Adding upstream version 14.2.21.upstream/14.2.21upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 392 insertions, 0 deletions

diff --git a/src/test/mgr/CMakeLists.txt b/src/test/mgr/CMakeLists.txt
new file mode 100644
index 00000000..9e6950d7
--- /dev/null
+++ b/src/test/mgr/CMakeLists.txt
@@ -0,0 +1,16 @@
+# unittest_mgr_mgrcap
+add_executable(unittest_mgr_mgrcap
+  test_mgrcap.cc
+  $<TARGET_OBJECTS:mgr_cap_obj>)
+add_ceph_unittest(unittest_mgr_mgrcap)
+target_link_libraries(unittest_mgr_mgrcap global)
+
+#scripts
+if(WITH_MGR_DASHBOARD_FRONTEND)
+  if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|AARCH64|arm|ARM")
+    add_ceph_test(mgr-dashboard-frontend-unittests ${CMAKE_SOURCE_DIR}/src/pybind/mgr/dashboard/run-frontend-unittests.sh)
+  endif(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|AARCH64|arm|ARM")
+
+  add_ceph_test(mgr-dashboard-smoke.sh ${CMAKE_CURRENT_SOURCE_DIR}/mgr-dashboard-smoke.sh)
+endif(WITH_MGR_DASHBOARD_FRONTEND)
+
diff --git a/src/test/mgr/mgr-dashboard-smoke.sh b/src/test/mgr/mgr-dashboard-smoke.sh
new file mode 100755
index 00000000..c3f2a822
--- /dev/null
+++ b/src/test/mgr/mgr-dashboard-smoke.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# Copyright (C) 2014,2015,2017 Red Hat <contact@redhat.com>
+# Copyright (C) 2018 SUSE LLC
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Library Public License as published by
+# the Free Software Foundation; either version 2, or (at your option)
+# any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Library Public License for more details.
+#
+source $(dirname $0)/../detect-build-env-vars.sh
+source $CEPH_ROOT/qa/standalone/ceph-helpers.sh
+
+function run() {
+    local dir=$1
+    shift
+
+    export CEPH_MON=127.0.0.1:7160  # git grep '\<7160\>' : there must be only one
+    export CEPH_ARGS
+    CEPH_ARGS+="--fsid=$(uuidgen) --auth-supported=none "
+    CEPH_ARGS+="--mon-initial-members=a --mon-host=$MON "
+    CEPH_ARGS+="--mgr-initial-modules=dashboard "
+    CEPH_ARGS+="--mon-host=$CEPH_MON"
+
+    setup $dir || return 1
+    TEST_dashboard $dir || return 1
+    teardown $dir || return 1
+}
+
+function TEST_dashboard() {
+    local dir=$1
+    shift
+
+    run_mon $dir a || return 1
+    timeout 30 ceph mon stat || return 1
+    ceph config-key set mgr/dashboard/x/server_port 7161
+    MGR_ARGS+="--mgr_module_path=${CEPH_ROOT}/src/pybind/mgr "
+    run_mgr $dir x ${MGR_ARGS} || return 1
+
+    tries=0
+    while [[ $tries < 30 ]] ; do
+        if [ $(ceph status -f json | jq .mgrmap.available) = "true" ]
+        then
+            break
+        fi
+        tries=$((tries+1))
+        sleep 1
+    done
+
+    DASHBOARD_ADMIN_SECRET_FILE="/tmp/dashboard-admin-secret.txt"
+    printf 'admin' > "${DASHBOARD_ADMIN_SECRET_FILE}"
+    ceph_adm tell mgr dashboard ac-user-create admin -i "${DASHBOARD_ADMIN_SECRET_FILE}"
+
+    tries=0
+    while [[ $tries < 30 ]] ; do
+        if curl -c $dir/cookiefile -X POST -d '{"username":"admin","password":"admin"}' http://127.0.0.1:7161/api/auth
+        then
+            if curl -b $dir/cookiefile -s http://127.0.0.1:7161/api/summary | \
+                 jq '.health.overall_status' | grep HEALTH_
+            then
+                break
+            fi
+        fi
+        tries=$((tries+1))
+        sleep 0.5
+    done
+}
+
+main mgr-dashboard-smoke "$@"
+
+# Local Variables:
+# compile-command: "cd ../.. ; make -j4 TESTS=test/mgr/mgr-dashboard-smoke.sh check"
+# End:
diff --git a/src/test/mgr/test_mgrcap.cc b/src/test/mgr/test_mgrcap.cc
new file mode 100644
index 00000000..90933dd7
--- /dev/null
+++ b/src/test/mgr/test_mgrcap.cc
@@ -0,0 +1,298 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2012 Inktank
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+ */
+
+#include <iostream>
+
+#include "include/stringify.h"
+#include "mgr/MgrCap.h"
+
+#include "gtest/gtest.h"
+
+const char *parse_good[] = {
+
+  // MgrCapMatch
+  "allow *",
+  "allow r",
+  "allow rwx",
+  "allow  r",
+  " allow rwx",
+  "allow rwx ",
+  " allow rwx ",
+  " allow\t   rwx ",
+  "\tallow\nrwx\t",
+  "allow service=foo x",
+  "allow service=\"froo\" x",
+  "allow profile read-only",
+  "allow profile read-write",
+  "allow profile \"rbd-read-only\", allow *",
+  "allow command \"a b c\"",
+  "allow command abc",
+  "allow command abc with arg=foo",
+  "allow command abc with arg=foo arg2=bar",
