|
Packit |
fd8b60 |
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
|
|
Packit |
fd8b60 |
/* tests/hooks.c - test harness for KDC send and recv hooks */
|
|
Packit |
fd8b60 |
/*
|
|
Packit |
fd8b60 |
* Copyright (C) 2016 by the Massachusetts Institute of Technology.
|
|
Packit |
fd8b60 |
* All rights reserved.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit |
fd8b60 |
* modification, are permitted provided that the following conditions
|
|
Packit |
fd8b60 |
* are met:
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions of source code must retain the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions in binary form must reproduce the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer in
|
|
Packit |
fd8b60 |
* the documentation and/or other materials provided with the
|
|
Packit |
fd8b60 |
* distribution.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
Packit |
fd8b60 |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
Packit |
fd8b60 |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
Packit |
fd8b60 |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
Packit |
fd8b60 |
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
Packit |
fd8b60 |
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
Packit |
fd8b60 |
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
Packit |
fd8b60 |
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit |
fd8b60 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
Packit |
fd8b60 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
Packit |
fd8b60 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
Packit |
fd8b60 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
Packit |
fd8b60 |
*/
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#include "k5-int.h"
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_context ctx;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static void
|
|
Packit |
fd8b60 |
check_code(krb5_error_code code, const char *file, int line)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const char *errmsg;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
if (code) {
|
|
Packit |
fd8b60 |
errmsg = krb5_get_error_message(ctx, code);
|
|
Packit |
fd8b60 |
fprintf(stderr, "%s:%d -- %s (code=%d)\n", file, line, errmsg,
|
|
Packit |
fd8b60 |
(int)code);
|
|
Packit |
fd8b60 |
krb5_free_error_message(ctx, errmsg);
|
|
Packit |
fd8b60 |
exit(1);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#define check(code) check_code((code), __FILE__, __LINE__)
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Verify that the canonicalize bit is set in an AS-REQ and remove it. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_send_as_req(krb5_context context, void *data, const krb5_data *realm,
|
|
Packit |
fd8b60 |
const krb5_data *message, krb5_data **new_message_out,
|
|
Packit |
fd8b60 |
krb5_data **reply_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_kdc_req *as_req;
|
|
Packit |
fd8b60 |
int cmp;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
assert(krb5_is_as_req(message));
|
|
Packit |
fd8b60 |
check(decode_krb5_as_req(message, &as_req));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
assert(as_req->msg_type == KRB5_AS_REQ);
|
|
Packit |
fd8b60 |
assert(as_req->kdc_options & KDC_OPT_CANONICALIZE);
|
|
Packit |
fd8b60 |
assert(as_req->client->realm.length == realm->length);
|
|
Packit |
fd8b60 |
cmp = memcmp(as_req->client->realm.data, realm->data, realm->length);
|
|
Packit |
fd8b60 |
assert(cmp == 0);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Remove the canonicalize flag and create a new message. */
|
|
Packit |
fd8b60 |
as_req->kdc_options &= ~KDC_OPT_CANONICALIZE;
|
|
Packit |
fd8b60 |
check(encode_krb5_as_req(as_req, new_message_out));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_free_kdc_req(context, as_req);
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Verify that reply is an AS-REP with kvno 1 and a valid enctype. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_recv_as_rep(krb5_context context, void *data, krb5_error_code code,
|
|
Packit |
fd8b60 |
const krb5_data *realm, const krb5_data *message,
|
|
Packit |
fd8b60 |
