Blame SOURCES/0016-add-tests-multiple-certs-same-id.patch

bac598
From f633f37e712cb0f7524a2ee257e15f34468149b4 Mon Sep 17 00:00:00 2001
bac598
From: Sumit Bose <sbose@redhat.com>
bac598
Date: Tue, 3 Nov 2020 09:58:52 +0100
bac598
Subject: [PATCH 16/16] add tests multiple certs same id
bac598
bac598
Add unit test for the case that two certificates use the same key.
bac598
bac598
Resolves: https://github.com/SSSD/sssd/issues/5400
bac598
bac598
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
bac598
---
bac598
 src/tests/cmocka/test_pam_srv.c              | 116 +++++++++++++++++++
bac598
 src/tests/test_CA/Makefile.am                |  26 ++++-
bac598
 src/tests/test_CA/SSSD_test_cert_0006.config |  20 ++++
bac598
 3 files changed, 161 insertions(+), 1 deletion(-)
bac598
 create mode 100644 src/tests/test_CA/SSSD_test_cert_0006.config
bac598
bac598
diff --git a/src/tests/cmocka/test_pam_srv.c b/src/tests/cmocka/test_pam_srv.c
bac598
index 5506fbf34..8ca5abd43 100644
bac598
--- a/src/tests/cmocka/test_pam_srv.c
bac598
+++ b/src/tests/cmocka/test_pam_srv.c
bac598
@@ -40,12 +40,14 @@
bac598
 #include "tests/test_CA/SSSD_test_cert_x509_0001.h"
bac598
 #include "tests/test_CA/SSSD_test_cert_x509_0002.h"
bac598
 #include "tests/test_CA/SSSD_test_cert_x509_0005.h"
bac598
+#include "tests/test_CA/SSSD_test_cert_x509_0006.h"
bac598
 
bac598
 #include "tests/test_ECC_CA/SSSD_test_ECC_cert_x509_0001.h"
bac598
 #else
bac598
 #define SSSD_TEST_CERT_0001 ""
bac598
 #define SSSD_TEST_CERT_0002 ""
bac598
 #define SSSD_TEST_CERT_0005 ""
bac598
+#define SSSD_TEST_CERT_0006 ""
bac598
 
bac598
 #define SSSD_TEST_ECC_CERT_0001 ""
bac598
 #endif
bac598
@@ -1093,6 +1095,13 @@ static int test_pam_creds_insufficient_check(uint32_t status,
bac598
     return EOK;
bac598
 }
bac598
 
bac598
+static int test_pam_auth_err_check(uint32_t status, uint8_t *body, size_t blen)
bac598
+{
bac598
+    /* PAM_AUTH_ERR is returned for different types of error, we use different
bac598
+     * names for the check functions to make the purpose more clear. */
bac598
+    return test_pam_wrong_pw_offline_auth_check(status, body, blen);
bac598
+}
bac598
+
bac598
 static int test_pam_user_unknown_check(uint32_t status,
bac598
                                        uint8_t *body, size_t blen)
bac598
 {
bac598
@@ -2500,6 +2509,107 @@ void test_pam_cert_auth_2certs_one_mapping(void **state)
bac598
     assert_int_equal(ret, EOK);
bac598
 }
bac598
 
