Merge ~ahasenack/ubuntu/+source/freeradius:kinetic-dep8-for-python3 into ubuntu/+source/freeradius:ubuntu/devel

[Andreas Hasenack]

This pulls in the DEP8 test that I created for bug #1873923 for the focal upload. They apply as is, but due to different checks that this version of freeradius in jammy/kinetic does, I had to put one small commit on top of it. I kept it separate to facilitate review, and it can be squashed together in the next upload.

Speaking of review, you can use this range-diff command line if you also have the focal branch for that bug:

git range-diff pkg/ubuntu/focal-devel..focal-freeradius-py3.8-1873923 pkg/ubuntu/devel..kinetic-dep8-for-python3

(atm focal-devel works, because the SRU team didn't accept the package yet)

I ran DEP8 tests locally (that's how I found out about the need of that extra commit on top) on a kinetic VM:

(...)
autopkgtest [17:20:45]: test rlm_python3-test: [-----------------------
Test that "ubuntu" can login with any password
    Reply-Message = "Hello ubuntu!"
Test that any other user won't work
    Reply-Message = "You are not ubuntu!"
autopkgtest [17:20:47]: test rlm_python3-test: -----------------------]
autopkgtest [17:20:47]: test rlm_python3-test: - - - - - - - - - - results - - - - - - - - - -
rlm_python3-test PASS
autopkgtest [17:20:47]: @@@@@@@@@@@@@@@@@@@@ summary
freeradius PASS
daemon PASS
clients PASS
rlm_python3-test PASS

As usual, I'll send this to Debian after the review.

[Sergio Durigan Junior (sergiodj)]

I'm reviewing this one.

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Andreas.

I built the package locally and ran autopkgtest; everything is working as expected. Since I've already reviewed the changes for Focal, this also LGTM. I verified the commit you put on top and it looks OK.

+1

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded
Uploading freeradius_3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu4.dsc
Uploading freeradius_3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu4.debian.tar.xz
Uploading freeradius_3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu4_source.buildinfo
Uploading freeradius_3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu4_source.changes

diff --git a/debian/changelog b/debian/changelog
index 41187e9..9fe2e0a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+freeradius (3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu4) kinetic; urgency=medium
+
+  * Add test for rlm_python3 (LP: #1969381):
+    - d/t/control: new rlm_python3 test
+    - d/t/rlm_python3-test: test the rlm_python3 module
+    - d/t/rlm_python3-data/*: test files
+  * d/t/freeradius: run python tests in verbose mode
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 04 May 2022 15:38:02 -0300
+
 freeradius (3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3) jammy; urgency=medium
 
