path: root/doc/kadm5/api-unit-test.tex

\documentstyle[times,fullpage,rcsid]{article}

\rcs$Header$

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Make _ actually generate an _, and allow line-breaking after it.
\let\underscore=\_
\catcode`_=13
\def_{\underscore\penalty75\relax}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\test}[1]{\begin{description}
\setlength{\itemsep}{0pt}
#1
\end{description}

}

\newcommand{\numtest}[2]{\begin{description}
\setlength{\itemsep}{0pt}
\Number{#1}
#2
\end{description}

}

\newcommand{\Number}[1]{\item[Number:] #1}
\newcommand{\Reason}[1]{\item[Reason:] #1}
%\newcommand{\Call}[1]{\item[Call:] #1}
%\newcommand{\Expected}[1]{\item[Expected:] #1}
\newcommand{\Conditions}[1]{\item[Conditions:] #1}

%\newcommand{\Number}[1]{}
%\newcommand{\Reason}[1]{}
\newcommand{\Call}[1]{}
\newcommand{\Expected}[1]{}
%\newcommand{\Conditions}[1]{}

\title{OpenV*Secure 1.0 Admin API\\
Unit Test Description\footnote{\rcsHeader}}
\author{Jonathan I. Kamens}

\begin{document}

\maketitle

%\tableofcontents

\section{Introduction}

The following is a description of a black-box unit test of the
OpenV*Secure Admin API.  Each API function is listed, followed by the
tests that shoud be performed on it.

The tests described here are based on the ``OV*Secure Admin Functional
Specifications'' dated November 9, 1993.

Since inter-realm functionality is not a requirement for OpenV*Secure
1.0, it is not tested.

%In these tests: ``usera'' and ``userb'' (abbreviated ``a'' and ``b'') as the
%non-realm part of a principal represent the names of principals that
%exist in the current realm; ``nouser'' (abbreviated ``n'') represents a
%principal that does not exist in the current realm; ``useras-password''
%(abbreviated ``a's-p'') represents ``usera'''s password; ``userbs-password''
%(abbreviated ``b's-p'') represents ``userb'''s password; ``no-password''
%(abbreviated ``no-p'') represents some password string which isn't the
%password of anyone in the database; ``LOCAL.REALM'' (abbreviated ``L.R'')
%represents the local realm; and ``BAD.REALM'' (abbreviated ``B.R'')
%represents a nonexistent realm.

All tests which test for success should verify, using some means other
than the return value of the function being tested, that the requested
operation was successfully performed.  For example: for init, test
that other operations can be performed after init; for destroy, test
that other operations can't be performed after destroy; for modify
functions, verify that all modifications to the database which should
have taken place did, and that the new, modified data is in effect;
for get operations, verify that the data retrieved is the data that
should actually be in the database.

Similarly, all tests which test for failure should verify that the
no component of the requested operation took place.  For example: if
init fails, other operations should not work.  If a modify fails, all
data in the database should be the same as it was before the attempt
to modify, and the old data should still be what is enforced.
Furthermore, tests which test for failure should verify that the
failure code returned is correct for the specific failure condition
tested.

\section{ovsec_kadm_init}

%ADMIN_SERVICE is abbreviated A_S, and CHANGEPW_SERVICE is abbreviated
%C_S.

\numtest{1}{
\Reason{An empty string realm is rejected.}
\Call{ovsec_kadm_init(a, a's-p, A_S, "")}
\Expected{returns XXX.}
}

\numtest{2}{
\Reason{A realm containing invalid characters is rejected.}
\Call{ovsec_kadm_init(a, a's-p, A_S, B.R)}
\Expected{returns XXX}
}

\numtest{2.5}{
\Reason{A non-existent realm is rejected.}
}

\numtest{3}{
\Reason{A bad service name representing an existing principal
	(different from the client principal) is rejected.}
\Call{ovsec_kadm_init(a, a's-p, b, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{4}{
\Reason{A bad service name representing a non-existent
		principal is rejected.}
\Call{ovsec_kadm_init(a, a's-p, n, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{5}{
\Reason{A bad service name identical to the (existing) client
		name is rejected.}
\Call{ovsec_kadm_init(a, a's-p, a, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{6}{
\Reason{A null password causes password prompting.}
\Call{ovsec_kadm_init(a, null, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{7}{
\Reason{An empty-string password is rejected.}
\Call{ovsec_kadm_init(a, "", A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{8}{
\Reason{An incorrect password which is the password of another
		user is rejected.}
\Call{ovsec_kadm_init(a, b's-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{9}{
\Reason{An incorrect password which isn't the password of any
		user is rejected.}
\Call{ovsec_kadm_init(a, no-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{10}{
\Reason{A null client_name is rejected.}
\Call{ovsec_kadm_init(null, no-p, A_S, null)}
\Expected{returns XXX}
}

\numtest{11}{
\Reason{An empty-string client_name is rejected.}
\Call{ovsec_kadm_init("", no-p, A_S, null)}
\Expected{returns XXX}
}

