rkerberos 0.2.3 → 0.3.1

data/spec/krb5_keytab_spec.rb

@@ -36,22 +36,64 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   subject(:keytab) { described_class.new }
 
+  def write_keytab_with_invalid_second_record(destination)
+    data = File.binread(@keytab_file)
+    first_record_size = data.byteslice(2, 4).unpack1('N')
+    second_record_offset = 6 + first_record_size
+
+    # INT32_MIN is reserved as an invalid record size by the FILE keytab
+    # implementation, so iteration must fail after yielding the first entry.
+    data[second_record_offset, 4] = [0x80000000].pack('N')
+    File.binwrite(destination, data)
+  end
+
   describe 'constructor' do
-    it 'accepts an optional name' do
-      expect { described_class.new("FILE:/usr/local/var/keytab") }.not_to raise_error
-      expect { described_class.new("FILE:/bogus/keytab") }.not_to raise_error
+    it 'accepts an optional name keyword' do
+      expect { described_class.new(name: "FILE:/usr/local/var/keytab") }.not_to raise_error
+      expect { described_class.new(name: "FILE:/bogus/keytab") }.not_to raise_error
     end
 
     it 'raises error for invalid residual type' do
       expect {
-        described_class.new("BOGUS:/tmp/keytab")
+        described_class.new(name: "BOGUS:/tmp/keytab")
       }.to raise_error(Kerberos::Krb5::Keytab::Exception)
     end
+
+    it 'accepts a context keyword argument' do
+      ctx = Kerberos::Krb5::Context.new
+      keytab = described_class.new(name: @keytab_name, context: ctx)
+      expect { ctx.close }.to raise_error(Kerberos::Krb5::Exception, /dependent wrapper/)
+      keytab.close
+      expect { ctx.close }.not_to raise_error
+    end
+
+    it 'works with context and no name' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { described_class.new(context: ctx) }.not_to raise_error
+    end
+
+    it 'rejects positional arguments' do
+      expect { described_class.new(@keytab_name) }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects unknown keywords' do
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { described_class.new(context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { described_class.new(context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '#keytab_name and #keytab_type' do
     it 'returns the underlying name and type strings' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt).to respond_to(:keytab_name)
       expect(kt).to respond_to(:keytab_type)
 
@@ -67,34 +109,43 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   describe '#close' do
     it 'returns true' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.close).to eq(true)
     end
 
     it 'can be called multiple times without error' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.close }.not_to raise_error
     end
 
     it 'raises an error when calling keytab_name after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.keytab_name }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'raises an error when calling keytab_type after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.keytab_type }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'does not segfault when garbage collected after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       kt = nil
       GC.start
     end
+
+    it 'raises from every operation that requires the closed handle' do
+      kt = described_class.new(name: @keytab_name)
+      kt.close
+
+      expect { kt.default_name }.to raise_error(Kerberos::Krb5::Exception)
+      expect { kt.each { |_| } }.to raise_error(Kerberos::Krb5::Exception)
+      expect { kt.get_entry("testuser1@#{@realm}") }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '.foreach' do
@@ -129,6 +180,19 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
       }.to raise_error(Kerberos::Krb5::Exception)
     end
 
+    it 'raises when an error interrupts iteration' do
+      corrupt_keytab = File.join(Dir.tmpdir, "invalid-foreach-#{Process.pid}.keytab")
+      write_keytab_with_invalid_second_record(corrupt_keytab)
+      entries = []
+
+      expect {
+        described_class.foreach("FILE:#{corrupt_keytab}") { |entry| entries << entry }
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_kt_next_entry/)
+      expect(entries).not_to be_empty
+    ensure
+      FileUtils.rm_f(corrupt_keytab)
+    end
+
     it 'raises an error for an invalid keytab type' do
       expect {
         described_class.foreach("BOGUS:/tmp/keytab") { |_| }
@@ -152,7 +216,7 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   describe '#each' do
     it 'yields keytab entries for a valid keytab' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entries = []
       kt.each { |entry| entries << entry }
       expect(entries.length).to eq(2)
@@ -166,25 +230,40 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'does not leak resources when the block raises' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect {
         kt.each { |_| raise "boom" }
       }.to raise_error(RuntimeError, "boom")
     end
 
