summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove braces from DEBUG statementsPavel Březina2016-06-182-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam-srv-tests: Fix warning unused-functionLukas Slebodnik2016-06-171-0/+2
| | | | | | | | | | | | | | If pam-srv-tests is not build with NSS support then certificate related test are not executed and therefore there is unused setup function pam_test_setup_no_verification. src/tests/cmocka/test_pam_srv.c:323:12: error: 'pam_test_setup_no_verification' defined but not used [-Werror=unused-function] static int pam_test_setup_no_verification(void **state) ^ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: New tests for negative caching of localsPetr Cech2016-06-104-0/+711
| | | | | | | | | | | Negative cache has special timeout for local entities (users, groups). This patch adds new tests for such behaviour. The tests are based on cwrap. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDERS: Negative caching of local usersPetr Cech2016-06-104-5/+6
| | | | | | | | | | | This patch adds new option 'neg_cache_locals_timeout' into section of NSS responder. It allows negative caching of local groups and users. Default value is 0 which means no caching. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Add build infrastructure for systemtap scriptsJakub Hrozek2016-06-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds infrastructure that generatest the probes.h and probes.o from the dtrace probes.d file. The probes.d file is empty except for the provider name in this commit, its content will be added with later commits that actually add some content. The probes.d file is always distributed in the tarball so that distributions can optionally enable systemtap support. The generation is done using the "dtrace" command because the probes.d file is compatible with the Solaris dtrace format. Please see "man 1 dtrace" for more information on the dtrace format and the command line tool. In order to make libtool happy, a fake libtool object is generated. This hunk was taken from the libvirt code. The AM_V_GEN macro is used to make the build compatible with the silent build configuration. To enable systemtap probing, configure sssd with: --enable-systemtap In order to do so, the 'dtrace' command-line utility must be installed. On Fedora and RHEL, this package is installed as part of the "systemtap-sdt-devel" package. You'll also want the 'systemtap' package installed as well as the matching versions of kernel-devel and kernel-debuginfo on your machine. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam-srv-tests: Increase cached_auth_timeoutLukas Slebodnik2016-06-101-2/+2
| | | | | | | | | | | | | | The execution sysdb_cache_password_ex can be slow due to function s3crypt_sha512 and valgrind slowdown. Therefore 2 seconds timeout can be reached in possitive tests test_pam_cached_auth_success and test_pam_cached_auth_success_combined_pw_with_cached_2fa Resolves: https://fedorahosted.org/sssd/ticket/2994 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: add SSS_NSS_GETNAMEBYCERT requestSumit Bose2016-06-091-0/+145
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: add certificate supportSumit Bose2016-06-091-4/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_attrs_add_base64_blob()Sumit Bose2016-06-091-0/+36
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add PKCS11_LOGIN_TOKEN_NAME environment variableSumit Bose2016-06-091-1/+13
| | | | | | | The PKCS11_LOGIN_TOKEN_NAME environment variable is e.g. used by the Gnome Settings Daemon to determine the name of the token used for login. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add OCSP default responder optionsSumit Bose2016-06-091-0/+80
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add no_verification optionSumit Bose2016-06-092-1/+30
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: use krb5_keytab for subdomain initializationSumit Bose2016-06-091-2/+4
| | | | | | | | | | During the initialization of AD subdomains parameters like the SASL auth id are determined. Since subdomains use a default set of the AD specific configuration options the default keytab will be used. If krb5_keytab is set in sssd.conf for the AD domain this keytab should be used for the subdomains (domains of the same AD forest) as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-191-28/+23
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Removing ncache from pam_ctxPetr Cech2016-05-111-3/+0
| | | | | | This patch switches ncache from pam_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from nss_ctxPetr Cech2016-05-112-12/+0
| | | | | | This patch switches ncache from nss_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDERS: Negcache in resp_ctx preparingPetr Cech2016-05-113-11/+30
| | | | | | Preparation for initialization of negative cache in common responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from nss responderPetr Cech2016-05-113-4/+0
| | | | | | | | | | Timeout of negative cahce is handled by internal negative cache context. This patch removes neg_timeout from struct nss_ctx. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from pam responderPetr Cech2016-05-111-4/+4
