nfs/internal/rpc/gss_extra_test.go

// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
// SPDX-License-Identifier: MIT

package rpc

import (
	"testing"
)

// The RPCSEC_GSS_INIT result round trips: handle, statuses, window and
// the reply token.
func TestGSSInitResRoundTrip(t *testing.T) {
	res := AppendGSSInitRes(nil, []byte("handle-2"), 0, 1, 32, []byte("ap-rep"))
	handle, major, minor, window, token, err := DecodeGSSInitRes(res)
	if err != nil || string(handle) != "handle-2" || major != 0 || minor != 1 ||
		window != 32 || string(token) != "ap-rep" {
		t.Fatalf("res %q %d %d %d %q %v", handle, major, minor, window, token, err)
	}
	// The empty refusal answers an empty handle and no token.
	res = AppendGSSInitRes(nil, nil, 16<<16, 1, 0, nil)
	if handle, major, _, _, token, err := DecodeGSSInitRes(res); err != nil ||
		len(handle) != 0 || major != 16<<16 || len(token) != 0 {
		t.Fatalf("refusal %q %d %q %v", handle, major, token, err)
	}
	// The error text of the credential sentinel is stable.
	if ErrGSSCred.Error() == "" {
		t.Fatal("empty error text")
	}
	// A truncated init result is refused word by word.
	for n := 0; n < len(res); n++ {
		if _, _, _, _, _, err := DecodeGSSInitRes(res[:n]); err == nil {
			t.Fatalf("a %d byte prefix decoded cleanly", n)
		}
	}
	// The NULL procedure constant the control exchange rides on.
	if ProcedureNull != 0 {
		t.Fatalf("null procedure %d", ProcedureNull)
	}
}