[libvirt] [PATCHv2] test driver: Add authentication to test driver.

[Richard W.M. Jones]

There is no easy way to test authentication against libvirt.  This
commit modifies the test driver to allow simple username/password
authentication.

You modify the test XML by adding:

 <node>
   ...
   <auth>
     <user password="123456">rich</user>
     <user>jane</user>
   </auth>
 </node>

If there are any /node/auth/user elements, then authentication is
required by the test driver (if none are present, then the test driver
will work as before and not require authentication).

In the example above, two phony users are added:

 rich  password: 123456
 jane  no password required

The test driver will demand a username.  If the password attribute is
present (or if the username entered is wrong), then the password is
also asked for and checked:

 $ virsh -c test://$(pwd)/testnode.xml list
 Enter username for localhost: rich
 Enter rich's password for localhost: ***
  Id    Name                           State
 ----------------------------------------------------
  1     fv0                            running
  2     fc4                            running

Signed-off-by: Richard W.M. Jones <rjones at redhat.com>
---
 src/test/test_driver.c | 111 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 110 insertions(+), 1 deletion(-)

diff --git a/src/test/test_driver.c b/src/test/test_driver.c
index cde82a1..b724f82 100644
--- a/src/test/test_driver.c
+++ b/src/test/test_driver.c
@@ -58,6 +58,7 @@
 #include "virrandom.h"
 #include "virstring.h"
 #include "cpu/cpu.h"
+#include "virauth.h"
 
 #define VIR_FROM_THIS VIR_FROM_TEST
 
@@ -82,6 +83,13 @@ typedef struct _testCell *testCellPtr;
 
 #define MAX_CELLS 128
 
+struct _testAuth {
+    char *username;
+    char *password;
+};
+typedef struct _testAuth testAuth;
+typedef struct _testAuth *testAuthPtr;
+
 struct _testConn {
     virMutex lock;
 
@@ -99,6 +107,8 @@ struct _testConn {
     virNodeDeviceObjList devs;
     int numCells;
     testCell cells[MAX_CELLS];
+    size_t numAuths;
+    testAuthPtr auths;
 
     virObjectEventStatePtr eventState;
 };
@@ -1355,6 +1365,45 @@ error:
     return ret;
 }
 
+static int
+testParseAuthUsers(testConnPtr privconn,
+                   xmlXPathContextPtr ctxt)
+{
+    int num, ret = -1;
+    size_t i;
+    xmlNodePtr *nodes = NULL;
+
+    num = virXPathNodeSet("/node/auth/user", ctxt, &nodes);
+    if (num < 0)
+        goto error;
+
+    privconn->numAuths = num;
+    if (num && VIR_ALLOC_N(privconn->auths, num) < 0)
+        goto error;
+
+    for (i = 0; i < num; i++) {
+        char *username, *password;
+
+        ctxt->node = nodes[i];
+        username = virXPathString("string(.)", ctxt);
+        if (!username || STREQ(username, "")) {
+            virReportError(VIR_ERR_XML_ERROR, "%s",
+                           _("missing username in /node/auth/user field"));
+            VIR_FREE(username);
+            goto error;
+        }
+        /* This field is optional. */
+        password = virXMLPropString(nodes[i], "password");
+
+        privconn->auths[i].username = username;
+        privconn->auths[i].password = password;
+    }
+
+    ret = 0;
+error:
+    VIR_FREE(nodes);
+    return ret;
+}
 
 /* No shared state between simultaneous test connections initialized
  * from a file.  */
@@ -1417,6 +1466,8 @@ testOpenFromFile(virConnectPtr conn, const char *file)
         goto error;
     if (testParseNodedevs(privconn, file, ctxt) < 0)
         goto error;
+    if (testParseAuthUsers(privconn, ctxt) < 0)
+        goto error;
 
     xmlXPathFreeContext(ctxt);
     xmlFreeDoc(doc);
@@ -1439,9 +1490,63 @@ testOpenFromFile(virConnectPtr conn, const char *file)
     return VIR_DRV_OPEN_ERROR;
 }
 
+static int
+testConnectAuthenticate(virConnectPtr conn,
+                        virConnectAuthPtr auth)
+{
+    testConnPtr privconn = conn->privateData;
+    int ret = -1;
+    ssize_t i;
+    char *username = NULL, *password = NULL;
+
+    if (privconn->numAuths == 0)
+        return 0;
+
+    /* Authentication is required because the test XML contains a
+     * non-empty <auth/> section.  First we must ask for a username.
+     */
+    username = virAuthGetUsername(conn, auth, "test", NULL, "localhost"/*?*/);
+    if (!username) {
+        virReportError(VIR_ERR_AUTH_FAILED, "%s",
+                       _("authentication failed when asking for username"));
+        goto cleanup;
+    }
+
+    /* Does the username exist? */
+    for (i = 0; i < privconn->numAuths; ++i) {
+        if (STREQ(privconn->auths[i].username, username))
+            goto found_user;
+    }
+    i = -1;
+
+found_user:
+    /* Even if we didn't find the user, we still ask for a password. */
+    if (i == -1 || privconn->auths[i].password != NULL) {
+        password = virAuthGetPassword(conn, auth, "test",
+                                      username, "localhost");
+        if (password == NULL) {
+            virReportError(VIR_ERR_AUTH_FAILED, "%s",
+                           _("authentication failed when asking for password"));
+            goto cleanup;
+        }
+    }
+
+    if (i == -1 ||
+        (password && STRNEQ(privconn->auths[i].password, password))) {
+        virReportError(VIR_ERR_AUTH_FAILED, "%s",
+                       _("authentication failed, see test XML for the correct username/password"));
+        goto cleanup;
+    }
+
+    ret = 0;
+cleanup:
+    VIR_FREE(username);
+    VIR_FREE(password);
+    return ret;
+}
 
 static virDrvOpenStatus testConnectOpen(virConnectPtr conn,
-                                        virConnectAuthPtr auth ATTRIBUTE_UNUSED,
+                                        virConnectAuthPtr auth,
                                         unsigned int flags)
 {
     int ret;
@@ -1479,6 +1584,10 @@ static virDrvOpenStatus testConnectOpen(virConnectPtr conn,
     if (ret != VIR_DRV_OPEN_SUCCESS)
         return ret;
 
+    /* Fake authentication. */
+    if (testConnectAuthenticate(conn, auth) < 0)
+        return VIR_DRV_OPEN_ERROR;
+
     return VIR_DRV_OPEN_SUCCESS;
 }
 
-- 
1.8.4.2