test/simline/hotp_isds_change_password.c

   1 #ifndef _POSIX_SOURCE
   2 #define _POSIX_SOURCE   /* For getaddrinfo(3) */
   3 #endif
   4
   5 #ifndef _BSD_SOURCE
   6 #define _BSD_SOURCE   /* For NI_MAXHOST */
   7 #endif
   8
   9 #ifndef _XOPEN_SOURCE
  10 #define _XOPEN_SOURCE 600   /* For unsetenv(3) */
  11 #endif
  12
  13 #include "../test.h"
  14 #include "server.h"
  15 #include "isds.h"
  16
  17 static const char *username = "Doug1as$";
  18 static const char *password = "42aA#bc8";
  19 static const char *otp_code = "314";
  20
  21
  22 static int test_login(const isds_error error,
  23         const isds_otp_resolution resolution, struct isds_ctx *context,
  24         const char *url, const char *username, const char *password,
  25         const struct isds_pki_credentials *pki_credentials,
  26         struct isds_otp *otp) {
  27     isds_error err;
  28
  29     err = isds_login(context, url, username, password, pki_credentials, otp);
  30     if (error != err)
  31         FAIL_TEST("Wrong return code: expected=%s, returned=%s (%s)",
  32                 isds_strerror(error), isds_strerror(err),
  33                 isds_long_message(context));
  34     if (otp != NULL && resolution != otp->resolution)
  35         FAIL_TEST("Wrong OTP resolution: expected=%d, returned=%d (%s)",
  36                 resolution, otp->resolution, isds_long_message(context));
  37
  38
  39     PASS_TEST;
  40 }
  41
  42
  43 static int test_isds_change_password(const isds_error error,
  44         const isds_otp_resolution resolution, const char *reference_number,
  45         struct isds_ctx *context, const char *old_password,
  46         const char *new_password, struct isds_otp *otp, char **refnum) {
  47     isds_error err;
  48
  49     err = isds_change_password(context, old_password, new_password, otp,
  50             refnum);
  51     if (error != err)
  52         FAIL_TEST("Wrong return code: expected=%s, returned=%s (%s)",
  53                 isds_strerror(error), isds_strerror(err),
  54                 isds_long_message(context));
  55     if (otp != NULL && resolution != otp->resolution)
  56         FAIL_TEST("Wrong OTP resolution: expected=%d, returned=%d (%s)",
  57                 resolution, otp->resolution, isds_long_message(context));
  58     if (NULL != refnum)
  59         TEST_STRING_DUPLICITY(reference_number, *refnum);
  60
  61     PASS_TEST;
  62 }
  63
  64 int main(int argc, char **argv) {
  65     int error;
  66     pid_t server_process;
  67     struct isds_ctx *context = NULL;
  68     char *url = NULL;
  69     char *refnum = NULL;
  70     struct isds_otp otp_credentials = {
  71         .method = OTP_HMAC
  72     };
  73
  74
  75     INIT_TEST("isds_change_password with HOTP");
  76
  77     if (unsetenv("http_proxy")) {
  78         ABORT_UNIT("Could not remove http_proxy variable from environment\n");
  79     }
  80     if (isds_init()) {
  81         isds_cleanup();
  82         ABORT_UNIT("isds_init() failed\n");
  83     }
  84     context = isds_ctx_create();
  85     if (!context) {
  86         isds_cleanup();
  87         ABORT_UNIT("isds_ctx_create() failed\n");
  88     }
  89
  90     {
  91         const struct arguments_asws_changePassword_ChangePasswordOTP
  92             passwd_arguments = {
  93             .username = username,
  94             .current_password = password,
  95             .method = AUTH_OTP_HMAC,
  96             .reference_number = "42"
  97         };
  98         const struct service_configuration services[] = {
  99             { SERVICE_DS_Dz_DummyOperation, NULL },
 100             { SERVICE_asws_changePassword_ChangePasswordOTP, &passwd_arguments },
 101             { SERVICE_END, NULL }
 102         };
 103         const struct arguments_otp_authentication server_arguments = {
 104             .method = AUTH_OTP_HMAC,
 105             .username = username,
 106             .password = password,
 107             .otp = (char *) otp_code,
 108             .isds_deviations = 1,
 109             .services = services
 110         };
 111         error = start_server(&server_process, &url,
 112                 server_otp_authentication, &server_arguments, NULL);
 113         if (error == -1) {
 114             isds_ctx_free(&context);
 115             isds_cleanup();
 116             ABORT_UNIT(server_error);
 117         }
 118
 119         otp_credentials.otp_code = (char *) otp_code;
 120         TEST("login", test_login, IE_SUCCESS, OTP_RESOLUTION_SUCCESS,
