fix test suite to reflect loss of des3-krb4

Fix a few things broken by fix for MITKRB5-SA-2003-004, since kiniting
to a des3 TGT intentionally no longer works.

Remove code to set up kadmind srvtab, as it's not needed anymore.

ticket: new
status: open
target_version: 1.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15303 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/tests/dejagnu/config/ChangeLog b/src/tests/dejagnu/config/ChangeLog
index 8fd69dd2f342fde9421b89fae4c72891f7ec25d0..980203378c347e29208778b32188715e475f0957 100644 (file)
--- a/src/tests/dejagnu/config/ChangeLog
+++ b/src/tests/dejagnu/config/ChangeLog
@@ -1,3 +1,9 @@
+2003-03-26  Tom Yu  <tlyu@mit.edu>
+
+       * default.exp (v4kinit): Expect failure when kiniting to a des3
+       TGT, due to fix for MITKRB5-SA-2003-004.
+       (setup_kadmind_srvtab): Remove.  It's not needed anymore.
+
 2003-03-14  Ken Raeburn  <raeburn@mit.edu>
 
        * default.exp (setup_root_shell): If we get connection refused

diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
index ececbf7d7c61f253a9452d541b397e2bba5e54d8..33a75153860a25d9b346c37679ad17f521b4f384 100644 (file)
--- a/src/tests/dejagnu/config/default.exp
+++ b/src/tests/dejagnu/config/default.exp
@@ -692,7 +692,6 @@ proc setup_kerberos_files { } {
        puts $conffile "                database_name = $tmppwd/db"
        puts $conffile "                admin_database_name = $tmppwd/adb"
        puts $conffile "                admin_database_lockfile = $tmppwd/adb.lock"
-       puts $conffile "                admin_keytab = $tmppwd/admin-keytab"
        puts $conffile "                key_stash_file = $tmppwd/stash"
        puts $conffile "                acl_file = $tmppwd/acl"
        puts $conffile "                kadmind_port = 3750"
@@ -938,83 +937,6 @@ proc restore_kerberos_env { } {
 
 }
 
-# setup_kadmind_srvtab
-# A procedure to build the srvtab for kadmind5 so that kadmin5 and it
-# may successfully communicate.
-# Returns 1 on success, 0 on failure.
-proc setup_kadmind_srvtab {  } {
-    global REALMNAME
-    global KADMIN_LOCAL
-    global KEY
-    global tmppwd
-
-    catch "exec rm -f $tmppwd/admin-keytab"
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    catch expect_after
-    expect_after {
-       -re "(.*)\r\nkadmin.local:  " {
-           fail "kadmin.local admin-keytab (unmatched output: $expect_out(1,string)"
-           catch "exec rm -f $tmppwd/admin-keytab"
-           catch "expect_after"
-           return 0
-       }
-       timeout {
-           fail "kadmin.local admin-keytab (timeout)"
-           catch "exec rm -f $tmppwd/admin-keytab"
-           catch "expect_after"
-           return 0
-       }
-       eof {
-           fail "kadmin.local admin-keytab (eof)"
-           catch "exec rm -f $tmppwd/admin-keytab"
-           catch "expect_after"
-           return 0
-       }
-    }
-    expect "kadmin.local:  "
-    send "xst -k admin-new-srvtab kadmin/admin\r"
-    expect "xst -k admin-new-srvtab kadmin/admin\r\n"
-    expect -re ".*Entry for principal kadmin/admin.* added to keytab WRFILE:admin-new-srvtab."
-    expect "kadmin.local:  "
-
-    catch "exec mv -f admin-new-srvtab changepw-new-srvtab" exec_output
-    if ![string match "" $exec_output] {
-       verbose -log "$exec_output"
-       perror "can't mv admin-new-srvtab"
-       catch expect_after
-       return 0
-    }
-
-    send "xst -k changepw-new-srvtab kadmin/changepw\r"
-    expect "xst -k changepw-new-srvtab kadmin/changepw\r\n"
-    expect -re ".*Entry for principal kadmin/changepw.* added to keytab WRFILE:changepw-new-srvtab."
-    expect "kadmin.local:  "
-    send "quit\r"
-    expect eof
-    catch expect_after
-    if ![check_exit_status "kadmin.local admin-keytab"] {
-       catch "exec rm -f $tmppwd/admin-keytab"
-       perror "kadmin.local admin-keytab exited abnormally"
-       return 0
-    }
-
-    catch "exec mv -f changepw-new-srvtab $tmppwd/admin-keytab" exec_output
-    if ![string match "" $exec_output] {
-       verbose -log "$exec_output"
-       perror "can't mv new admin-keytab"
-       return 0
-    }
-
-    # Make the srvtab file globally readable in case we are using a
-    # root shell and the srvtab is NFS mounted.
-    catch "exec chmod a+r $tmppwd/admin-keytab"
-
-    return 1
-}
-
 # setup_kerberos_db
 # Initialize the Kerberos database.  If the argument is non-zero, call
 # pass at relevant points.  Returns 1 on success, 0 on failure.
@@ -1270,12 +1192,7 @@ proc setup_kerberos_db { standalone } {
            }
        }
     }
-    # XXX should deal with envstack inside setup_kadmind_srvtab too
-    set ret [setup_kadmind_srvtab]
     envstack_pop
-    if !$ret {
-       return 0
-    }
 
