diff options
Diffstat (limited to 'source4/torture/local/nss_tests.c')
| -rw-r--r-- | source4/torture/local/nss_tests.c | 1061 |
1 files changed, 1061 insertions, 0 deletions
diff --git a/source4/torture/local/nss_tests.c b/source4/torture/local/nss_tests.c new file mode 100644 index 0000000..e911aa2 --- /dev/null +++ b/source4/torture/local/nss_tests.c @@ -0,0 +1,1061 @@ +/* + Unix SMB/CIFS implementation. + + local testing of the nss wrapper + + Copyright (C) Guenther Deschner 2009-2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "torture/torture.h" +#include "torture/local/proto.h" +#include "lib/replace/system/passwd.h" + +static bool copy_passwd(struct torture_context *tctx, + const struct passwd *pwd, + struct passwd *p) +{ + p->pw_name = talloc_strdup(tctx, pwd->pw_name); + torture_assert(tctx, (p->pw_name != NULL || pwd->pw_name == NULL), __location__); + p->pw_passwd = talloc_strdup(tctx, pwd->pw_passwd); + torture_assert(tctx, (p->pw_passwd != NULL || pwd->pw_passwd == NULL), __location__); + p->pw_uid = pwd->pw_uid; + p->pw_gid = pwd->pw_gid; + p->pw_gecos = talloc_strdup(tctx, pwd->pw_gecos); + torture_assert(tctx, (p->pw_gecos != NULL || pwd->pw_gecos == NULL), __location__); + p->pw_dir = talloc_strdup(tctx, pwd->pw_dir); + torture_assert(tctx, (p->pw_dir != NULL || pwd->pw_dir == NULL), __location__); + p->pw_shell = talloc_strdup(tctx, pwd->pw_shell); + torture_assert(tctx, (p->pw_shell != NULL || pwd->pw_shell == NULL), __location__); + + return true; +} + +static void print_passwd(struct passwd *pwd) +{ + printf("%s:%s:%lu:%lu:%s:%s:%s\n", + pwd->pw_name, + pwd->pw_passwd, + (unsigned long)pwd->pw_uid, + (unsigned long)pwd->pw_gid, + pwd->pw_gecos, + pwd->pw_dir, + pwd->pw_shell); +} + + +static bool test_getpwnam(struct torture_context *tctx, + const char *name, + struct passwd *pwd_p) +{ + struct passwd *pwd; + int ret; + + torture_comment(tctx, "Testing getpwnam: %s\n", name); + + errno = 0; + pwd = getpwnam(name); + ret = errno; + torture_assert(tctx, (pwd != NULL), talloc_asprintf(tctx, + "getpwnam(%s) failed - %d - %s", + name, ret, strerror(ret))); + + if (pwd_p != NULL) { + torture_assert(tctx, copy_passwd(tctx, pwd, pwd_p), __location__); + } + + return true; +} + +static bool test_getpwnam_r(struct torture_context *tctx, + const char *name, + struct passwd *pwd_p) +{ + struct passwd pwd, *pwdp; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing getpwnam_r: %s\n", name); + + ret = getpwnam_r(name, &pwd, buffer, sizeof(buffer), &pwdp); + torture_assert(tctx, ret == 0, talloc_asprintf(tctx, + "getpwnam_r(%s) failed - %d - %s", + name, ret, strerror(ret))); + + print_passwd(&pwd); + + if (pwd_p != NULL) { + torture_assert(tctx, copy_passwd(tctx, &pwd, pwd_p), __location__); + } + + return true; +} + +static bool test_getpwuid(struct torture_context *tctx, + uid_t uid, + struct passwd *pwd_p) +{ + struct passwd *pwd; + int ret; + + torture_comment(tctx, "Testing getpwuid: %lu\n", (unsigned long)uid); + + errno = 0; + pwd = getpwuid(uid); + ret = errno; + torture_assert(tctx, (pwd != NULL), talloc_asprintf(tctx, + "getpwuid(%lu) failed - %d - %s", + (unsigned long)uid, ret, strerror(ret))); + + print_passwd(pwd); + + if (pwd_p != NULL) { + torture_assert(tctx, copy_passwd(tctx, pwd, pwd_p), __location__); + } + + return true; +} + +static bool test_getpwuid_r(struct torture_context *tctx, + uid_t uid, + struct passwd *pwd_p) +{ + struct passwd pwd, *pwdp; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing getpwuid_r: %lu\n", (unsigned