Skip to content

Commit 9f89956

Browse files
hlinnakahlinnaka
committed
Move Kerberos module
So that we can reuse it in new tests. Discussion: https://www.postgresql.org/message-id/a3af4070-3556-461d-aec8-a8d794f94894@iki.fi Reviewed-by: Jacob Champion, Matthias van de Meent
1 parent 997db12 commit 9f89956

File tree

2 files changed

+245
-168
lines changed

2 files changed

+245
-168
lines changed

‎src/test/kerberos/t/001_auth.pl

Lines changed: 11 additions & 168 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
use warnings FATAL => 'all';
2222
use PostgreSQL::Test::Utils;
2323
use PostgreSQL::Test::Cluster;
24+
use PostgreSQL::Test::Kerberos;
2425
use Test::More;
2526
use Time::HiRes qw(usleep);
2627

@@ -34,182 +35,27 @@
3435
'Potentially unsafe test GSSAPI/Kerberos not enabled in PG_TEST_EXTRA';
3536
}
3637

37-
my ($krb5_bin_dir, $krb5_sbin_dir);
38-
39-
if ($^O eq 'darwin' && -d "/opt/homebrew")
40-
{
41-
# typical paths for Homebrew on ARM
42-
$krb5_bin_dir = '/opt/homebrew/opt/krb5/bin';
43-
$krb5_sbin_dir = '/opt/homebrew/opt/krb5/sbin';
44-
}
45-
elsif ($^O eq 'darwin')
46-
{
47-
# typical paths for Homebrew on Intel
48-
$krb5_bin_dir = '/usr/local/opt/krb5/bin';
49-
$krb5_sbin_dir = '/usr/local/opt/krb5/sbin';
50-
}
51-
elsif ($^O eq 'freebsd')
52-
{
53-
$krb5_bin_dir = '/usr/local/bin';
54-
$krb5_sbin_dir = '/usr/local/sbin';
55-
}
56-
elsif ($^O eq 'linux')
57-
{
58-
$krb5_sbin_dir = '/usr/sbin';
59-
}
60-
61-
my $krb5_config = 'krb5-config';
62-
my $kinit = 'kinit';
63-
my $klist = 'klist';
64-
my $kdb5_util = 'kdb5_util';
65-
my $kadmin_local = 'kadmin.local';
66-
my $krb5kdc = 'krb5kdc';
67-
68-
if ($krb5_bin_dir && -d $krb5_bin_dir)
69-
{
70-
$krb5_config = $krb5_bin_dir . '/' . $krb5_config;
71-
$kinit = $krb5_bin_dir . '/' . $kinit;
72-
$klist = $krb5_bin_dir . '/' . $klist;
73-
}
74-
if ($krb5_sbin_dir && -d $krb5_sbin_dir)
75-
{
76-
$kdb5_util = $krb5_sbin_dir . '/' . $kdb5_util;
77-
$kadmin_local = $krb5_sbin_dir . '/' . $kadmin_local;
78-
$krb5kdc = $krb5_sbin_dir . '/' . $krb5kdc;
79-
}
80-
81-
my $host = 'auth-test-localhost.postgresql.example.com';
82-
my $hostaddr = '127.0.0.1';
83-
my $realm = 'EXAMPLE.COM';
84-
85-
my $krb5_conf = "${PostgreSQL::Test::Utils::tmp_check}/krb5.conf";
86-
my $kdc_conf = "${PostgreSQL::Test::Utils::tmp_check}/kdc.conf";
87-
my $krb5_cache = "${PostgreSQL::Test::Utils::tmp_check}/krb5cc";
88-
my $krb5_log = "${PostgreSQL::Test::Utils::log_path}/krb5libs.log";
89-
my $kdc_log = "${PostgreSQL::Test::Utils::log_path}/krb5kdc.log";
90-
my $kdc_port = PostgreSQL::Test::Cluster::get_free_port();
91-
my $kdc_datadir = "${PostgreSQL::Test::Utils::tmp_check}/krb5kdc";
92-
my $kdc_pidfile = "${PostgreSQL::Test::Utils::tmp_check}/krb5kdc.pid";
93-
my $keytab = "${PostgreSQL::Test::Utils::tmp_check}/krb5.keytab";
94-
9538
my $pgpass = "${PostgreSQL::Test::Utils::tmp_check}/.pgpass";
9639

9740
my $dbname = 'postgres';
9841
my $username = 'test1';
9942
my $application = '001_auth.pl';
10043

101-
note "setting up Kerberos";
102-
103-
my ($stdout, $krb5_version);
104-
run_log [ $krb5_config, '--version' ], '>', \$stdout
105-
or BAIL_OUT("could not execute krb5-config");
106-
BAIL_OUT("Heimdal is not supported") if $stdout =~ m/heimdal/;
107-
$stdout =~ m/Kerberos 5 release ([0-9]+\.[0-9]+)/
108-
or BAIL_OUT("could not get Kerberos version");
109-
$krb5_version = $1;
110-
11144
# Construct a pgpass file to make sure we don't use it
11245
append_to_file($pgpass, '*:*:*:*:abc123');
11346

