dynsec: Tests for group commands with invalid params, plus fixes.

plugins/dynamic-security/auth.c

@@ -40,8 +40,14 @@ int dynsec_auth__base64_encode(unsigned char *in, int in_len, char **encoded)
 	if(in_len < 0) return 1;
 
 	b64 = BIO_new(BIO_f_base64());
+	if(b64 == NULL) return 1;
+
 	BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
 	bmem = BIO_new(BIO_s_mem());
+	if(bmem == NULL){
+		BIO_free_all(b64);
+		return 1;
+	}
 	b64 = BIO_push(b64, bmem);
 	BIO_write(b64, in, in_len);
 	if(BIO_flush(b64) != 1){

plugins/dynamic-security/clients.c

@@ -427,7 +427,11 @@ int dynsec_clients__process_create(cJSON *j_responses, struct mosquitto *context
 		client__free_item(client);
 		return MOSQ_ERR_INVAL;
 	}else{
-		dynsec__command_reply(j_responses, context, "createClient", "Internal error", correlation_data);
+		if(rc == MOSQ_ERR_INVAL){
+			dynsec__command_reply(j_responses, context, "createClient", "'roles' not an array or missing/invalid rolename", correlation_data);
+		}else{
+			dynsec__command_reply(j_responses, context, "createClient", "Internal error", correlation_data);
+		}
 		client__free_item(client);
 		return MOSQ_ERR_INVAL;
 	}
@@ -703,7 +707,7 @@ int dynsec_clients__process_modify(cJSON *j_responses, struct mosquitto *context
 
 	client = dynsec_clients__find(username);
 	if(client == NULL){
-		dynsec__command_reply(j_responses, context, "modifyClient", "Client does not exist", correlation_data);
+		dynsec__command_reply(j_responses, context, "modifyClient", "Client not found", correlation_data);
 		return MOSQ_ERR_INVAL;
 	}
 
@@ -762,9 +766,14 @@ int dynsec_clients__process_modify(cJSON *j_responses, struct mosquitto *context
 		dynsec_rolelist__cleanup(&rolelist);
 	}else if(rc == ERR_LIST_NOT_FOUND){
 		/* There was no list in the JSON, so no modification */
+	}else if(rc == MOSQ_ERR_NOT_FOUND){
+		dynsec__command_reply(j_responses, context, "modifyClient", "Role not found", correlation_data);
+		dynsec_rolelist__cleanup(&rolelist);
+		mosquitto_kick_client_by_username(username, false);
+		return MOSQ_ERR_INVAL;
 	}else{
 		if(rc == MOSQ_ERR_INVAL){
-			dynsec__command_reply(j_responses, context, "modifyClient", "'roles' not an array", correlation_data);
+			dynsec__command_reply(j_responses, context, "modifyClient", "'roles' not an array or missing/invalid rolename", correlation_data);
 		}else{
 			dynsec__command_reply(j_responses, context, "modifyClient", "Internal error", correlation_data);
 		}

plugins/dynamic-security/groups.c

@@ -78,19 +78,6 @@ static int group_cmp(void *a, void *b)
 }
 
 
-static void group__free_item(struct dynsec__group *group)
-{
-	if(group == NULL) return;
-
-	HASH_DEL(local_groups, group);
-	dynsec__remove_all_clients_from_group(group);
-	mosquitto_free(group->text_name);
-	mosquitto_free(group->text_description);
-	mosquitto_free(group->groupname);
-	dynsec_rolelist__cleanup(&group->rolelist);
-	mosquitto_free(group);
-}
-
 struct dynsec__group *dynsec_groups__find(const char *groupname)
 {
 	struct dynsec__group *group = NULL;
@@ -101,6 +88,24 @@ struct dynsec__group *dynsec_groups__find(const char *groupname)
 	return group;
 }
 
