On (17/08/16 14:32), Petr Cech wrote:
> Hello list,
>
> there is attached patch set for intg. testing of ldap nested netgroups.
>
> I used last version of Lukas patch 'sssd_netgroup.py: Resolve nested
> netgroups'. I don't know if it is on list.
>
> It is still WIP. It is in state that it is possible to run it.
> But there are comments in code what is needed to fix.
>
>
> If I remove some netgroups (in test), it is updated on LDAP and in cache, but
> sssd_netgroup.get_sssd_netgroups() returns nothing.
>
Yes, I was too strict regarding to failures in resolving nested netgroups.
glibc(getent netgroup) does not fail if there is non-existing nested netgroup.
There is bunch of pep8 warnings. Please fix them.
sh$ pep8 src/tests/intg/test_netgroup.py | wc -l
29
> Date: Wed, 17 Aug 2016 13:58:30 +0200
> Subject: [PATCH 2/2] WIP: INTG: Tests for ldap nested netgroups
>
> This patch adds tests on reproducer of t2841.
>
> Resolves:
>
https://fedorahosted.org/sssd/ticket/2841
> ---
> src/tests/intg/Makefile.am | 1 +
> src/tests/intg/test_netgroup.py | 487 ++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 488 insertions(+)
> create mode 100644 src/tests/intg/test_netgroup.py
>
> diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
> index
b8cc5c006845f911d8518df815925455482e9f6d..b3c553539d9e74dae986fa6551041544dd687c11 100644
> --- a/src/tests/intg/Makefile.am
> +++ b/src/tests/intg/Makefile.am
> @@ -14,6 +14,7 @@ dist_noinst_DATA = \
> util.py \
> test_memory_cache.py \
> test_ts_cache.py \
> + test_netgroup.py \
> $(NULL)
>
> config.py: config.py.m4
> diff --git a/src/tests/intg/test_netgroup.py b/src/tests/intg/test_netgroup.py
> new file mode 100644
> index
0000000000000000000000000000000000000000..4be2b1c7048f3d8dc4797557d6decf1367eea36d
> --- /dev/null
> +++ b/src/tests/intg/test_netgroup.py
> @@ -0,0 +1,487 @@
> +#
> +# Netgroup integration test
> +#
> +# Copyright (c) 2016 Red Hat, Inc.
> +# Author: Petr Cech <pcech(a)redhat.com>
> +#
> +# This is free software; you can redistribute it and/or modify it
> +# under the terms of the GNU General Public License as published by
> +# the Free Software Foundation; version 2 only
> +#
> +# This program is distributed in the hope that it will be useful, but
> +# WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> +# General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program. If not, see <
http://www.gnu.org/licenses/>.
> +#
> +
//snip
> +(a)pytest.fixture
> +def reproducer_t2841(request, ldap_conn):
> + ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +
> + ent_list.add_netgroup("t2841_netgroup1",
["(host1,user1,domain1)"])
> + ent_list.add_netgroup("t2841_netgroup2",
["(host2,user2,domain2)"])
> + ent_list.add_netgroup("t2841_netgroup3", [],
> + ["t2841_netgroup1",
"t2841_netgroup2"])
> +
> + create_ldap_fixture(request, ldap_conn, ent_list)
> + conf = format_basic_conf(ldap_conn, SCHEMA_RFC2307_BIS, enum=True)
> + create_conf_fixture(request, conf)
> + create_sssd_fixture(request)
> + return (ldap_conn, ent_list)
> +
> +
> +def test_reproducer_t2841(reproducer_t2841):
> + """
> + Adding two nested netgroup.
> + """
> +
> + ldap_conn = reproducer_t2841[0]
> + ent_list = reproducer_t2841[1]
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup1")
> + assert res == sssd_netgroup.NssReturnCode.SUCCESS
> + assert netgroups == [('host1', 'user1', 'domain1')]
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup2")
> + assert res == sssd_netgroup.NssReturnCode.SUCCESS
> + assert netgroups == [('host2', 'user2', 'domain2')]
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup3")
> + assert res == sssd_netgroup.NssReturnCode.SUCCESS
> + assert netgroups == [('host2', 'user2', 'domain2'),
> + ('host1', 'user1', 'domain1')]
> +
> + # removing of t2841_netgroup1
> + ldap_conn.delete_s(ent_list[0][0])
> + ent_list.remove(ent_list[0])
> + if subprocess.call(["sss_cache", "-N"]) != 0:
> + raise Exception("sssd_cache failed")
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup1")
> + assert res == sssd_netgroup.NssReturnCode.NOTFOUND
> + assert netgroups == []
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup2")
> + assert res == sssd_netgroup.NssReturnCode.SUCCESS
> + assert netgroups == [('host2', 'user2', 'domain2')]
> +
> + # FIX: This should be SUCCES
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup3")
> + assert res == sssd_netgroup.NssReturnCode.NOTFOUND
> + assert netgroups == []
Please never write test which always passes.
