2 #define _POSIX_SOURCE /* For getaddrinfo(3) */
6 #define _BSD_SOURCE /* For NI_MAXHOST */
10 #define _XOPEN_SOURCE 600 /* For unsetenv(3) */
17 static const char *username
= "Doug1as$";
18 static const char *password
= "42aA#bc8";
19 static const char *otp_code
= "314";
22 static int test_login(const isds_error error
,
23 const isds_otp_resolution resolution
, struct isds_ctx
*context
,
24 const char *url
, const char *username
, const char *password
,
25 const struct isds_pki_credentials
*pki_credentials
,
26 struct isds_otp
*otp
) {
29 err
= isds_login(context
, url
, username
, password
, pki_credentials
, otp
);
31 FAIL_TEST("Wrong return code: expected=%s, returned=%s (%s)",
32 isds_strerror(error
), isds_strerror(err
),
33 isds_long_message(context
));
34 if (otp
!= NULL
&& resolution
!= otp
->resolution
)
35 FAIL_TEST("Wrong OTP resolution: expected=%d, returned=%d (%s)",
36 resolution
, otp
->resolution
, isds_long_message(context
));
43 static int test_isds_change_password(const isds_error error
,
44 const isds_otp_resolution resolution
, const char *reference_number
,
45 struct isds_ctx
*context
, const char *old_password
,
46 const char *new_password
, struct isds_otp
*otp
, char **refnum
) {
49 err
= isds_change_password(context
, old_password
, new_password
, otp
,
52 FAIL_TEST("Wrong return code: expected=%s, returned=%s (%s)",
53 isds_strerror(error
), isds_strerror(err
),
54 isds_long_message(context
));
55 if (otp
!= NULL
&& resolution
!= otp
->resolution
)
56 FAIL_TEST("Wrong OTP resolution: expected=%d, returned=%d (%s)",
57 resolution
, otp
->resolution
, isds_long_message(context
));
59 TEST_STRING_DUPLICITY(reference_number
, *refnum
);
64 int main(int argc
, char **argv
) {
67 char *server_address
= NULL
;
68 struct isds_ctx
*context
= NULL
;
71 struct isds_otp otp_credentials
= {
74 const struct arguments_asws_changePassword_ChangePasswordOTP
77 .current_password
= password
,
78 .method
= AUTH_OTP_TIME
,
79 .reference_number
= "42"
81 struct arguments_asws_changePassword_SendSMSCode
82 sendsmscode_arguments
= {
83 .status_code
= "0000",
84 .status_message
= "One-time password sent via SMS gateway",
85 .reference_number
= "43"
87 const struct service_configuration services
[] = {
88 { SERVICE_DS_Dz_DummyOperation
, NULL
},
89 { SERVICE_asws_changePassword_ChangePasswordOTP
, &passwd_arguments
},
90 { SERVICE_asws_changePassword_SendSMSCode
, &sendsmscode_arguments
},
93 const struct arguments_otp_authentication server_arguments
= {
95 .method
= AUTH_OTP_TIME
,
98 .otp
= (char *) otp_code
,
104 INIT_TEST("isds_change_password with TOTP");
106 if (unsetenv("http_proxy")) {
107 ABORT_UNIT("Could not remove http_proxy variable from environment\n");
111 ABORT_UNIT("isds_init() failed\n");
113 context
= isds_ctx_create();
116 ABORT_UNIT("isds_ctx_create() failed\n");
120 sendsmscode_arguments
.status_code
= "0000";
121 sendsmscode_arguments
.status_message
=
122 "One-time password sent via SMS gateway";
123 error
= start_server(&server_process
, &server_address
,
124 server_otp_authentication
, &server_arguments
);
126 isds_ctx_free(&context
);
128 ABORT_UNIT(server_error
);
130 if (-1 == test_asprintf(&url
, "http://%s/", server_address
)) {
131 free(server_address
);
132 stop_server(server_process
);
133 isds_ctx_free(&context
