d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include <security/pam_modules.h>

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include <popt.h>

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

7f95145833bb24f54e037f73ecc37444d6635697Dwight Engen#include "tests/cmocka/common_mock.h"

99e4008cad9e959b683c6f48411fcf15a92be3b5Michel Normand#include "tests/cmocka/common_mock_resp.h"

10fba81b9d0221b8e47aa1e0b43236413b7d28dfMichel Normand#include "responder/common/responder_packet.h"

99e4008cad9e959b683c6f48411fcf15a92be3b5Michel Normand#include "responder/common/negcache.h"

99e4008cad9e959b683c6f48411fcf15a92be3b5Michel Normand#include "responder/pam/pamsrv.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include "responder/pam/pam_helpers.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include "sss_client/pam_message.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include "sss_client/sss_cli.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include "util/crypto/sss_crypto.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#ifdef HAVE_NSS

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#include "util/crypto/nss/nss_util.h"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#endif

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TESTS_PATH "tp_" BASE_FILE_STEM

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_CONF_DB "test_pam_conf.ldb"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_DOM_NAME "pam_test"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_SUBDOM_NAME "test.subdomain"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_ID_PROVIDER "ldap"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define NSS_DB_PATH "./sssd_test_nssdb"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define NSS_DB "sql:"NSS_DB_PATH

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_TOKEN_NAME "SSSD Test Token"

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano#define TEST_TOKEN_CERT \

b4578c5b380130a41a69b5b49c970157acaf1dbbDwight Engen"MIIECTCCAvGgAwIBAgIBCDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \

b4578c5b380130a41a69b5b49c970157acaf1dbbDwight Engen"REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA2MjMx" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"NjMyMDdaFw0xNzA2MjMxNjMyMDdaMDIxEjAQBgNVBAoMCUlQQS5ERVZFTDEcMBoG" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"A1UEAwwTaXBhLWRldmVsLmlwYS5kZXZlbDCCASIwDQYJKoZIhvcNAQEBBQADggEP" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"ADCCAQoCggEBALXUq56VlY+Z0aWLLpFAjFfbElPBXGQsbZb85J3cGyPjaMHC9wS+" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"wjB6Ve4HmQyPLx8hbINdDmbawMHYQvTScLYfsqLtj0Lqw20sUUmedk+Es5Oh9VHo" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"nd8MavYx25Du2u+T0iSgNIDikXguiwCmtAj8VC49ebbgITcjJGzMmiiuJkV3o93Y" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"vvYF0VjLGDQbQWOy7IxzYJeNVJnZWKo67CHdok6qOrm9rxQt81rzwV/mGLbCMUbr" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"+N4M8URtd7EmzaYZQmNm//s2owFrCYMxpLiURPj+URZVuB72504/Ix7X0HCbA/AV" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"26J27fPY5nc8DMwfhUDCbTqPH/JEjd3mvY8CAwEAAaOCASYwggEiMB8GA1UdIwQY" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"MBaAFJOq+KAQmPEnNp8Wok23eGTdE7aDMDsGCCsGAQUFBwEBBC8wLTArBggrBgEF" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"BQcwAYYfaHR0cDovL2lwYS1jYS5pcGEuZGV2ZWwvY2Evb2NzcDAOBgNVHQ8BAf8E" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"BAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHQGA1UdHwRtMGsw" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"aaAxoC+GLWh0dHA6Ly9pcGEtY2EuaXBhLmRldmVsL2lwYS9jcmwvTWFzdGVyQ1JM" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"LmJpbqI0pDIwMDEOMAwGA1UECgwFaXBhY2ExHjAcBgNVBAMMFUNlcnRpZmljYXRl" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"IEF1dGhvcml0eTAdBgNVHQ4EFgQUFaDNd5a53QGpaw5m63hnwXicMQ8wDQYJKoZI" \

