mirror of
https://github.com/osixia/container-openldap.git
synced 2026-11-12 15:23:49 -04:00
129 lines
6.3 KiB
Bash
129 lines
6.3 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
# if container log level is trace:
|
|
# print commands and their arguments as they are executed
|
|
container log level eq trace && set -x
|
|
|
|
# shellcheck disable=SC1091
|
|
source /tmp/openldap-test-lib.sh
|
|
|
|
if [ "${TEST_VALIDATE_LDIF_MODE}" = online ] && [ "${1:-}" != --online ]; then
|
|
printf 'bash %q --online\n' "$0" | container --bash
|
|
exit 0
|
|
fi
|
|
|
|
if [ "${TEST_VALIDATE_LDIF_MODE}" = offline ]; then
|
|
expect_rc 0 container --skip-process
|
|
else
|
|
eventually has_entry ldap://127.0.0.1:3890 "${TEST_SUFFIX}"
|
|
PID_BEFORE=$(cat /run/container/processes/openldap.pid)
|
|
fi
|
|
|
|
TEST_DIR=$(mktemp -d)
|
|
trap 'rm -rf "${TEST_DIR:?}"' EXIT
|
|
|
|
snapshot() {
|
|
find /etc/openldap/slapd.d -type f -exec sha256sum {} \; | sort
|
|
sha256sum /var/lib/openldap/openldap-data/data.mdb
|
|
}
|
|
snapshot > "${TEST_DIR}/before"
|
|
|
|
USER_DN="uid=validate-only,${TEST_SUFFIX}"
|
|
cat > "${TEST_DIR}/valid entries.ldif" <<LDIF
|
|
dn: ${USER_DN}
|
|
objectClass: inetOrgPerson
|
|
uid: validate-only
|
|
cn: Validate Only
|
|
sn: User
|
|
LDIF
|
|
chmod 400 "${TEST_DIR}/valid entries.ldif"
|
|
ln -s 'valid entries.ldif' "${TEST_DIR}/projected.ldif"
|
|
expect_rc 0 container run -- openldap-ctl validate-ldif "${TEST_DIR}/projected.ldif"
|
|
expect_output 'LDIF validation succeeded'
|
|
|
|
sed 's/validate-only/validate-second/g' "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/second.ldif"
|
|
expect_rc 0 container run -- openldap-ctl validate-ldif "${TEST_DIR}/projected.ldif" "${TEST_DIR}/second.ldif"
|
|
expect_output 'LDIF validation succeeded: .*projected.ldif$'
|
|
expect_output 'LDIF validation succeeded: .*second.ldif$'
|
|
|
|
mkdir -p "${TEST_DIR}/directory/..revision" "${TEST_DIR}/directory/nested"
|
|
cat "${TEST_DIR}/second.ldif" > "${TEST_DIR}/directory/..revision/2-second.ldif"
|
|
cat "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/directory/..revision/10-last.ldif"
|
|
cat "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/directory/nested/entry with spaces.ldif"
|
|
ln -s ..revision "${TEST_DIR}/directory/..data"
|
|
ln -s ..data/2-second.ldif "${TEST_DIR}/directory/2-second.ldif"
|
|
ln -s ..data/10-last.ldif "${TEST_DIR}/directory/10-last.ldif"
|
|
printf 'invalid LDIF\n' > "${TEST_DIR}/directory/.hidden.ldif"
|
|
printf 'invalid LDIF\n' > "${TEST_DIR}/directory/ignored.ldif.template"
|
|
expect_rc 0 container run -- openldap-ctl validate-ldif "${TEST_DIR}/directory"
|
|
mapfile -t VALIDATED_FILES < <(sed -n 's/.*LDIF validation succeeded: //p' "${OUTPUT_FILE}")
|
|
[ "${#VALIDATED_FILES[@]}" -eq 3 ] || fail 'directory entries were skipped or validated twice'
|
|
[ "${VALIDATED_FILES[0]}" = "${TEST_DIR}/directory/2-second.ldif" ] || fail 'directory ordering is not numeric'
|
|
[ "${VALIDATED_FILES[1]}" = "${TEST_DIR}/directory/10-last.ldif" ] || fail 'directory ordering is not numeric'
|
|
[ "${VALIDATED_FILES[2]}" = "${TEST_DIR}/directory/nested/entry with spaces.ldif" ] || fail 'nested LDIF was not validated'
|
|
ok 'multiple files, recursive directories and projected-volume symlinks are supported'
|
|
|
|
sed '/^sn:/d' "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/missing-sn.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/missing-sn.ldif"