\numtest{12}{
\Reason{A client_name referring to a non-existent principal in
		the default realm is rejected.}
\Call{ovsec_kadm_init(n, no-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{13}{
\Reason{A client_name referring to a non-existent principal
		with the local realm specified explicitly is rejected.}
\Call{ovsec_kadm_init(n@L.R, no-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{14}{
\Reason{A client_name referring to a non-existent principal in
	a nonexistent realm is rejected.}
\Call{ovsec_kadm_init(n@B.R, no-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{15}{
\Reason{A client_name referring to an existing principal in a
	nonexistent realm is rejected.}
\Call{ovsec_kadm_init(a@B.R, a's-p, A_S, null)}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{16}{
\Reason{Valid invocation.}
\Call{ovsec_kadm_init(a, a-s'p, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{17}{
\Reason{Valid invocation (explicit client realm).}
\Call{ovsec_kadm_init(a@L.R, a-s'p, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{18}{
\Reason{Valid invocation (CHANGEPW_SERVICE).}
\Call{ovsec_kadm_init(a, a-s'p, C_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{19}{
\Reason{Valid invocation (explicit service realm).}
\Call{ovsec_kadm_init(a, a-s'p, A_S, L.R);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{20}{
\Reason{Valid invocation (database access allowed after init).}
\Call{ovsec_kadm_init(a, a-s'p, A_S, null);
		ovsec_kadm_get_principal(a, buffer);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{21}{
\Reason{Init fails when called twice in a row.}
\Call{ovsec_kadm_init(a, a-s'p, A_S, null);
		ovsec_kadm_init(a, a-s'p, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK the first time, XXX the second time}
}

\numtest{22}{
\Reason{A null password causes master-key prompting.}
\Call{ovsec_kadm_init(a, null, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
\Conditions{local}
}

\numtest{23}{
\Reason{A non-null password causes reading from the kstash.}
\Call{ovsec_kadm_init(a, no-p, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
\Conditions{local}
}

\numtest{24}{
\Reason{Null service name is ignored in local invocation.}
\Call{ovsec_kadm_init(a, null, null, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
\Conditions{local}
}

\numtest{25}{
\Reason{Non-null service name is ignored in local invocation.}
\Call{ovsec_kadm_init(a, null, n, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
\Conditions{local}
}

\numtest{26}{
\Reason{Can't do ``get'' operation before calling init.}
}

\numtest{27}{
\Reason{Can't do ``add'' operation before calling init.}
}

\numtest{28}{
\Reason{Can't do ``modify'' operation before calling init.}
}

\numtest{29}{
\Reason{Can't do ``delete'' operation before calling init.}
}

\section{ovsec_kadm_destroy}

\numtest{1}{
\Reason{Valid invocation.}
\Call{ovsec_kadm_init(a, a-s'p, A_S, null);
		ovsec_kadm_destroy()}
\Expected{returns OK}
}

\numtest{2}{
\Reason{Valid invocation (``get'' not allowed after destroy).}
}

\numtest{3}{
\Reason{Valid invocation (``add'' not allowed after destroy).}
}

\numtest{4}{
\Reason{Valid invocation (``modify'' not allowed after destroy).}
}

\numtest{5}{
\Reason{Valid invocation (``delete'' not allowed after destroy).}
}

\numtest{6}{
\Reason{Fails if database not initialized.}
\Call{ovsec_kadm_destroy()}
\Expected{returns NOT_INIT}
}

\numtest{7}{
\Reason{Fails if invoked twice in a row.}
\Call{ovsec_kadm_init(a, a's-p, A_S, null);
		ovsec_kadm_destroy();
		ovsec_kadm_destroy()}
\Expected{returns OK the first time, NOT_INIT the second}
}

\numtest{8}{
\Reason{Database can be reinitialized after destroy.}
\Call{ovsec_kadm_init(a, a's-p, A_S, null);
		ovsec_kadm_destroy();
		ovsec_kadm_init(a, a's-p, A_S, null);
		ovsec_kadm_get_principal(a, buffer);
		verify contents of buffer;
		ovsec_kadm_destroy()}
}

\section{ovsec_kadm_create_principal}

%In the tests below, ``getu'' refers to a user who has only ``get'' access,
%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to
%a user who has only ``modify'' access, and ``deleteu'' refers to a user
%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and
%''modify'' access.  ``new_princ'' refers to a principal entry structure
%filled in as follows:
%
%	krb5_parse_name("newuser", \&new_princ.principal);
%	krb5_timeofday(\&new_princ.princ_expire_time);
%		new_princ.princ_expire_time += 130;
%	krb5_timeofday(\&new_princ.last_pwd_change);
%		new_princ.last_pwd_change += 140;
%	krb5_timeofday(\&new_princ.pw_expiration);
%		new_princ.pw_expiration += 150;
%	new_princ.max_life = 160;
%	krb5_parse_name("usera", \&new_princ.mod_name);
%	krb5_timeofday(\&new_princ.mod_date);
%		new_princ.mod_date += 170;
%	new_princ.attributes = 0xabcdabcd;
%	new_princ.kvno = 180;
%	new_princ.mkvno = 190;
%	new_princ.policy = null;
%	new_princ.aux_attributes = 0xdeadbeef;
%
%The offsets of 130 through 190 above are used to ensure that the
%fields are all known to be different from each other, so that
%accidentally switched fields can be detected.  Some of the fields in
%this structure may be changed by the tests, but they should clean up
%after themselves.

