dns gss-tsig

.travis.yml

@@ -17,7 +17,7 @@ before_install:
   - sudo apt-get install -yq krb5-user
   - sudo chmod 666 /etc/krb5.conf
   - go get -u golang.org/x/lint/golint
-  - docker run -d -h kdc.test.gokrb5 -v /etc/localtime:/etc/localtime:ro -e "TEST_KDC_ADDR=127.0.0.1" -p 53:53 -p 53:53/udp --name dns jcmturner/gokrb5:dns
+  - docker run -d -h ns.test.gokrb5 -v /etc/localtime:/etc/localtime:ro -e "TEST_KDC_ADDR=127.0.0.1" -p 53:53 -p 53:53/udp --name dns jcmturner/gokrb5:dns
   - docker run -d -h kdc.test.gokrb5 -v /etc/localtime:/etc/localtime:ro -p 88:88 -p 88:88/udp -p 464:464 -p 464:464/udp --name krb5kdc jcmturner/gokrb5:kdc-centos-default
   - docker run -d -h kdc.test.gokrb5 -v /etc/localtime:/etc/localtime:ro -p 78:88 -p 78:88/udp --name krb5kdc-old jcmturner/gokrb5:kdc-older
   - docker run -d -h kdc.test.gokrb5 -v /etc/localtime:/etc/localtime:ro -p 98:88 -p 98:88/udp --name krb5kdc-latest jcmturner/gokrb5:kdc-latest

testenv/docker/dns/Dockerfile

@@ -5,6 +5,10 @@ EXPOSE 53
 
 ENTRYPOINT ["/var/named/named.sh"]
 
+ENV KRB5_KTNAME /etc/named.keytab
+ADD files/krb5.conf /etc/krb5.conf
+ADD files/krb5.testtab /etc/krb5.keytab
+
 ENV DEBIAN_FRONTEND noninteractive
 RUN apt-get update && apt-get install -y bind9 && \
   mkdir -p /var/named/data && \

testenv/docker/dns/files/etc-named.conf

@@ -1,8 +1,8 @@
 options {
 	directory 	"/var/named";
 	dump-file 	"/var/named/data/cache_dump.db";
-        statistics-file "/var/named/data/named_stats.txt";
-        memstatistics-file "/var/named/data/named_mem_stats.txt";
+    statistics-file "/var/named/data/named_stats.txt";
+    memstatistics-file "/var/named/data/named_mem_stats.txt";
 	allow-query     { localhost; 10.0.0.0/8; 172.17.0.0/16; 172.18.0.0/16; };
 	recursion yes;
 
@@ -17,6 +17,8 @@ options {
 
 	pid-file "/run/named/named.pid";
 	session-keyfile "/run/named/session.key";
+
+	tkey-gssapi-keytab  "DNS/ns.test.gokrb5";
 };
 
 logging {

testenv/docker/dns/files/gokrb5.conf

@@ -1,9 +1,17 @@
 zone "test.gokrb5" {
 	type master;
 	file "/var/named/data/db.test.gokrb5";
+	check-names ignore;
+    update-policy {
+        grant * subdomain test.gokrb5. ANY;
+    };
 };
 
 zone "10.in-addr.arpa" {
 	type master;
 	file "/var/named/data/db.10";
+	check-names ignore;
+    update-policy {
+        grant * subdomain 10.in-addr.arpa. ANY;
+    };
 };

testenv/docker/dns/files/krb5.conf

@@ -0,0 +1,35 @@
+[logging]
+ default = FILE:/var/log/krb5libs.log
+ kdc = FILE:/var/log/krb5kdc.log
+ admin_server = FILE:/var/log/kadmind.log
+
+
+[libdefaults]
+  default_realm = TEST.GOKRB5
+  dns_lookup_realm = false
+  dns_lookup_kdc = false
+  ticket_lifetime = 24h
+  forwardable = yes
+  default_tkt_enctypes = aes256-cts-hmac-sha1-96
+  default_tgs_enctypes = aes256-cts-hmac-sha1-96
+  default_keytab_name = FILE:/etc/krb5.keytab
+
+[realms]
+ TEST.GOKRB5 = {
+  kdc = 127.0.0.1:88
+  admin_server = 127.0.0.1:749
+  default_domain = test.gokrb5
+ }
+
+[domain_realm]
+ .test.gokrb5 = TEST.GOKRB5
+ test.gokrb5 = TEST.GOKRB5
+
+[appdefaults]
+ pam = {
+   debug = false
+   ticket_lifetime = 36000
+   renew_lifetime = 36000
+   forwardable = true
+   krb4_convert = false
+ }

testenv/docker/krb5kdc/krb5kdc-init.sh

@@ -40,6 +40,8 @@ ENTROPY_PID=$!
   fi
 
   /usr/sbin/kadmin.local -q "add_principal -pw spnpasswordvalue -kvno 1 HTTP/host.test.gokrb5"
+  /usr/sbin/kadmin.local -q "add_principal -pw dnspasswordvalue -kvno 1 DNS/ns.test.gokrb5"
+
 
   /usr/sbin/kadmin.local -q "add_principal -pw passwordvalue -kvno 1 testuser1"
   /usr/sbin/kadmin.local -q "add_principal +requires_preauth -pw passwordvalue -kvno 1 testuser2"