| | | | | | | | | | | | It removes neg_timeout parameter from struct pam_ctx. Timeout is handled by context of negative cache internally. This patch additioanlly removes neg_timeout from struct cache_req_state. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Removing timeout from sss_ncache_check_*Petr Cech2016-05-111-79/+68
| | | | | | | | | | | | | | | | It removes timeout parameter from check functions of negative cache. Timeout is set ny init function and it is handled internally. API change: * int sss_ncache_check_...(struct sss_nc_ctx *ctx, int ttl, <----- timeout vanished struct sss_domain_info *dom, ...); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Adding timeout to struct sss_nc_ctxPetr Cech2016-05-114-7/+7
| | | | | | | | | | | | | | | | | | | It adds timeout of negative cache to handling struct sss_nc_ctx. There is one change in API of negatice cache: * int sss_ncache_init(TALLOC_CTX *memctx, uint32_t timeout, <----- new struct sss_nc_ctx **_ctx); There is also one new function in common/responder: * errno_t responder_get_neg_timeout_from_confdb(struct confdb_ctx *cdb, uint32_t *ncache_timeout); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add secure copy functionStephen Gallagher2016-05-111-2/+50
| | | | | | | | | | | This is a precursor to supporting a static default configuration file. We need to be able to copy the default into the mutable location if the infopipe is asked to modify it. This patch opens both the source and destination files together in order to avoid time-of-check/time-of-use bugs. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Removing duplication of mock_rctxPetr Cech2016-05-051-28/+0
| | | | | | There were duplicaton of mock_rctx(). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* intg: Use different uid range for add_remove testsLukas Slebodnik2016-04-221-2/+2
| | | | | | | | | | | Most linux distribution create local users from UID 1000. We used similar UID space in sssd but it might caused issues in add remove tests becuase sssd in cwrap enviroment run in the same PID space. If sssd try to remove user with uid 1001 it will fail because the local user with the same UID is active and sssd does not remove active users. Reviewed-by: Petr Cech <pcech@redhat.com>
* TESTS: Test of sysdb_search_sudo_rulesPetr Cech2016-04-201-0/+770
| | | | | | | | | There are tests functions of sysdb_sudo_rules. Resolves: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Removing of condition for ttl = -1Petr Cech2016-04-201-46/+0
| | | | | | | | | If ttl = -1 then function sss_ncache_check_str() returns EEXIST without checking negcache. This behaviour is out of logic. We use ttl = 0 for permanent caching. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NEGCACHE: Fixing typo in test_sss_ncache_gid()Petr Cech2016-04-201-2/+2
| | | | | | | There were sss_ncache_*_uid() functions instead of sss_ncache_*_gid() functions. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_ad_common: Include missing header if building with NSSLukas Slebodnik2016-04-131-0/+3
| | | | | | | | | | | | There was a compile time warning if building with NSS crypto libraries. src/tests/cmocka/test_ad_common.c: In function ‘main’: src/tests/cmocka/test_ad_common.c:873:5: error: implicit declaration of function ‘nspr_nss_cleanu’ [-Werror=implicit-function-declaration] nspr_nss_cleanup(); ^~~~~~~~~~~~~~~~ Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: Check NULL context in sysdb-tests when removing group membersJakub Hrozek2016-04-131-0/+25
| | | | | | This is done to make sure the memberof module does not leak memory. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_be_ptask: Check leaks in testsLukas Slebodnik2016-04-131-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* intg: local override for user with mixed case nameSumit Bose2016-04-131-1/+65
| | | | | | | | | Test for users with fully-qualified and mixed-cased names are added. Resolves: https://fedorahosted.org/sssd/ticket/2989 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: process PAC during initgroups requestSumit Bose2016-04-131-1/+345
| | | | | | | | | If there is a recently attached PAC blob in the cached user entry the PAC data is used to update the group memberships data of the user. If there is no PAC attached or if it is too old the other configured methods will be used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* util: make concatenate_string_array() reusableSumit Bose2016-04-133-0/+51
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: global_talloc_context push/pop removePetr Cech2016-04-125-12/+0
| | | | | | | | Push/pop global_talloc_context into check_leaks is redudant. It is done in leak_check_setup() and leak_check_teardown() functions in src/tests/check_leaks. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_ipa_subdom_server: Workaround for slow krb5 + SELinuxLukas Slebodnik2016-04-071-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an overhead caused by SELinux after fixing memory leak in krb5. https://bugzilla.redhat.com/show_bug.cgi?id=1311287. The overhead is mainly visible with valgrind and moreover it causes failures due to timeouts. sh$ time libtool --mode=execute ./test_ipa_subdom_server enabled/permissive SELinux real 0m7.976s user 0m6.680s sys 0m0.189s disabled SELinux real 0m2.111s user 0m0.071s sys 0m0.043s valgrind + enabled/permissive SELinux real 2m7.310s user 2m17.080s sys 0m0.786s valgrind + disabled SELinux real 0m5.510s user 0m3.396s sys 0m0.309s Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req test: add lookup by sidPavel Březina2016-03-141-5/+404
