Rebase opt-in fingerprint workaround onto KScreenLocker 6.7.5
This commit is contained in:
ajp_anton
@@ -0,0 +1,32 @@
|
||||
cmake_minimum_required(VERSION 3.25)
|
||||
project(fingerprintRetryTests LANGUAGES CXX)
|
||||
|
||||
# Compile the actual patched upstream classes, but never use the host's PAM
|
||||
# configuration or credentials. The test executable supplies a fake PAM API.
|
||||
set(KSCREENLOCKER_SOURCE "" CACHE PATH "Extracted, patched KScreenLocker source")
|
||||
if(NOT EXISTS "${KSCREENLOCKER_SOURCE}/greeter/pamauthenticator.cpp")
|
||||
message(FATAL_ERROR "Set KSCREENLOCKER_SOURCE to the patched source directory")
|
||||
endif()
|
||||
set(CMAKE_CXX_STANDARD 23)
|
||||
set(CMAKE_CXX_STANDARD_REQUIRED ON)
|
||||
set(CMAKE_AUTOMOC ON)
|
||||
find_package(Qt6 REQUIRED COMPONENTS Core Test)
|
||||
find_package(ECM REQUIRED NO_MODULE)
|
||||
list(APPEND CMAKE_MODULE_PATH "${ECM_MODULE_PATH}")
|
||||
include(ECMQtDeclareLoggingCategory)
|
||||
|
||||
set(sources retrytest.cpp
|
||||
${KSCREENLOCKER_SOURCE}/greeter/pamauthenticator.cpp
|
||||
${KSCREENLOCKER_SOURCE}/greeter/pamauthenticators.cpp)
|
||||
ecm_qt_declare_logging_category(sources
|
||||
HEADER kscreenlocker_greet_logging.h
|
||||
IDENTIFIER KSCREENLOCKER_GREET
|
||||
CATEGORY_NAME kscreenlocker_greet)
|
||||
add_executable(retrytest ${sources})
|
||||
target_include_directories(retrytest PRIVATE
|
||||
${CMAKE_CURRENT_BINARY_DIR} ${KSCREENLOCKER_SOURCE}/greeter)
|
||||
target_compile_definitions(retrytest PRIVATE HAVE_PAM_FAIL_DELAY)
|
||||
target_link_libraries(retrytest PRIVATE Qt6::Core Qt6::Test)
|
||||
enable_testing()
|
||||
add_test(NAME fingerprint-retry COMMAND retrytest)
|
||||
set_tests_properties(fingerprint-retry PROPERTIES TIMEOUT 30)
|
||||
@@ -0,0 +1,160 @@
|
||||
#include "pamauthenticators.h"
|
||||
|
||||
#include <QSignalSpy>
|
||||
#include <QTest>
|
||||
#include <security/pam_appl.h>
|
||||
#include <cstdlib>
|
||||
#include <cstring>
|
||||
|
||||
// Test-only PAM implementation. No real authentication or system files are used.
|
||||
struct pam_handle {
|
||||
QByteArray service;
|
||||
pam_conv conversation;
|
||||
int attempts = 0;
|
||||
};
|
||||
|
||||
int pam_start(const char *service, const char *, const pam_conv *conversation, pam_handle_t **handle)
|
||||
{
|
||||
*handle = new pam_handle{service, *conversation};
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
int pam_end(pam_handle_t *handle, int)
|
||||
{
|
||||
delete handle;
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
int pam_set_item(pam_handle_t *, int, const void *) { return PAM_SUCCESS; }
|
||||
int pam_setcred(pam_handle_t *, int) { return PAM_SUCCESS; }
|
||||
const char *pam_strerror(pam_handle_t *, int) { return "simulated PAM result"; }
|
||||
|
||||
int pam_authenticate(pam_handle_t *handle, int)
|
||||
{
|
||||
++handle->attempts;
|
||||
if (handle->service == "missing") {
|
||||
return PAM_MODULE_UNKNOWN;
|
||||
}
|
||||
if (handle->service == "transient" && handle->attempts == 1) {
|
||||
return PAM_AUTHINFO_UNAVAIL;
|
||||
}
|
||||
if (handle->service == "timeout" && handle->attempts == 1) {
|
||||
return PAM_MAXTRIES;
|
||||
}
|
||||
pam_message message{PAM_PROMPT_ECHO_OFF, "Test credential:"};
|
||||
const pam_message *messages = &message;
|
||||
pam_response *response = nullptr;
|
||||
const auto &conversation = handle->conversation;
|
||||
const int result = conversation.conv(1, &messages, &response, conversation.appdata_ptr);
|
||||
if (result != PAM_SUCCESS) {
|
||||
return result;
|
||||
}
|
||||
const bool accepted = response && response->resp && std::strcmp(response->resp, "correct") == 0;
|
||||
if (response) {
|
||||
std::free(response->resp);
|
||||
std::free(response);
|
||||
}
|
||||
return accepted ? PAM_SUCCESS : PAM_AUTH_ERR;
|
||||
}
|
||||
|
||||
class RetryTest : public QObject
|
||||
{
|
||||
Q_OBJECT
|
||||
private Q_SLOTS:
|
||||
void retryWithActivePassword_data()
|
||||
{
|
||||
QTest::addColumn<QString>("service");
|
||||
QTest::newRow("temporary unavailability") << QStringLiteral("transient");
|
||||
QTest::newRow("attempt timeout") << QStringLiteral("timeout");
|
||||
}
|
||||
|
||||