\numtest{1}{
\Reason{Fails if database not initialized.}
}

\numtest{2}{
\Reason{Fails on null princ argument.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(null, PRINCIPAL, "foobar",
					    true);
		ovsec_kadm_destroy()}
\Expected{returns EINVAL}
}

\numtest{3}{
\Reason{Fails on null password argument.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL, null,
					    true);
		ovsec_kadm_destroy()}
\Expected{returns EINVAL}
}

\numtest{4}{
\Reason{Fails on empty-string password argument. XXX Assumes
		that an empty string is not a legal password.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL, "",
					    true);
		ovsec_kadm_destroy()}
\Expected{returns XXX}
}

\numtest{5}{
\Reason{Fails when mask contains undefined bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL | 0x002000,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{6}{
\Reason{Fails when mask contains LAST_PWD_CHANGE bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, 
					    PRINCIPAL | LAST_PWD_CHANGE,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{7}{
\Reason{Fails when mask contains MOD_TIME bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL | MOD_TIME,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{8}{
\Reason{Fails when mask contains MOD_NAME bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL | MOD_NAME,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{9}{
\Reason{Fails when mask contains MKVNO bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL | MKVNO,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{10}{
\Reason{Fails when mask contains AUX_ATTRIBUTES bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ,
					    PRINCIPAL | AUX_ATTRIBUTES,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{11}{
\Reason{Fails when mask contains POLICY_CLR bit.}
\Call{ovsec_kadm_init(addu, addu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL | POLICY_CLR,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns BAD_MASK}
}

\numtest{12}{
\Reason{Fails for caller with no access bits.}
}

\numtest{13}{
\Reason{Fails when caller has ``get'' access and not ``add''.}
\Call{ovsec_kadm_init(getu, getu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns AUTH_ADD}
\Conditions{RPC}
}

\numtest{14}{
\Reason{Fails when caller has ``modify'' access and not ``add''.}
\Call{ovsec_kadm_init(modifyu, modifyu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns AUTH_ADD}
\Conditions{RPC}
}

\numtest{15}{
\Reason{Fails when caller has ``delete'' access and not ``add''.}
\Call{ovsec_kadm_init(deleteu, deleteu's-p, A_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns AUTH_ADD}
\Conditions{RPC}
}

\numtest{16}{
\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
\Call{ovsec_kadm_init(addu, addu's-p, C_S, null);
		ovsec_kadm_create_principal(new_princ, PRINCIPAL,
					    "foobar", true);
		ovsec_kadm_get_principal("newuser", buffer);
		ovsec_kadm_destroy()}
\Expected{returns XXX}
\Conditions{RPC}
}

\numtest{17}{
\Reason{Fails on attempt to create existing principal.}
\Call{ovsec_kadm_init(getu, getu's-p, A_S, null);
		ovsec_kadm_get_principal("usera", buffer);
		ovsec_kadm_destroy();
		ovsec_kadm_init(addu, addu's-p, A_S, null);
		save new_princ's principal;
		new_princ.principal = buffer.principal;
		save new_princ's max_life;
		new_princ.max_life = buffer.max_life + 1;
		ovsec_kadm_create_principal(new_princ, PRINCIPAL,
					    "foobar", true);
		ovsec_kadm_destroy();
		ovsec_kadm_init(getu, getu's-p, A_S, null);
		ovsec_kadm_get_principal("usera", buffer2);
		ovsec_kadm_destroy()
		compare buffer to buffer2;
		restore new_princ's principal;
		restore new_princ's max_life;
		ovsec_kadm_free_principle_ent(buffer);
		ovsec_kadm_free_principal_ent(buffer2)}
\Expected{returns DUP}
}

\numtest{18}{
\Reason{Fails when password is too short.}
}

\numtest{19}{
\Reason{Fails when password has too few classes.}
}

\numtest{20}{
\Reason{Fails when password is in dictionary.}
}

\numtest{21}{
\Reason{Nonexistent policy is rejected.}
}

\numtest{22}{
\Reason{Fails on invalid principal name.}
}

\numtest{23}{
\Reason{Valid invocation.}
}

\numtest{24}{
\Reason{Succeeds when caller has ``add'' access and another one.}
}

\numtest{25}{
\Reason{Allows too-short password when override_qual is true.}
}

\numtest{26}{
\Reason{Allows password with too few classes when
		override_qual is true.}
}

\numtest{27}{
\Reason{Allows password in dictionary when override_qual is
		true.}
}

\numtest{28}{
\Reason{Succeeds when assigning policy.}
}

\numtest{29}{
\Reason{Allows 0 (never) for princ_expire_time.}
}

\numtest{30}{
\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
}

\numtest{31}{
\Reason{Allows 0 (never) for pw_expiration when there's a policy with
	0 for pw_max_life.}
}

