Manual Testing - Revision history

Ghudson at 16:17, 11 September 2019

2019-09-11T16:17:31Z

Ghudson: /* Basic Test KDC Setup */

2017-12-25T20:39:46Z

‎Basic Test KDC Setup

TomYu: /* Unlocked kdb5_util dump */

2014-07-31T22:56:20Z

‎Unlocked kdb5_util dump

TomYu: /* Unlocked kdb5_util dump */

2014-07-31T22:19:02Z

‎Unlocked kdb5_util dump

TomYu: /* Unlocked kdb5_util dump */

2014-07-31T22:07:57Z

‎Unlocked kdb5_util dump

TomYu at 22:06, 31 July 2014

2014-07-31T22:06:15Z

Ghudson at 16:54, 31 July 2014

2014-07-31T16:54:21Z

Ghudson at 16:48, 31 July 2014

2014-07-31T16:48:01Z

Ghudson at 17:17, 31 August 2013

2013-08-31T17:17:47Z

Ghudson: /* SAM-2 preauth client code */

2012-12-21T17:30:19Z

‎SAM-2 preauth client code

@@ Line 61: / Line 61: @@
   kadmind
 If it has trouble starting, check the log file specified in krb5.conf.
 ==Valgrind==

@@ Line 39: / Line 39: @@
   # Depending on what you are testing, you may want:
   # [domain_realm]
-  #   .your.domain = EXAMPLE.COM
+  #   your.domain = EXAMPLE.COM
 Set the environment variable KRB5_CONFIG to the pathname of this krb5.conf file.  Set the environment variable KRB5_KDC_PROFILE to /dev/null.

@@ Line 268: / Line 268: @@
  make testrealm
- awk 'BEGIN { for (i = 0; i < 1024 * 1024; i++) { printf("ank -randkey a%07d\n", i) } }' /dev/null | kadmin.local
+ awk 'BEGIN { for (i = 0; i < 1024 * 1024; i++) { printf("ank -randkey a%07d\n", i) } }' /dev/null | kadmin.local > /dev/null 2>&1
  (time kdb5_util dump > /dev/null)& sleep 1; kadmin.local -q 'ank -randkey test1'
  (time kdb5_util -x unlockiter dump > /dev/null)& sleep 1; kadmin.local -q 'ank -randkey test2'
  (time kdb5_util dump > /dev/null)& sleep 1; kadmin.local -q 'ank -randkey test3'
@@ Line 280: / Line 282: @@
 Creation of test3 should happen immediately (after the sleep 1) but the creation of test4 should hang until the dump completes.

@@ Line 269: / Line 269: @@
  make testrealm
  awk 'BEGIN { for (i = 0; i < 1024 * 1024; i++) { printf("ank -randkey a%07d\n", i) } }' /dev/null | kadmin.local
- (time kdb5_util dump > /dev/null)& kadmin.local -q 'ank -randkey test1'
+ (time kdb5_util dump > /dev/null)& sleep 1; kadmin.local -q 'ank -randkey test1'
- (time kdb5_util -x unlockiter dump > /dev/null)& kadmin.local -q 'ank -randkey test2'
+ (time kdb5_util -x unlockiter dump > /dev/null)& sleep 1; kadmin.local -q 'ank -randkey test2'
-The kadmin.local invocation for "test1" should hang until the (normal, locked) dump completes.  The kadmin.local invocation for "test2" should complete immediately, but the unlocked dump could take about twice as long to execute.
+The kadmin.local invocation for "test1" should hang until the (normal, locked) dump completes.  The kadmin.local invocation for "test2" should complete immediately (after the sleep 1), but the unlocked dump could take about twice as long to execute.
-Also edit the [dbmodules] parameter "unlockiter" and modify the above lines appropriately to test that.
+Edit the [dbmodules] parameter "unlockiter" and then run:

@@ Line 265: / Line 265: @@
 ==Unlocked kdb5_util dump==
-An automated test for this is subject to race conditions or long run times.
+An automated test for this would be subject to race conditions or long run times.
  make testrealm

← Older revision		Revision as of 22:06, 31 July 2014
Line 262:		Line 262:
	# Run "kdestroy -A".		# Run "kdestroy -A".
	# Run "klist" and verify that no cache is displayed.		# Run "klist" and verify that no cache is displayed.
		+
		+	==Unlocked kdb5_util dump==
		+
		+	An automated test for this is subject to race conditions or long run times.
		+
		+	make testrealm
		+	awk 'BEGIN { for (i = 0; i < 1024 * 1024; i++) { printf("ank -randkey a%07d\n", i) } }' /dev/null \| kadmin.local
		+	(time kdb5_util dump > /dev/null)& kadmin.local -q 'ank -randkey test1'
		+	(time kdb5_util -x unlockiter dump > /dev/null)& kadmin.local -q 'ank -randkey test2'
		+
		+	The kadmin.local invocation for "test1" should hang until the (normal, locked) dump completes. The kadmin.local invocation for "test2" should complete immediately, but the unlocked dump could take about twice as long to execute.
		+
		+	Also edit the [dbmodules] parameter "unlockiter" and modify the above lines appropriately to test that.