+static void group__free_item(struct dynsec__group *group)
+{
+	struct dynsec__group *found_group = NULL;
+
+	if(group == NULL) return;
+
+	found_group = dynsec_groups__find(group->groupname);
+	if(found_group){
+		HASH_DEL(local_groups, found_group);
+	}
+	dynsec__remove_all_clients_from_group(group);
+	mosquitto_free(group->text_name);
+	mosquitto_free(group->text_description);
+	mosquitto_free(group->groupname);
+	dynsec_rolelist__cleanup(&group->rolelist);
+	mosquitto_free(group);
+}
+
 int dynsec_groups__process_add_role(cJSON *j_responses, struct mosquitto *context, cJSON *command, char *correlation_data)
 {
 	char *groupname, *rolename;
@@ -117,8 +122,8 @@ int dynsec_groups__process_add_role(cJSON *j_responses, struct mosquitto *contex
 		return MOSQ_ERR_INVAL;
 	}
 
-	if(json_get_string(command, "roleName", &rolename, false) != MOSQ_ERR_SUCCESS){
-		dynsec__command_reply(j_responses, context, "addGroupRole", "Invalid/missing roleName", correlation_data);
+	if(json_get_string(command, "rolename", &rolename, false) != MOSQ_ERR_SUCCESS){
+		dynsec__command_reply(j_responses, context, "addGroupRole", "Invalid/missing rolename", correlation_data);
 		return MOSQ_ERR_INVAL;
 	}
 	if(mosquitto_validate_utf8(rolename, (int)strlen(rolename)) != MOSQ_ERR_SUCCESS){
@@ -239,7 +244,7 @@ int dynsec_groups__config_load(cJSON *tree)
 			if(j_roles && cJSON_IsArray(j_roles)){
 				cJSON_ArrayForEach(j_role, j_roles){
 					if(cJSON_IsObject(j_role)){
-						j_rolename = cJSON_GetObjectItem(j_role, "roleName");
+						j_rolename = cJSON_GetObjectItem(j_role, "rolename");
 						if(j_rolename && cJSON_IsString(j_rolename)){
 							json_get_int(j_role, "priority", &priority, true, -1);
 							role = dynsec_roles__find(j_rolename->valuestring);
@@ -796,8 +801,8 @@ int dynsec_groups__process_remove_role(cJSON *j_responses, struct mosquitto *con
 		return MOSQ_ERR_INVAL;
 	}
 
-	if(json_get_string(command, "roleName", &rolename, false) != MOSQ_ERR_SUCCESS){
-		dynsec__command_reply(j_responses, context, "removeGroupRole", "Invalid/missing roleName", correlation_data);
+	if(json_get_string(command, "rolename", &rolename, false) != MOSQ_ERR_SUCCESS){
+		dynsec__command_reply(j_responses, context, "removeGroupRole", "Invalid/missing rolename", correlation_data);
 		return MOSQ_ERR_INVAL;
 	}
 	if(mosquitto_validate_utf8(rolename, (int)strlen(rolename)) != MOSQ_ERR_SUCCESS){
@@ -850,7 +855,7 @@ int dynsec_groups__process_modify(cJSON *j_responses, struct mosquitto *context,
 
 	group = dynsec_groups__find(groupname);
 	if(group == NULL){
-		dynsec__command_reply(j_responses, context, "modifyGroup", "Group does not exist", correlation_data);
+		dynsec__command_reply(j_responses, context, "modifyGroup", "Group not found", correlation_data);
 		return MOSQ_ERR_INVAL;
 	}
 
@@ -878,15 +883,21 @@ int dynsec_groups__process_modify(cJSON *j_responses, struct mosquitto *context,
 	if(rc == MOSQ_ERR_SUCCESS){
 		dynsec_rolelist__cleanup(&group->rolelist);
 		group->rolelist = rolelist;
+	}else if(rc == ERR_LIST_NOT_FOUND){
+		/* There was no list in the JSON, so no modification */
 	}else if(rc == MOSQ_ERR_NOT_FOUND){
 		dynsec__command_reply(j_responses, context, "modifyGroup", "Role not found", correlation_data);
 		dynsec_rolelist__cleanup(&rolelist);
+		group__kick_all(group);
 		return MOSQ_ERR_INVAL;
-	}else if(rc == ERR_LIST_NOT_FOUND){
-		/* There was no list in the JSON, so no modification */
 	}else{
-		dynsec__command_reply(j_responses, context, "modifyGroup", "Internal error", correlation_data);
+		if(rc == MOSQ_ERR_INVAL){
+			dynsec__command_reply(j_responses, context, "modifyGroup", "'roles' not an array or missing/invalid rolename", correlation_data);
+		}else{
+			dynsec__command_reply(j_responses, context, "modifyGroup", "Internal error", correlation_data);
+		}
 		dynsec_rolelist__cleanup(&rolelist);
+		group__kick_all(group);
 		return MOSQ_ERR_INVAL;
 	}
 