\numtest{32}{
\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
	non-zero pw_max_life, but actually sets pw_expiration to now +
	pw_max_life.}
}

\numtest{33}{
\Reason{Accepts and sets non-zero pw_expiration when no policy.}
}

\numtest{34}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
	with zero pw_max_life.}
}

\numtest{35}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
	with pw_max_life later than the specified pw_expiration.}
}

\numtest{36}{
\Reason{Accepts non-zero pw_expiration and limits it to now +
	pw_max_life when it's later than now + non-zero pw_max_life in
	policy.}
}

\numtest{37}{
\Reason{Sets pw_expiration to 0 (never) if there's no policy and no
	specified pw_expiration.}
}

\numtest{38}{
\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
	policy has a 0 (never) pw_max_life.}
}

\numtest{39}{
\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
	and the policy has a non-zero pw_max_life.}
}

\numtest{40}{
\Reason{Allows 0 (forever) for max_life.}
}



\section{ovsec_kadm_delete_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
}

\numtest{2}{
\Reason{Fails on null principal.}
}

\numtest{3}{
\Reason{Fails on empty-string principal.}
}

\numtest{4}{
\Reason{Fails on invalid principal name.}
}

\numtest{5}{
\Reason{Fails on nonexistent principal.}
}

\numtest{6}{
\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
}

\numtest{7}{
\Reason{Fails if caller has ``add'' access and not ``delete''.}
}

\numtest{8}{
\Reason{Fails if caller has ``modify'' access and not ``delete''.}
}

\numtest{9}{
\Reason{Fails if caller has ``get'' access and not ``delete''.}
}

\numtest{10}{
\Reason{Fails if caller has no access bits.}
}

\numtest{11}{
\Reason{Valid invocation.}
\Expected{Principal is removed from database.}
}

\numtest{12}{
\Reason{Valid invocation (on principal with policy).}
\Expected{Principal is removed from database.  Reference count
		of its policy is decremented.}
}



\section{ovsec_kadm_modify_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
}

\numtest{2}{
\Reason{Fails if user connected with CHANGEPW_SERVICE.}
}

\numtest{3}{
\Reason{Fails on mask with undefined bit set.}
}

\numtest{4}{
\Reason{Fails on mask with PRINCIPAL set.}
}

\numtest{5}{
\Reason{Fails on mask with LAST_PWD_CHANGE set.}
}

\numtest{6}{
\Reason{Fails on mask with MOD_TIME set.}
}

\numtest{7}{
\Reason{Fails on mask with MOD_NAME set.}
}

\numtest{8}{
\Reason{Fails on mask with MKVNO set.}
}

\numtest{9}{
\Reason{Fails on mask with AUX_ATTRIBUTES set.}
}

\numtest{10}{
\Reason{Fails on nonexistent principal.}
}

\numtest{11}{
\Reason{Fails for user with no access bits.}
}

\numtest{12}{
\Reason{Fails for user with ``get'' access.}
}

\numtest{13}{
\Reason{Fails for user with ``add'' access.}
}

\numtest{14}{
\Reason{Fails for user with ``delete'' access.}
}

\numtest{15}{
\Reason{Succeeds for user with ``modify'' access.}
}

\numtest{16}{
\Reason{Succeeds for user with ``modify'' and another access.}
}

\numtest{17}{
\Reason{Fails when nonexistent policy is specified.}
}

\numtest{18}{
\Reason{Succeeds when existent policy is specified.}
}

\numtest{19}{
\Reason{Updates policy count when setting policy from none.}
}

\numtest{20}{
\Reason{Updates policy count when clearing policy from set.}
}

\numtest{21}{
\Reason{Updates policy count when setting policy from other policy.}
}

\numtest{22}{
\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
}

\numtest{23}{
\Reason{Allows 0 (never) for pw_expiration when there's a policy with
	0 for pw_max_life.}
}

\numtest{24}{
\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
	non-zero pw_max_life, but actually sets pw_expiration to
	last_pwd_change + pw_max_life.}
}

\numtest{25}{
\Reason{Accepts and sets non-zero pw_expiration when no policy.}
}

\numtest{26}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
	with zero pw_max_life.}
}

\numtest{27}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
	with pw_max_life later than the specified pw_expiration.}
}

\numtest{28}{
\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change +
	pw_max_life when it's later than last_pwd_change + non-zero
	pw_max_life in policy.}
}

\numtest{29}{
\Reason{Sets pw_expiration to 0 (never) if there's no policy and no
	specified pw_expiration.}
}

\numtest{30}{
\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
	policy has a 0 (never) pw_max_life.}
}

\numtest{31}{
\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
	and the policy has a non-zero pw_max_life.}
}

\numtest{32}{
\Reason{Accepts princ_expire_time change.}
}

\numtest{33}{
\Reason{Accepts attributes change.}
}

\numtest{34}{
\Reason{Accepts max_life change.}
}

\numtest{35}{
\Reason{Accepts kvno change.}
}

\numtest{36}{
\Reason{Behaves correctly when policy is set to the same as it was
	before.}
}