10fba81b9d0221b8e47aa1e0b43236413b7d28dfMichel Normand"hvcNAQELBQADggEBADH7Nj00qqGhGJeXJQAsepqSskz/wooqXh8vgVyb8SS4N0/c" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"0aQtVmY81xamlXE12ZFpwDX43d+EufBkwCUKFX/+8JFDd2doAyeJxv1xM22kKRpc" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"AqITPgMsa9ToGMWxjbVpc/X/5YfZixWPF0/eZUTotBj9oaR039UrhGfyN7OguF/G" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"rzmxtB5y4ZrMpcD/Oe90mkd9HY7sA/fB8OWOUgeRfQoh97HNS0UiDWsPtfxmjQG5" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"zotpoBIZmdH+ipYsu58HohHVlM9Wi5H4QmiiXl+Soldkq7eXYlafcmT7wv8+cKwz" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano"Nz0Tm3+eYpFqRo3skr6QzXi525Jkg3r6r+kkhxU=" \

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcanostruct pam_test_ctx {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct sss_test_ctx *tctx;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct sss_domain_info *subdom;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct resp_ctx *rctx;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct cli_ctx *cctx;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct sss_cmd_table *pam_cmds;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano struct pam_ctx *pctx;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

f79d43bbe70a01454049b77d6f15f6369744959eStéphane Graber int ncache_hits;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano int exp_pam_status;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano};

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcanostruct pam_test_ctx *pam_test_ctx;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcanostatic errno_t setup_nss_db(void)

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano{

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano int ret;

f79d43bbe70a01454049b77d6f15f6369744959eStéphane Graber FILE *fp;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano int status;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano pid_t child_pid;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano ret = mkdir(NSS_DB_PATH, 0775);

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano if (ret != EOK) {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano DEBUG(SSSDBG_FATAL_FAILURE, "Failed to create " NSS_DB_PATH ".\n");

99e4008cad9e959b683c6f48411fcf15a92be3b5Michel Normand return ret;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano }

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano child_pid = fork();

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano if (child_pid == 0) { /* child */

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano ret = execlp("certutil", "certutil", "-N", "--empty-password", "-d",

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano NSS_DB, NULL);

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano if (ret == -1) {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano DEBUG(SSSDBG_FATAL_FAILURE, "execl() failed.\n");

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano exit(-1);

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano }

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano } else if (child_pid > 0) {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano wait(&status);

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano } else {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano ret = errno;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano DEBUG(SSSDBG_FATAL_FAILURE, "fork() failed\n");

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano return ret;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano }

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano fp = fopen(NSS_DB_PATH"/pkcs11.txt", "w");

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano if (fp == NULL) {

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano DEBUG(SSSDBG_FATAL_FAILURE, "fopen() failed.\n");

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano return ret;

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano }

d823d5b966f49d975a09a8512d084389d6d7ffc7dlezcano ret = fprintf(fp, "library=libsoftokn3.so\nname=soft\n");

if (ret < 0) {

DEBUG(SSSDBG_FATAL_FAILURE, "fprintf() failed.\n");

return ret;

}

ret = fprintf(fp, "parameters=configdir='sql:%s/src/tests/cmocka/p11_nssdb' dbSlotDescription='SSSD Test Slot' dbTokenDescription='SSSD Test Token' secmod='secmod.db' flags=readOnly \n\n", ABS_SRC_DIR);

if (ret < 0) {

DEBUG(SSSDBG_FATAL_FAILURE, "fprintf() failed.\n");

return ret;

}

ret = fclose(fp);

if (ret != 0) {

DEBUG(SSSDBG_FATAL_FAILURE, "fclose() failed.\n");

return ret;

}

return EOK;

}

static void cleanup_nss_db(void)

{

int ret;

ret = unlink(NSS_DB_PATH"/cert9.db");

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, "Failed to remove cert9.db.\n");

}

ret = unlink(NSS_DB_PATH"/key4.db");

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, "Failed to remove key4.db.\n");

}

ret = unlink(NSS_DB_PATH"/pkcs11.txt");

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, "Failed to remove pkcs11.db.\n");