plugins/dynamic-security/rolelist.c

@@ -180,6 +180,8 @@ int dynsec_rolelist__load_from_json(cJSON *command, struct dynsec__rolelist **ro
 						dynsec_rolelist__cleanup(rolelist);
 						return MOSQ_ERR_NOT_FOUND;
 					}
+				}else{
+					return MOSQ_ERR_INVAL;
 				}
 			}
 			return MOSQ_ERR_SUCCESS;

test/broker/14-dynsec-client-invalid.py

@@ -320,27 +320,23 @@ modify_client2_response = {'responses': [{'command': 'modifyClient', 'error': 'I
 
 # roles not a list
 modify_client4_command = { 'commands': [{'command': 'modifyClient', 'username':'user', 'password':'test', 'roles':'string'}]}
-modify_client4_response = {'responses': [{'command': 'modifyClient', 'error': "'roles' not an array"}]}
+modify_client4_response = {'responses': [{'command': 'modifyClient', 'error': "'roles' not an array or missing/invalid rolename"}]}
 
 # No rolename
 modify_client5_command = { 'commands': [{'command': 'modifyClient', 'username':'user', 'roles':[{'rolename':5}]}]}
-modify_client5_response = {'responses': [{'command': 'modifyClient', 'error': 'Invalid/missing rolename'}]}
-
-# rolename not a string
-modify_client6_command = { 'commands': [{'command': 'modifyClient', 'username':'user', 'rolename':5}]}
-modify_client6_response = {'responses': [{'command': 'modifyClient', 'error': 'Invalid/missing rolename'}]}
+modify_client5_response = {'responses': [{'command': 'modifyClient', 'error': "'roles' not an array or missing/invalid rolename"}]}
 
 # rolename not UTF-8
-#modify_client7_command = { 'commands': [{'command': 'modifyClient', 'username':'user'}]}
-#modify_client7_response = {'responses': [{'command': 'modifyClient', 'error': 'Invalid/missing rolename'}]}
+#modify_client6_command = { 'commands': [{'command': 'modifyClient', 'username':'user'}]}
+#modify_client6_response = {'responses': [{'command': 'modifyClient', 'error': 'Invalid/missing rolename'}]}
 
 # Client not found
-modify_client8_command = { 'commands': [{'command': 'modifyClient', 'username':'notfound', 'rolename':'notfound'}]}
-modify_client8_response = {'responses': [{'command': 'modifyClient', 'error': 'Client not found'}]}
+modify_client7_command = { 'commands': [{'command': 'modifyClient', 'username':'notfound', 'rolename':'notfound'}]}
+modify_client7_response = {'responses': [{'command': 'modifyClient', 'error': 'Client not found'}]}
 
 # Role not found
-modify_client9_command = { 'commands': [{'command': 'modifyClient', 'username':'admin', 'rolename':'notfound'}]}
-modify_client9_response = {'responses': [{'command': 'modifyClient', 'error': 'Role not found'}]}
+modify_client8_command = { 'commands': [{'command': 'modifyClient', 'username':'user', 'roles':[{'rolename':'notfound'}]}]}
+modify_client8_response = {'responses': [{'command': 'modifyClient', 'error': 'Role not found'}]}
 
 
 rc = 1
@@ -434,10 +430,10 @@ try:
     command_check(sock, modify_client2_command, modify_client2_response, "2")
     #command_check(sock, modify_client3_command, modify_client3_response, "3")
     command_check(sock, modify_client4_command, modify_client4_response, "4")
-    #command_check(sock, modify_client5_command, modify_client5_response, "5")
+    command_check(sock, modify_client5_command, modify_client5_response, "5")
     #command_check(sock, modify_client6_command, modify_client6_response, "6")
-    #command_check(sock, modify_client7_command, modify_client7_response, "7")
-    #command_check(sock, modify_client8_command, modify_client8_response, "8")
+    command_check(sock, modify_client7_command, modify_client7_response, "7")
+    command_check(sock, modify_client8_command, modify_client8_response, "8")
 