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: improve user and group creationPavel Březina2016-03-141-142/+118
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: use leak check in test fixturesPavel Březina2016-03-141-17/+47
| | | | | | | | | To ensure no memory is leak on long living context such as rctx. Resolves: https://fedorahosted.org/sssd/ticket/2869 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* mock domain: reset ldb errorsPavel Březina2016-03-141-0/+4
| | | | | | | | | | | | | | | | | | After ldb connect ldb context contains the following error: "NULL Base DN invalid for a base search" This comes from internal ldb function ldb_set_default_dns() which runs base search on NULL dn to discover records similar to what rootDSE provides. However, tdb backend considers this an error and sets the message above. This may break memory leak checks in tests when we do push/pop on test_ctx which is a indirect parent of ldb_context. The error message is allocated when push is called but it is freed by other ldb queries and therefore not preset during the push phase and thus the leak check fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: remove unused users and groupsPavel Březina2016-03-141-11/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-121-1/+1
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-111-0/+526
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Simplify build of cwrap testsLukas Slebodnik2016-03-101-48/+7
| | | | | | It will compilation of 40 files. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-011-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Extend test_child_common.c to include tests for the only_extra_args ↵Jakub Hrozek2016-02-262-7/+91
| | | | | | | functionality Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Use the IPA provider interface to resolve external group membersJakub Hrozek2016-02-241-1/+3
| | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2522 Currently the approach is not optimized for performance, because each external member is resolved in a full transaction to make sure even ID views and similar information is processed. In future, we should implement https://fedorahosted.org/sssd/ticket/2943 we will again be able to process all the data in a single transaction. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST_TOOLS_COLONDB: Add tests for sss_colondb_*Petr Cech2016-02-241-0/+419
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three functions at API of colondb wrapper: * sss_colondb_open() * sss_colondb_readline() * sss_colondb_writeline() This patch adds tests for all of them. We test those cases: * open nonexisting file for read * open nonexisting file for write * open existing empty file for read * open existing file with records for read * open existing empty file for write * open existing file with records for write * write to empty file * write to file with existing records * sss_colondb_open() * sss_colondb_readline() * sss_colondb_write_line() * write to empty file and read it Resolves: https://fedorahosted.org/sssd/ticket/2764 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_idmap-tests: Fix segmentation faultLukas Slebodnik2016-02-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | I can reproduce it only with clang. But it's tipical off by one error. sh$ ./sss_idmap-tests Running suite(s): IDMAP Segmentation fault (core dumped) Running suite(s): IDMAP ==2644== Process terminating with default action of signal 11 (SIGSEGV) ==2644== Access not within mapped region at address 0xA08F430 ==2644== at 0x4C2CC53: strcmp (vg_replace_strmem.c:842) ==2644== by 0x4060DA: idmap_test_sid2uid_additional_secondary_slices (sss_idmap-tests.c:451) ==2644== by 0x503C78A: ??? (in /usr/lib64/libcheck.so.0.0.0) ==2644== by 0x503CB7C: srunner_run (in /usr/lib64/libcheck.so.0.0.0) ==2644== by 0x4061EE: main (sss_idmap-tests.c:965) ==2644== If you believe this happened as a result of a stack ==2644== overflow in your program's main thread (unlikely but ==2644== possible), you can try to increase the size of the ==2644== main thread stack using the --main-stacksize= flag. ==2644== The main thread stack size used in this run was 8388608. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IDMAP: Add test to validate off by one bugPavel Reichl2016-02-151-4/+109
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2922 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* intg: Change preference of openldap module pathLukas Slebodnik2016-02-091-2/+2
| | | | | | | | | | | The /usr/lib64 should be preffered path for searching binary modules for openldap backends. The /usr/lib/ should be used for storing no binary files on 64 bit platform e.g. scripts ... The current vresion of would choose /usr/lib/ even though /usr/lib64 contains real openldap modules. Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-28 20:48:00 +0000