test_pam_srv.c revision 544a20de7667f05c1a406c4dea0706b0ab507430
/*
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2015 Red Hat
SSSD tests: PAM responder tests
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include <popt.h>
#include "tests/cmocka/common_mock.h"
#include "tests/cmocka/common_mock_resp.h"
#include "responder/common/responder_packet.h"
#include "responder/common/negcache.h"
#include "responder/pam/pam_helpers.h"
#include "sss_client/pam_message.h"
#include "sss_client/sss_cli.h"
#include "util/crypto/sss_crypto.h"
#ifdef HAVE_NSS
#include "util/crypto/nss/nss_util.h"
#endif
#define TEST_CONF_DB "test_pam_conf.ldb"
#define TEST_DOM_NAME "pam_test"
#define TEST_SUBDOM_NAME "test.subdomain"
#define TEST_ID_PROVIDER "ldap"
#define NSS_DB_PATH "./sssd_test_nssdb"
#define TEST_TOKEN_NAME "SSSD Test Token"
#define TEST_TOKEN_CERT \
"MIIECTCCAvGgAwIBAgIBCDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \
"REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA2MjMx" \
"NjMyMDdaFw0xNzA2MjMxNjMyMDdaMDIxEjAQBgNVBAoMCUlQQS5ERVZFTDEcMBoG" \
"A1UEAwwTaXBhLWRldmVsLmlwYS5kZXZlbDCCASIwDQYJKoZIhvcNAQEBBQADggEP" \
"ADCCAQoCggEBALXUq56VlY+Z0aWLLpFAjFfbElPBXGQsbZb85J3cGyPjaMHC9wS+" \
"wjB6Ve4HmQyPLx8hbINdDmbawMHYQvTScLYfsqLtj0Lqw20sUUmedk+Es5Oh9VHo" \
"nd8MavYx25Du2u+T0iSgNIDikXguiwCmtAj8VC49ebbgITcjJGzMmiiuJkV3o93Y" \
"+N4M8URtd7EmzaYZQmNm//s2owFrCYMxpLiURPj+URZVuB72504/Ix7X0HCbA/AV" \
"MBaAFJOq+KAQmPEnNp8Wok23eGTdE7aDMDsGCCsGAQUFBwEBBC8wLTArBggrBgEF" \
"BQcwAYYfaHR0cDovL2lwYS1jYS5pcGEuZGV2ZWwvY2Evb2NzcDAOBgNVHQ8BAf8E" \
"BAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHQGA1UdHwRtMGsw" \
"aaAxoC+GLWh0dHA6Ly9pcGEtY2EuaXBhLmRldmVsL2lwYS9jcmwvTWFzdGVyQ1JM" \
"LmJpbqI0pDIwMDEOMAwGA1UECgwFaXBhY2ExHjAcBgNVBAMMFUNlcnRpZmljYXRl" \
"IEF1dGhvcml0eTAdBgNVHQ4EFgQUFaDNd5a53QGpaw5m63hnwXicMQ8wDQYJKoZI" \
"0aQtVmY81xamlXE12ZFpwDX43d+EufBkwCUKFX/+8JFDd2doAyeJxv1xM22kKRpc" \
"AqITPgMsa9ToGMWxjbVpc/X/5YfZixWPF0/eZUTotBj9oaR039UrhGfyN7OguF/G" \
"zotpoBIZmdH+ipYsu58HohHVlM9Wi5H4QmiiXl+Soldkq7eXYlafcmT7wv8+cKwz" \
"Nz0Tm3+eYpFqRo3skr6QzXi525Jkg3r6r+kkhxU=" \
static char CACHED_AUTH_TIMEOUT_STR[] = "2";
static const int CACHED_AUTH_TIMEOUT = 2;
struct pam_test_ctx {
struct sss_test_ctx *tctx;
struct sss_domain_info *subdom;
struct sss_cmd_table *pam_cmds;
int ncache_hits;
int exp_pam_status;
bool provider_contacted;
};
/* Must be global because it is needed in some wrappers */
struct pam_test_ctx *pam_test_ctx;
static errno_t setup_nss_db(void)
{
int ret;
int status;
return ret;
}
if (child_pid == 0) { /* child */
if (ret == -1) {
exit(-1);
}
} else if (child_pid > 0) {
} else {
return ret;
}
return ret;
}
if (ret < 0) {
return ret;
}
ret = fprintf(fp, "parameters=configdir='sql:%s/src/tests/cmocka/p11_nssdb' dbSlotDescription='SSSD Test Slot' dbTokenDescription='SSSD Test Token' secmod='secmod.db' flags=readOnly \n\n", ABS_SRC_DIR);
if (ret < 0) {
return ret;
}
if (ret != 0) {
return ret;
}
return EOK;
}
static void cleanup_nss_db(void)
{
int ret;
}
}
}
}
}
{
return pctx;
}
{
const char *val[2];
int ret;
}
return EOK;
}
struct confdb_ctx *cdb)
{
}
struct confdb_ctx *cdb)
{
}
struct sss_test_conf_param pam_params[],
struct sss_test_conf_param monitor_params[],
void **state)
{
/* FIXME - perhaps this should be folded into sssd_domain_init or stricty
* used together
*/
/* Initialize the PAM responder */
/* Create client context */
}
static void pam_test_setup_common(void)
{
/* Prime the cache with a valid user */
"pamuser", 123, 456, "pam user",
NULL, 300, 0);
/* Add entry to the initgr cache to make sure no initgr request is sent to
* the backend */
discard_const("pamuser"),
/* Prime the cache with a user for wrong matches */
"wronguser", 321, 654, "wrong user",
NULL, 300, 0);
/* Add entry to the initgr cache to make sure no initgr request is sent to
* the backend */
discard_const("wronguser"),
}
static int pam_test_setup(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "enumerate", "false" },
{ "cache_credentials", "true" },
};
struct sss_test_conf_param pam_params[] = {
{ "p11_child_timeout", "30" },
};
struct sss_test_conf_param monitor_params[] = {
{ "certificate_verification", "no_ocsp"},
};
return 0;
}
static int pam_cached_test_setup(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "enumerate", "false" },
{ "cache_credentials", "true" },
{ "cached_auth_timeout", CACHED_AUTH_TIMEOUT_STR },
};
struct sss_test_conf_param pam_params[] = {
{ "p11_child_timeout", "30" },
};
struct sss_test_conf_param monitor_params[] = {
{ "certificate_verification", "no_ocsp"},
};
return 0;
}
static int pam_test_teardown(void **state)