     it 'does not leak resources when the block breaks' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       result = catch(:done) do
         kt.each { |_| throw :done, :escaped }
         :completed
       end
       expect(result).to eq(:escaped)
     end
+
+    it 'raises instead of returning a partial result after an iteration error' do
+      corrupt_keytab = File.join(Dir.tmpdir, "invalid-each-#{Process.pid}.keytab")
+      write_keytab_with_invalid_second_record(corrupt_keytab)
+      entries = []
+      kt = described_class.new(name: "FILE:#{corrupt_keytab}")
+
+      expect {
+        kt.each { |entry| entries << entry }
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_kt_next_entry/)
+      expect(entries).not_to be_empty
+    ensure
+      kt&.close
+      FileUtils.rm_f(corrupt_keytab)
+    end
   end
 
   describe '#get_entry' do
     it 'finds an entry by principal name' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entry = kt.get_entry("testuser1@#{@realm}")
       expect(entry).to be_a(Kerberos::Krb5::Keytab::Entry)
       expect(entry.principal).to eq("testuser1@#{@realm}")
@@ -194,14 +273,14 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'finds an entry filtering by vno' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entry = kt.get_entry("testuser1@#{@realm}", 1)
       expect(entry.principal).to eq("testuser1@#{@realm}")
       expect(entry.vno).to eq(1)
     end
 
     it 'finds an entry filtering by vno and enctype' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       # aes128-cts-hmac-sha1-96 is enctype 17
       entry = kt.get_entry("testuser1@#{@realm}", 1, 17)
       expect(entry.principal).to eq("testuser1@#{@realm}")
@@ -210,21 +289,21 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'raises an error for a non-existent principal' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect {
         kt.get_entry("bogus@#{@realm}")
       }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'is aliased as find' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.method(:find)).to eq(kt.method(:get_entry))
     end
   end
 