 
     rc = 0

test/broker/14-dynsec-group-invalid.py

@@ -0,0 +1,434 @@
+#!/usr/bin/env python3
+
+# Check invalid inputs for group commands
+
+from mosq_test_helper import *
+import json
+import shutil
+
+def write_config(filename, port):
+    with open(filename, 'w') as f:
+        f.write("listener %d\n" % (port))
+        f.write("allow_anonymous true\n")
+        f.write("plugin ../../plugins/dynamic-security/mosquitto_dynamic_security.so\n")
+        f.write("plugin_opt_config_file %d/dynamic-security.json\n" % (port))
+
+def command_check(sock, command_payload, expected_response, msg=""):
+    command_packet = mosq_test.gen_publish(topic="$CONTROL/dynamic-security/v1", qos=0, payload=json.dumps(command_payload))
+    sock.send(command_packet)
+    response = json.loads(mosq_test.read_publish(sock))
+    if response != expected_response:
+        print(expected_response)
+        print(response)
+        if msg != "":
+            print(msg)
+        raise ValueError(response)
+
+
+
+port = mosq_test.get_port()
+conf_file = os.path.basename(__file__).replace('.py', '.conf')
+write_config(conf_file, port)
+
+# Create client for modifying
+create_client0_command = { 'commands': [{'command': 'createClient', 'username':'validclient' }] }
+create_client0_response = {'responses': [{'command': 'createClient'}]}
+
+# Create group for modifying
+create_group0_command = { 'commands': [{'command': 'createGroup', 'groupname':'validgroup' }] }
+create_group0_response = {'responses': [{'command': 'createGroup'}]}
+
+# Create role for modifying
+create_role0_command = { 'commands': [{'command': 'createRole', 'rolename':'validrole' }] }
+create_role0_response = {'responses': [{'command': 'createRole'}]}
+
+# ==========================================================================
+# Create group
+# ==========================================================================
+
+# No groupname
+create_group1_command = { 'commands': [{'command': 'createGroup' }] }
+create_group1_response = {'responses': [{'command': 'createGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+create_group2_command = { 'commands': [{'command': 'createGroup', 'groupname':5 }] }
+create_group2_response = {'responses': [{'command': 'createGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#create_group3_command = { 'commands': [{'command': 'createGroup', 'groupname':5 }] }
+#create_group3_response = {'responses': [{'command': 'createGroup', 'error': 'Invalid/missing groupname'}]}
+
+# textname not a string
+create_group4_command = { 'commands': [{'command': 'createGroup', 'groupname':'g', 'textname':5 }] }
+create_group4_response = {'responses': [{'command': 'createGroup', 'error': 'Invalid/missing textname'}]}
+
+# textdescription not a string
+create_group5_command = { 'commands': [{'command': 'createGroup', 'groupname':'g', 'textdescription':5 }] }
+create_group5_response = {'responses': [{'command': 'createGroup', 'error': 'Invalid/missing textdescription'}]}
+
+# Group already exists
+create_group6_command = { 'commands': [{'command': 'createGroup', 'groupname': 'validgroup'}]}
+create_group6_response = {'responses': [{'command': 'createGroup', 'error': 'Group already exists'}]}
+
+# Role not found
+create_group7_command = { 'commands': [{'command': 'createGroup', 'groupname': 'group', 'roles':[{'rolename':'notfound'}]}] }
+create_group7_response = {'responses': [{'command': 'createGroup', 'error': 'Role not found'}]}
+
+# ==========================================================================
+# Delete group
+# ==========================================================================
+
+# No groupname
+delete_group1_command = { 'commands': [{'command': 'deleteGroup' }] }
+delete_group1_response = {'responses': [{'command': 'deleteGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+delete_group2_command = { 'commands': [{'command': 'deleteGroup', 'groupname':5 }] }
+delete_group2_response = {'responses': [{'command': 'deleteGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#delete_group3_command = { 'commands': [{'command': 'deleteGroup', 'groupname':5 }] }
+#delete_group3_response = {'responses': [{'command': 'deleteGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Group not found
+delete_group4_command = { 'commands': [{'command': 'deleteGroup', 'groupname': 'group'}]}
+delete_group4_response = {'responses': [{'command': 'deleteGroup', 'error': 'Group not found'}]}
+
+# ==========================================================================
+# Add role
+# ==========================================================================
+
+# No groupname
+add_role1_command = { 'commands': [{'command': 'addGroupRole' }] }
+add_role1_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+add_role2_command = { 'commands': [{'command': 'addGroupRole', 'groupname':5 }] }
+add_role2_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#add_role3_command = { 'commands': [{'command': 'addGroupRole', 'groupname':5 }] }
+#add_role3_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# No rolename
+add_role4_command = { 'commands': [{'command': 'addGroupRole', 'groupname':'g' }] }
+add_role4_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Rolename not a string
+add_role5_command = { 'commands': [{'command': 'addGroupRole', 'groupname':'g', 'rolename':5 }] }