@@ Line 232: / Line 232: @@
 A reasonably comprehensive series of tests is:
-# Run "kmake testrealm" with unmodified code.
+# Run "make testrealm" with unmodified code.
 # Run "kinit -T testdir/ccache" in a debugger and check that the AS-REP has client user@KRBTEST.COM.
 # Run "kinit -T testdir/ccache notfound" and check that the KRB-ERROR has client notfound@KRBTEST.COM.
@@ Line 245: / Line 245: @@
 # Verify that "kinit -T testdir/ccache" gives a password prompt and that "kvno notfound" yields a "not found in Kerberos database" error.
 # Repeat steps #11-12 with KDC_OPT_RENEW (corresponding to flag bit 30).

← Older revision		Revision as of 17:17, 31 August 2013
Line 206:		Line 206:

	* Remember to kill your krb5kdc process after exiting the test realm; the test realm code won't clean up the one you started by hand.		* Remember to kill your krb5kdc process after exiting the test realm; the test realm code won't clean up the one you started by hand.
		+
		+	==FAST option handling==
		+
		+	We do not currently have the necessary tools in our automated test suite to construct KDC requests with arbitrary FAST options or to examine KDC replies for the plaintext client name, so FAST option handling must be tested manually, by temporarily modifying the code.
		+
		+	To modify the FAST options in all kdc-reqs, look for the assignment to fast_req.fast_options in lib/krb5/krb/fast.c and assign the desired value. To ensure that we are recognizing the correct ASN.1 encodings of flags, it is best to use constants for KDCOptions, which have had more interoperability testing than FAST options. Some relevant constants are:
		+
		+	* KDC_OPT_FORWARDABLE(1) corresponds to hide-client-names(1).
		+	* KDC_OPT_FORWARDED(2) and KDC_OPT_CANONICALIZE(15) correspond to the limits of the other critical FAST option bits.
		+	* KDC_OPT_REQUEST_ANONYMOUS(16) is the first non-critical FAST option bit.
		+	* KDC_OPT_RENEW(30) is a FAST option bit which was erroneously treated as critical before {{bug\|7701}} was fixed.
		+
		+	To examine KDC-REP or KRB-ERROR fields before FAST processing replaces the client name, run the client program in a debugger and break on decode_krb5_as_rep, decode_krb5_tgs_rep, or decode_krb5_error as appropriate. Let the function finish (e.g. with the "fin" command in gdb) and then look at the values in the structure it yields.
		+
		+	A reasonably comprehensive series of tests is:
		+
		+	# Run "kmake testrealm" with unmodified code.
		+	# Run "kinit -T testdir/ccache" in a debugger and check that the AS-REP has client user@KRBTEST.COM.
		+	# Run "kinit -T testdir/ccache notfound" and check that the KRB-ERROR has client notfound@KRBTEST.COM.
		+	# Run "kvno user" in a debugger and check that the TGS-REP contains client principal user@KRBTEST.COM.
		+	# Run "kvno notfound" in a debugger and check that the KRB-ERROR has client user@KRBTEST.COM.
		+	# Modify fast.c to set fast_options to KDC_OPT_FORWARDABLE (corresponding to hide-client-names) and rebuild.
		+	# Perform steps #2-#5 and check that the client name is WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS in all four cases. Also check that the operations continue to work as they do without the hide-client-names option.
		+	# Modify fast.c to set fast_options to KDC_OPT_FORWARDED (corresponding to flag bit 2) and rebuild.
		+	# Verify that "kinit -T testdir/ccache" and "kvno notfound" yield the error "An unsupported critical FAST option was requested."
		+	# Repeat steps #8-#9 with KDC_OPT_CANONICALIZE (corresponding to flag bit 15).
		+	# Modify fast.c to set fast_options to KDC_OPT_REQUEST_ANONYMOUS (corresponding to flag bit 16) and rebuild.
		+	# Verify that "kinit -T testdir/ccache" gives a password prompt and that "kvno notfound" yields a "not found in Kerberos database" error.
		+	# Repeat steps #11-12 with KDC_OPT_RENEW (corresponding to flag bit 30).

	==Valgrind==		==Valgrind==

@@ Line 189: / Line 189: @@
     make testrealm
-* Edit testdir/krb5.master.conf and add the following to register the module.  Make sure to specify the correct absolute path to the module shared object, which will depend on where your build directory is located.
+* Edit testdir/krb5.conf and add the following to register the module.  Make sure to specify the correct absolute path to the module shared object, which will depend on where your build directory is located.
     [plugins]
@@ Line 206: / Line 206: @@
 * Remember to kill your krb5kdc process after exiting the test realm; the test realm code won't clean up the one you started by hand.
 ==Valgrind==