_t counter = 1; /* Does this type work on Windows? */ -+ uint32_t counter = 1; - size_t offset = 0; -- size_t hash_len = 0; -- size_t rand_len = 0; -- size_t key_len = 0; -- krb5_data random_data; -- krb5_sp80056a_other_info other_info_fields; -- krb5_pkinit_supp_pub_info supp_pub_info_fields; -- krb5_data *other_info = NULL; -- krb5_data *supp_pub_info = NULL; -- krb5_algorithm_identifier alg_id; - EVP_MD_CTX *ctx = NULL; -- const EVP_MD *(*EVP_func)(void); -- -- /* initialize random_data here to make clean-up safe */ -- random_data.length = 0; -- random_data.data = NULL; -- -- /* allocate and initialize the key block */ -- key_block->magic = 0; -- key_block->enctype = enctype; -- if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len, -- &key_len))) -- goto cleanup; -- -- random_data.length = rand_len; -- key_block->length = key_len; -- -- if (NULL == (key_block->contents = malloc(key_block->length))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- memset (key_block->contents, 0, key_block->length); -- -- /* If this is anonymous pkinit, use the anonymous principle for party_u_info */ -- if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info, -- krb5_anonymous_principal())) -- party_u_info = (krb5_principal)krb5_anonymous_principal(); -- -- if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func))) -- goto cleanup; -- -- /* 1. reps = keydatalen (K) / hash length (H) */ -- reps = key_block->length/hash_len; -- -- /* ... and round up, if necessary */ -- if (key_block->length > (reps * hash_len)) -- reps++; -- -- /* Allocate enough space in the random data buffer to hash directly into -- * it, even if the last hash will make it bigger than the key length. */ -- if (NULL == (random_data.data = malloc(reps * hash_len))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- /* Encode the ASN.1 octet string for "SuppPubInfo" */ -- supp_pub_info_fields.enctype = enctype; -- supp_pub_info_fields.as_req = *as_req; -- supp_pub_info_fields.pk_as_rep = *pk_as_rep; -- if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -- &supp_pub_info)))) -- goto cleanup; -- -- /* Now encode the ASN.1 octet string for "OtherInfo" */ -- memset(&alg_id, 0, sizeof alg_id); -- alg_id.algorithm = *alg_oid; /*alias*/ -- -- other_info_fields.algorithm_identifier = alg_id; -- other_info_fields.party_u_info = (krb5_principal) party_u_info; -- other_info_fields.party_v_info = (krb5_principal) party_v_info; -- other_info_fields.supp_pub_info = *supp_pub_info; -- if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info))) -- goto cleanup; - - /* 2. Initialize a 32-bit, big-endian bit string counter as 1. - * 3. For i = 1 to reps by 1, do the following: -@@ -2471,8 +2439,9 @@ pkinit_alg_agility_kdf(krb5_context context, - goto cleanup; - } - -- /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */ -- if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) { -+ /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K -+ * bytes. */ -+ if (!EVP_DigestFinal(ctx, (unsigned char *)out + offset, &s)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); - retval = KRB5_CRYPTO_INTERNAL; -@@ -2484,26 +2453,110 @@ pkinit_alg_agility_kdf(krb5_context context, - EVP_MD_CTX_free(ctx); - ctx = NULL; - } -- -- retval = krb5_c_random_to_key(context, enctype, &random_data, -- key_block); -- - cleanup: - EVP_MD_CTX_free(ctx); -+ return retval; -+} /* builtin_sskdf() */ -+#endif /* OSSL_KDFS */ - -- /* If this has been an error, free the allocated key_block, if any */ -- if (retval) { -- krb5_free_keyblock_contents(context, key_block); -+/* id-pkinit-kdf family, as specified by RFC 8636. */ -+krb5_error_code -+pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret, -+ krb5_data *alg_oid, krb5_const_principal party_u_info, -+ krb5_const_principal party_v_info, -+ krb5_enctype enctype, krb5_data *as_req, -+ krb5_data *pk_as_rep, krb5_keyblock *key_block) -+{ -+ krb5_error_code retval; -+ size_t hash_len = 0, rand_len = 0, key_len = 0; -+ const EVP_MD *(*EVP_func)(void); -+ krb5_sp80056a_other_info