long)uid); + + ret = getpwuid_r(uid, &pwd, buffer, sizeof(buffer), &pwdp); + torture_assert(tctx, ret == 0, talloc_asprintf(tctx, + "getpwuid_r(%lu) failed - %d - %s", + (unsigned long)uid, ret, strerror(ret))); + + print_passwd(&pwd); + + if (pwd_p != NULL) { + torture_assert(tctx, copy_passwd(tctx, &pwd, pwd_p), __location__); + } + + return true; +} + + +static bool copy_group(struct torture_context *tctx, + const struct group *grp, + struct group *g) +{ + int i; + + g->gr_name = talloc_strdup(tctx, grp->gr_name); + torture_assert(tctx, (g->gr_name != NULL || grp->gr_name == NULL), __location__); + g->gr_passwd = talloc_strdup(tctx, grp->gr_passwd); + torture_assert(tctx, (g->gr_passwd != NULL || grp->gr_passwd == NULL), __location__); + g->gr_gid = grp->gr_gid; + g->gr_mem = NULL; + + for (i=0; grp->gr_mem && grp->gr_mem[i]; i++) { + g->gr_mem = talloc_realloc(tctx, g->gr_mem, char *, i + 2); + torture_assert(tctx, (g->gr_mem != NULL), __location__); + g->gr_mem[i] = talloc_strdup(g->gr_mem, grp->gr_mem[i]); + torture_assert(tctx, (g->gr_mem[i] != NULL), __location__); + g->gr_mem[i+1] = NULL; + } + + return true; +} + +static void print_group(struct group *grp) +{ + int i; + printf("%s:%s:%lu:", + grp->gr_name, + grp->gr_passwd, + (unsigned long)grp->gr_gid); + + if ((grp->gr_mem == NULL) || !grp->gr_mem[0]) { + printf("\n"); + return; + } + + for (i=0; grp->gr_mem[i+1]; i++) { + printf("%s,", grp->gr_mem[i]); + } + printf("%s\n", grp->gr_mem[i]); +} + +static bool test_getgrnam(struct torture_context *tctx, + const char *name, + struct group *grp_p) +{ + struct group *grp; + int ret; + + torture_comment(tctx, "Testing getgrnam: %s\n", name); + + errno = 0; + grp = getgrnam(name); + ret = errno; + torture_assert(tctx, (grp != NULL), talloc_asprintf(tctx, + "getgrnam(%s) failed - %d - %s", + name, ret, strerror(ret))); + + print_group(grp); + + if (grp_p != NULL) { + torture_assert(tctx, copy_group(tctx, grp, grp_p), __location__); + } + + return true; +} + +static bool test_getgrnam_r(struct torture_context *tctx, + const char *name, + struct group *grp_p) +{ + struct group grp, *grpp; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing getgrnam_r: %s\n", name); + + ret = getgrnam_r(name, &grp, buffer, sizeof(buffer), &grpp); + torture_assert(tctx, ret == 0, talloc_asprintf(tctx, + "getgrnam_r(%s) failed - %d - %s", + name, ret, strerror(ret))); + + print_group(&grp); + + if (grp_p != NULL) { + torture_assert(tctx, copy_group(tctx, &grp, grp_p), __location__); + } + + return true; +} + + +static bool test_getgrgid(struct torture_context *tctx, + gid_t gid, + struct group *grp_p) +{ + struct group *grp; + int ret; + + torture_comment(tctx, "Testing getgrgid: %lu\n", (unsigned long)gid); + + errno = 0; + grp = getgrgid(gid); + ret = errno; + torture_assert(tctx, (grp != NULL), talloc_asprintf(tctx, + "getgrgid(%lu) failed - %d - %s", + (unsigned long)gid, ret, strerror(ret))); + + print_group(grp); + + if (grp_p != NULL) { + torture_assert(tctx, copy_group(tctx, grp, grp_p), __location__); + } + + return true; +} + +static bool test_getgrgid_r(struct torture_context *tctx, + gid_t gid, + struct group *grp_p) +{ + struct group grp, *grpp; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing getgrgid_r: %lu\n", (unsigned long)gid); + + ret = getgrgid_r(gid, &grp, buffer, sizeof(buffer), &grpp); + torture_assert(tctx, ret == 0, talloc_asprintf(tctx, + "getgrgid_r(%lu) failed - %d - %s", + (unsigned long)gid, ret, strerror(ret))); + + print_group(&grp); + + if (grp_p != NULL) { + torture_assert(tctx, copy_group(tctx, &grp, grp_p), __location__); + } + + return true; +} + +static bool test_enum_passwd(struct torture_context *tctx, + struct passwd **pwd_array_p, + size_t *num_pwd_p) +{ + struct passwd *pwd; + struct passwd *pwd_array = NULL; + size_t num_pwd = 0; + + torture_comment(tctx, "Testing setpwent\n"); + setpwent(); + + while ((pwd = getpwent()) != NULL) { + torture_comment(tctx, "Testing getpwent\n"); + + print_passwd(pwd); + if (pwd_array_p && num_pwd_p) { + pwd_array = talloc_realloc(tctx, pwd_array, struct passwd, num_pwd+1); + torture_assert(tctx, pwd_array, "out of memory"); + copy_passwd(tctx, pwd, &pwd_array[num_pwd]); + num_pwd++; + } + } + + torture_comment(tctx, "Testing endpwent\n"); + endpwent(); + + if (pwd_array_p) { + *pwd_array_p = pwd_array; + } + if (num_pwd_p) { + *num_pwd_p = num_pwd; + } + + return true; +} + +static bool test_enum_r_passwd(struct torture_context *tctx, + struct passwd **pwd_array_p, + size_t *num_pwd_p) +{ + struct passwd pwd, *pwdp; + struct passwd *pwd_array = NULL; + size_t num_pwd = 0; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing setpwent\n"); + setpwent(); + +#ifdef HAVE_GETPWENT_R /* getpwent_r not supported on macOS */ + while (1) { + torture_comment(tctx, "Testing getpwent_r\n"); + +#ifdef SOLARIS_GETPWENT_R + ret = getpwent_r(&pwd, buffer, sizeof(buffer)); +#else /* SOLARIS_GETPWENT_R */ + ret = getpwent_r(&pwd, buffer, sizeof(buffer), &pwdp); +#endif /* SOLARIS_GETPWENT_R */ + if (ret != 0) { + if (ret != ENOENT) { + torture_comment(tctx, "got %d return code\n", ret); + } + break; + } + print_passwd(&pwd); + if (pwd_array_p && num_pwd_p) { + pwd_array = talloc_realloc(tctx, pwd_array, struct passwd, num_pwd+1); + torture_assert(tctx, pwd_array, "out of memory"); + copy_passwd(tctx, &pwd, &pwd_array[num_pwd]); + num_pwd++; + } + } +#endif /* getpwent_r not supported on macOS */ + + torture_comment(tctx, "Testing endpwent\n"); + endpwent(); + + if (pwd_array_p) { + *pwd_array_p = pwd_array; + } + if (num_pwd_p) { + *num_pwd_p = num_pwd; + } + + return true; +} + +static bool torture_assert_passwd_equal(struct torture_context *tctx, + const struct passwd *p1, + const struct passwd *p2, + const char *comment) +{ + torture_assert_str_equal(tctx, p1->pw_name, p2->pw_name, comment); + torture_assert_str_equal(tctx, p1->pw_passwd, p2->pw_passwd, comment); + torture_assert_int_equal(tctx, p1->pw_uid, p2->pw_uid, comment); + torture_assert_int_equal(tctx, p1->pw_gid, p2->pw_gid, comment); + torture_assert_str_equal(tctx, p1->pw_gecos, p2->pw_gecos, comment); + torture_assert_str_equal(tctx, p1->pw_dir, p2->pw_dir, comment); + torture_assert_str_equal(tctx, p1->pw_shell, p2->pw_shell, comment); + + return true; +} + +static bool test_passwd(struct torture_context *tctx) +{ + int i; + struct passwd *pwd, pwd1, pwd2; + size_t num_pwd; + + torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd), + "failed to enumerate passwd"); + + for (i=0; i < num_pwd; i++) { + torture_assert(tctx, test_getpwnam(tctx, pwd[i].pw_name, &pwd1), + "failed to call getpwnam for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1, + "getpwent and getpwnam gave different results"), + __location__); + torture_assert(tctx, test_getpwuid(tctx, pwd[i].pw_uid, &pwd2), + "failed to call getpwuid for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2, + "getpwent and getpwuid gave different results"), + __location__); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2, + "getpwnam and getpwuid gave different