Check that the auth secret is made safely

The checks replaced get_secret with a constant, so its success path
never ran, and the luaposix stand-in had no link or unlink and a umask
that ignored its argument. Dropping the tightened mask, which leaves
the secret readable by everyone under the usual 022, or accepting a
short secret, passed. The real get_secret now makes the secret in the
run's directory through stand-ins that behave like the calls they
replace, and the checks cover the mask and its restoration, the link
race, the temporary file, reuse and a secret written by hand.

1 file changed, 30 insertions, 3 deletions

diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.luaindex 86f09a6..1a669ff 100644--- a/tests/extensions/harness.lua+++ b/tests/extensions/harness.lua@@ -263,15 +263,42 @@ local function fake_crypt(password, setting) 	return prefix .. password end --- The slices of luaossl and luaposix the auth checks reach.+-- The slices of luaossl and luaposix the auth checks reach. link refuses a+-- target that exists, as link(2) does, since that is how a script tells it+-- lost a race to make a file, and umask hands back the mask it replaces, so+-- a check can see the old one put back. function harness.stub_auth_modules() 	local rand_counter = 0+	local mask = 18 	preload("posix.unistd", { 		crypt = fake_crypt,+		link = function(from, to)+			local existing = io.open(to, "rb")+			if existing then+				existing:close()+				return nil, to .. ": File exists", 17+			end+			local source = assert(io.open(from, "rb"))+			local text = source:read("*a")+			source:close()+			local target = assert(io.open(to, "wb"))+			target:write(text)+			target:close()+			return 0+		end,+		unlink = function(path)+			local removed, err = os.remove(path)+			if not removed then+				return nil, err, 2+			end+			return 0+		end, 	}) 	preload("posix.sys.stat", {-		umask = function()-			return 18+		umask = function(new)+			local old = mask+			mask = new+			return old 		end, 	}) 	preload("openssl.rand", {
diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua
index 86f09a6..1a669ff 100644
--- a/tests/extensions/harness.lua
+++ b/tests/extensions/harness.lua
@@ -263,15 +263,42 @@ local function fake_crypt(password, setting)
 	return prefix .. password
 end
 
--- The slices of luaossl and luaposix the auth checks reach.
+-- The slices of luaossl and luaposix the auth checks reach. link refuses a
+-- target that exists, as link(2) does, since that is how a script tells it
+-- lost a race to make a file, and umask hands back the mask it replaces, so
+-- a check can see the old one put back.
 function harness.stub_auth_modules()
 	local rand_counter = 0
+	local mask = 18
 	preload("posix.unistd", {
 		crypt = fake_crypt,
+		link = function(from, to)
+			local existing = io.open(to, "rb")
+			if existing then
+				existing:close()
+				return nil, to .. ": File exists", 17
+			end
+			local source = assert(io.open(from, "rb"))
+			local text = source:read("*a")
+			source:close()
+			local target = assert(io.open(to, "wb"))
+			target:write(text)
+			target:close()
+			return 0
+		end,
+		unlink = function(path)
+			local removed, err = os.remove(path)
+			if not removed then
+				return nil, err, 2
+			end
+			return 0
+		end,
 	})
 	preload("posix.sys.stat", {
-		umask = function()
-			return 18
+		umask = function(new)
+			local old = mask
+			mask = new
+			return old
 		end,
 	})
 	preload("openssl.rand", {