rkerberos 0.3.0 → 0.3.1

data/spec/krb5_keytab_spec.rb

@@ -36,6 +36,17 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   subject(:keytab) { described_class.new }
 
+  def write_keytab_with_invalid_second_record(destination)
+    data = File.binread(@keytab_file)
+    first_record_size = data.byteslice(2, 4).unpack1('N')
+    second_record_offset = 6 + first_record_size
+
+    # INT32_MIN is reserved as an invalid record size by the FILE keytab
+    # implementation, so iteration must fail after yielding the first entry.
+    data[second_record_offset, 4] = [0x80000000].pack('N')
+    File.binwrite(destination, data)
+  end
+
   describe 'constructor' do
     it 'accepts an optional name keyword' do
       expect { described_class.new(name: "FILE:/usr/local/var/keytab") }.not_to raise_error
@@ -50,7 +61,10 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
     it 'accepts a context keyword argument' do
       ctx = Kerberos::Krb5::Context.new
-      expect { described_class.new(name: @keytab_name, context: ctx) }.not_to raise_error
+      keytab = described_class.new(name: @keytab_name, context: ctx)
+      expect { ctx.close }.to raise_error(Kerberos::Krb5::Exception, /dependent wrapper/)
+      keytab.close
+      expect { ctx.close }.not_to raise_error
     end
 
     it 'works with context and no name' do
@@ -123,6 +137,15 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
       kt = nil
       GC.start
     end
+
+    it 'raises from every operation that requires the closed handle' do
+      kt = described_class.new(name: @keytab_name)
+      kt.close
+
+      expect { kt.default_name }.to raise_error(Kerberos::Krb5::Exception)
+      expect { kt.each { |_| } }.to raise_error(Kerberos::Krb5::Exception)
+      expect { kt.get_entry("testuser1@#{@realm}") }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '.foreach' do
@@ -157,6 +180,19 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
       }.to raise_error(Kerberos::Krb5::Exception)
     end
 
+    it 'raises when an error interrupts iteration' do
+      corrupt_keytab = File.join(Dir.tmpdir, "invalid-foreach-#{Process.pid}.keytab")
+      write_keytab_with_invalid_second_record(corrupt_keytab)
+      entries = []
+
+      expect {
+        described_class.foreach("FILE:#{corrupt_keytab}") { |entry| entries << entry }
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_kt_next_entry/)
+      expect(entries).not_to be_empty
+    ensure
+      FileUtils.rm_f(corrupt_keytab)
+    end
+
     it 'raises an error for an invalid keytab type' do
       expect {
         described_class.foreach("BOGUS:/tmp/keytab") { |_| }
@@ -208,6 +244,21 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
       end
       expect(result).to eq(:escaped)
     end
+
+    it 'raises instead of returning a partial result after an iteration error' do
+      corrupt_keytab = File.join(Dir.tmpdir, "invalid-each-#{Process.pid}.keytab")
+      write_keytab_with_invalid_second_record(corrupt_keytab)
+      entries = []
+      kt = described_class.new(name: "FILE:#{corrupt_keytab}")
+
+      expect {
+        kt.each { |entry| entries << entry }
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_kt_next_entry/)
+      expect(entries).not_to be_empty
+    ensure
+      kt&.close
+      FileUtils.rm_f(corrupt_keytab)
+    end
   end
 
   describe '#get_entry' do

data/spec/krb5_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe Kerberos::Krb5 do
   let(:service) { 'kadmin/admin' }
 
   it 'has the correct version constant' do
-    expect(Kerberos::Krb5::VERSION).to eq('0.3.0')
+    expect(Kerberos::Krb5::VERSION).to eq('0.3.1')
   end
 
   it 'accepts a block and yields itself' do
@@ -73,6 +73,17 @@ RSpec.describe Kerberos::Krb5 do
     it 'default_realm is an alias for get_default_realm' do
       expect(krb5.method(:default_realm)).to eq(krb5.method(:get_default_realm))
     end
+    it 'raises after the object is closed' do
+      krb5.close
+      expect { krb5.get_default_realm }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#set_default_realm' do
+    it 'raises after the object is closed' do
+      krb5.close
+      expect { krb5.set_default_realm(@realm) }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '#verify_init_creds', :kadm5 do
@@ -131,6 +142,14 @@ RSpec.describe Kerberos::Krb5 do
       expect(krb5.verify_init_creds(keytab: kt)).to be true
     end
 
