diff options
Diffstat (limited to 'src/tests/t_policy.py')
| -rwxr-xr-x | src/tests/t_policy.py | 101 |
1 files changed, 36 insertions, 65 deletions
diff --git a/src/tests/t_policy.py b/src/tests/t_policy.py index bfec96a93212..26c4e466e4f0 100755 --- a/src/tests/t_policy.py +++ b/src/tests/t_policy.py @@ -7,35 +7,27 @@ realm = K5Realm(create_host=False, start_kadmind=True) # Test password quality enforcement. realm.run([kadminl, 'addpol', '-minlength', '6', '-minclasses', '2', 'pwpol']) realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'pwpol', 'pwuser']) -out = realm.run([kadminl, 'cpw', '-pw', 'sh0rt', 'pwuser'], expected_code=1) -if 'Password is too short' not in out: - fail('short password') -out = realm.run([kadminl, 'cpw', '-pw', 'longenough', 'pwuser'], - expected_code=1) -if 'Password does not contain enough character classes' not in out: - fail('insufficient character classes') +realm.run([kadminl, 'cpw', '-pw', 'sh0rt', 'pwuser'], expected_code=1, + expected_msg='Password is too short') +realm.run([kadminl, 'cpw', '-pw', 'longenough', 'pwuser'], expected_code=1, + expected_msg='Password does not contain enough character classes') realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser']) # Test some password history enforcement. Even with no history value, # the current password should be denied. -out = realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], - expected_code=1) -if 'Cannot reuse password' not in out: - fail('reuse of current password') +realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1, + expected_msg='Cannot reuse password') realm.run([kadminl, 'modpol', '-history', '2', 'pwpol']) realm.run([kadminl, 'cpw', '-pw', 'an0therpw', 'pwuser']) -out = realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], - expected_code=1) -if 'Cannot reuse password' not in out: - fail('reuse of old password') +realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1, + expected_msg='Cannot reuse password') realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser']) realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser']) # Test references to nonexistent policies. realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser']) -out = realm.run([kadminl, 'getprinc', 'newuser']) -if 'Policy: newpol [does not exist]\n' not in out: - fail('getprinc output for principal referencing nonexistent policy') +realm.run([kadminl, 'getprinc', 'newuser'], + expected_msg='Policy: newpol [does not exist]\n') realm.run([kadminl, 'modprinc', '-policy', 'newpol', 'pwuser']) # pwuser should allow reuse of the current password since newpol doesn't exist. realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser']) @@ -45,29 +37,20 @@ realm.run([kadmin, '-p', 'pwuser', '-w', '3rdpassword', 'cpw', '-pw', # Create newpol and verify that it is enforced. realm.run([kadminl, 'addpol', '-minlength', '3', 'newpol']) -out = realm.run([kadminl, 'getprinc', 'pwuser']) -if 'Policy: newpol\n' not in out: - fail('getprinc after creating policy (pwuser)') -out = realm.run([kadminl, 'cpw', '-pw', 'aa', 'pwuser'], expected_code=1) -if 'Password is too short' not in out: - fail('short password after creating policy (pwuser)') -out = realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser'], - expected_code=1) -if 'Cannot reuse password' not in out: - fail('reuse of current password after creating policy') +realm.run([kadminl, 'getprinc', 'pwuser'], expected_msg='Policy: newpol\n') +realm.run([kadminl, 'cpw', '-pw', 'aa', 'pwuser'], expected_code=1, + expected_msg='Password is too short') +realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser'], expected_code=1, + expected_msg='Cannot reuse password') -out = realm.run([kadminl, 'getprinc', 'newuser']) -if 'Policy: newpol\n' not in out: - fail('getprinc after creating policy (newuser)') -out = realm.run([kadminl, 'cpw', '-pw', 'aa', 'newuser'], expected_code=1) -if 'Password is too short' not in out: - fail('short password after creating policy (newuser)') +realm.run([kadminl, 'getprinc', 'newuser'], expected_msg='Policy: newpol\n') +realm.run([kadminl, 'cpw', '-pw', 'aa', 'newuser'], expected_code=1, + expected_msg='Password is too short') # Delete the policy