}

ret = rmdir(NSS_DB_PATH);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, "Failed to remove " NSS_DB_PATH "\n");

}

}

struct pam_ctx *mock_pctx(TALLOC_CTX *mem_ctx)

{

struct pam_ctx *pctx;

errno_t ret;

pctx = talloc_zero(mem_ctx, struct pam_ctx);

assert_non_null(pctx);

ret = sss_ncache_init(pctx, &pctx->ncache);

assert_int_equal(ret, EOK);

pctx->neg_timeout = 10;

ret = sss_hash_create(pctx, 10, &pctx->id_table);

assert_int_equal(ret, EOK);

return pctx;

}

static int add_pam_params(struct sss_test_conf_param pam_params[],

struct confdb_ctx *cdb)

{

const char *val[2];

int ret;

val[1] = NULL;

for (int i = 0; pam_params[i].key; i++) {

val[0] = pam_params[i].value;

ret = confdb_add_param(cdb, true, CONFDB_PAM_CONF_ENTRY,

pam_params[i].key, val);

assert_int_equal(ret, EOK);

}

return EOK;

}

void test_pam_setup(struct sss_test_conf_param dom_params[],

struct sss_test_conf_param pam_params[],

void **state)

{

errno_t ret;

pam_test_ctx = talloc_zero(NULL, struct pam_test_ctx);

assert_non_null(pam_test_ctx);

pam_test_ctx->tctx = create_dom_test_ctx(pam_test_ctx, TESTS_PATH,

TEST_CONF_DB, TEST_DOM_NAME,

TEST_ID_PROVIDER, dom_params);

assert_non_null(pam_test_ctx->tctx);

pam_test_ctx->pam_cmds = get_pam_cmds();

assert_non_null(pam_test_ctx->pam_cmds);

/* FIXME - perhaps this should be folded into sssd_domain_init or stricty

ret = sss_names_init(pam_test_ctx, pam_test_ctx->tctx->confdb,

TEST_DOM_NAME, &pam_test_ctx->tctx->dom->names);

assert_int_equal(ret, EOK);

/* Initialize the PAM responder */

pam_test_ctx->pctx = mock_pctx(pam_test_ctx);

assert_non_null(pam_test_ctx->pctx);

pam_test_ctx->rctx = mock_rctx(pam_test_ctx, pam_test_ctx->tctx->ev,

pam_test_ctx->tctx->dom, pam_test_ctx->pctx);

assert_non_null(pam_test_ctx->rctx);

pam_test_ctx->rctx->cdb = pam_test_ctx->tctx->confdb;

pam_test_ctx->pctx->rctx = pam_test_ctx->rctx;

ret = add_pam_params(pam_params, pam_test_ctx->rctx->cdb);

assert_int_equal(ret, EOK);

/* Create client context */

pam_test_ctx->cctx = mock_cctx(pam_test_ctx, pam_test_ctx->rctx);

assert_non_null(pam_test_ctx->cctx);

pam_test_ctx->cctx->cli_protocol_version = register_cli_protocol_version();

pam_test_ctx->cctx->ev = pam_test_ctx->tctx->ev;

}

static int pam_test_setup(void **state)

{

int ret;

struct sss_test_conf_param dom_params[] = {

{ "enumerate", "false" },

{ "cache_credentials", "true" },

{ NULL, NULL }, /* Sentinel */

};

struct sss_test_conf_param pam_params[] = {

{ "p11_child_timeout", "30"},

{ NULL, NULL }, /* Sentinel */

};

test_pam_setup(dom_params, pam_params, state);

/* Prime the cache with a valid user */

ret = sysdb_add_user(pam_test_ctx->tctx->dom,

"pamuser", 123, 456, "pam user",

"/home/pamuser", "/bin/sh", NULL,

NULL, 300, 0);

assert_int_equal(ret, EOK);

/* Add entry to the initgr cache to make sure no initgr request is sent to

ret = pam_initgr_cache_set(pam_test_ctx->pctx->rctx->ev,

pam_test_ctx->pctx->id_table,

discard_const("pamuser"),

pam_test_ctx->pctx->id_timeout);

assert_int_equal(ret, EOK);

