tests/intg/krb5utils.py

0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# MIT Kerberos server class
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# Copyright (c) 2016 Red Hat, Inc.
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# This is free software; you can redistribute it and/or modify it
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# under the terms of the GNU General Public License as published by
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# the Free Software Foundation; version 2 only
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# This program is distributed in the hope that it will be useful, but
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# WITHOUT ANY WARRANTY; without even the implied warranty of
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# General Public License for more details.
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# You should have received a copy of the GNU General Public License
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek# along with this program.  If not, see <http://www.gnu.org/licenses/>.
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek#
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozekimport os
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozekimport subprocess
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozekclass NoPrincipals(Exception):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def __init__(self):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        Exception.__init__(self, 'No principals in the collection')
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozekclass PrincNotFound(Exception):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def __init__(self, principal):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        Exception.__init__(self, 'Principal %s not found' % principal)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozekclass Krb5Utils(object):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    """
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    Helper class to test Kerberos command line utilities
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    """
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def __init__(self, krb5_conf_path):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        self.krb5_conf_path = krb5_conf_path
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
274489b092bba5fc81cb0f803843d56b267c5aafJakub Hrozek    def spawn_in_env(self, args, stdin=None, extra_env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        my_env = os.environ
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        my_env['KRB5_CONFIG'] = self.krb5_conf_path
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if 'KRB5CCNAME' in my_env:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            del my_env['KRB5CCNAME']
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if extra_env is not None:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            my_env.update(extra_env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        cmd = subprocess.Popen(args,
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                               env=my_env,
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                               stdin=subprocess.PIPE,
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                               stdout=subprocess.PIPE,
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                               stderr=subprocess.PIPE)
274489b092bba5fc81cb0f803843d56b267c5aafJakub Hrozek        return cmd
274489b092bba5fc81cb0f803843d56b267c5aafJakub Hrozek
274489b092bba5fc81cb0f803843d56b267c5aafJakub Hrozek    def _run_in_env(self, args, stdin=None, extra_env=None):
274489b092bba5fc81cb0f803843d56b267c5aafJakub Hrozek        cmd = self.spawn_in_env(args, stdin, extra_env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        out, err = cmd.communicate(stdin)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return cmd.returncode, out.decode('utf-8'), err.decode('utf-8')
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def kinit(self, principal, password, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["kinit", principal]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return self._run_in_env(args, password.encode('utf-8'), env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def kvno(self, principal, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["kvno", principal]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return self._run_in_env(args, env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def kdestroy(self, all_ccaches=False, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["kdestroy"]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if all_ccaches is True:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            args += ["-A"]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        retval, _, _ = self._run_in_env(args, env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return retval
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def kswitch(self, principal, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["kswitch", '-p', principal]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        retval, _, _ = self._run_in_env(args, env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return retval
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def _check_klist_l(self, line, exp_principal, exp_cache):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        try:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            princ, cache = line.split()
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        except ValueError:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            return False
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if exp_cache is not None and cache != exp_cache:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            return False
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if exp_principal != princ:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            return False
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return True
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def num_princs(self, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["klist", "-l"]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        retval, out, err = self._run_in_env(args, extra_env=env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if retval != 0:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            return 0
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        outlines = [l for l in out.split('\n') if len(l) > 1]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return len(outlines) - 2
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def list_princs(self, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["klist", "-l"]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        retval, out, err = self._run_in_env(args, extra_env=env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if retval == 1:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            raise NoPrincipals
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        elif retval != 0:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            raise Exception("klist failed: %d: %s\n", retval, err)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        outlines = out.split('\n')
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if len(outlines) < 2:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            raise Exception("Not enough output from klist -l")
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return [l for l in outlines[2:] if len(l) > 0]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def has_principal(self, exp_principal, exp_cache=None, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        try:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            princlist = self.list_princs(env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        except NoPrincipals:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            return False
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        for line in princlist:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            matches = self._check_klist_l(line, exp_principal, exp_cache)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            if matches is True:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                return True
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return False
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def default_principal(self, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        principals = self.list_princs(env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return principals[0].split()[0]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def _parse_klist_a(self, out):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        dflprinc = None
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        thisrealm = None
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        ccache_dict = dict()
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        for line in [l for l in out.split('\n') if len(l) > 0]:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            if line.startswith("Default principal"):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                dflprinc = line.split()[2]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                thisrealm = '@' + dflprinc.split('@')[1]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            elif thisrealm is not None and line.endswith(thisrealm):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                svc = line.split()[-1]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                if dflprinc in ccache_dict:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                    ccache_dict[dflprinc].append(svc)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                else:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek                    ccache_dict[dflprinc] = [svc]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return ccache_dict
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek    def list_all_princs(self, env=None):
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        args = ["klist", "-A"]
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        retval, out, err = self._run_in_env(args, extra_env=env)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        if retval == 1:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            raise NoPrincipals
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        elif retval != 0:
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek            raise Exception("klist -A failed: %d: %s\n", retval, err)
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek
0700118d8388c38b8cb28279510b206b76a3a411Jakub Hrozek        return self._parse_klist_a(out)