|
|
expect_output 'requires attribute.*sn'
|
|
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/projected.ldif" "${TEST_DIR}/missing-sn.ldif" "${TEST_DIR}/second.ldif"
|
|
expect_output 'LDIF validation succeeded: .*second.ldif$'
|
|
expect_output 'One or more LDIF files failed validation'
|
|
cat "${TEST_DIR}/missing-sn.ldif" > "${TEST_DIR}/directory/nested/invalid.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/directory"
|
|
expect_output 'requires attribute.*sn'
|
|
|
|
cat "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/unknown-attribute.ldif"
|
|
printf 'unknownAttribute: value\n' >> "${TEST_DIR}/unknown-attribute.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/unknown-attribute.ldif"
|
|
expect_output 'attribute type undefined'
|
|
|
|
cat > "${TEST_DIR}/invalid-value.ldif" <<LDIF
|
|
dn: cn=role,${TEST_SUFFIX}
|
|
objectClass: organizationalRole
|
|
cn: role
|
|
roleOccupant: invalid-dn
|
|
LDIF
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/invalid-value.ldif"
|
|
expect_output 'smr_normalize roleOccupant|invalid.*syntax|value.*invalid'
|
|
|
|
sed 's/^dn:.*/dn: uid=validate-only,dc=outside/' "${TEST_DIR}/valid entries.ldif" > "${TEST_DIR}/wrong-suffix.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/wrong-suffix.ldif"
|
|
expect_output 'not configured to hold'
|
|
|
|
printf 'dn: %s\nchangetype: modify\nreplace: cn\ncn: Changed\n' "${USER_DN}" > "${TEST_DIR}/modify.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/modify.ldif"
|
|
printf 'dn: invalid-dn\nobjectClass: inetOrgPerson\n' > "${TEST_DIR}/invalid-dn.ldif"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/invalid-dn.ldif"
|
|
ok "LDIF validation (${TEST_VALIDATE_LDIF_MODE}) rejects invalid entries and change records"
|
|
|
|
expect_fail container run -- openldap-ctl validate-ldif
|
|
expect_output 'Usage: openldap-ctl validate-ldif'
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/projected.ldif" extra
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/missing.ldif"
|
|
mkdir "${TEST_DIR}/empty"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/empty"
|
|
expect_output 'No LDIF files found'
|
|
mkdir "${TEST_DIR}/loop"
|
|
ln -s . "${TEST_DIR}/loop/cycle"
|
|
expect_fail container run -- openldap-ctl validate-ldif "${TEST_DIR}/loop"
|
|
expect_fail env OPENLDAP_CONF_DIR="${TEST_DIR}" container run -- openldap-ctl validate-ldif "${TEST_DIR}/projected.ldif"
|
|
expect_output 'configuration is not initialized'
|
|
expect_rc 0 container run -- openldap-ctl validate-ldif --help
|
|
|
|
snapshot > "${TEST_DIR}/after"
|
|
cmp "${TEST_DIR}/before" "${TEST_DIR}/after" || fail 'validation changed config or data files'
|
|
[ -z "$(find /run/container/tmp -maxdepth 1 -name 'openldap-validate.*' -print)" ] || fail 'validation left a temporary file'
|
|
|
|
if [ "${TEST_VALIDATE_LDIF_MODE}" = online ]; then
|
|
[ "$(cat /run/container/processes/openldap.pid)" = "${PID_BEFORE}" ] || fail 'validation restarted slapd'
|
|
expect_rc 32 bind_search ldap://127.0.0.1:3890 "${ADMIN_DN}" -b "${USER_DN}" -s base dn
|
|
expect_rc 0 bind_search ldap://127.0.0.1:3890 "${ADMIN_DN}" -b "${TEST_SUFFIX}" -s base dn
|
|
else
|
|
[ ! -e /run/container/processes/openldap.pid ] || fail 'validation started slapd'
|
|
fi
|
|
ok "LDIF validation (${TEST_VALIDATE_LDIF_MODE}) leaves configuration, data and process state unchanged"
|