/* Prime the cache with a user for wrong matches */

ret = sysdb_add_user(pam_test_ctx->tctx->dom,

"wronguser", 321, 654, "wrong user",

"/home/wringuser", "/bin/sh", NULL,

NULL, 300, 0);

assert_int_equal(ret, EOK);

/* Add entry to the initgr cache to make sure no initgr request is sent to

ret = pam_initgr_cache_set(pam_test_ctx->pctx->rctx->ev,

pam_test_ctx->pctx->id_table,

discard_const("wronguser"),

pam_test_ctx->pctx->id_timeout);

assert_int_equal(ret, EOK);

return 0;

}

static int pam_test_teardown(void **state)

{

int ret;

ret = sysdb_delete_user(pam_test_ctx->tctx->dom, "pamuser", 0);

assert_int_equal(ret, EOK);

ret = sysdb_delete_user(pam_test_ctx->tctx->dom, "wronguser", 0);

assert_int_equal(ret, EOK);

talloc_free(pam_test_ctx);

return 0;

}

typedef int (*cmd_cb_fn_t)(uint32_t, uint8_t *, size_t);

int __real_read_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,

uint8_t **buf, ssize_t *len);

void __real_sss_packet_get_body(struct sss_packet *packet,

uint8_t **body, size_t *blen);

void __wrap_sss_packet_get_body(struct sss_packet *packet,

uint8_t **body, size_t *blen)

{

enum sss_test_wrapper_call wtype = sss_mock_type(enum sss_test_wrapper_call);

size_t len;

if (wtype == WRAP_CALL_REAL) {

return __real_sss_packet_get_body(packet, body, blen);

}

*body = sss_mock_ptr_type(uint8_t *);

len = sss_mock_type(size_t);

if (len == 0) {

len = strlen((const char *) *body) + 1;

}

*blen = len;

return;

}

void __real_sss_packet_get_body(struct sss_packet *packet,

uint8_t **body, size_t *blen);

void __wrap_sss_cmd_done(struct cli_ctx *cctx, void *freectx)

{

struct sss_packet *packet = cctx->creq->out;

uint8_t *body;

size_t blen;

cmd_cb_fn_t check_cb;

assert_non_null(packet);

check_cb = sss_mock_ptr_type(cmd_cb_fn_t);

__real_sss_packet_get_body(packet, &body, &blen);

pam_test_ctx->tctx->error = check_cb(sss_packet_get_status(packet),

body, blen);

pam_test_ctx->tctx->done = true;

}

enum sss_cli_command __wrap_sss_packet_get_cmd(struct sss_packet *packet)

{

return sss_mock_type(enum sss_cli_command);

}

int __wrap_sss_cmd_send_empty(struct cli_ctx *cctx, TALLOC_CTX *freectx)

{

pam_test_ctx->tctx->done = true;

pam_test_ctx->tctx->error = ENOENT;

return EOK;

}

static void set_cmd_cb(cmd_cb_fn_t fn)

{

will_return(__wrap_sss_cmd_done, fn);

}

int __wrap_pam_dp_send_req(struct pam_auth_req *preq, int timeout)

{

/* Set expected status */

preq->pd->pam_status = pam_test_ctx->exp_pam_status;

preq->callback(preq);

return EOK;

}

static void mock_input_pam(TALLOC_CTX *mem_ctx, const char *name,

const char *pwd, const char *fa2)

{

size_t buf_size;

uint8_t *m_buf;

uint8_t *buf;

struct pam_items pi = { 0 };

int ret;

size_t needed_size;

uint8_t *authtok;

if (name != NULL) {

pi.pam_user = name;

pi.pam_user_size = strlen(pi.pam_user) + 1;

} else {

pi.pam_user = "";

pi.pam_user_size = 0;

