rewire testsuite for libafpclient to leverage its auth layer

[rdmark]

we want a testsuite that can use any client UAM, and to achieve that I can think of two approaches

• borrow the UAM implementations wholesale from netatalk_client (afpfs-ng fork)
• link with netatalk_client's libafpclient

the former is the quick win and least disruptive, but we end up with two copies of the client auth implementations; the latter is the Right Thing To Do from a software engineering perspective

this is about exploring the latter idea

[rdmark]

solution as proposed by GPT-5.5 follows

Replace Testsuite AFP Transport With libafpclient

Summary

Migrate the testsuite client from its hand-rolled synchronous DSI login/transport to a libafpclient-backed transport, while preserving the existing CONN/DSI surface that hundreds of tests already inspect directly. Use libafpclient’s UAM registry and implementations for No User Authent, Cleartxt Passwrd, Randnum Exchange, 2-Way Randnum Exchange, DHCAST128, DHX2, and SRP.

This should be staged, with legacy raw DSI kept only for DSI-protocol tests that intentionally exercise unauthenticated or malformed sessions.

Key Changes

• Add a testsuite transport layer behind CONN:

  • Keep CONN.dsi.header, commands, data, cmdlen, and datalen populated exactly as tests expect.
  • Add an opaque transport pointer/state to CONN for the libafpclient server/session handle.
  • Introduce connection helpers that replace direct OpenClientSocket + dsi.socket setup for normal AFP tests.

• Link libafpclient cleanly:

  • Add a Meson feature option for testsuite libafpclient transport.
  • Resolve libafpclient via pkg-config or an explicit dependency, not a hard-coded /Users/... path.
  • Isolate external afp.h/dsi.h includes in a small adapter source to avoid clashes with testsuite dsi.h and Netatalk headers.

• Add a libafpclient raw AFP command bridge:

  • Expose a synchronous raw-command API in/around libafpclient that sends an AFP command payload over an authenticated session and returns raw DSI code plus raw reply bytes.
  • Reimplement testsuite dsi_stream_send + dsi_cmd_receive/dsi_data_receive compatibility paths on top of that bridge for authenticated AFP commands.
  • Preserve the existing byte-building helpers (SendInit, SetLen, AFP command wrappers) initially, so most tests keep working without a full proto rewrite.

• Use libafpclient for authentication:

  • Replace AFPopenLogin* normal-path auth with libafpclient connection/login.
  • Select UAM through libafpclient’s find_uam_by_name, including aliases like randnum, randnum2, dhx, dhx2, and srp.
  • Add -A <uam> to major testsuite binaries that currently hard-code Cleartxt Passwrd.

• Keep legacy raw transport for special DSI tests:

  • logintest cases that test unauthenticated DSIOpenSession, unknown AFP commands before login, malformed DSI headers, or session-limit behavior should use an explicit legacy/raw connection helper.
  • Normal authenticated AFP tests should use libafpclient.

Test Plan

• Build with libafpclient transport enabled and confirm afp_logintest, afp_spectest, afp_lantest, and afparg link.
• Run login matrix against a server configured for:
  • guest
  • cleartext
  • Randnum Exchange
  • 2-Way Randnum Exchange
  • DHCAST128
  • DHX2
  • SRP
• For each password UAM, run a small authenticated AFP smoke subset: server info, open volume, create file/dir, read/write, delete, logout.
• Add wrong-password checks for each password UAM and expect authentication failure without leaving a usable session.
• Run existing DSI-specific logintest cases under the legacy raw path to verify they still exercise malformed/unauthenticated protocol behavior.
• Run the full existing testsuite once with default Cleartxt Passwrd to catch reply-buffer compatibility regressions.

Assumptions

• The migration prioritizes preserving testsuite behavior over immediately rewriting every AFP helper to libafpclient high-level APIs.
• RandNum means both Randnum Exchange and 2-Way Randnum Exchange.
• SRP tests require a server with a valid SRP verifier file; otherwise SRP login tests should report not-tested rather than failed.
• Legacy raw transport remains acceptable only for tests whose purpose is DSI/session protocol behavior before authenticated AFP command handling.

[rdmark]

I ran an experiment on this a while ago in this branch: #3076

this experiment reaffirmed that there is a class of tests that do shenanigans with malformed DSI requests or unusual AFP calls that libafpclient does not handle (and probably shouldn't)

my current thinking is to bifurcate the test suite into one section that continues to use the netatalk AFP test client, and one that always runs on libafpclient rather than a compile time option that allows you to chose either one

[rdmark]

pivoted to a less intrusive design in #3247 -- implement a native DHCAST128 and DHX2 UAM module for libafptest, which solves the immediate problem of enabling testing against secured AFP server deployments