const krb5_data *reply, krb5_data **new_reply)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_kdc_rep *as_rep;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
assert(code == 0);
|
|
Packit |
fd8b60 |
assert(krb5_is_as_rep(reply));
|
|
Packit |
fd8b60 |
check(decode_krb5_as_rep(reply, &as_rep));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
assert(as_rep->msg_type == KRB5_AS_REP);
|
|
Packit |
fd8b60 |
assert(as_rep->ticket->enc_part.kvno == 1);
|
|
Packit |
fd8b60 |
assert(krb5_c_valid_enctype(as_rep->ticket->enc_part.enctype));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_free_kdc_rep(context, as_rep);
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Create a fake error reply. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_send_error(krb5_context context, void *data, const krb5_data *realm,
|
|
Packit |
fd8b60 |
const krb5_data *message, krb5_data **new_message_out,
|
|
Packit |
fd8b60 |
krb5_data **reply_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_error_code ret;
|
|
Packit |
fd8b60 |
krb5_error err;
|
|
Packit |
fd8b60 |
krb5_principal client, server;
|
|
Packit |
fd8b60 |
char *realm_str, *princ_str;
|
|
Packit |
fd8b60 |
int r;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
realm_str = k5memdup0(realm->data, realm->length, &ret;;
|
|
Packit |
fd8b60 |
check(ret);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
r = asprintf(&princ_str, "invalid@%s", realm_str);
|
|
Packit |
fd8b60 |
assert(r > 0);
|
|
Packit |
fd8b60 |
check(krb5_parse_name(ctx, princ_str, &client));
|
|
Packit |
fd8b60 |
free(princ_str);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
r = asprintf(&princ_str, "krbtgt@%s", realm_str);
|
|
Packit |
fd8b60 |
assert(r > 0);
|
|
Packit |
fd8b60 |
check(krb5_parse_name(ctx, princ_str, &server));
|
|
Packit |
fd8b60 |
free(princ_str);
|
|
Packit |
fd8b60 |
free(realm_str);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
err.magic = KV5M_ERROR;
|
|
Packit |
fd8b60 |
err.ctime = 1971196337;
|
|
Packit |
fd8b60 |
err.cusec = 0;
|
|
Packit |
fd8b60 |
err.susec = 97008;
|
|
Packit |
fd8b60 |
err.stime = 1458219390;
|
|
Packit |
fd8b60 |
err.error = 6;
|
|
Packit |
fd8b60 |
err.client = client;
|
|
Packit |
fd8b60 |
err.server = server;
|
|
Packit |
fd8b60 |
err.text = string2data("CLIENT_NOT_FOUND");
|
|
Packit |
fd8b60 |
err.e_data = empty_data();
|
|
Packit |
fd8b60 |
check(encode_krb5_error(&err, reply_out));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_free_principal(ctx, client);
|
|
Packit |
fd8b60 |
krb5_free_principal(ctx, server);
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_recv_error(krb5_context context, void *data, krb5_error_code code,
|
|
Packit |
fd8b60 |
const krb5_data *realm, const krb5_data *message,
|
|
Packit |
fd8b60 |
const krb5_data *reply, krb5_data **new_reply)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
/* The send hook created a reply, so this hook should not be executed. */
|
|
Packit |
fd8b60 |
abort();
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Modify an AS-REP reply, change the msg_type to KRB5_TGS_REP. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_recv_modify_reply(krb5_context context, void *data, krb5_error_code code,
|
|
Packit |
fd8b60 |
const krb5_data *realm, const krb5_data *message,
|
|
Packit |
fd8b60 |
const krb5_data *reply, krb5_data **new_reply)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_kdc_rep *as_rep;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
assert(code == 0);
|
|
Packit |
fd8b60 |
assert(krb5_is_as_rep(reply));
|
|
Packit |
fd8b60 |
check(decode_krb5_as_rep(reply, &as_rep));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
as_rep->msg_type = KRB5_TGS_REP;
|
|
Packit |
fd8b60 |
check(encode_krb5_as_rep(as_rep, new_reply));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_free_kdc_rep(context, as_rep);
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Return an error given by the callback data argument. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_send_return_value(krb5_context context, void *data,
|
|
Packit |
fd8b60 |
const krb5_data *realm, const krb5_data *message,
|
|
Packit |
fd8b60 |
krb5_data **new_message_out, krb5_data **reply_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
assert(data != NULL);
|
|
Packit |
fd8b60 |
return *(krb5_error_code *)data;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Return an error given by the callback argument. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
test_recv_return_value(krb5_context context, void *data, krb5_error_code code,
|
|
Packit |
fd8b60 |
const krb5_data *realm, const krb5_data *message,
|
|
Packit |
fd8b60 |
const krb5_data *reply, krb5_data **new_reply)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
assert(data != NULL);
|
|
Packit |
fd8b60 |
return *(krb5_error_code *)data;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
int
|
|
Packit |
fd8b60 |
main(int argc, char *argv[])
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
const char *principal, *password;
|
|
Packit |
fd8b60 |
krb5_principal client;
|
|
Packit |
fd8b60 |
krb5_get_init_creds_opt *opts;
|
|
Packit |
fd8b60 |
krb5_creds creds;
|
|
Packit |
fd8b60 |
krb5_error_code ret, test_return_code;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
if (argc != 3) {
|
|
Packit |
fd8b60 |
fprintf(stderr, "Usage: %s princname password\n", argv[0]);
|
|
Packit |
fd8b60 |
exit(1);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
principal = argv[1];
|
|
Packit |
fd8b60 |
password = argv[2];
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
check(krb5_init_context(&ctx));
|
|
Packit |
fd8b60 |
check(krb5_parse_name(ctx, principal, &client));
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Use a send hook to modify an outgoing AS-REQ. The library will detect
|
|
Packit |
fd8b60 |
* the modification in the reply. */
|
|
Packit |
fd8b60 |
check(krb5_get_init_creds_opt_alloc(ctx, &opts));
|
|
Packit |
fd8b60 |
krb5_get_init_creds_opt_set_canonicalize(opts, 1);
|
|
Packit |
fd8b60 |
krb5_set_kdc_send_hook(ctx, test_send_as_req, NULL);
|
|
Packit |
fd8b60 |
krb5_set_kdc_recv_hook(ctx, test_recv_as_rep, NULL);
|
|
Packit |
fd8b60 |
ret = krb5_get_init_creds_password(ctx, &creds, client, password, NULL,
|
|
Packit |
fd8b60 |
NULL, 0, NULL, opts);
|
|
Packit |
fd8b60 |
assert(ret == KRB5_KDCREP_MODIFIED);
|
|
Packit |
fd8b60 |
krb5_get_init_creds_opt_free(ctx, opts);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Use a send hook to synthesize a KRB-ERROR reply. */
|
|
Packit |
fd8b60 |
krb5_set_kdc_send_hook(ctx, test_send_error, NULL);
|
|
Packit |
fd8b60 |
krb5_set_kdc_recv_hook(ctx, test_recv_error, NULL);
|
|
Packit |
fd8b60 |
ret = krb5_get_init_creds_password(ctx, &creds, client, password, NULL,
|
|
Packit |
fd8b60 |
NULL, 0, NULL, NULL);
|
|
Packit |
fd8b60 |
assert(ret == KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Use a recv hook to modify a KDC reply. */
|
|
Packit |
fd8b60 |
krb5_set_kdc_send_hook(ctx, NULL, NULL);
|
|
Packit |
fd8b60 |
krb5_set_kdc_recv_hook(ctx, test_recv_modify_reply, NULL);
|
|
Packit |
fd8b60 |
ret = krb5_get_init_creds_password(ctx, &creds, client, password, NULL,
|
|
Packit |
fd8b60 |
NULL, 0, NULL, NULL);
|
|
Packit |
fd8b60 |
assert(ret == KRB5KRB_AP_ERR_MSG_TYPE);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Verify that the user data pointer works in the send hook. */
|
|
Packit |
fd8b60 |
test_return_code = KRB5KDC_ERR_PREAUTH_FAILED;
|
|
Packit |
fd8b60 |
krb5_set_kdc_send_hook(ctx, test_send_return_value, &test_return_code);
|
|
Packit |
fd8b60 |
krb5_set_kdc_recv_hook(ctx, NULL, NULL);
|
|
Packit |
fd8b60 |
ret = krb5_get_init_creds_password(ctx, &creds, client, password, NULL,
|
|
Packit |
fd8b60 |
NULL, 0, NULL, NULL);
|
|
Packit |
fd8b60 |
assert(ret == KRB5KDC_ERR_PREAUTH_FAILED);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Verify that the user data pointer works in the recv hook. */
|
|
Packit |
fd8b60 |
test_return_code = KRB5KDC_ERR_NULL_KEY;
|
|
Packit |
fd8b60 |
krb5_set_kdc_send_hook(ctx, NULL, NULL);
|
|
Packit |
fd8b60 |
krb5_set_kdc_recv_hook(ctx, test_recv_return_value, &test_return_code);
|
|
Packit |
fd8b60 |
ret = krb5_get_init_creds_password(ctx, &creds, client, password, NULL,
|
|
Packit |
fd8b60 |
NULL, 0, NULL, NULL);
|
|
Packit |
fd8b60 |
assert(ret == KRB5KDC_ERR_NULL_KEY);
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_free_principal(ctx, client);
|
|
Packit |
fd8b60 |
krb5_free_context(ctx);
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
}
|