results"), + __location__); + } + + return true; +} + +static bool test_passwd_r(struct torture_context *tctx) +{ + int i; + struct passwd *pwd, pwd1, pwd2; + size_t num_pwd; + + torture_assert(tctx, test_enum_r_passwd(tctx, &pwd, &num_pwd), + "failed to enumerate passwd"); + + for (i=0; i < num_pwd; i++) { + torture_assert(tctx, test_getpwnam_r(tctx, pwd[i].pw_name, &pwd1), + "failed to call getpwnam_r for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1, + "getpwent_r and getpwnam_r gave different results"), + __location__); + torture_assert(tctx, test_getpwuid_r(tctx, pwd[i].pw_uid, &pwd2), + "failed to call getpwuid_r for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2, + "getpwent_r and getpwuid_r gave different results"), + __location__); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2, + "getpwnam_r and getpwuid_r gave different results"), + __location__); + } + + return true; +} + +static bool test_passwd_r_cross(struct torture_context *tctx) +{ + int i; + struct passwd *pwd, pwd1, pwd2, pwd3, pwd4; + size_t num_pwd; + + torture_assert(tctx, test_enum_r_passwd(tctx, &pwd, &num_pwd), + "failed to enumerate passwd"); + + for (i=0; i < num_pwd; i++) { + torture_assert(tctx, test_getpwnam_r(tctx, pwd[i].pw_name, &pwd1), + "failed to call getpwnam_r for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1, + "getpwent_r and getpwnam_r gave different results"), + __location__); + torture_assert(tctx, test_getpwuid_r(tctx, pwd[i].pw_uid, &pwd2), + "failed to call getpwuid_r for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2, + "getpwent_r and getpwuid_r gave different results"), + __location__); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2, + "getpwnam_r and getpwuid_r gave different results"), + __location__); + torture_assert(tctx, test_getpwnam(tctx, pwd[i].pw_name, &pwd3), + "failed to call getpwnam for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd3, + "getpwent_r and getpwnam gave different results"), + __location__); + torture_assert(tctx, test_getpwuid(tctx, pwd[i].pw_uid, &pwd4), + "failed to call getpwuid for enumerated user"); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd4, + "getpwent_r and getpwuid gave different results"), + __location__); + torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd3, &pwd4, + "getpwnam and getpwuid gave different results"), + __location__); + } + + return true; +} + +static bool test_enum_group(struct torture_context *tctx, + struct group **grp_array_p, + size_t *num_grp_p) +{ + struct group *grp; + struct group *grp_array = NULL; + size_t num_grp = 0; + + torture_comment(tctx, "Testing setgrent\n"); + setgrent(); + + while ((grp = getgrent()) != NULL) { + torture_comment(tctx, "Testing getgrent\n"); + + print_group(grp); + if (grp_array_p && num_grp_p) { + grp_array = talloc_realloc(tctx, grp_array, struct group, num_grp+1); + torture_assert(tctx, grp_array, "out of memory"); + copy_group(tctx, grp, &grp_array[num_grp]); + num_grp++; + } + } + + torture_comment(tctx, "Testing endgrent\n"); + endgrent(); + + if (grp_array_p) { + *grp_array_p = grp_array; + } + if (num_grp_p) { + *num_grp_p = num_grp; + } + + return true; +} + +static bool test_enum_r_group(struct torture_context *tctx, + struct group **grp_array_p, + size_t *num_grp_p) +{ + struct group grp, *grpp; + struct group *grp_array = NULL; + size_t num_grp = 0; + char buffer[4096]; + int ret; + + torture_comment(tctx, "Testing setgrent\n"); + setgrent(); + +#ifdef HAVE_GETGRENT_R /* getgrent_r not supported on macOS */ + while (1) { + torture_comment(tctx, "Testing getgrent_r\n"); + +#ifdef SOLARIS_GETGRENT_R + ret = getgrent_r(&grp, buffer, sizeof(buffer)); +#else /* SOLARIS_GETGRENT_R */ + ret = getgrent_r(&grp, buffer, sizeof(buffer), &grpp); +#endif /* SOLARIS_GETGRENT_R */ + if (ret != 0) { + if (ret != ENOENT) { + torture_comment(tctx, "got %d return code\n", ret); + } + break; + } + print_group(&grp); + if (grp_array_p && num_grp_p) { + grp_array = talloc_realloc(tctx, grp_array, struct group, num_grp+1); + torture_assert(tctx, grp_array, "out of memory"); + copy_group(tctx, &grp, &grp_array[num_grp]); + num_grp++; + } + } +#endif /* getgrent_r not supported on macOS */ + + torture_comment(tctx, "Testing endgrent\n"); + endgrent(); + + if (grp_array_p) { + *grp_array_p = grp_array; + } + if (num_grp_p) { + *num_grp_p = num_grp; + } + + return true; +} + +static bool torture_assert_group_equal(struct torture_context *tctx, + const struct group *g1, + const struct group *g2, + const char *comment) +{ + int i; + torture_assert_str_equal(tctx, g1->gr_name, g2->gr_name, comment); + torture_assert_str_equal(tctx, g1->gr_passwd, g2->gr_passwd, comment); + torture_assert_int_equal(tctx, g1->gr_gid, g2->gr_gid, comment); + torture_assert(tctx, !(g1->gr_mem && !g2->gr_mem), __location__); + torture_assert(tctx, !(!g1->gr_mem && g2->gr_mem), __location__); + if (!g1->gr_mem && !g2->gr_mem) { + return true; + } + for (i=0; g1->gr_mem[i] && g2->gr_mem[i]; i++) { + torture_assert_str_equal(tctx, g1->gr_mem[i], g2->gr_mem[i], comment); + } + + return true; +} + +static bool test_group(struct torture_context *tctx) +{ + int i; + struct group *grp, grp1, grp2; + size_t num_grp; + + torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp), + "failed to enumerate group"); + + for (i=0; i < num_grp; i++) { + torture_assert(tctx, test_getgrnam(tctx, grp[i].gr_name, &grp1), + "failed to call getgrnam for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1, + "getgrent and getgrnam gave different results"), + __location__); + torture_assert(tctx, test_getgrgid(tctx, grp[i].gr_gid, &grp2), + "failed to call getgrgid for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2, + "getgrent and getgrgid gave different results"), + __location__); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2, + "getgrnam and getgrgid gave different results"), + __location__); + } + + return true; +} + +static bool test_group_r(struct torture_context *tctx) +{ + int i; + struct group *grp, grp1, grp2; + size_t num_grp; + + torture_assert(tctx, test_enum_r_group(tctx, &grp, &num_grp), + "failed to enumerate group"); + + for (i=0; i < num_grp; i++) { + torture_assert(tctx, test_getgrnam_r(tctx, grp[i].gr_name, &grp1), + "failed to call getgrnam_r for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1, + "getgrent_r and getgrnam_r gave different results"), + __location__); + torture_assert(tctx, test_getgrgid_r(tctx, grp[i].gr_gid, &grp2), + "failed to call getgrgid_r for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2, + "getgrent_r and getgrgid_r gave different results"), + __location__); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2, + "getgrnam_r and getgrgid_r gave different results"), + __location__); + } + + return true; +} + +static bool test_group_r_cross(struct torture_context *tctx) +{ + int i; + struct group *grp, grp1, grp2, grp3, grp4; + size_t num_grp; + + torture_assert(tctx, test_enum_r_group(tctx, &grp, &num_grp), + "failed to enumerate group"); + + for (i=0; i < num_grp; i++) { + torture_assert(tctx, test_getgrnam_r(tctx, grp[i].gr_name, &grp1), + "failed to call getgrnam_r for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1, + "getgrent_r and getgrnam_r gave different results"), + __location__); + torture_assert(tctx, test_getgrgid_r(tctx, grp[i].gr_gid, &grp2), + "failed to call getgrgid_r for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2, + "getgrent_r and getgrgid_r gave different results"), + __location__); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2, + "getgrnam_r and getgrgid_r gave different results"), + __location__); + torture_assert(tctx, test_getgrnam(tctx, grp[i].gr_name, &grp3), + "failed to call getgrnam for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp3, + "getgrent_r and getgrnam gave different results"), + __location__); + torture_assert(tctx, test_getgrgid(tctx, grp[i].gr_gid, &grp4), + "failed to call getgrgid for enumerated user"); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp4, + "getgrent_r and getgrgid gave different results"), + __location__); + torture_assert(tctx, torture_assert_group_equal(tctx, &grp3, &grp4, + "getgrnam and getgrgid gave different results"), + __location__); + } + + return true; +} + +#ifdef HAVE_GETGROUPLIST +static bool test_getgrouplist(struct torture_context *tctx, + const char *user, + gid_t gid, + gid_t **gids_p, + int *num_gids_p) +{ + int ret; + int num_groups = 0; + gid_t *groups = NULL; + + torture_comment(tctx, "Testing getgrouplist: %s\n", user); + + ret = getgrouplist(user, gid, NULL, &num_groups); + if (ret == -1 || num_groups != 0) { + + groups = talloc_array(tctx, gid_t, num_groups); + torture_assert(tctx, groups, "out of memory\n"); + + ret = getgrouplist(user, gid, groups, &num_groups); + } + + torture_assert(tctx, (ret != -1), "failed to call getgrouplist"); + + torture_comment(tctx, "%s is member in %d groups\n", user, num_groups); + + if (gids_p) { + *gids_p = groups; + } + if (num_gids_p) { + *num_gids_p = num_groups; + } + + return true; +} +#endif /* HAVE_GETGROUPLIST */ + +static bool test_user_in_group(struct torture_context *tctx, + const struct passwd *pwd, + const struct group *grp) +{ + int i; + + for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) { + if (strequal(grp->gr_mem[i], pwd->pw_name)) { + return true; + } + } + + return false; +} + +static bool test_membership_user(struct torture_context *tctx, + const struct passwd *pwd, + struct group *grp_array, + size_t num_grp) +{ + int num_user_groups = 0; + int num_user_groups_from_enum = 0; + gid_t *user_groups = NULL; + int g, i; + bool primary_group_had_user_member = false; + + /* + * For the local users ('LOCALADMEMBER') below, the test fails. + * wb_queryuser() wrongly defaults the group sid to RID 513 i.e. + * 'LOCALADMEMBER/domusers', but those users have a different group sid. + * + * The fix for wb_queryuser() is not part of this MR. It is a complex + * task that needs to fill samlogon cache using S4USelf and will come + * sometime later. Once wb_queryuser() gets fixed, this can be removed. + */ + if (strcmp(pwd->pw_name, "user1") == 0 || + strcmp(pwd->pw_name, "user2") == 0 || + strcmp(pwd->pw_name, "force_user") == 0 || pwd->pw_uid == 1000) { + return true; + } + +#ifdef HAVE_GETGROUPLIST + torture_assert(tctx, test_getgrouplist(tctx, + pwd->pw_name, + pwd->pw_gid, + &user_groups, + &num_user_groups), + "failed to test getgrouplist"); +#endif /* HAVE_GETGROUPLIST */ + + for (g=0; g < num_user_groups; g++) { + torture_assert(tctx, test_getgrgid(tctx, user_groups[g], NULL), + "failed