bac598
+/* The following three tests cover a use case where multiple certificates are
bac598
+ * using the same key-pair. According to PKCS#11 specs "The CKA_ID field is
bac598
+ * intended to distinguish among multiple keys. In the case of public and
bac598
+ * private keys, this field assists in handling multiple keys held by the same
bac598
+ * subject; the key identifier for a public key and its corresponding private
bac598
+ * key should be the same. The key identifier should also be the same as for
bac598
+ * the corresponding certificate, if one exists. Cryptoki does not enforce
bac598
+ * these associations, however." As a result certificates sharing the same
bac598
+ * key-pair will have the same id on the Smartcard. This means a second
bac598
+ * parameter is needed to distinguish them. We use the label here.
bac598
+ *
bac598
+ * The first test makes sure authentication fails is the label is missing, the
bac598
+ * second and third test make sure that each certificate can be selected with
bac598
+ * the proper label. */
bac598
+void test_pam_cert_auth_2certs_same_id_no_label(void **state)
bac598
+{
bac598
+    int ret;
bac598
+
bac598
+    set_cert_auth_param(pam_test_ctx->pctx, CA_DB);
bac598
+    putenv(discard_const("SOFTHSM2_CONF=" ABS_BUILD_DIR "/src/tests/test_CA/softhsm2_2certs_same_id.conf"));
bac598
+
bac598
+    mock_input_pam_cert(pam_test_ctx, "pamuser", "123456", "SSSD Test Token",
bac598
+                        TEST_MODULE_NAME,
bac598
+                        "11111111",
bac598
+                        NULL, NULL,
bac598
+                        NULL, SSSD_TEST_CERT_0001);
bac598
+
bac598
+    will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);
bac598
+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);
bac598
+
bac598
+    /* Assume backend cannot handle Smartcard credentials */
bac598
+    pam_test_ctx->exp_pam_status = PAM_BAD_ITEM;
bac598
+
bac598
+    set_cmd_cb(test_pam_auth_err_check);
bac598
+    ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,
bac598
+                          pam_test_ctx->pam_cmds);
bac598
+    assert_int_equal(ret, EOK);
bac598
+
bac598
+    /* Wait until the test finishes with EOK */
bac598
+    ret = test_ev_loop(pam_test_ctx->tctx);
bac598
+    assert_int_equal(ret, EOK);
bac598
+}
bac598
+
bac598
+void test_pam_cert_auth_2certs_same_id_with_label_1(void **state)
bac598
+{
bac598
+    int ret;
bac598
+
bac598
+    set_cert_auth_param(pam_test_ctx->pctx, CA_DB);
bac598
+    putenv(discard_const("SOFTHSM2_CONF=" ABS_BUILD_DIR "/src/tests/test_CA/softhsm2_2certs_same_id.conf"));
bac598
+
bac598
+    mock_input_pam_cert(pam_test_ctx, "pamuser", "123456", "SSSD Test Token",
bac598
+                        TEST_MODULE_NAME,
bac598
+                        "11111111",
bac598
+                        "SSSD test cert 0001", NULL,
bac598
+                        test_lookup_by_cert_double_cb, SSSD_TEST_CERT_0001);
bac598
+
bac598
+    will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);
bac598
+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);
bac598
+
bac598
+    /* Assume backend cannot handle Smartcard credentials */
bac598
+    pam_test_ctx->exp_pam_status = PAM_BAD_ITEM;
bac598
+
bac598
+    set_cmd_cb(test_pam_simple_check_success);
bac598
+    ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,
bac598
+                          pam_test_ctx->pam_cmds);
bac598
+    assert_int_equal(ret, EOK);
bac598
+
bac598
+    /* Wait until the test finishes with EOK */
bac598
+    ret = test_ev_loop(pam_test_ctx->tctx);
bac598
+    assert_int_equal(ret, EOK);
bac598
+}
bac598
+
bac598
+void test_pam_cert_auth_2certs_same_id_with_label_6(void **state)
bac598
+{
bac598
+    int ret;
bac598
+
bac598
+    set_cert_auth_param(pam_test_ctx->pctx, CA_DB);
bac598
+    putenv(discard_const("SOFTHSM2_CONF=" ABS_BUILD_DIR "/src/tests/test_CA/softhsm2_2certs_same_id.conf"));
bac598
+
bac598
+    mock_input_pam_cert(pam_test_ctx, "pamuser", "123456", "SSSD Test Token",
bac598
+                        TEST_MODULE_NAME,
bac598
+                        "11111111",
bac598
+                        "SSSD test cert 0006", NULL,
bac598
+                        test_lookup_by_cert_double_cb, SSSD_TEST_CERT_0006);
bac598
+
bac598
+    will_return(__wrap_sss_packet_get_cmd, SSS_PAM_AUTHENTICATE);
bac598
+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);
bac598
+
bac598
+    /* Assume backend cannot handle Smartcard credentials */
bac598
+    pam_test_ctx->exp_pam_status = PAM_BAD_ITEM;
bac598
+
bac598
+    set_cmd_cb(test_pam_simple_check_success);
bac598
+    ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_AUTHENTICATE,
bac598
+                          pam_test_ctx->pam_cmds);
bac598
+    assert_int_equal(ret, EOK);
bac598
+
bac598
+    /* Wait until the test finishes with EOK */
bac598
+    ret = test_ev_loop(pam_test_ctx->tctx);
bac598
+    assert_int_equal(ret, EOK);
bac598
+}
bac598
+
bac598
 void test_pam_cert_preauth_uri_token1(void **state)
bac598
 {
bac598
     int ret;
bac598
@@ -3179,6 +3289,12 @@ int main(int argc, const char *argv[])
bac598
                                         pam_test_setup, pam_test_teardown),
bac598
         cmocka_unit_test_setup_teardown(test_pam_cert_auth_2certs_one_mapping,
bac598
                                         pam_test_setup, pam_test_teardown),
bac598
+        cmocka_unit_test_setup_teardown(test_pam_cert_auth_2certs_same_id_no_label,
bac598
+                                        pam_test_setup, pam_test_teardown),
bac598
+        cmocka_unit_test_setup_teardown(test_pam_cert_auth_2certs_same_id_with_label_1,
bac598
+                                        pam_test_setup, pam_test_teardown),
bac598
+        cmocka_unit_test_setup_teardown(test_pam_cert_auth_2certs_same_id_with_label_6,
bac598
+                                        pam_test_setup, pam_test_teardown),
bac598
         cmocka_unit_test_setup_teardown(test_pam_cert_auth_no_logon_name,
bac598
                                         pam_test_setup, pam_test_teardown),
bac598
         cmocka_unit_test_setup_teardown(test_pam_cert_auth_no_logon_name_no_key_id,
bac598
diff --git a/src/tests/test_CA/Makefile.am b/src/tests/test_CA/Makefile.am
bac598
index 0e0122737..8765d0fd6 100644
bac598
--- a/src/tests/test_CA/Makefile.am
bac598
+++ b/src/tests/test_CA/Makefile.am
bac598
@@ -6,6 +6,7 @@ dist_noinst_DATA = \
bac598
     SSSD_test_cert_0003.config \
bac598
     SSSD_test_cert_0004.config \
bac598
     SSSD_test_cert_0005.config \
bac598
+    SSSD_test_cert_0006.config \
bac598
     SSSD_test_cert_key_0001.pem \
bac598
     SSSD_test_cert_key_0002.pem \
bac598
     SSSD_test_cert_key_0003.pem \
bac598
@@ -25,7 +26,7 @@ pubkeys = $(addprefix SSSD_test_cert_pubsshkey_,$(addsuffix .pub,$(ids)))
bac598
 pubkeys_h = $(addprefix SSSD_test_cert_pubsshkey_,$(addsuffix .h,$(ids)))
bac598
 pkcs12 = $(addprefix SSSD_test_cert_pkcs12_,$(addsuffix .pem,$(ids)))
bac598
 
