From 827099139b23e7fe45813735916af685f7687c4d Mon Sep 17 00:00:00 2001 From: Alberto Planas Date: Mon, 14 Sep 2026 13:33:22 +0200 Subject: [PATCH] test: check the credentials Varlink error table credentials_varlink_error_by_errno() answers with the first row whose errno matches, so two rows sharing one errno make the second unreachable and the client is told the wrong error. This series re-keys UnexpectedPCRState to EPERM and adds PCRsKeptChanging on EUCLEAN, so walk the table by id and check that the errno lookup comes back to the same row, in both errno signs. Co-Authored-By: Claude Opus 5 --- src/test/test-creds.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/src/test/test-creds.c b/src/test/test-creds.c index 661a766502..cb57784c4b 100644 --- a/src/test/test-creds.c +++ b/src/test/test-creds.c @@ -503,4 +503,41 @@ TEST(mime_type_matches) { } } +TEST(credentials_varlink_error) { + /* The errno lookup answers with the first row that matches, so two rows sharing an errno would make + * one of them unreachable, and the error the client is told would silently be the wrong one. */ + + static const char* const ids[] = { + "io.systemd.Credentials.BadFormat", + "io.systemd.Credentials.NameMismatch", + "io.systemd.Credentials.TimeMismatch", + "io.systemd.Credentials.NoSuchUser", + "io.systemd.Credentials.BadScope", + "io.systemd.Credentials.CantFindPCRSignature", + "io.systemd.Credentials.NullKeyNotAllowed", + "io.systemd.Credentials.KeyBelongsToOtherTPM", + "io.systemd.Credentials.TPMInDictionaryLockout", + "io.systemd.Credentials.UnexpectedPCRState", + "io.systemd.Credentials.PCRsKeptChanging", + "io.systemd.Credentials.NVIndexUnusable", + }; + + FOREACH_ELEMENT(id, ids) { + const CredentialsVarlinkError *e = ASSERT_PTR(credentials_varlink_error_by_id(*id)); + + ASSERT_NOT_NULL(e->msg); + ASSERT_STREQ(ASSERT_PTR(credentials_varlink_error_by_errno(e->errnum))->id, *id); + ASSERT_PTR_EQ(credentials_varlink_error_by_errno(-e->errnum), e); + } + + /* The two errnos the PCR diagnosis hangs on */ + ASSERT_STREQ(ASSERT_PTR(credentials_varlink_error_by_errno(EPERM))->id, + "io.systemd.Credentials.UnexpectedPCRState"); + ASSERT_STREQ(ASSERT_PTR(credentials_varlink_error_by_errno(EUCLEAN))->id, + "io.systemd.Credentials.PCRsKeptChanging"); + + ASSERT_NULL(credentials_varlink_error_by_id("io.systemd.Credentials.NoSuchError")); + ASSERT_NULL(credentials_varlink_error_by_errno(EDOM)); +} + DEFINE_TEST_MAIN(LOG_INFO);