+add_role5_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Rolename not UTF-8
+#add_role6_command = { 'commands': [{'command': 'addGroupRole', 'groupname':'g', 'rolename':5 }] }
+#add_role6_response = {'responses': [{'command': 'addGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Group not found
+add_role7_command = { 'commands': [{'command': 'addGroupRole', 'groupname':'notfound', 'rolename':'notfound' }] }
+add_role7_response = {'responses': [{'command': 'addGroupRole', 'error': 'Group not found'}]}
+
+# Role not found
+add_role8_command = { 'commands': [{'command': 'addGroupRole', 'groupname':'validgroup', 'rolename':'notfound' }] }
+add_role8_response = {'responses': [{'command': 'addGroupRole', 'error': 'Role not found'}]}
+
+
+# ==========================================================================
+# Remove role
+# ==========================================================================
+
+# No groupname
+remove_role1_command = { 'commands': [{'command': 'removeGroupRole' }] }
+remove_role1_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+remove_role2_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':5 }] }
+remove_role2_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#remove_role3_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':5 }] }
+#remove_role3_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing groupname'}]}
+
+# No rolename
+remove_role4_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':'g' }] }
+remove_role4_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Rolename not a string
+remove_role5_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':'g', 'rolename':5 }] }
+remove_role5_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Rolename not UTF-8
+#remove_role6_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':'g', 'rolename':5 }] }
+#remove_role6_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Invalid/missing rolename'}]}
+
+# Group not found
+remove_role7_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':'notfound', 'rolename':'notfound' }] }
+remove_role7_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Group not found'}]}
+
+# Role not found
+remove_role8_command = { 'commands': [{'command': 'removeGroupRole', 'groupname':'validgroup', 'rolename':'notfound' }] }
+remove_role8_response = {'responses': [{'command': 'removeGroupRole', 'error': 'Role not found'}]}
+
+
+# ==========================================================================
+# Add client
+# ==========================================================================
+
+# No groupname
+add_client1_command = { 'commands': [{'command': 'addGroupClient', 'username':'g' }] }
+add_client1_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+add_client2_command = { 'commands': [{'command': 'addGroupClient', 'groupname':5, 'username':'g' }] }
+add_client2_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#add_client3_command = { 'commands': [{'command': 'addGroupClient', 'groupname':5, 'username':'g' }] }
+#add_client3_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# No username
+add_client4_command = { 'commands': [{'command': 'addGroupClient', 'groupname':'g' }] }
+add_client4_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Username not a string
+add_client5_command = { 'commands': [{'command': 'addGroupClient', 'groupname':'g', 'username':5 }] }
+add_client5_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Username not UTF-8
+#add_client6_command = { 'commands': [{'command': 'addGroupClient', 'groupname':'g', 'username':5 }] }
+#add_client6_response = {'responses': [{'command': 'addGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Group not found
+add_client7_command = { 'commands': [{'command': 'addGroupClient', 'groupname':'notfound', 'username':'validclient' }] }
+add_client7_response = {'responses': [{'command': 'addGroupClient', 'error': 'Group not found'}]}
+
+# Client not found
+add_client8_command = { 'commands': [{'command': 'addGroupClient', 'groupname':'validgroup', 'username':'notfound' }] }
+add_client8_response = {'responses': [{'command': 'addGroupClient', 'error': 'Client not found'}]}
+
+
+# ==========================================================================
+# Remove client
+# ==========================================================================
+
+# No groupname
+remove_client1_command = { 'commands': [{'command': 'removeGroupClient', 'username':'g' }] }
+remove_client1_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+remove_client2_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':5, 'username':'g' }] }
+remove_client2_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#remove_client3_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':5, 'username':'g' }] }
+#remove_client3_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing groupname'}]}
+
+# No username
+remove_client4_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':'g' }] }
+remove_client4_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Username not a string
+remove_client5_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':'g', 'username':5 }] }
+remove_client5_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Username not UTF-8