);
135 ABORT_UNIT("Could not format ISDS URL");
137 free(server_address
);
139 otp_credentials
.otp_code
= (char *) otp_code
;
140 TEST("login", test_login
, IE_SUCCESS
, OTP_RESOLUTION_SUCCESS
,
141 context
, url
, username
, password
, NULL
, &otp_credentials
);
143 /* First phase of authentication */
144 otp_credentials
.otp_code
= NULL
;
145 TEST("First phase with invalid password", test_isds_change_password
,
146 IE_NOT_LOGGED_IN
, OTP_RESOLUTION_BAD_AUTHENTICATION
, NULL
,
147 context
, "nbuusr1", "h2k$Aana", &otp_credentials
, &refnum
);
148 otp_credentials
.otp_code
= NULL
;
149 TEST("First phase with valid password", test_isds_change_password
,
150 IE_PARTIAL_SUCCESS
, OTP_RESOLUTION_TOTP_SENT
, "43",
151 context
, password
, "h2k$Aana", &otp_credentials
, &refnum
);
153 /* Second phase of authentication */
154 otp_credentials
.otp_code
= (char *) otp_code
;
155 TEST("Second phase with invalid password", test_isds_change_password
,
156 IE_NOT_LOGGED_IN
, OTP_RESOLUTION_BAD_AUTHENTICATION
, NULL
,
157 context
, "nbuusr1", "h2k$Aana", &otp_credentials
, &refnum
);
158 /* XXX: There is bug in curl < 7.28.0 when authorization header is not
159 * sent on second attempt after 401 response. Fixed by upstream commit
160 * ce8311c7e49eca93c136b58efa6763853541ec97. The only work-around is
161 * to use new CURL handle. */
162 TEST("Second phase with invalid password 2", test_isds_change_password
,
163 IE_NOT_LOGGED_IN
, OTP_RESOLUTION_BAD_AUTHENTICATION
, NULL
,
164 context
, "nbuusr2", "h2k$Aana", &otp_credentials
, &refnum
);
165 otp_credentials
.otp_code
= "666";
166 TEST("Second phase with valid password but invalid OTP code",
167 test_isds_change_password
,
168 IE_NOT_LOGGED_IN
, OTP_RESOLUTION_BAD_AUTHENTICATION
, NULL
,
169 context
, password
, "h2k$Aana", &otp_credentials
, &refnum
);
171 /* Checks for new password */
172 otp_credentials
.otp_code
= (char *) otp_code
;
173 TEST("too short (7 characters)", test_isds_change_password
, IE_INVAL
,
174 OTP_RESOLUTION_SUCCESS
, "42",
175 context
, password
, "aB34567", &otp_credentials
, &refnum
);
176 TEST("too long (33 characters)", test_isds_change_password
, IE_INVAL
,
177 OTP_RESOLUTION_SUCCESS
, "42",
178 context
, password
, "aB3456789112345678921234567893123",
179 &otp_credentials
, &refnum
);
180 TEST("no upper case letter", test_isds_change_password
, IE_INVAL
,
181 OTP_RESOLUTION_SUCCESS
, "42",
182 context
, password
, "1bcdefgh", &otp_credentials
, &refnum
);
183 TEST("no lower case letter", test_isds_change_password
, IE_INVAL
,
184 OTP_RESOLUTION_SUCCESS
, "42",
185 context
, password
, "1BCDEFGH", &otp_credentials
, &refnum
);
186 TEST("no digit", test_isds_change_password
, IE_INVAL
,
187 OTP_RESOLUTION_SUCCESS
, "42",
188 context
, password
, "aBCDEFGH", &otp_credentials
, &refnum
);
189 TEST("forbidden space", test_isds_change_password
, IE_INVAL
,
190 OTP_RESOLUTION_SUCCESS
, "42",
191 context
, password
, " h2k$Aan", &otp_credentials
, &refnum
);
192 TEST("reused password", test_isds_change_password
, IE_INVAL
,
193 OTP_RESOLUTION_SUCCESS
, "42",
194 context
, password
, password
, &otp_credentials
, &refnum
);
195 TEST("password contains user ID", test_isds_change_password
, IE_INVAL
,
196 OTP_RESOLUTION_SUCCESS
, "42",
197 context
, password
, username
, &otp_credentials