}

if (pwd != NULL) {

if (fa2 != NULL) {

ret = sss_auth_pack_2fa_blob(pwd, 0, fa2, 0, NULL, 0, &needed_size);

assert_int_equal(ret, EAGAIN);

authtok = talloc_size(mem_ctx, needed_size);

assert_non_null(authtok);

ret = sss_auth_pack_2fa_blob(pwd, 0, fa2, 0, authtok,

needed_size, &needed_size);

assert_int_equal(ret, EOK);

pi.pam_authtok = (char *) authtok;

pi.pam_authtok_size = needed_size;

pi.pam_authtok_type = SSS_AUTHTOK_TYPE_2FA;

} else {

pi.pam_authtok = discard_const(pwd);

pi.pam_authtok_size = strlen(pi.pam_authtok) + 1;

pi.pam_authtok_type = SSS_AUTHTOK_TYPE_PASSWORD;

}

}

pi.pam_service = "ssh";

pi.pam_service_size = strlen(pi.pam_service) + 1;

pi.pam_tty = "/dev/tty";

pi.pam_tty_size = strlen(pi.pam_tty) + 1;

pi.pam_ruser = "remuser";

pi.pam_ruser_size = strlen(pi.pam_ruser) + 1;

pi.pam_rhost = "remhost";

pi.pam_rhost_size = strlen(pi.pam_rhost) + 1;

pi.requested_domains = "";

pi.cli_pid = 12345;

ret = pack_message_v3(&pi, &buf_size, &m_buf);

assert_int_equal(ret, 0);

buf = talloc_memdup(mem_ctx, m_buf, buf_size);

free(m_buf);

assert_non_null(buf);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_WRAPPER);

will_return(__wrap_sss_packet_get_body, buf);

will_return(__wrap_sss_packet_get_body, buf_size);

}

static void mock_input_pam_cert(TALLOC_CTX *mem_ctx, const char *name,

const char *pin)

{

size_t buf_size;

uint8_t *m_buf;

uint8_t *buf;

struct pam_items pi = { 0 };

int ret;

if (name != NULL) {

pi.pam_user = name;

pi.pam_user_size = strlen(pi.pam_user) + 1;

} else {

pi.pam_user = "";

pi.pam_user_size = 0;

}

if (pin != NULL) {

pi.pam_authtok = discard_const(pin);

pi.pam_authtok_size = strlen(pi.pam_authtok) + 1;

pi.pam_authtok_type = SSS_AUTHTOK_TYPE_SC_PIN;

}

pi.pam_service = "login";

pi.pam_service_size = strlen(pi.pam_service) + 1;

pi.pam_tty = "/dev/tty";

pi.pam_tty_size = strlen(pi.pam_tty) + 1;

pi.pam_ruser = "remuser";

pi.pam_ruser_size = strlen(pi.pam_ruser) + 1;

pi.pam_rhost = "remhost";

pi.pam_rhost_size = strlen(pi.pam_rhost) + 1;

pi.requested_domains = "";

pi.cli_pid = 12345;

ret = pack_message_v3(&pi, &buf_size, &m_buf);

assert_int_equal(ret, 0);

buf = talloc_memdup(mem_ctx, m_buf, buf_size);

free(m_buf);

assert_non_null(buf);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_WRAPPER);

will_return(__wrap_sss_packet_get_body, buf);

will_return(__wrap_sss_packet_get_body, buf_size);

}

static int test_pam_simple_check(uint32_t status, uint8_t *body, size_t blen)

{

size_t rp = 0;

uint32_t val;

assert_int_equal(status, 0);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, pam_test_ctx->exp_pam_status);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 1);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_DOMAIN_NAME);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 9);

assert_int_equal(*(body + rp + val - 1), 0);

assert_string_equal(body + rp, TEST_DOM_NAME);

return EOK;

}

static int test_pam_cert_check(uint32_t status, uint8_t *body, size_t blen)

{

size_t rp = 0;

uint32_t val;

assert_int_equal(status, 0);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, pam_test_ctx->exp_pam_status);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 2);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_DOMAIN_NAME);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 9);

assert_int_equal(*(body + rp + val - 1), 0);

assert_string_equal(body + rp, TEST_DOM_NAME);

rp += val;