bac598
-extra = softhsm2_none softhsm2_one softhsm2_two softhsm2_2tokens softhsm2_ocsp
bac598
+extra = softhsm2_none softhsm2_one softhsm2_two softhsm2_2tokens softhsm2_ocsp softhsm2_2certs_same_id
bac598
 if HAVE_FAKETIME
bac598
 extra += SSSD_test_CA_expired_crl.pem
bac598
 endif
bac598
@@ -41,6 +42,14 @@ $(pwdfile):
bac598
 SSSD_test_CA.pem: $(openssl_ca_key) $(openssl_ca_config) serial
bac598
 	$(OPENSSL) req -batch -config ${openssl_ca_config} -x509 -new -nodes -key $< -sha256 -days 1024 -set_serial 0 -extensions v3_ca -out $@
bac598
 
bac598
+# SSSD_test_cert_0006 should use the same key as SSSD_test_cert_0001
bac598
+.INTERMEDIATE: SSSD_test_cert_req_0006.pem
bac598
+SSSD_test_cert_req_0006.pem: $(srcdir)/SSSD_test_cert_key_0001.pem $(srcdir)/SSSD_test_cert_0006.config
bac598
+	if [ $(shell grep -c req_exts $(srcdir)/SSSD_test_cert_0006.config) -eq 0 ]; then \
bac598
+		$(OPENSSL) req -new -nodes -key $< -config $(srcdir)/SSSD_test_cert_0006.config -out $@ ; \
bac598
+	else \
bac598
+		$(OPENSSL) req -new -nodes -key $< -reqexts req_exts -config $(srcdir)/SSSD_test_cert_0006.config -out $@ ; \
bac598
+	fi
bac598
 
bac598
 SSSD_test_cert_req_%.pem: $(srcdir)/SSSD_test_cert_key_%.pem $(srcdir)/SSSD_test_cert_%.config
bac598
 	if [ $(shell grep -c req_exts $(srcdir)/SSSD_test_cert_$*.config) -eq 0 ]; then \
bac598
@@ -52,6 +61,9 @@ SSSD_test_cert_req_%.pem: $(srcdir)/SSSD_test_cert_key_%.pem $(srcdir)/SSSD_test
bac598
 SSSD_test_cert_x509_%.pem: SSSD_test_cert_req_%.pem $(openssl_ca_config) SSSD_test_CA.pem
bac598
 	$(OPENSSL) ca -config ${openssl_ca_config} -batch -notext -keyfile $(openssl_ca_key) -in $< -days 200 -extensions usr_cert -out $@
bac598
 
