Merge ~ahasenack/ubuntu/+source/krb5:krb5-dep8-1677881 into ubuntu/+source/krb5:ubuntu/devel

[Andreas Hasenack]

Add dep8 tests to the krb5 package.

Bileto ticket: https://bileto.ubuntu.com/#/ticket/3355

Salsa merge request to add this in debian (no response so far): https://salsa.debian.org/debian/krb5/merge_requests/2

Note that this will become our only delta with debian in this package. Currently it's a sync.

On IRC a point was raised that the slapd-gssapi test could perhaps be in the slapd (openldap source) package. This test actually touches many areas:
- krb5 itself
- cyrus-sasl
- slapd

I used the bare mininum of slapd for the test, focusing on the authentication aspect. That's why I used the ldapwhoami command instead of anything that would actually touch the ldap database. That's also why I wanted debian's opinion on these tests.

That being said, this test could fail due to bugs in slapd, ldap-utils or even cyrus-sasl itself.

[Andreas Hasenack (ahasenack)]

Got a review from debian, they want a copyright statement. I'll do it over there, and we should get this in our next sync. I'll put this MP back into "work in progress" for now, because of that.

[Andreas Hasenack (ahasenack)]

Debian merged our tests, so reopening this MP.

Bileto ticket: https://bileto.ubuntu.com/#/ticket/3355

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3355/+packages

I don't know when debian will release a new krb5 package with these tests. Given the approaching freeze, I would like to get them in now, even if that means dropping them later on again.

[Andreas Hasenack (ahasenack)]

Bileto tests passed, opening up the MP for review again.

[Christian Ehrhardt  (paelzer)]

The pastebin initially linked is a "zpool iostat 2", not what you wanted to add here.
But I find what I actually need, so ok on that - just FYI.

[Andreas Hasenack (ahasenack)]

Removed the pastebin link and replaced it with the bileto one. Oops.

[Christian Ehrhardt  (paelzer)]

Checked the output on all arches, LGTM
+1 on good coverage

As mentioned on IRC you have used "local" which works in dash but isn't guaranteed by /bin/sh.
Let me know if you want to fix that up before upload.

review: Approve

[Christian Ehrhardt  (paelzer)]

discussed on IRC - keeping as is as that is fine on Ubuntu (dash) and the way it already is accepted by Debian.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/krb5
 * [new tag] upload/1.16-2ubuntu1 -> upload/1.16-2ubuntu1

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading krb5_1.16-2ubuntu1.dsc: done.
  Uploading krb5_1.16-2ubuntu1.debian.tar.xz: done.
  Uploading krb5_1.16-2ubuntu1_source.buildinfo: done.
  Uploading krb5_1.16-2ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 1987b93..8ce40eb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+krb5 (1.16-2ubuntu1) cosmic; urgency=medium
+
+  * Add DEP8 tests (LP: #1677881):
+    - d/t/util: common functions used in the tests
+    - d/t/control, d/t/kinit: simple kinit test
+    - d/t/control, d/t/slapd-gssapi: DEP8 test for service principals
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 06 Jul 2018 15:39:44 -0300
+
 krb5 (1.16-2build1) bionic; urgency=high
 