\numtest{37}{
\Reason{Behaves properly when POLICY_CLR is specified and there was no
	policy before.}
}

\numtest{38}{
\Reason{Accepts 0 (never) for princ_expire_time.}
}

\numtest{39}{
\Reason{Accepts 0 for max_life.}
}



\section{ovsec_kadm_rename_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
}

\numtest{2}{
\Reason{Fails if user connected with CHANGEPW_SERVICE.}
}

\numtest{3}{
\Reason{Fails for user with no access bits.}
}

\numtest{4}{
\Reason{Fails for user with ``modify'' access and not ``add'' or
``delete''.}
}

\numtest{5}{
\Reason{Fails for user with ``get'' access and not ``add'' or
``delete''.}
}

\numtest{6}{
\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.}
}

\numtest{7}{
\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.}
}

\numtest{8}{
\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.}
}

\numtest{9}{
\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''}
}

\numtest{10}{
\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not
	``delete''.}
}

\numtest{11}{
\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but
	not ``add''.}
}

\numtest{12}{
\Reason{Fails for user with ``add'' but not ``delete''.}
}

\numtest{13}{
\Reason{Fails for user with ``delete'' but not ``add''.}
}

\numtest{14}{
\Reason{Succeeds for user with ``add'' and ``delete''.}
}

\numtest{15}{
\Reason{Fails if target principal name exists.}
}



\section{ovsec_kadm_chpass_principal}
\label{ovseckadmchpassprincipal}

\subsection{Quality/history enforcement tests}

This section lists a series of tests which will be run a number of
times, with various parameter settings (e.g., which access bits user
has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE,
whether override_qual is specified, etc.).  These changes should
either all succeed or all fail, depending on the parameter settings.
After the list of tests, the various invocations of them, with the
corresponding parameter settings and whether the changes should
succeed or fail, will be given.

\subsubsection{List of tests}

The test number of each of these tests is an offset from the base
given in the table below.

\numtest{1}{
\Reason{With history setting of 1, change password to itself.}
}

\numtest{2}{
\Reason{With history setting of 2 but no password changes since
	principal creation, change password to itself.}
}

\numtest{3}{
\Reason{With history setting of 2 and one password change since
	principal creation, change password to itself
	and directly previous password.}
}

\numtest{4}{
\Reason{With a history setting of 3 and no password changes,
	change password to itself.}
}

\numtest{5}{
\Reason{With a history setting of 3 and 1 password change,
	change password itself or previous password.}
}

\numtest{6}{
\Reason{With a history setting of 3 and 2 password changes,
	change password to itself and the two previous passwords.}
}

\numtest{7}{
\Reason{Change to previously unused password when now -
	last_pwd_change $<$ pw_min_life.}
}

\numtest{8}{
\Reason{Change to previously unused password that doesn't contain enough
	character classes.}
}

\numtest{9}{
\Reason{Change to previously unused password that's too short.}
}

\numtest{10}{
\Reason{Change to previously unused password that's in the dictionary.}
}

\subsubsection{List of parameter settings}

\begin{tabular}{llllll}
Base & Modify access? & Own password? & Service & override_qual & Pass/Fail \\ \hline
0 & no & yes & ADMIN & false & fail \\
10 & no & yes & ADMIN & true & RPC: fail; local: {\em pass} \\
20 & no & yes & CHANGEPW & false & fail \\
30 & no & yes & CHANGEPW & true & RPC: fail; local: {\em pass} \\
40 & no & no & ADMIN & false & fail \\
50 & no & no & ADMIN & true & RPC: fail; local: {\em pass} \\
60 & no & no & CHANGEPW & false & fail \\
70 & no & no & CHANGEPW & true & RPC: fail; local: {\em pass} \\
80 & yes & yes & ADMIN & false & fail \\
90 & yes & yes & ADMIN & true & RPC: fail; local {\em pass} \\
100 & yes & yes & CHANGEPW & false & fail \\
110 & yes & yes & CHANGEPW & true & RPC: fail; local: {\em pass} \\
120 & yes & no & ADMIN & false & fail \\
130 & yes & no & ADMIN & true & {\em pass} \\
140 & yes & no & CHANGEPW & false & fail \\
150 & yes & no & CHANGEPW & true & RPC: fail; local: {\em pass}
\end{tabular}

\subsection{Other quality/history tests}

These tests should be run with override_qual false.