void retryWithActivePassword()
|
||||
{
|
||||
QFETCH(QString, service);
|
||||
auto password = std::make_unique<PamAuthenticator>(QStringLiteral("password"), QStringLiteral("test"));
|
||||
auto fingerprint = std::make_unique<PamAuthenticator>(service, QStringLiteral("test"), PamAuthenticator::Fingerprint);
|
||||
auto *fingerprintPtr = fingerprint.get();
|
||||
QSignalSpy passwordPrompts(password.get(), &PamAuthenticator::promptForSecret);
|
||||
QSignalSpy fingerprintPrompts(fingerprintPtr, &PamAuthenticator::promptForSecret);
|
||||
QSignalSpy fingerprintFailures(fingerprintPtr, &PamAuthenticator::failed);
|
||||
std::vector<std::unique_ptr<PamAuthenticator>> others;
|
||||
others.push_back(std::move(fingerprint));
|
||||
PamAuthenticators authenticators(std::move(password), std::move(others));
|
||||
QSignalSpy successes(&authenticators, &PamAuthenticators::succeeded);
|
||||
|
||||
authenticators.startAuthenticating();
|
||||
QTRY_COMPARE(passwordPrompts.count(), 1);
|
||||
QTRY_COMPARE_WITH_TIMEOUT(fingerprintFailures.count(), 1, 2000);
|
||||
QTRY_VERIFY(!fingerprintPtr->isAvailable());
|
||||
QCOMPARE(authenticators.state(), PamAuthenticators::Authenticating);
|
||||
QVERIFY(!authenticators.isUnlocked());
|
||||
|
||||
authenticators.startAuthenticating();
|
||||
QTRY_COMPARE_WITH_TIMEOUT(fingerprintPrompts.count(), 1, 2000);
|
||||
QTRY_VERIFY(fingerprintPtr->isAvailable());
|
||||
// Repeated starts must not duplicate either active conversation.
|
||||
authenticators.startAuthenticating();
|
||||
QTest::qWait(100);
|
||||
QCOMPARE(passwordPrompts.count(), 1);
|
||||
QCOMPARE(fingerprintPrompts.count(), 1);
|
||||
QCOMPARE(successes.count(), 0);
|
||||
|
||||
// The original password conversation still accepts a response.
|
||||
authenticators.respond("correct");
|
||||
QTRY_COMPARE(successes.count(), 1);
|
||||
QVERIFY(authenticators.isUnlocked());
|
||||
}
|
||||
|
||||
void permanentUnavailability_data()
|
||||
{
|
||||
QTest::addColumn<QString>("service");
|
||||
QTest::addColumn<int>("type");
|
||||
QTest::newRow("absent smartcard") << QStringLiteral("transient") << int(PamAuthenticator::Smartcard);
|
||||
QTest::newRow("missing fingerprint module") << QStringLiteral("missing") << int(PamAuthenticator::Fingerprint);
|
||||
}
|
||||
|
||||
void permanentUnavailability()
|
||||
{
|
||||
QFETCH(QString, service);
|
||||
QFETCH(int, type);
|
||||
PamAuthenticator auth(service, QStringLiteral("test"), PamAuthenticator::NoninteractiveAuthenticatorType(type));
|
||||
QSignalSpy availability(&auth, &PamAuthenticator::availableChanged);
|
||||
QSignalSpy prompts(&auth, &PamAuthenticator::promptForSecret);
|
||||
auth.tryUnlock();
|
||||
QTRY_VERIFY(availability.count() >= 3);
|
||||
QVERIFY(!auth.isAvailable());
|
||||
availability.clear();
|
||||
auth.tryUnlock();
|
||||
QTest::qWait(100);
|
||||
QCOMPARE(availability.count(), 0);
|
||||
QCOMPARE(prompts.count(), 0);
|
||||
QVERIFY(!auth.isUnlocked());
|
||||
}
|
||||
|
||||
void graceAndIncorrectPassword()
|
||||
{
|
||||
auto password = std::make_unique<PamAuthenticator>(QStringLiteral("password"), QStringLiteral("test"));
|
||||
PamAuthenticators authenticators(std::move(password), {});
|
||||
QSignalSpy prompts(&authenticators, &PamAuthenticators::promptForSecretChanged);
|
||||
QSignalSpy failures(&authenticators, &PamAuthenticators::failed);
|
||||
QSignalSpy successes(&authenticators, &PamAuthenticators::succeeded);
|
||||
authenticators.setGraceLocked(true);
|
||||
authenticators.startAuthenticating();
|
||||
QTest::qWait(100);
|
||||
QCOMPARE(prompts.count(), 0);
|
||||
authenticators.setGraceLocked(false);
|
||||
authenticators.startAuthenticating();
|
||||
QTRY_COMPARE(prompts.count(), 1);
|
||||
authenticators.respond("incorrect");
|
||||
QTRY_COMPARE(failures.count(), 1);
|
||||
QCOMPARE(successes.count(), 0);
|
||||
QVERIFY(!authenticators.isUnlocked());
|
||||
authenticators.startAuthenticating();
|
||||
QTRY_COMPARE(prompts.count(), 2);
|
||||
authenticators.respond("correct");
|
||||
QTRY_COMPARE(successes.count(), 1);
|
||||
}
|
||||
};
|
||||
|
||||
QTEST_GUILESS_MAIN(RetryTest)
|
||||
#include "retrytest.moc"
|
||||
Reference in New Issue
Block a user