other_info_fields; -+ krb5_pkinit_supp_pub_info supp_pub_info_fields; -+ krb5_data *other_info = NULL, *supp_pub_info = NULL; -+ krb5_data random_data = empty_data(); -+ krb5_algorithm_identifier alg_id; -+ unsigned int reps; -+ -+ /* Allocate and initialize the key block. */ -+ key_block->magic = 0; -+ key_block->enctype = enctype; -+ -+ /* Use separate variables to avoid alignment restriction problems. */ -+ retval = krb5_c_keylengths(context, enctype, &rand_len, &key_len); -+ if (retval) -+ goto cleanup; -+ random_data.length = rand_len; -+ key_block->length = key_len; -+ -+ key_block->contents = k5calloc(key_block->length, 1, &retval); -+ if (key_block->contents == NULL) -+ goto cleanup; -+ -+ /* If this is anonymous pkinit, use the anonymous principle for -+ * party_u_info. */ -+ if (party_u_info && -+ krb5_principal_compare_any_realm(context, party_u_info, -+ krb5_anonymous_principal())) { -+ party_u_info = (krb5_principal)krb5_anonymous_principal(); - } - -- /* free other allocated resources, either way */ -- if (random_data.data) -- free(random_data.data); -+ retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func); -+ if (retval) -+ goto cleanup; -+ -+ /* 1. reps = keydatalen (K) / hash length (H) */ -+ reps = key_block->length / hash_len; -+ -+ /* ... and round up, if necessary. */ -+ if (key_block->length > (reps * hash_len)) -+ reps++; -+ -+ /* Allocate enough space in the random data buffer to hash directly into -+ * it, even if the last hash will make it bigger than the key length. */ -+ random_data.data = k5alloc(reps * hash_len, &retval); -+ if (random_data.data == NULL) -+ goto cleanup; -+ -+ /* Encode the ASN.1 octet string for "SuppPubInfo". */ -+ supp_pub_info_fields.enctype = enctype; -+ supp_pub_info_fields.as_req = *as_req; -+ supp_pub_info_fields.pk_as_rep = *pk_as_rep; -+ retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -+ &supp_pub_info); -+ if (retval) -+ goto cleanup; -+ -+ /* Now encode the ASN.1 octet string for "OtherInfo". */ -+ memset(&alg_id, 0, sizeof(alg_id)); -+ alg_id.algorithm = *alg_oid; -+ other_info_fields.algorithm_identifier = alg_id; -+ other_info_fields.party_u_info = (krb5_principal)party_u_info; -+ other_info_fields.party_v_info = (krb5_principal)party_v_info; -+ other_info_fields.supp_pub_info = *supp_pub_info; -+ retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info); -+ if (retval) -+ goto cleanup; -+ -+#ifdef OSSL_KDFS -+ retval = openssl_sskdf(context, hash_len, secret, other_info, -+ random_data.data, key_block->length); -+#else -+ retval = builtin_sskdf(context, reps, hash_len, EVP_func, secret, -+ other_info, random_data.data, key_block->length); -+#endif -+ if (retval) -+ goto cleanup; -+ -+ retval = krb5_c_random_to_key(context, enctype, &random_data, key_block); -+cleanup: -+ if (retval) -+ krb5_free_keyblock_contents(context, key_block); -+ -+ zapfree(random_data.data, random_data.length); - krb5_free_data(context, other_info); - krb5_free_data(context, supp_pub_info); -- - return retval; --} /*pkinit_alg_agility_kdf() */ -+} - - /* Call DH_compute_key() and ensure that we left-pad short results instead of - * leaving junk bytes at the end of the buffer. */ diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch deleted file mode 100644 index 32111ec..0000000 --- a/krb5-krad-larger-attrs.patch +++ /dev/null @@ -1,69 +0,0 @@ -From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Mon, 8 Nov 2021 17:48:50 +0100 -Subject: [PATCH] Support larger RADIUS attributes in libkrad - -In kr_attrset_decode(), explicitly treat the length byte as unsigned. -Otherwise attributes longer than 125 characters will be rejected with -EBADMSG. - -Add a 253-character-long NAS-Identifier attribute to the tests to make -sure that attributes with the maximal number of characters are working -as expected. - -[ghudson@mit.edu: used uint8_t cast per current practices; edited -commit message] - -ticket: 9036 (new) ---- - src/lib/krad/attrset.c | 2 +- - src/lib/krad/t_packet.c | 13 +++++++++++++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c -index 03c613716..f309f1581 100644 ---- a/src/lib/krad/attrset.c -+++ b/src/lib/krad/attrset.c -@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret, - - for (i = 0; i + 2 < in->length; ) { - type = in->data[i++]; -- tmp = make_data(&in->data[i + 1], in->data[i] - 2); -+ tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2); - i += tmp.length + 1; - - retval = (in->length < i) ? EBADMSG : 0; -diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c -index 0a92e9cc2..c22489144 100644 ---- a/src/lib/krad/t_packet.c -+++ b/src/lib/krad/t_packet.c -@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username, - krb5_error_code retval; - const krb5_data *data; - int i = 0; -+ krb5_data nas_id; -+ -+ nas_id = string2data("12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "123"); - - retval = krad_attrset_new(ctx, &set); - if (retval != 0) -@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username, - if (retval != 0) - goto out; - -+ retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"), -+ &nas_id); -+ if (retval != 0) -+ goto out; -+ - retval = krad_packet_new_request(ctx, "foo", - krad_code_name2num("Access-Request"), - set, iterator, &i, &tmp); --- -2.35.1 - diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch deleted file mode 100644 index 42452ff..0000000 --- a/krb5-krad-remote.patch +++ /dev/null @@ -1,209 +0,0 @@ -From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 9 Nov 2021 13:00:43 -0500 -Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup - -libkrad client requests contain a list of references to remotes, with -no back-references or reference counts. To prevent accesses to -dangling references during cleanup, cancel all requests on all remotes -before freeing any remotes. - -Remove the code for aging out unused servers. This code was fairly -safe as all requests referencing a remote should have completed or -timed out during an hour of disuse, but in the current design we have -no way to guarantee or check that. The set of addresses we send -RADIUS requests to will generally be small, so aging out servers is -unnecessary. - -ticket: 9035 (new) ---- - src/lib/krad/client.c | 42 ++++++++++++++--------------------------- - src/lib/krad/internal.h | 4 ++++ - src/lib/krad/remote.c | 11 ++++++++--- - 3 files changed, 26 insertions(+), 31 deletions(-) - -diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c -index 6365dd1c6..810940afc 100644 ---- a/src/lib/krad/client.c -+++ b/src/lib/krad/client.c -@@ -64,7 +64,6 @@ struct request_st { - - struct server_st { - krad_remote *serv; -- time_t last; - K5_LIST_ENTRY(server_st) list; - }; - -@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, - krad_remote **out) - { - krb5_error_code retval; -- time_t currtime; - server *srv; - -- if (time(&currtime) == (time_t)-1) -- return errno; -- - K5_LIST_FOREACH(srv, &rc->servers, list) { - if (kr_remote_equals(srv->serv, ai, secret)) { -- srv->last = currtime; - *out = srv->serv; - return 0; - } -@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, - srv = calloc(1, sizeof(server)); - if (srv == NULL) - return ENOMEM; -- srv->last = currtime; - - retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv); - if (retval != 0) { -@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs, - return 0; - } - --/* Close remotes that haven't been used in a while. */ --static void --age(struct server_head *head, time_t currtime) --{ -- server *srv, *tmp; -- -- K5_LIST_FOREACH_SAFE(srv, head, list, tmp) { -- if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) { -- K5_LIST_REMOVE(srv, list); -- kr_remote_free(srv->serv); -- free(srv); -- } -- } --} -- - /* Handle a response from a server (or related errors). */ - static void - on_response(krb5_error_code retval, const krad_packet *reqp, - const krad_packet *rspp, void *data) - { - request *req = data; -- time_t currtime; - size_t i; - - /* Do nothing if we are already completed. */ -@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp, - for (i = 0; req->remotes[i].remote != NULL; i++) - kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet); - -- /* Age out servers that haven't been used in a while. */ -- if (time(&currtime) != (time_t)-1) -- age(&req->rc->servers, currtime); -- - request_free(req); - } - -@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out) - void - krad_client_free(krad_client *rc) - { -+ server *srv; -+ - if (rc == NULL) - return; - -- age(&rc->servers, -1); -+ /* Cancel all requests before freeing any remotes, since each request's -+ * callback data may contain references to multiple remotes. */ -+ K5_LIST_FOREACH(srv, &rc->servers, list) -+ kr_remote_cancel_all(srv->serv); -+ -+ while (!K5_LIST_EMPTY(&rc->servers)) { -+ srv = K5_LIST_FIRST(&rc->servers); -+ K5_LIST_REMOVE(srv, list); -+ kr_remote_free(srv->serv); -+ free(srv); -+ } -+ - free(rc); - } - -diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 0143d155a..7619563fc 100644 ---- a/src/lib/krad/internal.h -+++ b/src/lib/krad/internal.h -@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, - void - kr_remote_cancel(krad_remote *rr, const krad_packet *pkt); - -+/* Cancel all requests awaiting responses. */ -+void -+kr_remote_cancel_all(krad_remote *rr); -+ - /* Determine if this remote object refers to the remote resource identified - * by the addrinfo struct and the secret. */ - krb5_boolean -diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index 7e491e994..06ae751bc 100644 ---- a/src/lib/krad/remote.c -+++ b/src/lib/krad/remote.c -@@ -421,15 +421,20 @@ error: - return retval; - } - -+void -+kr_remote_cancel_all(krad_remote *rr) -+{ -+ while (!K5_TAILQ_EMPTY(&rr->list)) -+ request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); -+} -+ - void - kr_remote_free(krad_remote *rr) - { - if (rr == NULL) - return; - -- while (!K5_TAILQ_EMPTY(&rr->list)) -- request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); -- -+ kr_remote_cancel_all(rr); - free(rr->secret); - if (rr->info != NULL) - free(rr->info->ai_addr); --- -2.35.1 - - -From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Mon, 8 Nov 2021 17:47:17 +0100 -Subject: [PATCH 2/2] More python3 fixes for t_daemon.py - -[ghudson@mit.edu: use a list comprehension instead of map()] ---- - src/lib/krad/t_daemon.py | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py -index 7668cd7f8..4a3de079c 100755 ---- a/src/lib/krad/t_daemon.py -+++ b/src/lib/krad/t_daemon.py -@@ -50,7 +50,7 @@ class TestServer(server.Server): - - for key in pkt.keys(): - if key == "User-Password": -- passwd = map(pkt.PwDecrypt, pkt[key]) -+ passwd = [pkt.PwDecrypt(x) for x in pkt[key]] - - reply = self.CreateReplyPacket(pkt) - if passwd == ['accept']: -@@ -61,8 +61,8 @@ class TestServer(server.Server): - - srv = TestServer(addresses=["localhost"], - hosts={"127.0.0.1": -- server.RemoteHost("127.0.0.1", "foo", "localhost")}, -- dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY))) -+ server.RemoteHost("127.0.0.1", b"foo", "localhost")}, -+ dict=dictionary.Dictionary(StringIO(DICTIONARY))) - - # Write a sentinel character to let the parent process know we're listening. - sys.stdout.write("~") --- -2.35.1 - diff --git a/krb5.spec b/krb5.spec index c6039dc..b14c9c9 100644 --- a/krb5.spec +++ b/krb5.spec @@ -34,7 +34,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 13 +%global baserelease 0.1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -46,9 +46,9 @@ %endif %global krb5_version_major 1 -%global krb5_version_minor 19 +%global krb5_version_minor 20 # For a release without a patch number set to %%nil -%global krb5_version_patch 2 +%global krb5_version_patch 1 %global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} %global krb5_version %{krb5_version_major_minor} @@ -68,59 +68,29 @@ Release: %{krb5_release}%{?dist} Source0: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz Source1: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz.asc -# Numbering is a relic of old init systems etc. It's easiest to just leave. Source2: kprop.service -Source4: kadmin.service -Source5: krb5kdc.service -Source6: krb5.conf -Source10: kdc.conf -Source11: kadm5.acl -Source19: krb5kdc.sysconfig -Source20: kadmin.sysconfig -Source21: kprop.sysconfig -Source29: ksu.pamd -Source33: krb5kdc.logrotate -Source34: kadmind.logrotate -Source39: krb5-krb5kdc.conf +Source3: kadmin.service +Source4: krb5kdc.service +Source5: krb5.conf +Source6: kdc.conf +Source7: kadm5.acl +Source8: krb5kdc.sysconfig +Source9: kadmin.sysconfig +Source10: kprop.sysconfig +Source11: ksu.pamd +Source12: krb5kdc.logrotate +Source13: kadmind.logrotate +Source14: krb5-krb5kdc.conf -Patch0: downstream-ksu-pam-integration.patch -Patch1: downstream-SELinux-integration.patch -Patch4: downstream-fix-debuginfo-with-y.tab.c.patch -Patch5: downstream-Remove-3des-support.patch -Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch8: Add-APIs-for-marshalling-credentials.patch -Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch -Patch10: Support-host-based-GSS-initiator-names.patch -Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch -Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch -Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch -Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch -Patch15: Fix-KCM-retrieval-support-for-sssd.patch -Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch -Patch18: Fix-some-principal-realm-canonicalization-cases.patch -Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch -Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch -Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch -Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch -Patch23: Fix-k5tls-module-for-OpenSSL-3.patch -Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch -Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch -Patch26: Use-asan-in-one-of-the-CI-builds.patch -Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch -Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch -Patch32: Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch -Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch -Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch -Patch35: Handle-OpenSSL-3-s-providers.patch -Patch36: Remove-TCL-based-libkadm5-API-tests.patch -Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch -Patch38: krb5-krad-remote.patch -Patch39: krb5-krad-larger-attrs.patch -Patch40: Try-harder-to-avoid-password-change-replay-errors.patch -Patch41: Add-configure-variable-for-default-PKCS-11-module.patch -Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch -Patch43: Read-GSS-configuration-files-with-mtime-0.patch -Patch44: Fix-integer-overflows-in-PAC-parsing.patch +Patch1: 0001-downstream-ksu-pam-integration.patch +Patch2: 0002-downstream-SELinux-integration.patch +Patch3: 0003-downstream-fix-debuginfo-with-y.tab.c.patch +Patch4: 0004-downstream-Remove-3des-support.patch +Patch5: 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +Patch6: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +Patch7: 0007-Add-configure-variable-for-default-PKCS-11-module.patch +Patch8: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch +Patch9: 0009-Simplify-plugin-loading-code.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -153,8 +123,14 @@ BuildRequires: procps-ng BuildRequires: resolv_wrapper %endif +%if 0%{?fedora} > 35 # Need KDFs. This is the "real" version BuildRequires: openssl-devel => 1:3.0.0 +%else +# Need KDFs. This is the backported version +BuildRequires: openssl-devel >= 1:1.1.1d-4 +BuildRequires: openssl-devel < 1:3.0.0 +%endif %description Kerberos V5 is a trusted-third-party network authentication system, @@ -180,7 +156,12 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 +%if 0%{?fedora} > 35 Requires: openssl-libs >= 1:3.0.0 +%else +Requires: openssl-libs >= 1:1.1.1d-4 +Requires: openssl-libs < 1:3.0.0 +%endif Requires: coreutils, gawk, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -296,6 +277,13 @@ PORT=`expr 7777 + $LONG_BIT - 48` sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg +# Fix kadmind port hard-coded in tests +PORT=`expr 61000 + $LONG_BIT - 48` +sed -i -e \ + "s,params.kadmind_port = 61001;,params.kadmind_port = $((PORT + 1));," \ + src/lib/kadm5/t_kadm5.c + + %build # Go ahead and supply tcl info, because configure doesn't know how to find it. source %{_libdir}/tclConfig.sh @@ -379,15 +367,15 @@ popd # Sample KDC config files (bundled kdc.conf and kadm5.acl). mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc -install -pm 600 %{SOURCE10} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ -install -pm 600 %{SOURCE11} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ +install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ +install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ # Where per-user keytabs live by default. mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user # Default configuration file for everything. mkdir -p $RPM_BUILD_ROOT/etc -install -pm 644 %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf +install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf # Default include on this directory mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d @@ -407,16 +395,16 @@ mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d export DEFCCNAME="%{configured_default_ccache_name}" awk '{print} /^# default_realm/{print " default_ccache_name =", ENVIRON["DEFCCNAME"]}' \ - %{SOURCE6} > $RPM_BUILD_ROOT/etc/krb5.conf -touch -r %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf + %{SOURCE5} > $RPM_BUILD_ROOT/etc/krb5.conf +touch -r %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf grep default_ccache_name $RPM_BUILD_ROOT/etc/krb5.conf %endif # Server init scripts (krb5kdc,kadmind,kpropd) and their sysconfig files. mkdir -p $RPM_BUILD_ROOT%{_unitdir} for unit in \ - %{SOURCE5}\ - %{SOURCE4} \ + %{SOURCE4}\ + %{SOURCE3} \ %{SOURCE2} ; do # In the past, the init script was supposed to be named after the service # that the started daemon provided. Changing their names is an @@ -424,11 +412,11 @@ for unit in \ install -pm 644 ${unit} $RPM_BUILD_ROOT%{_unitdir} done mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir} -install -pm 644 %{SOURCE39} $RPM_BUILD_ROOT/%{_tmpfilesdir}/ +install -pm 644 %{SOURCE14} $RPM_BUILD_ROOT/%{_tmpfilesdir}/ mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc mkdir -p $RPM_BUILD_ROOT/etc/sysconfig -for sysconfig in %{SOURCE19} %{SOURCE20} %{SOURCE21} ; do +for sysconfig in %{SOURCE8} %{SOURCE9} %{SOURCE10} ; do install -pm 644 ${sysconfig} \ $RPM_BUILD_ROOT/etc/sysconfig/`basename ${sysconfig} .sysconfig` done @@ -436,15 +424,15 @@ done # logrotate configuration files mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/ for logrotate in \ - %{SOURCE33} \ - %{SOURCE34} ; do + %{SOURCE12} \ + %{SOURCE13} ; do install -pm 644 ${logrotate} \ $RPM_BUILD_ROOT/etc/logrotate.d/`basename ${logrotate} .logrotate` done # PAM configuration files. mkdir -p $RPM_BUILD_ROOT/etc/pam.d/ -for pam in %{SOURCE29} ; do +for pam in %{SOURCE11} ; do install -pm 644 ${pam} \ $RPM_BUILD_ROOT/etc/pam.d/`basename ${pam} .pamd` done @@ -676,6 +664,13 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Nov 22 2022 Julien Rische - 1.20.1-0.1 +- New upstream version (1.20.1) +- Resolves: rhbz#2124463 +- Restore "supportedCMSTypes" attribute in PKINIT preauth requests +- Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms +- Resolves: rhbz#2114766 + * Wed Nov 09 2022 Julien Rische - 1.19.2-13 - Fix integer overflows in PAC parsing (CVE-2022-42898) - Resolves: rhbz#2143011 diff --git a/sources b/sources index 16c7a8d..9bc9770 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19.2.tar.gz) = b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470 -SHA512 (krb5-1.19.2.tar.gz.asc) = 87c4d096dbb6821401125b8f8a315ce1aac029744ba9670a4f8a2a680e6dd5798e1c6d5d2b68b17fd9a4b3b9c6ff111cd1dcac42f934d48fb20381b3765e0f64 +SHA512 (krb5-1.20.1.tar.gz) = 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2 +SHA512 (krb5-1.20.1.tar.gz.asc) = 1d3312bd67581e07adfdadf2c5fe394179631d8add8bd075efefe982a0de22369004e60a14422d426382c8c591e4181b9897088afe9d4e86f0b5a97e5954c67a