\numtest{161}{
\Reason{With history of 1, can change password to anything other than
	itself that doesn't conflict with other quality
	rules.}
}

\numtest{162}{
\Reason{With history of 2 and 2 password changes, can change password
	to original password.}
}

\numtest{163}{
\Reason{With history of 3 and 3 password changes, can change password
	to original password.}
}

\numtest{164}{
\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.}
}

\numtest{165}{
\Reason{Can change password when it contains exactly the number of
	classes required by the policy.}
}

\numtest{166}{
\Reason{Can change password when it is exactly the length required by
	the policy.}
}

\numtest{167}{
\Reason{Can change password to a word that isn't in the dictionary.}
}


\subsection{Other tests}

\numtest{168}{
\Reason{Fails if database not initialized.}
}

\numtest{169}{
\Reason{Fails for non-existent principal.}
}

\numtest{170}{
\Reason{Fails for null password.}
}

\numtest{171}{
\Reason{Fails for empty-string password.}
}

\numtest{172}{
\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
	has non-zero max_pw_life.}
}

\numtest{173}{
\Reason{Pw_expiration is set to 0 if policy exists and has zero
	max_pw_life.}
}

\numtest{174}{
\Reason{Pw_expiration is set to 0 if no policy.}
}

\numtest{175}{
\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is
	successfully changed.}
}

\numtest{176}{
\Reason{Fails for user with no access bits, on other's password.}
}

\numtest{177}{
\Reason{Fails for user with ``get'' but not ``modify'' access, on
	other's password.}
}

\numtest{178}{
\Reason{Fails for user with ``delete'' but not ``modify'' access, on
	other's password.}
}

\numtest{179}{
\Reason{Fails for user with ``add'' but not ``modify'' access, on
	other's password.}
}

\numtest{180}{
\Reason{Succeeds for user with ``get'' and ``modify'' access, on
	other's password.}
}



\section{ovsec_kadm_chpass_principal_util}

XXX Needs to be modified to take into account the new argument.

Rerun all the tests listed for ovsec_kadm_chpass_principal above in
Section \ref{ovseckadmchpassprincipal}.  Verify that they succeed
and fail in the same circumstances.  Also verify that in each failure
case, the error message returned in msg_ret is as specified in the
functional specification.



\section{ovsec_kadm_randkey_principal}

\subsection{TOOSOON enforcement tests}

This test should be run a number of times, as indicated in the table
following it.  The table also indicates the expected result of each
run of the test.

\test{
\Reason{Change key when now - last_pwd_change $<$ pw_min_life.}
}

\subsubsection{List of parameter settings}

\begin{tabular}{llllll}
Number & Modify access? & Own key? & Service & override_qual & Pass/Fail \\ \hline
1 & no & yes & ADMIN & false & fail \\
2 & no & yes & ADMIN & true & RPC: fail; local: {\em pass} \\
3 & no & yes & CHANGEPW & false & fail \\
4 & no & yes & CHANGEPW & true & RPC: fail; local: {\em pass} \\
5 & no & no & ADMIN & false & fail \\
6 & no & no & ADMIN & true & RPC: fail; local: {\em pass} \\
7 & no & no & CHANGEPW & false & fail \\
8 & no & no & CHANGEPW & true & RPC: fail; local: {\em pass} \\
9 & yes & yes & ADMIN & false & fail \\
10 & yes & yes & ADMIN & true & RPC: fail; local {\em pass} \\
11 & yes & yes & CHANGEPW & false & fail \\
12 & yes & yes & CHANGEPW & true & RPC: fail; local: {\em pass} \\
13 & yes & no & ADMIN & false & fail \\
14 & yes & no & ADMIN & true & {\em pass} \\
15 & yes & no & CHANGEPW & false & fail \\
16 & yes & no & CHANGEPW & true & RPC: fail; local: {\em pass}
\end{tabular}

\subsection{Other tests}

\numtest{17}{
\Reason{Fails if database not initialized.}
}

\numtest{18}{
\Reason{Fails for non-existent principal.}
}

\numtest{19}{
\Reason{Fails for null keyblock pointer.}
}

\numtest{20}{
\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
	has non-zero max_pw_life.}
}

\numtest{21}{
\Reason{Pw_expiration is set to 0 if policy exists and has zero
	max_pw_life.}
}

\numtest{22}{
\Reason{Pw_expiration is set to 0 if no policy.}
}

\numtest{23}{
\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is
	successfully changed.}
}

\numtest{24}{
\Reason{Fails for user with no access bits, on other's password.}
}

\numtest{25}{
\Reason{Fails for user with ``get'' but not ``modify'' access, on
	other's password.}
}

\numtest{26}{
\Reason{Fails for user with ``delete'' but not ``modify'' access, on
	other's password.}
}

\numtest{27}{
\Reason{Fails for user with ``add'' but not ``modify'' access, on
	other's password.}
}

\numtest{28}{
\Reason{Succeeds for user with ``get'' and ``modify'' access, on
	other's password.}
}

\numtest{29}{
\Reason{The new key that's assigned is truly random. XXX not sure how
	to test this.}
}



\section{ovsec_kadm_get_principal}

\numtest{1}{
\Reason{Fails for null ent.}
}

\numtest{2}{
\Reason{Fails for non-existent principal.}
}

\numtest{3}{
\Reason{Fails for user with no access bits, retrieving other principal.}
}

\numtest{4}{
\Reason{Fails for user with ``add'' but not ``get'', getting principal
	other than his own, using ADMIN_SERVICE.}
}

