Commit eebd8c2d authored by Chuck Lever's avatar Chuck Lever
Browse files

SUNRPC: Add KUnit tests for rpcsec_krb5.ko 



The Kerberos RFCs provide test vectors to verify the operation of
an implementation. Introduce a KUnit test framework to exercise the
Linux kernel's implementation of Kerberos.

Start with test cases for the RFC 3961-defined n-fold function. The
sample vectors for that are found in RFC 3961 Section 10.

Run the GSS Kerberos 5 mechanism's unit tests with this command:

$ ./tools/testing/kunit/kunit.py run \
	--kunitconfig ./net/sunrpc/.kunitconfig

Tested-by: default avatarScott Mayhew <smayhew@redhat.com>
Reviewed-by: default avatarSimo Sorce <simo@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 6e460c23

net/sunrpc/.kunitconfig

0 → 100644
+22 −0
Original line number Diff line number Diff line 
CONFIG_KUNIT=y

CONFIG_UBSAN=y

CONFIG_STACKTRACE=y

CONFIG_NET=y

CONFIG_NETWORK_FILESYSTEMS=y

CONFIG_INET=y

CONFIG_FILE_LOCKING=y

CONFIG_MULTIUSER=y

CONFIG_CRYPTO=y

CONFIG_CRYPTO_CBC=y

CONFIG_CRYPTO_CTS=y

CONFIG_CRYPTO_ECB=y

CONFIG_CRYPTO_HMAC=y

CONFIG_CRYPTO_MD5=y

CONFIG_CRYPTO_SHA1=y

CONFIG_CRYPTO_DES=y

CONFIG_NFS_FS=y

CONFIG_SUNRPC=y

CONFIG_SUNRPC_GSS=y

CONFIG_RPCSEC_GSS_KRB5=y

CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_DES=y

CONFIG_RPCSEC_GSS_KRB5_KUNIT_TEST=y

net/sunrpc/Kconfig

+15 −0
Original line number Diff line number Diff line
@@ -107,6 +107,21 @@ config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 
	  SHA-2 digests. These include aes128-cts-hmac-sha256-128 and

	  aes256-cts-hmac-sha384-192.



config RPCSEC_GSS_KRB5_KUNIT_TEST

	tristate "KUnit tests for RPCSEC GSS Kerberos" if !KUNIT_ALL_TESTS

	depends on RPCSEC_GSS_KRB5 && KUNIT

	default KUNIT_ALL_TESTS

	help

	  This builds the KUnit tests for RPCSEC GSS Kerberos 5.



	  KUnit tests run during boot and output the results to the debug

	  log in TAP format (https://testanything.org/). Only useful for

	  kernel devs running KUnit test harness and are not for inclusion

	  into a production build.



	  For more information on KUnit and unit tests in general, refer

	  to the KUnit documentation in Documentation/dev-tools/kunit/.



config SUNRPC_DEBUG

	bool "RPC: Enable dprintk debugging"

	depends on SUNRPC && SYSCTL

net/sunrpc/auth_gss/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -13,3 +13,5 @@ obj-$(CONFIG_RPCSEC_GSS_KRB5) += rpcsec_gss_krb5.o 


rpcsec_gss_krb5-y := gss_krb5_mech.o gss_krb5_seal.o gss_krb5_unseal.o \

	gss_krb5_seqnum.o gss_krb5_wrap.o gss_krb5_crypto.o gss_krb5_keys.o



obj-$(CONFIG_RPCSEC_GSS_KRB5_KUNIT_TEST) += gss_krb5_test.o

net/sunrpc/auth_gss/gss_krb5_internal.h

+4 −0
Original line number Diff line number Diff line
@@ -214,4 +214,8 @@ u32 krb5_etm_encrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf, 
u32 krb5_etm_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len,

		     struct xdr_buf *buf, u32 *headskip, u32 *tailskip);



#if IS_ENABLED(CONFIG_KUNIT)

void krb5_nfold(u32 inbits, const u8 *in, u32 outbits, u8 *out);

#endif



#endif /* _NET_SUNRPC_AUTH_GSS_KRB5_INTERNAL_H */

net/sunrpc/auth_gss/gss_krb5_keys.c

+11 −4
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ 
#include <linux/sunrpc/xdr.h>

#include <linux/lcm.h>

#include <crypto/hash.h>

#include <kunit/visibility.h>



#include "gss_krb5_internal.h"
@@ -68,13 +69,18 @@ 
# define RPCDBG_FACILITY        RPCDBG_AUTH

#endif



/*

/**

 * krb5_nfold - n-fold function

 * @inbits: number of bits in @in

 * @in: buffer containing input to fold

 * @outbits: number of bits in the output buffer

 * @out: buffer to hold the result

 *

 * This is the n-fold function as described in rfc3961, sec 5.1

 * Taken from MIT Kerberos and modified.

 */



static void krb5_nfold(u32 inbits, const u8 *in,

		       u32 outbits, u8 *out)

VISIBLE_IF_KUNIT

void krb5_nfold(u32 inbits, const u8 *in, u32 outbits, u8 *out)

{

	unsigned long ulcm;

	int byte, i, msbit;
@@ -135,6 +141,7 @@ static void krb5_nfold(u32 inbits, const u8 *in, 
		}

	}

}

EXPORT_SYMBOL_IF_KUNIT(krb5_nfold);



/*

 * This is the DK (derive_key) function as described in rfc3961, sec 5.1