bac598
+SSSD_test_cert_pkcs12_0006.pem: SSSD_test_cert_x509_0006.pem $(srcdir)/SSSD_test_cert_key_0001.pem $(pwdfile)
bac598
+	$(OPENSSL) pkcs12 -export -in SSSD_test_cert_x509_0006.pem -inkey $(srcdir)/SSSD_test_cert_key_0001.pem -nodes -passout file:$(pwdfile) -out $@
bac598
+
bac598
 SSSD_test_cert_pkcs12_%.pem: SSSD_test_cert_x509_%.pem $(srcdir)/SSSD_test_cert_key_%.pem $(pwdfile)
bac598
 	$(OPENSSL) pkcs12 -export -in SSSD_test_cert_x509_$*.pem -inkey $(srcdir)/SSSD_test_cert_key_$*.pem -nodes -passout file:$(pwdfile) -out $@
bac598
 
bac598
@@ -130,6 +142,18 @@ softhsm2_ocsp.conf:
bac598
 	@echo "objectstore.backend = file" >> $@
bac598
 	@echo "slots.removable = true" >> $@
bac598
 
bac598
+softhsm2_2certs_same_id: softhsm2_2certs_same_id.conf SSSD_test_cert_x509_0001.pem SSSD_test_cert_x509_0006.pem
bac598
+	mkdir $@
bac598
+	SOFTHSM2_CONF=./$< $(SOFTHSM2_UTIL) --init-token  --label "SSSD Test Token" --pin 123456 --so-pin 123456 --free
bac598
+	GNUTLS_PIN=123456 SOFTHSM2_CONF=./$< $(P11TOOL) --provider=$(SOFTHSM2_PATH) --write --no-mark-private --load-certificate=SSSD_test_cert_x509_0006.pem --login  --label 'SSSD test cert 0006' --id '11111111'
bac598
+	GNUTLS_PIN=123456 SOFTHSM2_CONF=./$< $(P11TOOL) --provider=$(SOFTHSM2_PATH) --write --no-mark-private --load-certificate=SSSD_test_cert_x509_0001.pem --login  --label 'SSSD test cert 0001' --id '11111111'
bac598
+	GNUTLS_PIN=123456 SOFTHSM2_CONF=./$< $(P11TOOL) --provider=$(SOFTHSM2_PATH) --write --load-privkey=$(srcdir)/SSSD_test_cert_key_0001.pem --login  --label 'SSSD test cert 0001' --id '11111111'
bac598
+
bac598
+softhsm2_2certs_same_id.conf:
bac598
+	@echo "directories.tokendir = "$(abs_top_builddir)"/src/tests/test_CA/softhsm2_2certs_same_id" > $@
bac598
+	@echo "objectstore.backend = file" >> $@
bac598
+	@echo "slots.removable = true" >> $@
bac598
+
bac598
 CLEANFILES = \
bac598
     index.txt  index.txt.attr \
bac598
     index.txt.attr.old  index.txt.old \
bac598
diff --git a/src/tests/test_CA/SSSD_test_cert_0006.config b/src/tests/test_CA/SSSD_test_cert_0006.config
bac598
new file mode 100644
bac598
index 000000000..762de55cd
bac598
--- /dev/null
bac598
+++ b/src/tests/test_CA/SSSD_test_cert_0006.config
bac598
@@ -0,0 +1,20 @@
bac598
+# This certificate is used in
bac598
+# - src/tests/cmocka/test_pam_srv.c
bac598
+# and should use the same key-pair as SSSD_test_cert_0001
bac598
+[ req ]
bac598
+distinguished_name = req_distinguished_name
bac598
+prompt = no
bac598
+
bac598
+[ req_distinguished_name ]
bac598
+O = SSSD
bac598
+OU = SSSD test
bac598
+CN = SSSD test cert 0006
bac598
+
bac598
+[ req_exts ]
bac598
+basicConstraints = CA:FALSE
bac598
+nsCertType = client, email
bac598
+nsComment = "SSSD test Certificate"
bac598
+subjectKeyIdentifier = hash
bac598
+keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
bac598
+extendedKeyUsage = clientAuth, emailProtection
bac598
+subjectAltName = email:sssd-devel@lists.fedorahosted.org,URI:https://github.com/SSSD/sssd//
bac598
-- 
bac598
2.21.3
bac598