+#remove_client6_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':'g', 'username':5 }] }
+#remove_client6_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Invalid/missing username'}]}
+
+# Group not found
+remove_client7_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':'notfound', 'username':'validclient' }] }
+remove_client7_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Group not found'}]}
+
+# Client not found
+remove_client8_command = { 'commands': [{'command': 'removeGroupClient', 'groupname':'validgroup', 'username':'notfound' }] }
+remove_client8_response = {'responses': [{'command': 'removeGroupClient', 'error': 'Client not found'}]}
+
+
+# ==========================================================================
+# Get group
+# ==========================================================================
+
+# No groupname
+get_group1_command = { 'commands': [{'command': 'getGroup'}] }
+get_group1_response = {'responses': [{'command': 'getGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+get_group2_command = { 'commands': [{'command': 'getGroup', 'groupname':5}] }
+get_group2_response = {'responses': [{'command': 'getGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#get_group3_command = { 'commands': [{'command': 'getGroup', 'groupname':5}] }
+#get_group3_response = {'responses': [{'command': 'getGroup', 'error': 'Invalid/missing groupname'}]}
+
+# ==========================================================================
+# Set anon group
+# ==========================================================================
+
+# No groupname
+set_anon_group1_command = { 'commands': [{'command': 'setAnonymousGroup'}] }
+set_anon_group1_response = {'responses': [{'command': 'setAnonymousGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not a string
+set_anon_group2_command = { 'commands': [{'command': 'setAnonymousGroup', 'groupname':5}] }
+set_anon_group2_response = {'responses': [{'command': 'setAnonymousGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Groupname not UTF-8
+#set_anon_group3_command = { 'commands': [{'command': 'setAnonymousGroup', 'groupname':5}] }
+#set_anon_group3_response = {'responses': [{'command': 'setAnonymousGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Group not found
+set_anon_group4_command = { 'commands': [{'command': 'setAnonymousGroup', 'groupname':'notfound' }] }
+set_anon_group4_response = {'responses': [{'command': 'setAnonymousGroup', 'error': 'Group not found'}]}
+
+# ==========================================================================
+# Modify group
+# ==========================================================================
+
+# No groupname
+modify_group1_command = { 'commands': [{'command': 'modifyGroup'}]}
+modify_group1_response = {'responses': [{'command': 'modifyGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Username not a string
+modify_group2_command = { 'commands': [{'command': 'modifyGroup', 'groupname':5}]}
+modify_group2_response = {'responses': [{'command': 'modifyGroup', 'error': 'Invalid/missing groupname'}]}
+
+# Username not UTF-8
+#modify_group3_command = { 'commands': [{'command': 'modifyGroup', 'groupname':5}]}
+#modify_group3_response = {'responses': [{'command': 'modifyGroup', 'error': 'Invalid/missing groupname'}]}
+
+# roles not a list
+modify_group4_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'validgroup', 'password':'test', 'roles':'string'}]}
+modify_group4_response = {'responses': [{'command': 'modifyGroup', 'error': "'roles' not an array or missing/invalid rolename"}]}
+
+# No rolename
+modify_group5_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'validgroup', 'roles':[{}]}]}
+modify_group5_response = {'responses': [{'command': 'modifyGroup', 'error': "'roles' not an array or missing/invalid rolename"}]}
+
+# rolename not a string
+modify_group6_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'validgroup', 'roles':[{'rolename':5}]}]}
+modify_group6_response = {'responses': [{'command': 'modifyGroup', 'error': "'roles' not an array or missing/invalid rolename"}]}
+
+# rolename not UTF-8
+#modify_group7_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'validgroup'}]}
+#modify_group7_response = {'responses': [{'command': 'modifyGroup', 'error': 'Invalid/missing rolename'}]}
+
+# Group not found
+modify_group8_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'notfound', 'rolename':'notfound'}]}
+modify_group8_response = {'responses': [{'command': 'modifyGroup', 'error': 'Group not found'}]}
+
+# Role not found
+modify_group9_command = { 'commands': [{'command': 'modifyGroup', 'groupname':'validgroup', 'roles':[{'rolename':'notfound'}]}]}
+modify_group9_response = {'responses': [{'command': 'modifyGroup', 'error': 'Role not found'}]}
+
+
+rc = 1
+keepalive = 10
+connect_packet = mosq_test.gen_connect("ctrl-test", keepalive=keepalive, username="admin", password="admin")
+connack_packet = mosq_test.gen_connack(rc=0)
+
+mid = 2
+subscribe_packet = mosq_test.gen_subscribe(mid, "$CONTROL/dynamic-security/#", 1)
+suback_packet = mosq_test.gen_suback(mid, 1)
+
+try:
+    os.mkdir(str(port))
+    shutil.copyfile("dynamic-security-init.json", "%d/dynamic-security.json" % (port))
+except FileExistsError:
+    pass
+
+broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port)
+
+try:
+    sock = mosq_test.do_client_connect(connect_packet, connack_packet, timeout=5, port=port)
+    mosq_test.do_send_receive(sock, subscribe_packet, suback_packet, "suback")
+
+    command_check(sock, create_client0_command, create_client0_response, "0")
+    command_check(sock, create_group0_command, create_group0_response, "0")
+    command_check(sock, create_role0_command, create_role0_response, "0")
+
+    command_check(sock, create_group1_command, create_group1_response, "1")
+    command_check(sock, create_group2_command, create_group2_response, "2")
+    #command_check(sock, create_group3_command, create_group3_response, "3")
+    command_check(sock, create_group4_command, create_group4_response, "4")
+    command_check(sock, create_group5_command, create_group5_response, "5")
+    command_check(sock, create_group6_command, create_group6_response, "6")
+    command_check(sock, create_group7_command, create_group7_response, "7")
+
+    command_check(sock, delete_group1_command, delete_group1_response, "1")
+    command_check(sock, delete_group2_command, delete_group2_response, "2")
+    #command_check(sock, delete_group3_command, delete_group3_response, "3")
+    command_check(sock, delete_group4_command, delete_group4_response, "4")
+
+    command_check(sock, add_role1_command, add_role1_response, "1")
+    command_check(sock, add_role2_command, add_role2_response, "2")
+    #command_check(sock, add_role3_command, add_role3_response, "3")
+    command_check(sock, add_role4_command, add_role4_response, "4")
+    command_check(sock, add_role5_command, add_role5_response, "5")
+    #command_check(sock, add_role6_command, add_role6_response, "6")
+    command_check(sock, add_role7_command, add_role7_response, "7")
+    command_check(sock, add_role8_command, add_role8_response, "8")
+
+    command_check(sock, remove_role1_command, remove_role1_response, "1")
+    command_check(sock, remove_role2_command, remove_role2_response, "2")
+    #command_check(sock, remove_role3_command, remove_role3_response, "3")
+    command_check(sock, remove_role4_command, remove_role4_response, "4")
+    command_check(sock, remove_role5_command, remove_role5_response, "5")
+    #command_check(sock, remove_role6_command, remove_role6_response, "6")
+    command_check(sock, remove_role7_command, remove_role7_response, "7")
+    command_check(sock, remove_role8_command, remove_role8_response, "8")
+
+    command_check(sock, add_client1_command, add_client1_response, "1")
+    command_check(sock, add_client2_command, add_client2_response, "2")
+    #command_check(sock, add_client3_command, add_client3_response, "3")
+    command_check(sock, add_client4_command, add_client4_response, "4")
+    command_check(sock, add_client5_command, add_client5_response, "5")
+    #command_check(sock, add_client6_command, add_client6_response, "6")
+    command_check(sock, add_client7_command, add_client7_response, "7")
+    command_check(sock, add_client8_command, add_client8_response, "8")
+
+    command_check(sock, remove_client1_command, remove_client1_response, "1")
+    command_check(sock, remove_client2_command, remove_client2_response, "2")
+    #command_check(sock, remove_client3_command, remove_client3_response, "3")
+    command_check(sock, remove_client4_command, remove_client4_response, "4")
+    command_check(sock, remove_client5_command, remove_client5_response, "5")
+    #command_check(sock, remove_client6_command, remove_client6_response, "6")
+    command_check(sock, remove_client7_command, remove_client7_response, "7")
+    command_check(sock, remove_client8_command, remove_client8_response, "8")
+
+    command_check(sock, get_group1_command, get_group1_response, "1")
+    command_check(sock, get_group2_command, get_group2_response, "2")
+    #command_check(sock, get_group3_command, get_group3_response, "3")
+
+    command_check(sock, set_anon_group1_command, set_anon_group1_response, "1")
+    command_check(sock, set_anon_group2_command, set_anon_group2_response, "2")
+    #command_check(sock, set_anon_group3_command, set_anon_group3_response, "3")
+    command_check(sock, set_anon_group4_command, set_anon_group4_response, "4")
+
+    command_check(sock, modify_group1_command, modify_group1_response, "1")
+    command_check(sock, modify_group2_command, modify_group2_response, "2")
+    #command_check(sock, modify_group3_command, modify_group3_response, "3")
+    command_check(sock, modify_group4_command, modify_group4_response, "4")
+    command_check(sock, modify_group5_command, modify_group5_response, "5")
+    command_check(sock, modify_group6_command, modify_group6_response, "6")
+    #command_check(sock, modify_group7_command, modify_group7_response, "7")
+    command_check(sock, modify_group8_command, modify_group8_response, "8")
+    command_check(sock, modify_group9_command, modify_group9_response, "9")
+
+    rc = 0
+
+    sock.close()
+except mosq_test.TestError:
+    pass
+finally:
+    os.remove(conf_file)
+    try:
+        os.remove(f"{port}/dynamic-security.json")
+    except FileNotFoundError:
+        pass
+    os.rmdir(f"{port}")
+    broker.terminate()
+    broker.wait()
+    (stdo, stde) = broker.communicate()
+    if rc:
+        print(stde.decode('utf-8'))
+
+
+exit(rc)