+    it 'rejects a closed Keytab object' do
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      kt = Kerberos::Krb5::Keytab.new
+      kt.close
+      expect { krb5.verify_init_creds(keytab: kt) }
+        .to raise_error(Kerberos::Krb5::Exception, /keytab is closed/)
+    end
+
     it 'stores additional credentials in provided CredentialsCache' do
       ccache = Kerberos::Krb5::CredentialsCache.new
       krb5.get_init_creds_password(principal: user, password: 'changeme')
@@ -139,6 +158,22 @@ RSpec.describe Kerberos::Krb5 do
       expect(ccache.primary_principal).to include('@')
     end
 
+    it 'rejects a closed CredentialsCache' do
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      expect { krb5.verify_init_creds(ccache: ccache) }
+        .to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
+
+    it 'does not acquire credentials into a closed CredentialsCache' do
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      expect {
+        krb5.get_init_creds_password(principal: user, password: 'changeme', ccache: ccache)
+      }.to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
+
     it 'provides authenticate! which acquires and verifies (Zanarotti mitigation)' do
       expect(krb5).to respond_to(:authenticate!)
       expect(krb5.authenticate!(principal: user, password: 'changeme')).to be true
@@ -147,9 +182,19 @@ RSpec.describe Kerberos::Krb5 do
 
     it 'accepts an optional service argument' do
       expect {
-        krb5.authenticate!(principal: user, password: 'changeme', service: 'kadmin/changepw')
+        krb5.authenticate!(principal: user, password: 'changeme', service: 'verify/rkerberos-test')
       }.not_to raise_error
-      expect(krb5.verify_init_creds).to be true
+    end
+
+    it 'fails closed when no verification keytab is available' do
+      original_keytab = ENV['KRB5_KTNAME']
+      ENV['KRB5_KTNAME'] = "FILE:/tmp/missing_verify_keytab_#{Process.pid}"
+
+      expect {
+        described_class.new.authenticate!(principal: user, password: 'changeme')
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_verify_init_creds/)
+    ensure
+      ENV['KRB5_KTNAME'] = original_keytab
     end
 
     it 'validates argument types for authenticate!' do
@@ -272,6 +317,15 @@ RSpec.describe Kerberos::Krb5 do
       expect(ccache.primary_principal).to be_a(String)
       expect(ccache.primary_principal).to include('@')
     end
+
+    it 'rejects a closed CredentialsCache' do
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      kt_name = "FILE:#{@kt_file}"
+      expect {
+        krb5.get_init_creds_keytab(principal: user, keytab: kt_name, ccache: ccache)
+      }.to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
   end
 
   describe '.thread_safe?' do

data/spec/principal_spec.rb

@@ -63,6 +63,32 @@ RSpec.describe Kerberos::Krb5::Principal do
     end
   end
 
+  describe '#close' do
+    it 'releases a borrowed context and prevents further native operations' do
+      context = Kerberos::Krb5::Context.new
+      principal = described_class.new(name: name, context: context)
+
+      expect(principal.close).to equal(principal)
+      expect { principal.realm }.to raise_error(Kerberos::Krb5::Exception)
+      expect { context.close }.not_to raise_error
+    end
+
+    it 'can be called multiple times' do
+      expect { 2.times { princ.close } }.not_to raise_error
+    end
+  end
+
+  describe '#==' do
+    it 'returns true for equivalent principals' do
+      expect(princ).to eq(described_class.new(name: name))
+    end
+
+    it 'returns false for objects of another type' do
+      expect(princ == name).to be false
+      expect(princ == nil).to be false
+    end
+  end
+
   describe '#name' do
     it 'responds to name' do
       expect(princ).to respond_to(:name)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rkerberos
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Daniel Berger