From: Otto Moerbeek Date: Tue, 4 Jan 2022 15:10:46 +0000 (+0100) Subject: Start kerberos services using docker for regression tests. X-Git-Tag: rec-4.8.0-alpha1~31^2~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb4f68fd463f6691ec632598378d9570bd5bc2c8;p=thirdparty%2Fpdns.git Start kerberos services using docker for regression tests. --- diff --git a/regression-tests.auth-py/authtests.py b/regression-tests.auth-py/authtests.py index e7a4e03a3b..06fc48b773 100644 --- a/regression-tests.auth-py/authtests.py +++ b/regression-tests.auth-py/authtests.py @@ -171,6 +171,20 @@ options { if cls._zone_keys.get(zonename, None): cls.secureZone(confdir, zonename, cls._zone_keys.get(zonename)) + @classmethod + def waitForTCPSocket(cls, ipaddress, port): + for try_number in range(0, 100): + try: + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(1.0) + sock.connect((ipaddress, port)) + sock.close() + return + except Exception as err: + if err.errno != errno.ECONNREFUSED: + print(f'Error occurred: {try_number} {err}', file=sys.stderr) + time.sleep(0.1) + @classmethod def startAuth(cls, confdir, ipaddress): @@ -187,18 +201,14 @@ options { cls._auths[ipaddress] = subprocess.Popen(authcmd, close_fds=True, stdout=fdLog, stderr=fdLog, env=cls._auth_env) - - time.sleep(2) + cls.waitForTCPSocket(ipaddress, cls._authPort) if cls._auths[ipaddress].poll() is not None: - try: - cls._auths[ipaddress].kill() - except OSError as e: - if e.errno != errno.ESRCH: - raise - with open(logFile, 'r') as fdLog: - print(fdLog.read()) - sys.exit(cls._auths[ipaddress].returncode) + print(f"\n*** startAuth log for {logFile} ***") + with open(logFile, 'r') as fdLog: + print(fdLog.read()) + print(f"*** End startAuth log for {logFile} ***") + raise AssertionError('%s failed (%d)' % (authcmd, cls._auths[ipaddress].returncode)) @classmethod def setUpSockets(cls): @@ -239,23 +249,32 @@ options { cls.tearDownAuth() @classmethod - def tearDownAuth(cls): - if 'PDNSRECURSOR_FAST_TESTS' in os.environ: - delay = 0.1 - else: - delay = 1.0 + def killProcess(cls, p): + # Don't try to kill it if it's already dead + if p.poll() is not None: + return + try: + p.terminate() + for count in range(10): + x = p.poll() + if x is not None: + break + time.sleep(0.1) + if x is None: + print("kill...", p, file=sys.stderr) + p.kill() + p.wait() + except OSError as e: + # There is a race-condition with the poll() and + # kill() statements, when the process is dead on the + # kill(), this is fine + if e.errno != errno.ESRCH: + raise + @classmethod + def tearDownAuth(cls): for _, auth in cls._auths.items(): - try: - auth.terminate() - if auth.poll() is None: - time.sleep(delay) - if auth.poll() is None: - auth.kill() - auth.wait() - except OSError as e: - if e.errno != errno.ESRCH: - raise + cls.killProcess(auth) @classmethod def sendUDPQuery(cls, query, timeout=2.0, decode=True, fwparams=dict()): diff --git a/regression-tests.auth-py/kerberos-client/init-keytab.sh b/regression-tests.auth-py/kerberos-client/init-keytab.sh new file mode 100755 index 0000000000..ad4f331806 --- /dev/null +++ b/regression-tests.auth-py/kerberos-client/init-keytab.sh @@ -0,0 +1,9 @@ +echo commands to run: +echo Passwords enterd shoudl match those in kerberos-server