+  "allow command abc with arg=foo arg2=bar",
+  "allow command abc with arg=foo arg2 prefix bar arg3 prefix baz",
+  "allow command abc with arg=foo arg2 prefix \"bar bingo\" arg3 prefix baz",
+  "allow command abc with arg regex \"^[0-9a-z.]*$\"",
+  "allow command abc with arg regex \"\(invaluid regex\"",
+  "allow service foo x",
+  "allow service foo x; allow service bar x",
+  "allow service foo w ;allow service bar x",
+  "allow service foo  w , allow service bar x",
+  "allow service foo r , allow service bar x",
+  "allow service foo_foo r, allow service bar r",
+  "allow service foo-foo r, allow service bar r",
+  "allow service \" foo \" w, allow service bar r",
+  "allow module foo x",
+  "allow module=foo x",
+  "allow module foo_foo r",
+  "allow module \" foo \" w",
+  "allow module foo with arg1=value1 x",
+  "allow command abc with arg=foo arg2=bar, allow service foo r",
+  "allow command abc.def with arg=foo arg2=bar, allow service foo r",
+  "allow command \"foo bar\" with arg=\"baz\"",
+  "allow command \"foo bar\" with arg=\"baz.xx\"",
+  "allow command \"foo bar\" with arg = \"baz.xx\"",
+  "profile crash",
+  "profile osd",
+  "profile mds",
+  "profile rbd pool=ABC namespace=NS",
+  "profile \"rbd-read-only\", profile crash",
+  "allow * network 1.2.3.4/24",
+  "allow * network ::1/128",
+  "allow * network [aa:bb::1]/128",
+  "allow service=foo x network 1.2.3.4/16",
+  "allow command abc network 1.2.3.4/8",
+  "profile crash network 1.2.3.4/32",
+  "allow profile crash network 1.2.3.4/32",
+  0
+};
+
+TEST(MgrCap, ParseGood) {
+  for (int i=0; parse_good[i]; ++i) {
+    string str = parse_good[i];
+    MgrCap cap;
+    std::cout << "Testing good input: '" << str << "'" << std::endl;
+    ASSERT_TRUE(cap.parse(str, &cout));
+    std::cout << "                                         -> " << cap
+              << std::endl;
+  }
+}
+
+// these should stringify to the input value
+const char *parse_identity[] = {
+  "allow *",
+  "allow r",
+  "allow rwx",
+  "allow service foo x",
+  "profile crash",
+  "profile rbd-read-only, allow *",
+  "profile rbd namespace=NS pool=ABC",
+  "allow command abc",
+  "allow command \"a b c\"",
+  "allow command abc with arg=foo",
+  "allow command abc with arg=foo arg2=bar",
+  "allow command abc with arg=foo arg2=bar",
+  "allow command abc with arg=foo arg2 prefix bar arg3 prefix baz",
+  "allow command abc with arg=foo arg2 prefix \"bar bingo\" arg3 prefix baz",
+  "allow service foo x",
+  "allow service foo x, allow service bar x",
+  "allow service foo w, allow service bar x",
+  "allow service foo r, allow service bar x",
+  "allow service foo_foo r, allow service bar r",
+  "allow service foo-foo r, allow service bar r",
+  "allow service \" foo \" w, allow service bar r",
+  "allow module foo x",
+  "allow module \" foo_foo \" r",
+  "allow module foo with arg1=value1 x",
+  "allow command abc with arg=foo arg2=bar, allow service foo r",
+  0
+};
+
+TEST(MgrCap, ParseIdentity)
+{
+  for (int i=0; parse_identity[i]; ++i) {
+    string str = parse_identity[i];
+    MgrCap cap;
+    std::cout << "Testing good input: '" << str << "'" << std::endl;
+    ASSERT_TRUE(cap.parse(str, &cout));
+    string out = stringify(cap);
+    ASSERT_EQ(out, str);
+  }
+}
+
+const char *parse_bad[] = {
+  "allow r foo",
+  "allow*",
+  "foo allow *",
+  "profile foo rwx",
+  "profile",
+  "profile foo bar rwx",
+  "allow profile foo rwx",
+  "allow profile",
+  "allow profile foo bar rwx",
+  "allow service bar",
+  "allow command baz x",
+  "allow r w",
+  "ALLOW r",
+  "allow rwx,",
+  "allow rwx x",
+  "allow r pool foo r",
+  "allow wwx pool taco",
+  "allow wwx pool taco^funny&chars",
+  "allow rwx pool 'weird name''",
+  "allow rwx object_prefix \"beforepool\" pool weird",
+  "allow rwx auid 123 pool asdf",
+  "allow command foo a prefix b",
+  "allow command foo with a prefixb",
+  "allow command foo with a = prefix b",
+  "allow command foo with a prefix b c",
+  0
+};
+
+TEST(MgrCap, ParseBad) {
+  for (int i=0; parse_bad[i]; ++i) {
+    string str = parse_bad[i];
+    MgrCap cap;
+    std::cout << "Testing bad input: '" << str << "'" << std::endl;
+    ASSERT_FALSE(cap.parse(str, &cout));
+  }
+}
+
+TEST(MgrCap, AllowAll) {
+  MgrCap cap;
+  ASSERT_FALSE(cap.is_allow_all());
+