Test must cover the test case and not be green in 100% cases.
Otherwise we cousl have "assert True" everywhere :-)
> +
> + # point A
> + # run_shell()
> +
> + # removing of t2841_netgroup2
> + ldap_conn.delete_s(ent_list[0][0])
> + ent_list.remove(ent_list[0])
> + if subprocess.call(["sss_cache", "-N"]) != 0:
> + raise Exception("sssd_cache failed")
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup1")
> + assert res == sssd_netgroup.NssReturnCode.NOTFOUND
> + assert netgroups == []
> +
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup2")
> + assert res == sssd_netgroup.NssReturnCode.NOTFOUND
> + assert netgroups == []
> +
> + # FIX: This should be SUCCES
> + res, errno, netgroups =
sssd_netgroup.get_sssd_netgroups("t2841_netgroup3")
> + assert res == sssd_netgroup.NssReturnCode.NOTFOUND
> + assert netgroups == []
> +
> + # point B
> + # run_shell()
I fixed the expected results(@see patch) and the test passes with latest
version of sssd_netgroup.py and git master. There are two possible explanations
a) we need to close ticket 2841 as works for me
b) the test test_reproducer_t2841 is testing something different.
BTW I tested the same test-case outside of cwrap with simple shell script.
sh# ldapadd -x -w Secret123 -D 'cn=admin,dc=example,dc=com' -h localhost:10389 \
-f netgroups.ldif
adding new entry "ou=Netgroups,dc=example,dc=com"
adding new entry "cn=t2841_netgroup1,ou=Netgroups,dc=example,dc=com"
adding new entry "cn=t2841_netgroup2,ou=Netgroups,dc=example,dc=com"
adding new entry "cn=t2841_netgroup3,ou=Netgroups,dc=example,dc=com"
sh# systemctl restart sssd
sh# systemctl restart sssd
sh# getent netgroup t2841_netgroup1 || echo FAILED
t2841_netgroup1 (host1,user1,domain1)
sh# getent netgroup t2841_netgroup2 || echo FAILED
t2841_netgroup2 (host2,user2,domain2)
sh# getent netgroup t2841_netgroup3 || echo FAILED
t2841_netgroup3 (host2,user2,domain2) (host1,user1,domain1)
sh# ldapdelete -x -w Secret123 -D 'cn=admin,dc=example,dc=com' -h localhost:10389
cn=t2841_netgroup1,ou=Netgroups,dc=example,dc=com
sh# sss_cache -N
sh# getent netgroup t2841_netgroup1 || echo FAILED
FAILED
sh# getent netgroup t2841_netgroup2 || echo FAILED
t2841_netgroup2 (host2,user2,domain2)
sh# getent netgroup t2841_netgroup3 || echo FAILED
t2841_netgroup3 (host2,user2,domain2)
sh# ldapdelete -x -w Secret123 -D 'cn=admin,dc=example,dc=com' -h localhost:10389
cn=t2841_netgroup2,ou=Netgroups,dc=example,dc=com
sh# sss_cache -N
sh# getent netgroup t2841_netgroup1 || echo FAILED
FAILED
sh# getent netgroup t2841_netgroup2 || echo FAILED
FAILED
sh# getent netgroup t2841_netgroup3 || echo FAILED
t2841_netgroup3
Could you explain it?
The situation is:
netgroups: A, B, C
B and C in A
I remove B and C, but the right way is
remove B, C from A,
not B, C themself.
attached.
The first patch fixes the issue,
the second patch adds support for netgroups to INTG tests,
the third adds tests.
This patch set is applicable after Lukas's patch
sssd_netgroup.py: Resolve nested netgroups
Regards
--
Petr^4 Čech