   * d/p/fix-python-version-parsing.patch: fix parsing of python versions
diff --git a/debian/tests/control b/debian/tests/control
index 8f1aaeb..f8a3e2a 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,3 +1,7 @@
 Tests: freeradius daemon clients
 Depends: freeradius, freeradius-utils, python3, lsb-release
 Restrictions: needs-root
+
+Tests: rlm_python3-test
+Depends: freeradius, freeradius-python3, freeradius-utils
+Restrictions: needs-root
diff --git a/debian/tests/freeradius b/debian/tests/freeradius
index d7c51a8..7445a93 100644
--- a/debian/tests/freeradius
+++ b/debian/tests/freeradius
@@ -3,4 +3,4 @@
 # Testing freeradius
 #-------------------
 set -e
-python3 `dirname $0`/test-freeradius.py 2>&1
+python3 `dirname $0`/test-freeradius.py -v 2>&1
diff --git a/debian/tests/rlm_python3-data/python3.mods-available b/debian/tests/rlm_python3-data/python3.mods-available
new file mode 100644
index 0000000..d10a019
--- /dev/null
+++ b/debian/tests/rlm_python3-data/python3.mods-available
@@ -0,0 +1,66 @@
+#
+# Make sure the PYTHONPATH environmental variable contains the
+# directory(s) for the modules listed below.
+#
+# Uncomment any func_* which are included in your module. If
+# rlm_python is called for a section which does not have
+# a function defined, it will return NOOP.
+#
+python3 {
+	#  Path to the python modules
+	#
+	#  Note that due to limitations on Python, this configuration
+	#  item is GLOBAL TO THE SERVER.  That is, you cannot have two
+	#  instances of the python module, each with a different path.
+	#
+#        python_path="/path/to/python/files:/another_path/to/python_files/"
+
+	python_path="${modconfdir}/${.:name}"
+	module = ubuntu_example
+
+	# Pass all VPS lists as a 6-tuple to the callbacks
+	# (request, reply, config, state, proxy_req, proxy_reply)
+	# pass_all_vps = no
+
+	# Pass all VPS lists as a dictionary to the callbacks
+	# Keys: "request", "reply", "config", "session-state", "proxy-request",
+	#       "proxy-reply"
+	# This option prevales over "pass_all_vps"
+	# pass_all_vps_dict = no
+
+	mod_instantiate = ${.module}
+	func_instantiate = instantiate
+
+	mod_detach = ${.module}
+	func_detach = detach
+
+	mod_authorize = ${.module}
+	func_authorize = authorize
+
+#	mod_authenticate = ${.module}
+#	func_authenticate = authenticate
+
+#	mod_preacct = ${.module}
+#	func_preacct = preacct
+
+#	mod_accounting = ${.module}
+#	func_accounting = accounting
+
+#	mod_checksimul = ${.module}
+#	func_checksimul = checksimul
+
+#	mod_pre_proxy = ${.module}
+#	func_pre_proxy = pre_proxy
+
+#	mod_post_proxy = ${.module}
+#	func_post_proxy = post_proxy
+
+#	mod_post_auth = ${.module}
+#	func_post_auth = post_auth
+
+#	mod_recv_coa = ${.module}
+#	func_recv_coa = recv_coa
+
+#	mod_send_coa = ${.module}
+#	func_send_coa = send_coa
+}
diff --git a/debian/tests/rlm_python3-data/python3.sites-available b/debian/tests/rlm_python3-data/python3.sites-available
new file mode 100644
index 0000000..93333f8
--- /dev/null
+++ b/debian/tests/rlm_python3-data/python3.sites-available
@@ -0,0 +1,85 @@
+server python3_test {
+listen {
+	type = auth
+	ipaddr = *
+	port = 1234
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+authorize {
+	filter_username
+	preprocess
+    python3
+	chap
+	mschap
+	digest
+	suffix
+	eap {
+		ok = return
+	}
+	files
+	-sql
+	-ldap
+	expiration
+	logintime
+	pap
+}
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	digest
+	eap
+}
+preacct {
+	preprocess
+	acct_unique
+	suffix
+	files
+}
+accounting {
+	detail
+	unix
+	-sql
+	exec
+	attr_filter.accounting_response
+}
+session {
+}
+post-auth {
+	if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
+		update reply {
+			&User-Name !* ANY
+		}
+	}
+	update {
+		&reply: += &session-state:
+	}
+	-sql
+	exec
+	remove_reply_message_if_eap
+	Post-Auth-Type REJECT {
+		-sql
+		attr_filter.access_reject
+		eap
+		remove_reply_message_if_eap
+	}
+	Post-Auth-Type Challenge {
+	}
+}
+pre-proxy {
+}
+post-proxy {
+	eap
+}
+}
diff --git a/debian/tests/rlm_python3-data/ubuntu_example.py.mods-config b/debian/tests/rlm_python3-data/ubuntu_example.py.mods-config
new file mode 100644
index 0000000..5b6330f
--- /dev/null
+++ b/debian/tests/rlm_python3-data/ubuntu_example.py.mods-config
@@ -0,0 +1,26 @@
+#! /usr/bin/env python3
+
+import radiusd
+
+def instantiate(p):
+  radiusd.radlog(radiusd.L_INFO, '*** example.py instantiate ***')
+  return radiusd.RLM_MODULE_OK
+
+def authorize(p):
+  radiusd.radlog(radiusd.L_INFO, '*** example.py authorize ***')
+  # whatever password was supplied
+  config = ( ('Cleartext-Password', p[1][1]), )
+  if p[0][1] == "ubuntu":
+      msg = "Hello ubuntu!"
+      status = radiusd.RLM_MODULE_OK
+      reply = ( ('Reply-Message', msg), )
+      return (radiusd.RLM_MODULE_OK, reply, config)
+  else:
+      msg = "You are not ubuntu!"
+      reply = ( ('Reply-Message', msg), )
+      status = radiusd.RLM_MODULE_REJECT
+  return (status, reply, config)
+
+def detach(p):
+  radiusd.radlog(radiusd.L_INFO, "*** example.py detach ***")
+  return radiusd.RLM_MODULE_OK
diff --git a/debian/tests/rlm_python3-test b/debian/tests/rlm_python3-test
new file mode 100644
index 0000000..ddf0982
--- /dev/null
+++ b/debian/tests/rlm_python3-test
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -e
+
+cp debian/tests/rlm_python3-data/python3.mods-available \
+    /etc/freeradius/3.0/mods-available/python3
+cp debian/tests/rlm_python3-data/python3.sites-available \
+    /etc/freeradius/3.0/sites-available/python3-test
+cp debian/tests/rlm_python3-data/ubuntu_example.py.mods-config \
+    /etc/freeradius/3.0/mods-config/python3/ubuntu_example.py
+
+# enable our python3 test site
+ln -sf /etc/freeradius/3.0/sites-available/python3-test \
+    /etc/freeradius/3.0/sites-enabled
+
+# enable the python3 module
+ln -sf /etc/freeradius/3.0/mods-available/python3 \
+    /etc/freeradius/3.0/mods-enabled
+
+# restart
+systemctl restart freeradius.service
+
+echo "Test that \"ubuntu\" can login with any password"
+result=0
+output=$(radtest ubuntu anypass$$ 127.0.0.1:1234 0 testing123) || result=$?
+if [ ${result} -ne 0 ]; then
+    echo "Failed. Output:"
+    echo "${output}"
+    exit 1
+else
+    echo "${output}" | grep "Reply-Message"
+fi
+
+echo "Test that any other user won't work"
+result=0
+output=$(radtest otheruser$$ secret$$ 127.0.0.1:1234 0 testing123 2>&1) || result=$?
+echo "${output}" | grep "Reply-Message"
+if [ ${result} -eq 0 ]; then
+    echo "This shouldn't have worked..."
+    echo "Output:"
+    echo "${output}"
+    exit 1
+fi