 121                 context, url, username, password, NULL, &otp_credentials);
 122
 123         /* Second phase of authentication */
 124         otp_credentials.otp_code = (char *) otp_code;
 125         TEST("Second phase with invalid password", test_isds_change_password,
 126                 IE_NOT_LOGGED_IN, OTP_RESOLUTION_BAD_AUTHENTICATION, NULL,
 127                 context, "nbuusr1", "h2k$Aana", &otp_credentials, &refnum);
 128         /* XXX: There is bug in curl < 7.28.0 when authorization header is not
 129          * sent on second attempt after 401 response. Fixed by upstream commit
 130          * ce8311c7e49eca93c136b58efa6763853541ec97. The only work-around is
 131          * to use new CURL handle. */
 132         TEST("Second phase with invalid password 2", test_isds_change_password,
 133                 IE_NOT_LOGGED_IN, OTP_RESOLUTION_BAD_AUTHENTICATION, NULL,
 134                 context, "nbuusr2", "h2k$Aana", &otp_credentials, &refnum);
 135         otp_credentials.otp_code = "666";
 136         TEST("Second phase with valid password but invalid OTP code",
 137                 test_isds_change_password,
 138                 IE_NOT_LOGGED_IN, OTP_RESOLUTION_BAD_AUTHENTICATION, NULL,
 139                 context, password, "h2k$Aana", &otp_credentials, &refnum);
 140
 141         /* Checks for new password */
 142         otp_credentials.otp_code = (char *) otp_code;
 143         TEST("too short (7 characters)", test_isds_change_password, IE_INVAL,
 144                 OTP_RESOLUTION_SUCCESS, "42",
 145                 context, password, "aB34567", &otp_credentials, &refnum);
 146         TEST("too long (33 characters)", test_isds_change_password, IE_INVAL,
 147                 OTP_RESOLUTION_SUCCESS, "42",
 148                 context, password, "aB3456789112345678921234567893123",
 149                 &otp_credentials, &refnum);
 150         TEST("no upper case letter", test_isds_change_password, IE_INVAL,
 151                 OTP_RESOLUTION_SUCCESS, "42",
 152                 context, password, "1bcdefgh", &otp_credentials, &refnum);
 153         TEST("no lower case letter", test_isds_change_password, IE_INVAL,
 154                 OTP_RESOLUTION_SUCCESS, "42",
 155                 context, password, "1BCDEFGH", &otp_credentials, &refnum);
 156         TEST("no digit", test_isds_change_password, IE_INVAL,
 157                 OTP_RESOLUTION_SUCCESS, "42",
 158                 context, password, "aBCDEFGH", &otp_credentials, &refnum);
 159         TEST("forbidden space", test_isds_change_password, IE_INVAL,
 160                 OTP_RESOLUTION_SUCCESS, "42",
 161                 context, password, " h2k$Aan", &otp_credentials, &refnum);
 162         TEST("reused password", test_isds_change_password, IE_INVAL,
 163                 OTP_RESOLUTION_SUCCESS, "42",
 164                 context, password, password, &otp_credentials, &refnum);
 165         TEST("password contains user ID", test_isds_change_password, IE_INVAL,
 166                 OTP_RESOLUTION_SUCCESS, "42",
 167                 context, password, username, &otp_credentials, &refnum);
 168         TEST("sequence of the same characters", test_isds_change_password,
 169                 IE_INVAL, OTP_RESOLUTION_SUCCESS, "42",
 170                 context, password, "h222k$Aa", &otp_credentials, &refnum);
 171         TEST("forbiden prefix qwert", test_isds_change_password,
 172                 IE_INVAL, OTP_RESOLUTION_SUCCESS, "42",
 173                 context, password, "qwert$A8", &otp_credentials, &refnum);
 174         TEST("forbiden prefix asdgf", test_isds_change_password,
 175                 IE_INVAL, OTP_RESOLUTION_SUCCESS, "42",
 176                 context, password, "asdgf$A8", &otp_credentials, &refnum);
 177         TEST("forbiden prefix 12345", test_isds_change_password,
 178                 IE_INVAL, OTP_RESOLUTION_SUCCESS, "42",
 179                 context, password, "12345$Aa", &otp_credentials, &refnum);
 180         TEST("valid request", test_isds_change_password, IE_SUCCESS,
 181                 OTP_RESOLUTION_SUCCESS, "42",
 182                 context, password, "h2k$Aana", &otp_credentials, &refnum);
 183
 184         free(refnum);
 185         refnum = NULL;
 186         isds_logout(context);
 187         if (stop_server(server_process)) {
 188             ABORT_UNIT(server_error);
 189         }
 190
 191         free(url);
 192         url = NULL;
 193     }
 194
 195
 196     isds_logout(context);
 197     isds_ctx_free(&context);
 198     isds_cleanup();
 199     SUM_TEST();
 200 }