Add tests for the "tkey-gssapi-credential" option

Four named instances in the "nsupdate" system test have GSS-TSIG support
enabled.  All of them currently use "tkey-gssapi-keytab".  Configure two
of them with "tkey-gssapi-credential" to test that option.

As "tkey-gssapi-keytab" and "tkey-gssapi-credential" both provide the
same functionality, no test modifications are required.  The difference
between the two options is that the value of "tkey-gssapi-keytab" is an
explicit path to the keytab file to acquire credentials from, while the
value of "tkey-gssapi-credential" is the name of the principal whose
credentials should be used; those credentials are looked up in the
keytab file expected by the Kerberos library, i.e. /etc/krb5.keytab by
default.  The path to the default keytab file can be overridden using by
setting the KRB5_KTNAME environment variable.  Utilize that variable to
use existing keytab files with the "tkey-gssapi-credential" option.

The KRB5_KTNAME environment variable should not interfere with the
"tkey-gssapi-keytab" option.  Nevertheless, rename one of the keytab
files used with "tkey-gssapi-keytab" to something else than the contents
of the KRB5_KTNAME environment variable in order to make sure that both
"tkey-gssapi-keytab" and "tkey-gssapi-credential" are actually tested.

(cherry picked from commit 1746d2e84acee77ec88bf3f61eaa8f11cc1039a5)

diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index a4daa2235260314e0c9405a1b61618f5d984027a..85792a9f079704becfe3fdcc145d083b07615533 100644 (file)
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -90,6 +90,8 @@ SAMPLEUPDATE=$TOP/lib/samples/sample-update
 
 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=/dev/null
+# use local keytab instead of default /etc/krb5.keytab
+KRB5_KTNAME=dns.keytab
 
 # the amount of fake "entropy" to generate with GENRANDOM in
 # system tests
@@ -627,6 +629,7 @@ export KEYGEN
 export KEYSETTOOL
 export KEYSIGNER
 export KRB5_CONFIG
+export KRB5_KTNAME
 export LWRESD
 export LWTEST
 export MAKEJOURNAL

diff --git a/bin/tests/system/conf.sh.win32 b/bin/tests/system/conf.sh.win32
index 5ed910b40dfa0f8af74d30a4121b0e9217331471..dd5c7af5142ff4c4d7d736304a5a36a5c55275c0 100644 (file)
--- a/bin/tests/system/conf.sh.win32
+++ b/bin/tests/system/conf.sh.win32
@@ -99,6 +99,8 @@ PIPEQUERIES=$TOP/Build/$VSCONF/pipequeries@EXEEXT@
 
 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=NUL
+# use local keytab instead of default /etc/krb5.keytab
+KRB5_KTNAME=dns.keytab
 
 # the amount of fake "entropy" to generate with GENRANDOM in
 # system tests
@@ -596,6 +598,7 @@ export KEYGEN
 export KEYSETTOOL
 export KEYSIGNER
 export KRB5_CONFIG
+export KRB5_KTNAME
 export LWRESD
 export LWTEST
 export MAKEJOURNAL

diff --git a/bin/tests/system/nsupdate/krb/setup.sh b/bin/tests/system/nsupdate/krb/setup.sh
index 3fef030bd1d330d3144cff40a659a76ef4c05973..150b2050f85cd86e3da77ba4900b2da3da25319b 100644 (file)
--- a/bin/tests/system/nsupdate/krb/setup.sh
+++ b/bin/tests/system/nsupdate/krb/setup.sh
@@ -101,7 +101,7 @@ kinit -V -k -t krb5-machine.keytab -l ${lifetime}d -c krb5-machine.ccache host/m
 kinit -V -k -t ms-machine.keytab -l ${lifetime}d -c ms-machine.ccache 'machine$@EXAMPLE.COM'
 
 cp ns7-server.keytab ../ns7/dns.keytab
-cp ns8-server.keytab ../ns8/dns.keytab
+cp ns8-server.keytab ../ns8/dns-other-than-KRB5_KTNAME.keytab
 cp ns9-server.keytab ../ns9/dns.keytab
 cp ns10-server.keytab ../ns10/dns.keytab
 

diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in
index 3c0aad491414a7cef2b5119f3902d3dc4a684dd4..3ea8761978617c845e6f4c700e6237600298dc73 100644 (file)
--- a/bin/tests/system/nsupdate/ns10/named.conf.in
+++ b/bin/tests/system/nsupdate/ns10/named.conf.in
@@ -20,7 +20,7 @@ options {
        recursion no;
        notify yes;
        minimal-responses no;
-       tkey-gssapi-keytab "dns.keytab";
+       tkey-gssapi-credential "DNS/ns10.example.com@EXAMPLE.COM";
 };
 
 key rndc_key {

diff --git a/bin/tests/system/nsupdate/ns8/dns.keytab b/bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab
similarity index 100%
rename from bin/tests/system/nsupdate/ns8/dns.keytab
rename to bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab

diff --git a/bin/tests/system/nsupdate/ns8/named.conf.in b/bin/tests/system/nsupdate/ns8/named.conf.in
index ef7574db4d232300ea58214d76d672896b3bafc9..129350149e17b4dfc2e393c3f053d3b584cdd944 100644 (file)
--- a/bin/tests/system/nsupdate/ns8/named.conf.in
+++ b/bin/tests/system/nsupdate/ns8/named.conf.in
@@ -20,7 +20,7 @@ options {
        recursion no;
        notify yes;
        minimal-responses no;
-       tkey-gssapi-keytab "dns.keytab";
+       tkey-gssapi-keytab "dns-other-than-KRB5_KTNAME.keytab";
 };
 
 key rndc_key {

diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
index 1eda3841c3096ea74d19ff657502da91b869596d..52294d12ec33b270b1a47b91c7ffc415090f5c52 100644 (file)
--- a/bin/tests/system/nsupdate/ns9/named.conf.in
+++ b/bin/tests/system/nsupdate/ns9/named.conf.in
@@ -20,7 +20,7 @@ options {
        recursion no;
        notify yes;
        minimal-responses no;
-       tkey-gssapi-keytab "dns.keytab";
+       tkey-gssapi-credential "DNS/ns9.example.com@EXAMPLE.COM";
 };
 
 key rndc_key {

diff --git a/util/copyrights b/util/copyrights
index 6d8f9bceba7d8aa308b8caae9115c55b29e559da..41f02a95596b74803a15657c355672ffae43f80c 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -1865,7 +1865,7 @@
 ./bin/tests/system/nsupdate/ns7/in-addr.db.in  ZONE    2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns7/machine.ccache X       2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns7/named.conf.in  CONF-C  2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns8/dns.keytab     X       2018,2019,2020,2021
+./bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab      X       2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns8/example.com.db.in      ZONE    2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns8/in-addr.db.in  ZONE    2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns8/machine.ccache X       2018,2019,2020,2021