Fix tests when built with system CrackLib

Skip tests that require the stronger rule configuration in the
embedded CrackLib when built against system CrackLib.  This avoids
test failures when built with system CrackLib.

diff --git a/NEWS b/NEWS
index bb066872f48f3320b2f8e39ccddcd4528c158094..a57b84ff41f0cbfef8627965975ac2a18cf79ec2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,10 @@ krb5-strength 3.2 (unreleased)
     copies of passwords before freeing memory.  This reduces the lifetime
     of passwords in memory.
 
+    Skip tests that require the stronger rule configuration in the
+    embedded CrackLib when built against system CrackLib.  This avoids
+    test failures when built with system CrackLib.
+
     Rework the check-valgrind target to use the new C TAP Harness valgrind
     support and automatically check the valgrind log files for errors at
     the end of the test suite.

diff --git a/configure.ac b/configure.ac
index 955bc57bb0d9c2ee506b82fea2ab786f6408668c..ced8dabb6f049969eee2a653bd4aa7150d78fd14 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -41,7 +41,9 @@ RRA_LIB_CRACKLIB
 AS_IF([test x"$rra_system_cracklib" = xyes],
     [RRA_LIB_CRACKLIB_SWITCH
      AC_CHECK_HEADERS([crack.h])
-     RRA_LIB_CRACKLIB_RESTORE])
+     RRA_LIB_CRACKLIB_RESTORE
+     AC_DEFINE([HAVE_SYSTEM_CRACKLIB], 1,
+        [Define if using the system CrackLib.])])
 RRA_LIB_KRB5
 RRA_LIB_KRB5_SWITCH
 AC_CHECK_HEADERS([krb5/pwqual_plugin.h], [], [], [RRA_INCLUDES_KRB5])

diff --git a/tests/data/passwords/cracklib.json b/tests/data/passwords/cracklib.json
index 037a70fdf5b9e01ea8a66cc96d9ed9178490b73c..c88a8435f4ff79c4fd0fd3d099b3c9e1660c2026 100644 (file)
--- a/tests/data/passwords/cracklib.json
+++ b/tests/data/passwords/cracklib.json
@@ -24,21 +24,24 @@
         "principal": "test@EXAMPLE.ORG",
         "password": "stanfordstanford",
         "code": "KADM5_PASS_Q_GENERIC",
-        "error": "it is based on a (duplicated) dictionary word"
+        "error": "it is based on a (duplicated) dictionary word",
+        "skip_for_system_cracklib": true
     },
     {
         "name": "in dictionary (reversed)",
         "principal": "test@EXAMPLE.ORG",
         "password": "enabrettib",
         "code": "KADM5_PASS_Q_GENERIC",
-        "error": "it is based on a (reversed) dictionary word"
+        "error": "it is based on a (reversed) dictionary word",
+        "skip_for_system_cracklib": true
     },
     {
         "name": "seven characters",
         "principal": "test@EXAMPLE.ORG",
         "password": "dfareas",
         "code": "KADM5_PASS_Q_GENERIC",
-        "error": "it is too short"
+        "error": "it is too short",
+        "skip_for_system_cracklib": true
     },
     {
         "name": "four characters",

diff --git a/tests/data/passwords/make-c-data b/tests/data/passwords/make-c-data
index 55a2733410e6e2986d0cd3660149c77b577d0272..d525c0a998b47647277c2bbcb539bc67cf8d0524 100755 (executable)
--- a/tests/data/passwords/make-c-data
+++ b/tests/data/passwords/make-c-data
@@ -46,12 +46,17 @@ Readonly my $HEADER => <<'END_HEADER';
 END_HEADER
 
 # The list of attributes, in order, whose values go into the C struct.
-Readonly my @ATTRIBUTES => qw(name principal password code error);
+Readonly my @ATTRIBUTES => qw(
+  name principal password code error skip_for_system_cracklib
+);
 
 # A hash of attributes that should be put in the C struct as they literally
 # appear in the JSON, rather than as strings.  (In other words, attributes
-# that are numbers or C constants.)  Only the keys are of interest.
-Readonly my %IS_LITERAL_ATTRIBUTE => (code => 1);
+# that are numbers, booleans, or C constants.)  Only the keys are of interest.
+Readonly my %IS_LITERAL_ATTRIBUTE => (
+    code                     => 1,
+    skip_for_system_cracklib => 1
+);
 