to find the group the user is a member of"); + } + + + for (i=0; i < num_grp; i++) { + + struct group grp = grp_array[i]; + + if (test_user_in_group(tctx, pwd, &grp)) { + + struct group current_grp; + num_user_groups_from_enum++; + + torture_assert(tctx, test_getgrnam(tctx, grp.gr_name, ¤t_grp), + "failed to find the group the user is a member of"); + + if (current_grp.gr_gid == pwd->pw_gid) { + torture_comment(tctx, "primary group %s of user %s lists user as member\n", + current_grp.gr_name, + pwd->pw_name); + primary_group_had_user_member = true; + } + + continue; + } + } + + if (!primary_group_had_user_member) { + num_user_groups_from_enum++; + } + + torture_assert_int_equal(tctx, num_user_groups, num_user_groups_from_enum, + "getgrouplist and real inspection of grouplist gave different results\n"); + + return true; +} + +static bool test_membership(struct torture_context *tctx) +{ + const char *old_pwd = getenv("NSS_WRAPPER_PASSWD"); + const char *old_group = getenv("NSS_WRAPPER_GROUP"); + struct passwd *pwd; + size_t num_pwd; + struct group *grp; + size_t num_grp; + int i; + const char *env = getenv("ENVNAME"); + + if (!old_pwd || !old_group) { + torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n"); + torture_skip(tctx, "nothing to test\n"); + } + + /* + * test_membership_user() fails for ad_dc with error like this: + * + * WARNING!: ../../source4/torture/local/nss_tests.c:823: + * num_user_groups was 3 (0x3), expected 2 (0x2): getgrouplist + * and real inspection of grouplist gave different results + + * There are at least 3 reasons: + + * 1. For each ADDOMAIN user, there is also a group with the same name: + +$ bin/wbinfo --user-info ADDOMAIN/alice +ADDOMAIN/alice:*:3000015:65531::/home/ADDOMAIN/alice:/bin/false + +$ bin/wbinfo --group-info ADDOMAIN/alice +ADDOMAIN/alice:x:3000015:ADDOMAIN/alice + + * 2. ADDOMAIN/joe is the only user of "ADDOMAIN/Domain Users" + * e.g. alice is not there: + +$ bin/wbinfo --group-info "ADDOMAIN/Domain users" +ADDOMAIN/domain users:x:65531:ADDOMAIN/joe + + * 3. getgrouplist() for joe returns also "ADDOMAIN/samba users" + * but "ADDOMAIN/samba users" is an empty group: + +$ bin/wbinfo --group-info "ADDOMAIN/samba users" +ADDOMAIN/samba users:x:3000051: + + */ + + /* Only ad_member_idmap_rid sets 'winbind expand groups' */ + if (strcmp(env, "ad_member_idmap_rid:local") != 0) { + torture_comment(tctx, + "Testing in env '%s' is not supported.\n", + env); + torture_skip(tctx, "nothing to test\n"); + return true; + } + + torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd), + "failed to enumerate passwd"); + torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp), + "failed to enumerate group"); + + for (i=0; i < num_pwd; i++) { + + torture_assert(tctx, test_membership_user(tctx, &pwd[i], grp, num_grp), + "failed to test membership for user"); + + } + + return true; +} + +static bool test_enumeration(struct torture_context *tctx) +{ + const char *old_pwd = getenv("NSS_WRAPPER_PASSWD"); + const char *old_group = getenv("NSS_WRAPPER_GROUP"); + + if (!old_pwd || !old_group) { + torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n"); + torture_skip(tctx, "nothing to test\n"); + } + + torture_assert(tctx, test_passwd(tctx), + "failed to test users"); + torture_assert(tctx, test_group(tctx), + "failed to test groups"); + + return true; +} + +static bool test_reentrant_enumeration(struct torture_context *tctx) +{ + const char *old_pwd = getenv("NSS_WRAPPER_PASSWD"); + const char *old_group = getenv("NSS_WRAPPER_GROUP"); + + if (!old_pwd || !old_group) { + torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n"); + torture_skip(tctx, "nothing to test\n"); + } + + torture_comment(tctx, "Testing re-entrant calls\n"); + + torture_assert(tctx, test_passwd_r(tctx), + "failed to test users"); + torture_assert(tctx, test_group_r(tctx), + "failed to test groups"); + + return true; +} + +static bool test_reentrant_enumeration_crosschecks(struct torture_context *tctx) +{ + const char *old_pwd = getenv("NSS_WRAPPER_PASSWD"); + const char *old_group = getenv("NSS_WRAPPER_GROUP"); + + if (!old_pwd || !old_group) { + torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n"); + torture_skip(tctx, "nothing to test\n"); + } + + torture_comment(tctx, "Testing re-entrant calls with cross checks\n"); + + torture_assert(tctx, test_passwd_r_cross(tctx), + "failed to test users"); + torture_assert(tctx, test_group_r_cross(tctx), + "failed to test groups"); + + return true; +} + +static bool test_passwd_duplicates(struct torture_context *tctx) +{ + size_t i, d; + struct passwd *pwd; + size_t num_pwd; + int duplicates = 0; + + torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd), + "failed to enumerate passwd"); + + for (i=0; i < num_pwd; i++) { + const char *current_name = pwd[i].pw_name; + for (d=0; d < num_pwd; d++) { + const char *dup_name = pwd[d].pw_name; + if (d == i) { + continue; + } + if (!strequal(current_name, dup_name)) { + continue; + } + + torture_warning(tctx, "found duplicate names:"); + print_passwd(&pwd[d]); + print_passwd(&pwd[i]); + duplicates++; + } + } + + if (duplicates) { + torture_fail(tctx, talloc_asprintf(tctx, "found %d duplicate names", duplicates)); + } + + return true; +} + +static bool test_group_duplicates(struct torture_context *tctx) +{ + size_t i, d; + struct group *grp; + size_t num_grp; + int duplicates = 0; + + torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp), + "failed to enumerate group"); + + for (i=0; i < num_grp; i++) { + const char *current_name = grp[i].gr_name; + for (d=0; d < num_grp; d++) { + const char *dup_name = grp[d].gr_name; + if (d == i) { + continue; + } + if (!strequal(current_name, dup_name)) { + continue; + } + + torture_warning(tctx, "found duplicate names:"); + print_group(&grp[d]); + print_group(&grp[i]); + duplicates++; + } + } + + if (duplicates) { + torture_fail(tctx, talloc_asprintf(tctx, "found %d duplicate names", duplicates)); + } + + return true; +} + + +static bool test_duplicates(struct torture_context *tctx) +{ + const char *old_pwd = getenv("NSS_WRAPPER_PASSWD"); + const char *old_group = getenv("NSS_WRAPPER_GROUP"); + + if (!old_pwd || !old_group) { + torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n"); + torture_skip(tctx, "nothing to test\n"); + } + + torture_assert(tctx, test_passwd_duplicates(tctx), + "failed to test users"); + torture_assert(tctx, test_group_duplicates(tctx), + "failed to test groups"); + + return true; +} + + +struct torture_suite *torture_local_nss(TALLOC_CTX *mem_ctx) +{ + struct torture_suite *suite = torture_suite_create(mem_ctx, "nss"); + + torture_suite_add_simple_test(suite, "enumeration", test_enumeration); + torture_suite_add_simple_test(suite, "reentrant enumeration", test_reentrant_enumeration); + torture_suite_add_simple_test(suite, "reentrant enumeration crosschecks", test_reentrant_enumeration_crosschecks); + torture_suite_add_simple_test(suite, "membership", test_membership); + torture_suite_add_simple_test(suite, "duplicates", test_duplicates); + + return suite; +} |