and verify that it is no longer enforced. realm.run([kadminl, 'delpol', 'newpol']) -out = realm.run([kadminl, 'getpol', 'newpol'], expected_code=1) -if 'Policy does not exist' not in out: - fail('deletion of referenced policy') +realm.run([kadminl, 'getpol', 'newpol'], expected_code=1, + expected_msg='Policy does not exist') realm.run([kadminl, 'cpw', '-pw', 'aa', 'pwuser']) # Test basic password lockout support. @@ -78,18 +61,14 @@ realm.run([kadminl, 'modprinc', '+requires_preauth', '-policy', 'lockout', 'user']) # kinit twice with the wrong password. -output = realm.run([kinit, realm.user_princ], input='wrong\n', expected_code=1) -if 'Password incorrect while getting initial credentials' not in output: - fail('Expected error message not seen in kinit output') -output = realm.run([kinit, realm.user_princ], input='wrong\n', expected_code=1) -if 'Password incorrect while getting initial credentials' not in output: - fail('Expected error message not seen in kinit output') +realm.run([kinit, realm.user_princ], input='wrong\n', expected_code=1, + expected_msg='Password incorrect while getting initial credentials') +realm.run([kinit, realm.user_princ], input='wrong\n', expected_code=1, + expected_msg='Password incorrect while getting initial credentials') # Now the account should be locked out. -output = realm.run([kinit, realm.user_princ], expected_code=1) -if 'Client\'s credentials have been revoked while getting initial credentials' \ - not in output: - fail('Expected lockout error message not seen in kinit output') +m = 'Client\'s credentials have been revoked while getting initial credentials' +realm.run([kinit, realm.user_princ], expected_code=1, expected_msg=m) # Check that modprinc -unlock allows a further attempt. realm.run([kadminl, 'modprinc', '-unlock', 'user']) @@ -113,10 +92,8 @@ realm.run([kadminl, 'cpw', '-pw', 'pw2', 'user']) # Swap the keys, simulating older kadmin having chosen the second entry. realm.run(['./hist', 'swap']) # Make sure we can read the history entry. -out = realm.run([kadminl, 'cpw', '-pw', password('user'), 'user'], - expected_code=1) -if 'Cannot reuse password' not in out: - fail('Expected error not seen in output') +realm.run([kadminl, 'cpw', '-pw', password('user'), 'user'], expected_code=1, + expected_msg='Cannot reuse password') # Test key/salt constraints. @@ -142,9 +119,8 @@ realm.run([kadminl, 'cpw', '-randkey', '-e', 'aes256-cts', 'server']) # Test modpol. realm.run([kadminl, 'modpol', '-allowedkeysalts', 'aes256-cts,rc4-hmac', 'ak']) -out = realm.run([kadminl, 'getpol', 'ak']) -if not 'Allowed key/salt types: aes256-cts,rc4-hmac' in out: - fail('getpol does not implement allowedkeysalts?') +realm.run([kadminl, 'getpol', 'ak'], + expected_msg='Allowed key/salt types: aes256-cts,rc4-hmac') # Test subsets and full set. realm.run([kadminl, 'cpw', '-randkey', '-e', 'rc4-hmac', 'server']) @@ -153,19 +129,14 @@ realm.run([kadminl, 'cpw', '-randkey', '-e', 'aes256-cts,rc4-hmac', 'server']) realm.run([kadminl, 'cpw', '-randkey', '-e', 'rc4-hmac,aes256-cts', 'server']) # Check that the order we got is the one from the policy. -out = realm.run([kadminl, 'getprinc', '-terse', 'server']) -if not '2\t1\t6\t18\t0\t1\t6\t23\t0' in out: - fail('allowed_keysalts policy did not preserve order') +realm.run([kadminl, 'getprinc', '-terse', 'server'], + expected_msg='2\t1\t6\t18\t0\t1\t6\t23\t0') # Test partially intersecting sets. -out = realm.run([kadminl, 'cpw', '-randkey', '-e', 'rc4-hmac,aes128-cts', - 'server'], expected_code=1) -if not 'Invalid key/salt tuples' in out: - fail('allowed_keysalts policy not applied properly') -out = realm.run([kadminl, 'cpw', '-randkey', '-e', - 'rc4-hmac,aes256-cts,aes128-cts', 'server'], expected_code=1) -if not 'Invalid key/salt tuples' in out: - fail('allowed_keysalts policy not applied properly') +realm.run([kadminl, 'cpw', '-randkey', '-e', 'rc4-hmac,aes128-cts', 'server'], + expected_code=1, expected_msg='Invalid key/salt tuples') +realm.run([kadminl, 'cpw', '-randkey', '-e', 'rc4-hmac,aes256-cts,aes128-cts', + 'server'], expected_code=1, expected_msg='Invalid key/salt tuples') # Test reset of allowedkeysalts. realm.run([kadminl, 'modpol', '-allowedkeysalts', '-', 'ak']) |