\numtest{5}{
\Reason{Fails for user with ``modify'' but not ``get'', getting
	principal other than his own, using ADMIN_SERVICE.}
}

\numtest{6}{
\Reason{Fails for user with ``delete'' but not ``get'', getting
	principal other than his own, using ADMIN_SERVICE.}
}

\numtest{7}{
\Reason{Fails for user with ``delete'' but not ``get'', getting
	principal other than his own, using CHANGEPW_SERVICE.}
}

\numtest{8}{
\Reason{Fails for user with ``get'', getting principal other than his
	own, using CHANGEPW_SERVICE.}
}

\numtest{9}{
\Reason{Succeeds for user without ``get'', retrieving self, using
	ADMIN_SERVICE.}
}

\numtest{10}{
\Reason{Succeeds for user without ``get'', retrieving self, using
	CHANGEPW_SERVICE.}
}

\numtest{11}{
\Reason{Succeeds for user with ``get'', retrieving self, using
	ADMIN_SERVICE.}
}

\numtest{12}{
\Reason{Succeeds for user with ``get'', retrieving self, using
	CHANGEPW_SERVICE.}
}

\numtest{13}{
\Reason{Succeeds for user with ``get'', retrieving other user, using
	ADMIN_SERVICE.}
}

\numtest{14}{
\Reason{Succeeds for user with ``get'' and ``modify'', retrieving
	other principal, using ADMIN_SERVICE.}
}