 ##############################################################################
 # Functions
@@ -181,6 +186,7 @@ struct is expected to have the following definition:
         const char *name;
         const char *principal;
         const char *password;
+        bool skip_for_system_cracklib;
         krb5_error_code code;
         const char *error;
     };

diff --git a/tests/data/passwords/tests.h b/tests/data/passwords/tests.h
index b42bf374dfd3903c933482ae47c07bf655a1b533..f1ce2f9cf9e77484c561bd3695e70329b1a3c2dc 100644 (file)
--- a/tests/data/passwords/tests.h
+++ b/tests/data/passwords/tests.h
@@ -5,6 +5,7 @@
  * out by make-c-data.  It's included by the test data files.
  *
  * Written by Russ Allbery <eagle@eyrie.org>
+ * Copyright 2020 Russ Allbery <eagle@eyrie.org>
  * Copyright 2013
  *     The Board of Trustees of the Leland Stanford Junior University
  *
@@ -17,6 +18,7 @@
 #include <config.h>
 #include <portable/kadmin.h>
 #include <portable/krb5.h>
+#include <portable/stdbool.h>
 
 struct password_test {
     const char *name;
@@ -24,6 +26,7 @@ struct password_test {
     const char *password;
     krb5_error_code code;
     const char *error;
+    bool skip_for_system_cracklib;
 };
 
 #endif /* !TESTS_DATA_PASSWORD_TESTS_H */

diff --git a/tests/plugin/heimdal-t.c b/tests/plugin/heimdal-t.c
index fbabb6b5188a30b4684c50f32eb2da7f46b6b5c7..0c0afa5b4b2ba286b18d2feea60c8e148f55e98a 100644 (file)
--- a/tests/plugin/heimdal-t.c
+++ b/tests/plugin/heimdal-t.c
@@ -196,8 +196,15 @@ main(void)
     run_setup((const char **) setup_argv);
 
     /* Now, run all of the tests. */
-    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++)
+    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++) {
+#        ifdef HAVE_SYSTEM_CRACKLIB
+        if (cracklib_tests[i].skip_for_system_cracklib) {
+            skip_block(2, "not built with embedded CrackLib");
+            continue;
+        }
+#        endif
         is_password_test(verifier, &cracklib_tests[i]);
+    }
 
     /*
      * Add length restrictions and a maximum length for CrackLib.  This should

diff --git a/tests/plugin/mit-t.c b/tests/plugin/mit-t.c
index ebf885b60850ae2b2c80c97b1c785c9e80fcee98..7abc5d88df02588e1d2b6599ece52aad2dafd39b 100644 (file)
--- a/tests/plugin/mit-t.c
+++ b/tests/plugin/mit-t.c
@@ -207,9 +207,20 @@ main(void)
         is_password_test(ctx, vtable, data, &principal_tests[i]);
 
 #    ifdef HAVE_CRACKLIB
-    /* Run the CrackLib tests if CrackLib is available, otherwise skip them. */
-    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++)
+    /*
+     * Run the CrackLib tests if CrackLib is available, otherwise skip them.
+     * If built with the system CrackLib, skip tests that are marked as only
+     * working with the tougher rules of our embedded CrackLib.
+     */
+    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++) {
+#        ifdef HAVE_SYSTEM_CRACKLIB
+        if (cracklib_tests[i].skip_for_system_cracklib) {
+            skip_block(2, "not built with embedded CrackLib");
+            continue;
+        }
+#        endif
         is_password_test(ctx, vtable, data, &cracklib_tests[i]);
+    }
 #    else
     count = ARRAY_SIZE(cracklib_tests);
     skip_block(count * 2, "not built with CrackLib support");
@@ -253,8 +264,15 @@ main(void)
     is_int(0, code, "Plugin initialization (krb5.conf dictionary)");
     if (code != 0)
         bail("cannot continue after plugin initialization failure");
-    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++)
+    for (i = 0; i < ARRAY_SIZE(cracklib_tests); i++) {
+#        ifdef HAVE_SYSTEM_CRACKLIB
+        if (cracklib_tests[i].skip_for_system_cracklib) {
+            skip_block(2, "not built with embedded CrackLib");
+            continue;
+        }
+#        endif
         is_password_test(ctx, vtable, data, &cracklib_tests[i]);
+    }
     vtable->close(ctx, data);
 
     /*

diff --git a/tests/tools/heimdal-strength-t b/tests/tools/heimdal-strength-t
index 21f94301b56a7b4d4e8728ba468710b53f3d7976..5e7b1cb9da8cd9f53f8404335979749bddbc7d66 100755 (executable)
--- a/tests/tools/heimdal-strength-t
+++ b/tests/tools/heimdal-strength-t
@@ -296,10 +296,18 @@ sub test_require_classes_syntax {
     return;
 }
 
-# Load the password tests from JSON.
+# Load the password tests from JSON, removing the CrackLib tests that may fail
+# if we were built with the system CrackLib.  We don't have an easy way of
+# knowing which CrackLib heimdal-strength was linked against, so we have to
+# ignore them unconditionally.  The separate plugin tests will exercise that
+# code.
 my %tests;
 for my $type (qw(cdb classes cracklib length letter principal sqlite)) {
     my $tests = load_password_tests("$type.json");
+    if ($type eq 'cracklib') {
+        my @tests = grep { !$_->{skip_for_system_cracklib} } @{$tests};
+        $tests = [@tests];
+    }
     $tests{$type} = $tests;
 }