# Standalone Kerberos test.

# This is a DejaGnu test script.

# This script tests that the Kerberos tools can talk to each other.

# This mostly just calls procedures in testsuite/config/default.exp.

# Set up the Kerberos files and environment.

if {![get_hostname] || ![setup_kerberos_files] || ![setup_kerberos_env]} {

    return

}

# Initialize the Kerberos database.  The argument tells

# setup_kerberos_db that it is being called from here.

if ![setup_kerberos_db 1] {

    return

}

# We are about to start up a couple of daemon processes.  We do all

# the rest of the tests inside a proc, so that we can easily kill the

# processes when the procedure ends.

proc dump_and_reload {} {

    global KDB5_UTIL

    global tmppwd

    set dumpfile $tmppwd/dump-file

    set dumpokfile $dumpfile.dump_ok

    set test1name "kdb5_util dump"

    set test2name "kdb5_util load"

    if [file exists $dumpfile] { file delete $dumpfile }

    if [file exists $dumpokfile] { file delete $dumpokfile }

    spawn $KDB5_UTIL dump $dumpfile

    expect {

	-re "..*" {

	    fail $test1name

	    untested $test2name

	    return

	}

	timeout {

	    fail $test1name

	    untested $test2name

	    return

	}

	eof { }

    }

    if ![check_exit_status $test1name] {

	untested $test2name

	return

    }

    if ![file exists $dumpfile]||![file exists $dumpokfile] {

	fail $test1name

	untested $test2name

	return

    }

    pass $test1name

    spawn $KDB5_UTIL load $dumpfile

    expect {

	-re "..*" {

	    fail $test2name

	    return

	}

	timeout {

	    fail $test2name

	    return

	}

	eof { }

    }

    if [check_exit_status $test2name] {

	pass $test2name

    }

}

proc kinit_wrong_pw { name badpass } {

    global REALMNAME

    global KINIT

    global spawn_id

    # Use kinit to get a ticket.

	#

	# For now always get forwardable tickets. Later when we need to make

	# tests that distiguish between forwardable tickets and otherwise

	# we should but another option to this proc. --proven

	#

    spawn $KINIT -5 -f $name@$REALMNAME

    expect {

	"Password for $name@$REALMNAME:" {

	    verbose "kinit started"

	}

	timeout {

	    fail "kinit bad pw"

	    return 0

	}

	eof {

	    fail "kinit bad pw"

	    return 0

	}

    }

    send "$badpass\r"

    expect {

	"Password incorrect while getting initial credentials" {

	}

	timeout {

	    fail "kinit bad pw"

	    # kill it?

	}

	eof {

	    fail "kinit bad pw"

	    return

	}

    }

    expect eof

    set status_list [wait -i $spawn_id]

    catch "close -i $spawn_id"

    verbose -log "exit status: $status_list"

    if { [lindex $status_list 2] != 0 || [lindex $status_list 3] != 0 } {

	pass "kinit bad pw"

    } else {

	fail "kinit bad pw"

    }

}

proc doit { } {

    global REALMNAME

    global KLIST

    global KDESTROY

    global KEY

    global KADMIN_LOCAL

    global KTUTIL

    global hostname

    global tmppwd

    global spawn_id

    global supported_enctypes

    global KRBIV

    global portbase

    global mode

    global tmppwd

    setup_kerberos_env kdc

    # Start up the kerberos and kadmind daemons.

    if ![start_kerberos_daemons 1] {

	return

    }

    # Use kadmin to add an host key.

    if ![add_random_key host/$hostname 1] {

	return

    }

    spawn $KADMIN_LOCAL -q "addpol fred"

    catch expect_after

    expect {

	timeout {

	    fail "kadmin.local addpol fred"

	}

	eof {

	    pass "kadmin.local addpol fred"

	}

    }

    set k_stat [wait -i $spawn_id]

    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"

    catch "close -i $spawn_id"

    # Use ksrvutil to create a keytab entry.

    if ![setup_keytab 1] {

	return

    }

    # Test dump and load.  Continue on, whatever the result.

    dump_and_reload

    spawn $KADMIN_LOCAL -q "getpols"

    expect {

	fred {

	    pass "kadmin.local getpols"

	    expect eof

	}

	timeout {

	    fail "kadmin.local getpols"

	}

	eof {

	    fail "kadmin.local getpols"

	}

    }

    set k_stat [wait -i $spawn_id]

    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"

    catch "close -i $spawn_id"

    # Test use of wrong password.

    kinit_wrong_pw krbtest/admin wrongpassword

    setup_kerberos_env client

    # Use kinit to get a ticket.

    if ![kinit krbtest/admin adminpass$KEY 1] {

	return

    }

    if ![kinit_renew krbtest/admin adminpass$KEY 1] {

	return

    }

    # Make sure that klist can see the ticket.

    if ![do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist"] {

	return

    }

# Get a ticket to later use with FAST

    if ![kinit krbtest/fast adminpass$KEY 1] {

	return

    }

    # Use fast to get a ticket

    if ![kinit_fast krbtest/fast adminpass$KEY 1] {

	return

    }

    # Destroy the ticket.

    spawn $KDESTROY -5

    if ![check_exit_status "kdestroy"] {

	return

    }

    pass "kdestroy"

    # Double check that the ticket was destroyed.

    if ![do_klist_err "klist after destroy"] { return }

    if ![add_random_key WELLKNOWN/ANONYMOUS 0] {

	return

    }

    # If we have anonymous  then test it

    if [file exists "$tmppwd/../../../plugins/preauth/pkinit.so" ] {

	kinit_anonymous "WELLKNOWN/ANONYMOUS"

    }

    if ![add_random_key foo/bar 1] {

	return

    }

    set keytab $tmppwd/fookeytab

    catch "exec rm -f $keytab"

    modify_principal foo/bar -kvno 252

    foreach vno {253 254 255 256 257 258} {

	xst $tmppwd/fookeytab foo/bar

	do_klist_kt $tmppwd/fookeytab "klist keytab foo/bar vno $vno"

	kinit_kt "foo/bar" $tmppwd/fookeytab 1 "kt kvno $vno"

	do_klist "foo/bar" "krbtgt/$REALMNAME@$REALMNAME" "klist kt foo/bar vno $vno"

	do_kdestroy "kdestroy foo/bar vno $vno"

    }

    catch "exec rm -f $keytab"

    # Check that kadmin.local can actually read the correct kvno, even

    # if we don't expect kadmin to be able to.

    setup_kerberos_env kdc

    spawn $KADMIN_LOCAL -r $REALMNAME

    set ok 1

    expect_after {

	timeout		{ fail "kadmin.local correct high kvno" ; set ok 0 }

	eof		{ fail "kadmin.local correct high kvno" ; set ok 0 }

    }

    expect "kadmin.local: "

    send "getprinc foo/bar\r"

#    exec sleep 10

    expect "Key: vno $vno,"

    send "quit\r"

    expect eof

    if [check_exit_status "kadmin.local examine foo/bar for high kvno"] {

	if $ok {

	    pass "kadmin.local correct high kvno"

	}

    }

}

set status [catch doit msg]

stop_kerberos_daemons

if { $status != 0 } {

    send_error "ERROR: error in standalone.exp\n"

    send_error "$msg\n"

    exit 1

}