setup script +echo rm -f kt.keytab +echo ktutil +echo add_entry -password -p testuser1@EXAMPLE.COM -k 1 -e aes256-cts-hmac-sha1-96 +echo add_entry -password -p testuser2@EXAMPLE.COM -k 1 -e aes256-cts-hmac-sha1-96 +echo add_entry -password -p DNS/ns1.example.net@EXAMPLE.COM -k 1 -e aes256-cts-hmac-sha1-96 +echo wkt kt.keytab +echo quit diff --git a/regression-tests.auth-py/kerberos-client/krb5.conf b/regression-tests.auth-py/kerberos-client/krb5.conf new file mode 100755 index 0000000000..1d65c48436 --- /dev/null +++ b/regression-tests.auth-py/kerberos-client/krb5.conf @@ -0,0 +1,9 @@ +[libdefaults] + default_realm = EXAMPLE.COM + +[realms] + EXAMPLE.COM = { + kdc = 127.0.0.1:1188 + admin_server = 127.0.0.1:1749 + } + diff --git a/regression-tests.auth-py/kerberos-client/kt.keytab b/regression-tests.auth-py/kerberos-client/kt.keytab new file mode 100644 index 0000000000..f70cdffeb3 Binary files /dev/null and b/regression-tests.auth-py/kerberos-client/kt.keytab differ diff --git a/regression-tests.auth-py/kerberos-client/update-policy.lua b/regression-tests.auth-py/kerberos-client/update-policy.lua new file mode 100644 index 0000000000..509927f591 --- /dev/null +++ b/regression-tests.auth-py/kerberos-client/update-policy.lua @@ -0,0 +1,4 @@ +function updatepolicy(arg) + princ = arg:getPeerPrincipal() + return princ == "testuser2@EXAMPLE.COM" +end diff --git a/regression-tests.auth-py/kerberos-server/Dockerfile b/regression-tests.auth-py/kerberos-server/Dockerfile new file mode 100644 index 0000000000..b2d3f42c81 --- /dev/null +++ b/regression-tests.auth-py/kerberos-server/Dockerfile @@ -0,0 +1,20 @@ +FROM debian:bullseye + +EXPOSE 749 88 + +ENV DEBIAN_FRONTEND noninteractive +# The -qq implies --yes +RUN apt-get -qq update +RUN apt-get -qq install locales krb5-kdc krb5-admin-server +RUN apt-get -qq clean + +#RUN locale-gen "en_US.UTF-8" +#RUN echo "LC_ALL=\"en_US.UTF-8\"" >> /etc/default/locale + +ENV REALM ${REALM:-EXAMPLE.COM} +ENV SUPPORTED_ENCRYPTION_TYPES ${SUPPORTED_ENCRYPTION_TYPES:-aes256-cts-hmac-sha1-96:normal} +ENV KADMIN_PRINCIPAL ${KADMIN_PRINCIPAL:-kadmin/admin} +ENV KADMIN_PASSWORD ${KADMIN_PASSWORD:-MITiys4K5} + +COPY kerberos-init.sh /tmp/ +CMD /tmp/kerberos-init.sh diff --git a/regression-tests.auth-py/kerberos-server/docker-compose.yml b/regression-tests.auth-py/kerberos-server/docker-compose.yml new file mode 100644 index 0000000000..8afa3f95fe --- /dev/null +++ b/regression-tests.auth-py/kerberos-server/docker-compose.yml @@ -0,0 +1,10 @@ +version: "2" +services: + kerberos: + build: . + ports: + - "1188:88" + - "1749:749" + volumes: + # This is needed otherwise there won't be enough entropy to generate a new kerberos realm + - /dev/urandom:/dev/random diff --git a/regression-tests.auth-py/kerberos-server/kerberos-init.sh b/regression-tests.auth-py/kerberos-server/kerberos-init.sh new file mode 100755 index 0000000000..34dca0c7a0 --- /dev/null +++ b/regression-tests.auth-py/kerberos-server/kerberos-init.sh @@ -0,0 +1,57 @@ +#!/bin/bash + +KADMIN_PRINCIPAL_FULL=$KADMIN_PRINCIPAL@$REALM + +echo "REALM: $REALM" +echo "KADMIN_PRINCIPAL_FULL: $KADMIN_PRINCIPAL_FULL" +echo "KADMIN_PASSWORD: $KADMIN_PASSWORD" +echo "" + +KDC_KADMIN_SERVER=$(hostname -f) +tee /etc/krb5.conf <