     # create the admin database lock file
     catch "exec touch $tmppwd/adb.lock"
@@ -2029,6 +1946,7 @@ proc v4kinit { name pass standalone } {
     global REALMNAME
     global KINIT
     global spawn_id
+    global des3_krbtgt
 
     # Use kinit to get a ticket.
        #
@@ -2052,10 +1970,20 @@ proc v4kinit { name pass standalone } {
     }
     send "$pass\r"
     expect eof
-    if ![check_exit_status kinit] {
-       return 0
+    if {$des3_krbtgt == 0} {
+       if ![check_exit_status v4kinit] {
+           return 0
+       }
+    } else {
+       # Fail if kinit is successful with a des3 TGT.
+       set status_list [wait -i $spawn_id]
+       set testname v4kinit
+       verbose "wait -i $spawn_id returned $status_list ($testname)"
+       if { [lindex $status_list 2] != 0 || [lindex $status_list 3] != 1 } {
+           verbose -log "exit status: $status_list"
+           fail "$testname (exit status)"
+       }
     }
-
     if {$standalone} {
        pass "v4kinit"
     }

diff --git a/src/tests/dejagnu/krb-standalone/ChangeLog b/src/tests/dejagnu/krb-standalone/ChangeLog
index fe3f185a6b1801532ed327cf9f19c593a06b6a62..01f490230ff9222bdc3819819112b0547bc7deec 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/ChangeLog
+++ b/src/tests/dejagnu/krb-standalone/ChangeLog
@@ -1,3 +1,12 @@
+2003-03-26  Tom Yu  <tlyu@mit.edu>
+
+       * v4gssftp.exp (v4ftp_test): Return early if $des3_krbtgt set.
+
+       * v4krb524d.exp (doit): Return early if $des3_krbtgt set.
+
+       * v4standalone.exp (check_and_destroy_v4_tix): Return early if
+       $des3_krbtgt set.
+
 2003-01-01  Ezra Peisach  <epeisach@bu.edu>
 
        * standalone.exp: Only run the keytab to srvtab tests if kerberos 4

diff --git a/src/tests/dejagnu/krb-standalone/v4gssftp.exp b/src/tests/dejagnu/krb-standalone/v4gssftp.exp
index c0b95d0ae02769ef36952ab9c00aece399b830a9..c4d5fd35c4fe27250137f82762378bab58022dd3 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/v4gssftp.exp
+++ b/src/tests/dejagnu/krb-standalone/v4gssftp.exp
@@ -179,7 +179,11 @@ proc v4ftp_test { } {
     global tmppwd
     global ftp_save_ktname
     global ftp_save_ccname
+    global des3_krbtgt
 
+    if {$des3_krbtgt} {
+       return
+    }
     # Start up the kerberos and kadmind daemons and get a srvtab and a
     # ticket file.
     if {![start_kerberos_daemons 0] \

diff --git a/src/tests/dejagnu/krb-standalone/v4krb524d.exp b/src/tests/dejagnu/krb-standalone/v4krb524d.exp
index 5506a06b7dc9bdd3fd87a3c126f83c7df01f9d9b..6e922c7e15fc16630e99b8eff0ec5d71f793271f 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/v4krb524d.exp
+++ b/src/tests/dejagnu/krb-standalone/v4krb524d.exp
@@ -78,7 +78,11 @@ proc doit { } {
     global KDESTROY
     global tmppwd
     global REALMNAME
+    global des3_krbtgt
 
+    if {$des3_krbtgt} {
+       return
+    }
     # Start up the kerberos and kadmind daemons.
     if ![start_kerberos_daemons 1] {
        return

diff --git a/src/tests/dejagnu/krb-standalone/v4standalone.exp b/src/tests/dejagnu/krb-standalone/v4standalone.exp
index 62db0a794b94a49606077ffd3ffbdd97f621d6b9..cc42e8dabad9f33742ca555360c1b3d6f13c7690 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/v4standalone.exp
+++ b/src/tests/dejagnu/krb-standalone/v4standalone.exp
@@ -26,7 +26,12 @@ if ![setup_kerberos_db 1] {
 
 proc check_and_destroy_v4_tix { client server } {
     global REALMNAME
+    global des3_krbtgt
 
+    # Skip this if we're using a des3 TGT, since that's supposed to fail.
+    if {$des3_krbtgt} {
+       return
+    }
     # Make sure that klist can see the ticket.
     if ![v4klist "$client" "$server" "v4klist"] {
        return