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_CERT_INFO);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, (sizeof("pamuser") + sizeof(TEST_TOKEN_NAME)));

assert_int_equal(*(body + rp + sizeof("pamuser") - 1), 0);

assert_string_equal(body + rp, "pamuser");

rp += sizeof("pamuser");

assert_int_equal(*(body + rp + sizeof(TEST_TOKEN_NAME) - 1), 0);

assert_string_equal(body + rp, TEST_TOKEN_NAME);

return EOK;

}

static int test_pam_offline_chauthtok_check(uint32_t status,

uint8_t *body, size_t blen)

{

size_t rp = 0;

uint32_t val;

pam_test_ctx->exp_pam_status = PAM_AUTHTOK_ERR;

assert_int_equal(status, 0);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, pam_test_ctx->exp_pam_status);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 2);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_DOMAIN_NAME);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 9);

assert_int_equal(*(body + rp + val - 1), 0);

assert_string_equal(body + rp, TEST_DOM_NAME);

rp += val;

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_USER_INFO);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 4);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, SSS_PAM_USER_INFO_OFFLINE_CHPASS);

return EOK;

}

static int test_pam_failed_offline_auth_check(uint32_t status, uint8_t *body,

size_t blen)

{

pam_test_ctx->exp_pam_status = PAM_PERM_DENIED;

return test_pam_simple_check(status, body, blen);

}

static int test_pam_successful_offline_auth_check(uint32_t status,

uint8_t *body, size_t blen)

{

pam_test_ctx->exp_pam_status = PAM_SUCCESS;

return test_pam_simple_check(status, body, blen);

}

static int test_pam_wrong_pw_offline_auth_check(uint32_t status,

uint8_t *body, size_t blen)

{

pam_test_ctx->exp_pam_status = PAM_AUTH_ERR;

return test_pam_simple_check(status, body, blen);

}

static int test_pam_creds_insufficient_check(uint32_t status,

uint8_t *body, size_t blen)

{

size_t rp = 0;

uint32_t val;

assert_int_equal(status, 0);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, PAM_CRED_INSUFFICIENT);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 0);

return EOK;

}

static int test_pam_user_unknown_check(uint32_t status,

uint8_t *body, size_t blen)

{

size_t rp = 0;

uint32_t val;

assert_int_equal(status, 0);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, PAM_USER_UNKNOWN);

SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

assert_int_equal(val, 0);

return EOK;

}

void test_pam_authenticate(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_setcreds(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_SETCRED);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_SETCRED,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_acct_mgmt(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_ACCT_MGMT);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_ACCT_MGMT,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_open_session(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_OPEN_SESSION);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_NO_MODULE_DATA;

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_OPEN_SESSION,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_close_session(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_CLOSE_SESSION);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_CLOSE_SESSION,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_chauthtok(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_CHAUTHTOK);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_CHAUTHTOK,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_chauthtok_prelim(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_CHAUTHTOK_PRELIM);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_CHAUTHTOK_PRELIM,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_preauth(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_no_hash(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", "12345", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_failed_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_success(void **state)

{

int ret;

ret = sysdb_cache_password(pam_test_ctx->tctx->dom, "pamuser", "12345");

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_successful_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_wrong_pw(void **state)

{

int ret;

ret = sysdb_cache_password(pam_test_ctx->tctx->dom, "pamuser", "12345");

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "11111", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_success_2fa(void **state)

{

int ret;

ret = sysdb_cache_password(pam_test_ctx->tctx->dom, "pamuser", "12345");

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345", "abcde");

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_successful_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_failed_2fa(void **state)

{

int ret;

ret = sysdb_cache_password(pam_test_ctx->tctx->dom, "pamuser", "12345");

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "11111", "abcde");

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_success_2fa_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser", "12345",

SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345", "abcde");

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_successful_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_failed_2fa_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser", "12345",

SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "11111", "abcde");

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_success_pw_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser", "12345",

SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_successful_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_failed_pw_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser", "12345",

SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "11111", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_success_combined_pw_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser",