test/broker/14-dynsec-group.py

@@ -30,7 +30,7 @@ create_client_command = { "commands": [{
             "command": "createClient", "username": "user_one",
             "password": "password", "clientid": "cid",
             "textname": "Name", "textdescription": "Description",
-            "roleName": "", "correlationData": "2" }]}
+            "rolename": "", "correlationData": "2" }]}
 create_client_response = {'responses':[{"command":"createClient","correlationData":"2"}]}
 
 create_group_command = { "commands": [{

test/broker/Makefile

@@ -231,6 +231,7 @@ ifeq ($(WITH_CJSON),yes)
 	./14-dynsec-default-access.py
 	./14-dynsec-disable-client.py
 	./14-dynsec-group.py
+	./14-dynsec-group-invalid.py
 	./14-dynsec-modify-client.py
 	./14-dynsec-modify-group.py
 	./14-dynsec-modify-role.py

test/broker/test.py

@@ -197,6 +197,7 @@ tests = [
     (1, './14-dynsec-default-access.py'),
     (1, './14-dynsec-disable-client.py'),
     (1, './14-dynsec-group.py'),
+    (1, './14-dynsec-group-invalid.py'),
     (1, './14-dynsec-modify-client.py'),
     (1, './14-dynsec-modify-group.py'),
     (1, './14-dynsec-modify-role.py'),