+  ASSERT_TRUE(cap.parse("allow r", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow w", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow x", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow rwx", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow rw", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow rx", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow wx", nullptr));
+  ASSERT_FALSE(cap.is_allow_all());
+  cap.grants.clear();
+
+  ASSERT_TRUE(cap.parse("allow *", nullptr));
+  ASSERT_TRUE(cap.is_allow_all());
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "foo", "", "asdf", {}, true, true,
+                             true, {}));
+
+  MgrCap cap2;
+  ASSERT_FALSE(cap2.is_allow_all());
+  cap2.set_allow_all();
+  ASSERT_TRUE(cap2.is_allow_all());
+}
+
+TEST(MgrCap, Network) {
+  MgrCap cap;
+  bool r = cap.parse("allow * network 192.168.0.0/16, allow * network 10.0.0.0/8", nullptr);
+  ASSERT_TRUE(r);
+
+  entity_addr_t a, b, c;
+  a.parse("10.1.2.3");
+  b.parse("192.168.2.3");
+  c.parse("192.167.2.3");
+
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "foo", "", "asdf", {}, true, true,
+                             true, a));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "foo", "", "asdf", {}, true, true,
+                             true, b));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "foo", "", "asdf", {}, true, true,
+                              true, c));
+}
+
+TEST(MgrCap, CommandRegEx) {
+  MgrCap cap;
+  ASSERT_FALSE(cap.is_allow_all());
+  ASSERT_TRUE(cap.parse("allow command abc with arg regex \"^[0-9a-z.]*$\"",
+                        nullptr));
+
+  EntityName name;
+  name.from_str("osd.123");
+  ASSERT_TRUE(cap.is_capable(nullptr, name, "", "", "abc",
+                             {{"arg", "12345abcde"}}, true, true, true, {}));
+  ASSERT_FALSE(cap.is_capable(nullptr, name, "", "", "abc", {{"arg", "~!@#$"}},
+                              true, true, true, {}));
+
+  ASSERT_TRUE(cap.parse("allow command abc with arg regex \"[*\"", nullptr));
+  ASSERT_FALSE(cap.is_capable(nullptr, name, "", "", "abc", {{"arg", ""}}, true,
+                              true, true, {}));
+}
+
+TEST(MgrCap, Module) {
+  MgrCap cap;
+  ASSERT_FALSE(cap.is_allow_all());
+  ASSERT_TRUE(cap.parse("allow module abc r, allow module bcd w", nullptr));
+
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "abc", "", {}, true, true, false,
+                              {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "abc", "", {}, true, false, false,
+                             {}));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "bcd", "", {}, true, true, false,
+                              {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "bcd", "", {}, false, true, false,
+                             {}));
+}
+
+TEST(MgrCap, Profile) {
+  MgrCap cap;
+  ASSERT_FALSE(cap.is_allow_all());
+
+  ASSERT_FALSE(cap.parse("profile unknown"));
+  ASSERT_FALSE(cap.parse("profile rbd invalid-key=value"));
+
+  ASSERT_TRUE(cap.parse("profile rbd", nullptr));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "abc", "", {}, true, false,
+                              false, {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "rbd_support", "", {}, true,
+                             true, false, {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "rbd_support", "", {}, true,
+                             false, false, {}));
+
+  ASSERT_TRUE(cap.parse("profile rbd pool=abc namespace prefix def", nullptr));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "rbd_support", "", {},
+                              true, true, false, {}));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "rbd_support", "",
+                              {{"pool", "abc"}},
+                              true, true, false, {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "rbd_support", "",
+                             {{"pool", "abc"}, {"namespace", "defghi"}},
+                             true, true, false, {}));
+
+  ASSERT_TRUE(cap.parse("profile rbd-read-only", nullptr));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "abc", "", {}, true, false,
+                              false, {}));
+  ASSERT_FALSE(cap.is_capable(nullptr, {}, "", "rbd_support", "", {}, true,
+                              true, false, {}));
+  ASSERT_TRUE(cap.is_capable(nullptr, {}, "", "rbd_support", "", {}, true,
+                             false, false, {}));
+}