   * No change rebuild against openssl1.1.
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..42ae680
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,7 @@
+Tests: kinit
+Depends: @
+Restrictions: isolation-container, needs-root, allow-stderr
+
+Tests: slapd-gssapi
+Depends: @, slapd, ldap-utils, libsasl2-modules-gssapi-mit
+Restrictions: isolation-container, needs-root, allow-stderr
diff --git a/debian/tests/kinit b/debian/tests/kinit
new file mode 100644
index 0000000..5c5075f
--- /dev/null
+++ b/debian/tests/kinit
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -ex
+
+. debian/tests/util
+
+TEST_REALM="EXAMPLE.INTERNAL"
+MYHOSTNAME="krb5-dep8.internal"
+adjust_hostname "${MYHOSTNAME}"
+
+create_realm "${TEST_REALM}" "${MYHOSTNAME}"
+
+# create a random-enough principal
+principal="testuser$$"
+kadmin.local -q "addprinc -pw secret ${principal}"
+
+# get a ticket
+echo secret | kinit ${principal}
+
+# did we really get a ticket?
+klist | grep krbtgt/${TEST_REALM}@${TEST_REALM}
+
+# destroy it
+kdestroy
+
+# delete the principal
+kadmin.local -q "delprinc -force ${principal}"
diff --git a/debian/tests/slapd-gssapi b/debian/tests/slapd-gssapi
new file mode 100644
index 0000000..1b28606
--- /dev/null
+++ b/debian/tests/slapd-gssapi
@@ -0,0 +1,52 @@
+#!/bin/sh
+
+set -ex
+
+. debian/tests/util
+
+TEST_REALM="EXAMPLE.INTERNAL"
+MYHOSTNAME="krb5-dep8.internal"
+adjust_hostname "${MYHOSTNAME}"
+
+create_realm "${TEST_REALM}" "${MYHOSTNAME}"
+
+# restart slapd
+systemctl restart slapd.service
+
+# create a random-enough principal
+principal="testuser$$"
+kadmin.local -q "addprinc -pw secret ${principal}"
+
+# create an ldap service principal
+kadmin.local -q "addprinc -randkey ldap/${MYHOSTNAME}"
+
+# extract the key into the system keytab
+kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/${MYHOSTNAME}"
+
+# make sure the user under which the service runs can read that keytab
+chown root:openldap /etc/krb5.keytab
+chmod 0640 /etc/krb5.keytab
+
+# Prepare some LDAP defaults
+# The LDAP base doesn't matter for this test
+cat > /etc/ldap/ldap.conf <<EOF
+BASE dc=example,dc=internal
+URI ldap://${MYHOSTNAME}/
+SASL_REALM ${TEST_REALM}
+# Do not perform reverse DNS lookups to canonicalize SASL host names.
+SASL_NOCANON yes
+EOF
+
+# moment of truth
+# first, authenticate ourselves
+echo secret | kinit ${principal}
+klist | grep krbtgt/${TEST_REALM}@${TEST_REALM}
+
+# now let's see if ldap thinks we are authenticated with gssapi
+ldapwhoami -Y GSSAPI -Q | grep -E "^dn:uid=${principal},cn=gssapi,cn=auth"
+
+# and we should have an ldap ticket
+klist | grep ldap/${MYHOSTNAME}@${TEST_REALM}
+
+# remove tickets
+kdestroy
diff --git a/debian/tests/util b/debian/tests/util
new file mode 100644
index 0000000..b4c5838
--- /dev/null
+++ b/debian/tests/util
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+set -ex
+
+adjust_hostname() {
+    local myhostname="$1"
+
+    echo "${myhostname}" > /etc/hostname
+    hostname "${myhostname}"
+    if ! grep -qE "${myhostname}" /etc/hosts; then
+        # just so it's resolvable
+        echo "127.0.1.10 ${myhostname}" >> /etc/hosts
+    fi
+}
+
+create_realm() {
+    local realm_name="$1"
+    local kerberos_server="$2"
+
+    # start fresh
+    rm -rf /var/lib/krb5kdc/*
+    rm -rf /etc/krb5kdc/*
+    rm -f /etc/krb5.keytab
+
+    # setup some defaults
+    cat > /etc/krb5kdc/kdc.conf <<EOF
+[kdcdefaults]
+    kdc_ports = 750,88
+[realms]
+    ${realm_name} = {
+	    database_name = /var/lib/krb5kdc/principal
+	    admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
+	    acl_file = /etc/krb5kdc/kadm5.acl
+	    key_stash_file = /etc/krb5kdc/stash
+	    kdc_ports = 750,88
+	    max_life = 10h 0m 0s
+	    max_renewable_life = 7d 0h 0m 0s
+	    master_key_type = des3-hmac-sha1
+	    #supported_enctypes = aes256-cts:normal aes128-cts:normal
+	    default_principal_flags = +preauth
+    }
+EOF
+
+    cat > /etc/krb5.conf <<EOF
+[libdefaults]
+    default_realm = ${realm_name}
+    kdc_timesync = 1
+    ccache_type = 4
+    forwardable = true
+    proxiable = true
+    fcc-mit-ticketflags = true
+[realms]
+	${realm_name} = {
+		kdc = ${kerberos_server}
+		admin_server = ${kerberos_server}
+	}
+EOF
+    echo "# */admin *" > /etc/krb5kdc/kadm5.acl
+
+    # create the realm
+    kdb5_util create -s -P secretpassword
+
+    # restart services
+    systemctl restart krb5-kdc.service krb5-admin-server.service
+}