"12345678", SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345678abcde", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_successful_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_failed_combined_pw_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser",

"12345678", SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "11111111abcde", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_auth_failed_wrong_2fa_size_with_cached_2fa(void **state)

{

int ret;

ret = sysdb_cache_password_ex(pam_test_ctx->tctx->dom, "pamuser",

"12345678", SSS_AUTHTOK_TYPE_2FA, 5);

assert_int_equal(ret, EOK);

mock_input_pam(pam_test_ctx, "pamuser", "12345678abcd", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_wrong_pw_offline_auth_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_chauthtok_prelim(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_CHAUTHTOK_PRELIM);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_offline_chauthtok_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_CHAUTHTOK_PRELIM,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_offline_chauthtok(void **state)

{

int ret;

mock_input_pam(pam_test_ctx, "pamuser", NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_CHAUTHTOK);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

pam_test_ctx->exp_pam_status = PAM_AUTHINFO_UNAVAIL;

set_cmd_cb(test_pam_offline_chauthtok_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_CHAUTHTOK,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_preauth_no_logon_name(void **state)

{

int ret;

mock_input_pam_cert(pam_test_ctx, NULL, NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_creds_insufficient_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

static void set_cert_auth_param(struct pam_ctx *pctx, const char *dbpath)

{

pam_test_ctx->pctx->cert_auth = true;

pam_test_ctx->pctx->nss_db = discard_const(dbpath);

}

void test_pam_preauth_cert_nocert(void **state)

{

int ret;

set_cert_auth_param(pam_test_ctx->pctx, "/no/path");

mock_input_pam_cert(pam_test_ctx, "pamuser", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

static int test_lookup_by_cert_cb(void *pvt)

{

int ret;

struct sysdb_attrs *attrs;

unsigned char *der = NULL;

size_t der_size;

if (pvt != NULL) {

attrs = sysdb_new_attrs(pam_test_ctx);

assert_non_null(attrs);

der = sss_base64_decode(pam_test_ctx, pvt, &der_size);

assert_non_null(der);

ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);

talloc_free(der);

assert_int_equal(ret, EOK);

ret = sysdb_set_user_attr(pam_test_ctx->tctx->dom, "pamuser", attrs,

LDB_FLAG_MOD_ADD);

assert_int_equal(ret, EOK);

}

return EOK;

}

static int test_lookup_by_cert_wrong_user_cb(void *pvt)

{

int ret;

struct sysdb_attrs *attrs;

unsigned char *der = NULL;

size_t der_size;

if (pvt != NULL) {

attrs = sysdb_new_attrs(pam_test_ctx);

assert_non_null(attrs);

der = sss_base64_decode(pam_test_ctx, pvt, &der_size);

assert_non_null(der);

ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);

talloc_free(der);

assert_int_equal(ret, EOK);

ret = sysdb_set_user_attr(pam_test_ctx->tctx->dom, "wronguser", attrs,

LDB_FLAG_MOD_ADD);

assert_int_equal(ret, EOK);

}

return EOK;

}

void test_pam_preauth_cert_nomatch(void **state)

{

int ret;

set_cert_auth_param(pam_test_ctx->pctx, NSS_DB);

mock_input_pam_cert(pam_test_ctx, "pamuser", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

mock_account_recv(0, 0, NULL, test_lookup_by_cert_cb, NULL);

set_cmd_cb(test_pam_simple_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_preauth_cert_match(void **state)

{

int ret;

set_cert_auth_param(pam_test_ctx->pctx, NSS_DB);

mock_input_pam_cert(pam_test_ctx, "pamuser", NULL);

will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

mock_account_recv(0, 0, NULL, test_lookup_by_cert_cb,

discard_const(TEST_TOKEN_CERT));

set_cmd_cb(test_pam_cert_check);

ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

pam_test_ctx->pam_cmds);

assert_int_equal(ret, EOK);

/* Wait until the test finishes with EOK */

ret = test_ev_loop(pam_test_ctx->tctx);

assert_int_equal(ret, EOK);

}

void test_pam_preauth_cert_match_wrong_user(void **state)