   describe '#dup' do
     it 'creates an independent handle referring to same keytab' do
-      kt1 = described_class.new(@keytab_name)
+      kt1 = described_class.new(name: @keytab_name)
       kt2 = kt1.dup
       expect(kt2).to be_a(described_class)
       expect(kt2.keytab_name).to eq(kt1.keytab_name)
@@ -235,8 +314,184 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'clone is an alias for dup' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.method(:clone)).to eq(kt.method(:dup))
     end
   end
+
+  describe '#have_content?' do
+    it 'returns true for a keytab with entries' do
+      kt = described_class.new(name: @keytab_name)
+      expect(kt.have_content?).to be true
+      kt.close
+    end
+
+    it 'returns false for an empty keytab' do
+      empty_file = File.join(Dir.tmpdir, 'empty_test.keytab')
+      FileUtils.touch(empty_file)
+      kt = described_class.new(name: "FILE:#{empty_file}")
+      expect(kt.have_content?).to be false
+      kt.close
+      FileUtils.rm_f(empty_file)
+    end
+
+    it 'raises when the context is closed' do
+      kt = described_class.new(name: @keytab_name)
+      kt.close
+      expect { kt.have_content? }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#add_entry' do
+    let(:add_kt_file) { File.join(Dir.tmpdir, 'add_test.keytab') }
+    let(:add_kt_name) { "FILE:#{add_kt_file}" }
+
+    after(:each) { FileUtils.rm_f(add_kt_file) }
+
+    it 'adds an entry that is retrievable via get_entry' do
+      kt = described_class.new(name: add_kt_name)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1)
+
+      entry = kt.get_entry("testuser1@#{@realm}")
+      expect(entry).to be_a(Kerberos::Krb5::Keytab::Entry)
+      expect(entry.principal).to eq("testuser1@#{@realm}")
+      expect(entry.vno).to eq(1)
+      # default enctype is aes256-cts-hmac-sha1-96 = 18
+      expect(entry.key).to eq(18)
+      kt.close
+    end
+
+    it 'accepts an explicit enctype' do
+      kt = described_class.new(name: add_kt_name)
+      # aes128-cts-hmac-sha1-96 = 17
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 2, enctype: 17)
+
+      entry = kt.get_entry("testuser1@#{@realm}", 2, 17)
+      expect(entry.vno).to eq(2)
+      expect(entry.key).to eq(17)
+      kt.close
+    end
+
+    it 'can add multiple entries for the same principal' do
+      kt = described_class.new(name: add_kt_name)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 17)
+
+      entries = []
+      kt.each { |e| entries << e }
+      expect(entries.length).to eq(2)
+      kt.close
+    end
+
+    it 'returns self for chaining' do
+      kt = described_class.new(name: add_kt_name)
+      result = kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret')
+      expect(result).to equal(kt)
+      kt.close
+    end
+
+    it 'raises ArgumentError when principal is missing' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry(password: 'secret') }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'raises ArgumentError when password is missing' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry(principal: "testuser1@#{@realm}") }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'raises ArgumentError with no arguments' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'rejects unknown keywords' do
+      kt = described_class.new(name: add_kt_name)
+      expect {
+        kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+      kt.close
+    end
+
+    it 'raises when the keytab is closed' do
+      kt = described_class.new(name: add_kt_name)
+      kt.close
+      expect {
+        kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret')
+      }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#remove_entry' do
+    let(:rm_kt_file) { File.join(Dir.tmpdir, 'remove_test.keytab') }
+    let(:rm_kt_name) { "FILE:#{rm_kt_file}" }
+
+    before(:each) do
+      @rm_kt = described_class.new(name: rm_kt_name)
+      @rm_kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+      @rm_kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 2, enctype: 17)
+      @rm_kt.add_entry(principal: "testuser2@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+    end
+
+    after(:each) do
+      @rm_kt.close rescue nil
+      FileUtils.rm_f(rm_kt_file)
+    end
+
+    it 'removes all entries for a principal when vno and enctype are defaulted' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}")
+      entries = []
+      @rm_kt.each { |e| entries << e }
+      principals = entries.map(&:principal)
+      expect(principals).not_to include("testuser1@#{@realm}")
+      expect(principals).to include("testuser2@#{@realm}")
+    end
+
+    it 'removes only the entry matching a specific vno' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}", vno: 1)
+      entry = @rm_kt.get_entry("testuser1@#{@realm}")
+      expect(entry.vno).to eq(2)
+    end
+
+    it 'removes only the entry matching a specific enctype' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}", enctype: 17)
+      entry = @rm_kt.get_entry("testuser1@#{@realm}")
+      expect(entry.key).to eq(18)
+    end
+
+    it 'returns self for chaining' do
+      result = @rm_kt.remove_entry(principal: "testuser2@#{@realm}")
+      expect(result).to equal(@rm_kt)
+    end
+
+    it 'raises ArgumentError when principal is missing' do
+      expect { @rm_kt.remove_entry(vno: 1) }.to raise_error(ArgumentError)
+    end
+
+    it 'raises ArgumentError with no arguments' do
+      expect { @rm_kt.remove_entry }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects unknown keywords' do
+      expect {
+        @rm_kt.remove_entry(principal: "testuser1@#{@realm}", unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'raises when the keytab is closed' do
+      @rm_kt.close
+      expect {
+        @rm_kt.remove_entry(principal: "testuser1@#{@realm}")
+      }.to raise_error(Kerberos::Krb5::Exception)
+    end
+
+    it 'raises for a non-existent entry' do
+      expect {
+        @rm_kt.remove_entry(principal: "nobody@#{@realm}")
+      }.to raise_error(Kerberos::Krb5::Keytab::Exception)
+    end
+  end
 end