{
int ret;
return 0;
}
{
if (wtype == WRAP_CALL_REAL) {
}
if (len == 0) {
}
return;
}
{
}
{
return sss_mock_type(enum sss_cli_command);
}
{
return EOK;
}
{
}
{
pam_test_ctx->provider_contacted = true;
/* Set expected status */
return EOK;
}
{
int ret;
} else {
pi.pam_user_size = 0;
}
} else {
}
}
assert_int_equal(ret, 0);
}
const char *pin)
{
int ret;
} else {
pi.pam_user_size = 0;
}
}
assert_int_equal(ret, 0);
}
{
assert_int_equal(status, 0);
return EOK;
}
{
assert_int_equal(status, 0);
rp += sizeof("pamuser");
return EOK;
}
{
assert_int_equal(status, 0);
return EOK;
}
{
}
{
}
{
}
{
}
{
assert_int_equal(status, 0);
assert_int_equal(val, 0);
return EOK;
}
{
assert_int_equal(status, 0);
assert_int_equal(val, 0);
return EOK;
}
void test_pam_authenticate(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_setcreds(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_acct_mgmt(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_open_session(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_close_session(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_chauthtok(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_chauthtok_prelim(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
/* Cached on-line authentication */
static void common_test_pam_cached_auth(const char *pwd)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_cached_auth_success(void **state)
{
int ret;
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
/* Reset before next call */
pam_test_ctx->provider_contacted = false;
common_test_pam_cached_auth("12345");
/* Back end should not be contacted */
}
void test_pam_cached_auth_wrong_pw(void **state)
{
int ret;
common_test_pam_cached_auth("11111");
/* Back end should be contacted */
}
/* test cached_auth_timeout option */
void test_pam_cached_auth_opt_timeout(void **state)
{
int ret;
"pamuser",
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
}
/* too long since last on-line authentication */
void test_pam_cached_auth_timeout(void **state)
{
int ret;
"pamuser", 0);
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
}
{
int ret;
common_test_pam_cached_auth("12345678");
/* Reset before next call */
pam_test_ctx->provider_contacted = false;
common_test_pam_cached_auth("12345678");
}
{
int ret;
common_test_pam_cached_auth("1111abcde");
}
/* Off-line authentication */
void test_pam_offline_auth_no_hash(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_wrong_pw(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_2fa(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_2fa(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_2fa_with_cached_2fa(void **state)
{
int ret;
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_2fa_with_cached_2fa(void **state)
{
int ret;
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_pw_with_cached_2fa(void **state)
{
int ret;
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_pw_with_cached_2fa(void **state)
{
int ret;
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_chauthtok_prelim(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_chauthtok(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_no_logon_name(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
{
}
void test_pam_preauth_cert_nocert(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
static int test_lookup_by_cert_cb(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
}
return EOK;
}
static int test_lookup_by_cert_wrong_user_cb(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
}
return EOK;
}
void test_pam_preauth_cert_nomatch(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_match(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_match_wrong_user(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_no_cert_no_logon_name(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name_no_match(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_cert_auth(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
{
int rv;
int no_cleanup = 0;
int opt;
struct poptOption long_options[] = {
_("Do not delete the test database after a test run"), NULL },
};
const struct CMUnitTest tests[] = {
/* p11_child is not built without NSS */
#ifdef HAVE_NSS
#endif /* HAVE_NSS */
};
/* Set debug level to invalid value so we can deside if -d 0 was used. */
switch (opt) {
default:
return 1;
}
}
/* Even though normally the tests should clean up after themselves
* they might not after a failed run. Remove the old db to be sure */
rv = setup_nss_db();
exit(-1);
}
if (rv == 0 && !no_cleanup) {
}
#ifdef HAVE_NSS
/* Cleanup NSS and NSPR to make valgrund happy. */
#endif
return rv;
}