\section{ovsec_kadm_create_policy}

\numtest{1}{
\Reason{Fails for mask with undefined bit set.}
}

\numtest{2}{
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
}

\numtest{3}{
\Reason{Fails for mask without POLICY bit set.}
}

\numtest{4}{
\Reason{Fails for mask with REF_COUNT bit set.}
}

\numtest{5}{
\Reason{Fails for invalid policy name.}
}

\numtest{6}{
\Reason{Fails for existing policy name.}
}

\numtest{7}{
\Reason{Fails for null policy name.}
}

\numtest{8}{
\Reason{Fails for empty-string policy name.}
}

\numtest{9}{
\Reason{Accepts 0 for pw_min_life.}
}

\numtest{10}{
\Reason{Accepts non-zero for pw_min_life.}
}

\numtest{11}{
\Reason{Accepts 0 for pw_max_life.}
}

\numtest{12}{
\Reason{Accepts non-zero for pw_max_life.}
}

\numtest{13}{
\Reason{Accepts 0 for pw_min_length.}
}

\numtest{14}{
\Reason{Accepts non-zero for pw_min_length.}
}

\numtest{15}{
\Reason{Rejects 0 for pw_min_classes.}
}

\numtest{16}{
\Reason{Accepts 1 for pw_min_classes.}
}

\numtest{17}{
\Reason{Accepts 4 for pw_min_classes.}
}

\numtest{18}{
\Reason{Rejects 5 for pw_min_classes.}
}

\numtest{19}{
\Reason{Rejects 0 for pw_history_num.}
}

\numtest{20}{
\Reason{Accepts 1 for pw_history_num.}
}

\numtest{21}{
\Reason{Accepts 10 for pw_history_num.}
}

\numtest{22}{
\Reason{Fails for user with no access bits.}
}

\numtest{23}{
\Reason{Fails for user with ``get'' but not ``add''.}
}

\numtest{24}{
\Reason{Fails for user with ``modify'' but not ``add.''}
}

\numtest{25}{
\Reason{Fails for user with ``delete'' but not ``add.''}
}

\numtest{26}{
\Reason{Succeeds for user with ``add.''}
}

\numtest{27}{
\Reason{Succeeds for user with ``get'' and ``add.''}
}



\section{ovsec_kadm_delete_policy}

\numtest{1}{
\Reason{Fails for null policy name.}
}

\numtest{2}{
\Reason{Fails for empty-string policy name.}
}

\numtest{3}{
\Reason{Fails for non-existent policy name.}
}

\numtest{4}{
\Reason{Fails for bad policy name.}
}

\numtest{5}{
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
}

\numtest{6}{
\Reason{Fails for user with no access bits.}
}

\numtest{7}{
\Reason{Fails for user with ``add'' but not ``delete''.}
}

\numtest{8}{
\Reason{Fails for user with ``modify'' but not ``delete''.}
}

\numtest{9}{
\Reason{Fails for user with ``get'' but not ``delete.''}
}

\numtest{10}{
\Reason{Succeeds for user with only ``delete''.}
}

\numtest{11}{
\Reason{Succeeds for user with ``delete'' and ``add''.}
}

\numtest{12}{
\Reason{Fails for policy with non-zero reference count.}
}



\section{ovsec_kadm_modify_policy}

\numtest{1}{
\Reason{Fails for mask with undefined bit set.}
}

\numtest{2}{
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
}

\numtest{3}{
\Reason{Fails for mask with POLICY bit set.}
}

\numtest{4}{
\Reason{Fails for mask with REF_COUNT bit set.}
}

\numtest{5}{
\Reason{Fails for invalid policy name.}
}

\numtest{6}{
\Reason{Fails for non-existent policy name.}
}

\numtest{7}{
\Reason{Fails for null policy name.}
}

\numtest{8}{
\Reason{Fails for empty-string policy name.}
}

\numtest{9}{
\Reason{Accepts 0 for pw_min_life.}
}

\numtest{10}{
\Reason{Accepts non-zero for pw_min_life.}
}

\numtest{11}{
\Reason{Accepts 0 for pw_max_life.}
}

\numtest{12}{
\Reason{Accepts non-zero for pw_max_life.}
}

\numtest{13}{
\Reason{Accepts 0 for pw_min_length.}
}

\numtest{14}{
\Reason{Accepts non-zero for pw_min_length.}
}

\numtest{15}{
\Reason{Rejects 0 for pw_min_classes.}
}

\numtest{16}{
\Reason{Accepts 1 for pw_min_classes.}
}

\numtest{17}{
\Reason{Accepts 4 for pw_min_classes.}
}

\numtest{18}{
\Reason{Rejects 5 for pw_min_classes.}
}

\numtest{19}{
\Reason{Rejects 0 for pw_history_num.}
}

\numtest{20}{
\Reason{Accepts 1 for pw_history_num.}
}

\numtest{21}{
\Reason{Accepts 10 for pw_history_num.}
}

\numtest{22}{
\Reason{Fails for user with no access bits.}
}

\numtest{23}{
\Reason{Fails for user with ``get'' but not ``modify''.}
}

\numtest{24}{
\Reason{Fails for user with ``add'' but not ``modify.''}
}

\numtest{25}{
\Reason{Fails for user with ``delete'' but not ``modify.''}
}

\numtest{26}{
\Reason{Succeeds for user with ``modify.''}
}

\numtest{27}{
\Reason{Succeeds for user with ``get'' and ``modify.''}
}



\section{ovsec_kadm_get_policy}

\numtest{1}{
\Reason{Fails for null policy.}
}

\numtest{2}{
\Reason{Fails for invalid policy name.}
}

\numtest{3}{
\Reason{Fails for empty-string policy name.}
}

\numtest{4}{
\Reason{Fails for non-existent policy name.}
}

\numtest{5}{
\Reason{Fails for null ent.}
}

\numtest{6}{
\Reason{Fails for user with no access bits trying to get other's
	policy, using ADMIN_SERVICE.}
}

\numtest{7}{
\Reason{Fails for user with ``add'' but not ``get'' trying to get
	other's policy, using ADMIN_SERVICE.}
}

\numtest{8}{
\Reason{Fails for user with ``modify'' but not ``get'' trying to get
	other's policy, using ADMIN_SERVICE.}
}

\numtest{9}{
\Reason{Fails for user with ``delete'' but not ``get'' trying to get
	other's policy, using ADMIN_SERVICE.}
}

\numtest{10}{
\Reason{Fails for user with ``delete'' but not ``get'' trying to get
	other's policy, using CHANGEPW_SERVICE.}
}

\numtest{11}{
\Reason{Succeeds for user with only ``get'', trying to get own policy,
	using ADMIN_SERVICE.}
}

\numtest{12}{
\Reason{Succeeds for user with only ``get'', trying to get own policy,
	using CHANGEPW_SERVICE.}
}

\numtest{13}{
\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
	policy, using ADMIN_SERVICE.}
}

\numtest{14}{
\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
	policy, using CHANGEPW_SERVICE.}
}

\numtest{15}{
\Reason{Succeeds for user without ``get'', trying to get own policy,
	using ADMIN_SERVICE.}
}

\numtest{16}{
\Reason{Succeeds for user without ``get'', trying to get own policy,
	using CHANGEPW_SERVICE.}
}

\numtest{17}{
\Reason{Succeeds for user with ``get'', trying to get other's policy,
	using ADMIN_SERVICE.}
}

\numtest{18}{
\Reason{Fails for user with ``get'', trying to get other's policy,
	using CHANGEPW_SERVICE.}
}

\numtest{19}{
\Reason{Succeeds for user with ``modify'' and ``get'', trying to get
	other's policy, using ADMIN_SERVICE.}
}

\numtest{20}{
\Reason{Fails for user with ``modify'' and ``get'', trying to get
	other's policy, using CHANGEPW_SERVICE.}
}



\section{ovsec_kadm_free_principal_ent}

Handled by memory-leak testing handled elsewhere.

XXX This isn't sufficient.


\section{ovsec_kadm_free_policy_ent}

Handled by memory-leak testing handled elsewhere.

XXX This isn't sufficient.


\section{ovsec_kadm_get_privs}

\numtest{1}{
\Reason{Fails for null pointer argument.}
}

This test should be run with the 16 possible combinations of access
bits (since there are 4 access bits, there are $2^4 = 16$ popsible
combinations of them):

\numtest{2}{
\Reason{Returns correct bit mask for access bits of user.}
\Conditions{RPC}
}

This test should be run locally:

\numtest{3}{
\Reason{Returns 0x0f.}
\Conditions{local}
}

\end{document}