, &refnum
);
198 TEST("sequence of the same characters", test_isds_change_password
,
199 IE_INVAL
, OTP_RESOLUTION_SUCCESS
, "42",
200 context
, password
, "h222k$Aa", &otp_credentials
, &refnum
);
201 TEST("forbiden prefix qwert", test_isds_change_password
,
202 IE_INVAL
, OTP_RESOLUTION_SUCCESS
, "42",
203 context
, password
, "qwert$A8", &otp_credentials
, &refnum
);
204 TEST("forbiden prefix asdgf", test_isds_change_password
,
205 IE_INVAL
, OTP_RESOLUTION_SUCCESS
, "42",
206 context
, password
, "asdgf$A8", &otp_credentials
, &refnum
);
207 TEST("forbiden prefix 12345", test_isds_change_password
,
208 IE_INVAL
, OTP_RESOLUTION_SUCCESS
, "42",
209 context
, password
, "12345$Aa", &otp_credentials
, &refnum
);
210 TEST("valid request", test_isds_change_password
, IE_SUCCESS
,
211 OTP_RESOLUTION_SUCCESS
, "42",
212 context
, password
, "h2k$Aana", &otp_credentials
, &refnum
);
216 isds_logout(context
);
217 if (-1 == stop_server(server_process
)) {
218 ABORT_UNIT(server_error
);
226 sendsmscode_arguments
.status_code
= "2301";
227 sendsmscode_arguments
.status_message
=
228 "One-time code cannot be re-send faster than once a 30 seconds";
229 error
= start_server(&server_process
, &server_address
,
230 server_otp_authentication
, &server_arguments
);
232 isds_ctx_free(&context
);
234 ABORT_UNIT(server_error
);
236 if (-1 == test_asprintf(&url
, "http://%s/", server_address
)) {
237 free(server_address
);
238 stop_server(server_process
);
239 isds_ctx_free(&context
);
241 ABORT_UNIT("Could not format ISDS URL");
243 free(server_address
);
245 otp_credentials
.otp_code
= (char *) otp_code
;
246 TEST("login", test_login
, IE_SUCCESS
, OTP_RESOLUTION_SUCCESS
,
247 context
, url
, username
, password
, NULL
, &otp_credentials
);
249 /* First phase of authentication */
250 otp_credentials
.otp_code
= NULL
;
251 TEST("SendSMSCode cannot send so fast", test_isds_change_password
,
252 IE_ISDS
, OTP_RESOLUTION_TO_FAST
, "43",
253 context
, password
, "h2k$Aana", &otp_credentials
, &refnum
);
257 isds_logout(context
);
258 if (-1 == stop_server(server_process
)) {
259 ABORT_UNIT(server_error
);
266 sendsmscode_arguments
.status_code
= "2302";
267 sendsmscode_arguments
.status_message
=
268 "One-time code could not been sent. Try later again.";
269 error
= start_server(&server_process
, &server_address
,
270 server_otp_authentication
, &server_arguments
);
272 isds_ctx_free(&context
);
274 ABORT_UNIT(server_error
);
276 if (-1 == test_asprintf(&url
, "http://%s/", server_address
)) {
277 free(server_address
);
278 stop_server(server_process
);
279 isds_ctx_free(&context
);
281 ABORT_UNIT("Could not format ISDS URL");
283 free(server_address
);
285 otp_credentials
.otp_code
= (char *) otp_code
;
286 TEST("login", test_login
, IE_SUCCESS
, OTP_RESOLUTION_SUCCESS
,
287 context
, url
, username
, password
, NULL
, &otp_credentials
);
289 /* First phase of authentication */
290 otp_credentials
.otp_code
= NULL
;
291 TEST("SendSMSCode cannot send", test_isds_change_password
,
292 IE_ISDS
, OTP_RESOLUTION_TOTP_NOT_SENT
, "43",
293 context
, password
, "h2k$Aana", &otp_credentials
, &refnum
);
297 isds_logout(context
);
298 if (-1 == stop_server(server_process
)) {
299 ABORT_UNIT(server_error
);
305 isds_logout(context
);
306 isds_ctx_free(&context
);