11447
chmod 0600, $pgpass or die $!;
11548

116-
# Build the krb5.conf to use.
117-
#
118-
# Explicitly specify the default (test) realm and the KDC for
119-
# that realm to avoid the Kerberos library trying to look up
120-
# that information in DNS, and also because we're using a
121-
# non-standard KDC port.
122-
#
123-
# Also explicitly disable DNS lookups since this isn't really
124-
# our domain and we shouldn't be causing random DNS requests
125-
# to be sent out (not to mention that broken DNS environments
126-
# can cause the tests to take an extra long time and timeout).
127-
#
128-
# Reverse DNS is explicitly disabled to avoid any issue with a
129-
# captive portal or other cases where the reverse DNS succeeds
130-
# and the Kerberos library uses that as the canonical name of
131-
# the host and then tries to acquire a cross-realm ticket.
132-
append_to_file(
133-
$krb5_conf,
134-
qq![logging]
135-
default = FILE:$krb5_log
136-
kdc = FILE:$kdc_log
137-
138-
[libdefaults]
139-
dns_lookup_realm = false
140-
dns_lookup_kdc = false
141-
default_realm = $realm
142-
forwardable = false
143-
rdns = false
144-
145-
[realms]
146-
$realm = {
147-
kdc = $hostaddr:$kdc_port
148-
}
149-
!);
150-
151-
append_to_file(
152-
$kdc_conf,
153-
qq![kdcdefaults]
154-
!);
155-
156-
# For new-enough versions of krb5, use the _listen settings rather
157-
# than the _ports settings so that we can bind to localhost only.
158-
if ($krb5_version >= 1.15)
159-
{
160-
append_to_file(
161-
$kdc_conf,
162-
qq!kdc_listen = $hostaddr:$kdc_port
163-
kdc_tcp_listen = $hostaddr:$kdc_port
164-
!);
165-
}
166-
else
167-
{
168-
append_to_file(
169-
$kdc_conf,
170-
qq!kdc_ports = $kdc_port
171-
kdc_tcp_ports = $kdc_port
172-
!);
173-
}
174-
append_to_file(
175-
$kdc_conf,
176-
qq!
177-
[realms]
178-
$realm = {
179-
database_name = $kdc_datadir/principal
180-
admin_keytab = FILE:$kdc_datadir/kadm5.keytab
181-
acl_file = $kdc_datadir/kadm5.acl
182-
key_stash_file = $kdc_datadir/_k5.$realm
183-
}!);
184-
185-
mkdir $kdc_datadir or die;
186-
187-
# Ensure that we use test's config and cache files, not global ones.
188-
$ENV{'KRB5_CONFIG'} = $krb5_conf;
189-
$ENV{'KRB5_KDC_PROFILE'} = $kdc_conf;
190-
$ENV{'KRB5CCNAME'} = $krb5_cache;
49+
note "setting up Kerberos";
19150

192-
my $service_principal = "$ENV{with_krb_srvnam}/$host";
51+
my $host = 'auth-test-localhost.postgresql.example.com';
52+
my $hostaddr = '127.0.0.1';
53+
my $realm = 'EXAMPLE.COM';
19354

194-
system_or_bail $kdb5_util, 'create', '-s', '-P', 'secret0';
55+
my $krb = PostgreSQL::Test::Kerberos->new($host, $hostaddr, $realm);
19556

19657
my $test1_password = 'secret1';
197-
system_or_bail $kadmin_local, '-q', "addprinc -pw $test1_password test1";
198-
199-
system_or_bail $kadmin_local, '-q', "addprinc -randkey $service_principal";
200-
system_or_bail $kadmin_local, '-q', "ktadd -k $keytab $service_principal";
201-
202-
system_or_bail $krb5kdc, '-P', $kdc_pidfile;
203-
204-
END
205-
{
206-
# take care not to change the script's exit value
207-
my $exit_code = $?;
208-
209-
kill 'INT', `cat $kdc_pidfile` if defined($kdc_pidfile) && -f $kdc_pidfile;
210-
211-
$? = $exit_code;
212-
}
58+
$krb->create_principal('test1', $test1_password);
21359

21460
note "setting up PostgreSQL instance";
21561

@@ -218,7 +64,7 @@ END
21864
$node->append_conf(
21965
'postgresql.conf', qq{
22066
listen_addresses = '$hostaddr'
221-
krb_server_keyfile = '$keytab'
67+
krb_server_keyfile = '$krb->{keytab}'
22268
log_connections = on
22369
lc_messages = 'C'
22470
});
@@ -332,8 +178,7 @@ sub test_query
332178

333179
test_access($node, 'test1', 'SELECT true', 2, '', 'fails without ticket');
334180

335-
run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?);
336-
run_log [ $klist, '-f' ] or BAIL_OUT($?);
181+
$krb->create_ticket('test1', $test1_password);
337182

338183
test_access(
339184
$node,
@@ -475,10 +320,8 @@ sub test_query
475320
hostgssenc all all $hostaddr/32 gss map=mymap
476321
});
477322

478-
string_replace_file($krb5_conf, "forwardable = false", "forwardable = true");
479-
480-
run_log [ $kinit, 'test1' ], \$test1_password or BAIL_OUT($?);
481-
run_log [ $klist, '-f' ] or BAIL_OUT($?);
323+
# Re-create the ticket, with the forwardable flag set
324+
$krb->create_ticket('test1', $test1_password, forwardable => 1);
482325

483326
test_access(
484327
$node,

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy