X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=main_test.go;h=a8b81b41e2430ce3d983eacde7a3d3162c2f7564;hb=f8e6645b525579b9529f3924972db291e3d3c901;hp=563f683ab5fb6a3e7d443baa8906b66303bec082;hpb=3ab8d3737f51fdd328c972b94e687c161c915f8e;p=nsscash%2Fnsscash.git

diff --git a/main_test.go b/main_test.go
index 563f683..a8b81b4 100644
--- a/main_test.go
+++ b/main_test.go
@@ -191,11 +191,20 @@ func TestMainFetch(t *testing.T) {
 		fetchPasswdInvalid,
 		fetchPasswdLimits,
 		fetchPasswd,
-		// Tests for plain
+		// Tests for plain and group
 		fetchPlainEmpty,
 		fetchPlain,
+		fetchGroupEmpty,
+		fetchGroupInvalid,
+		fetchGroupLimits,
+		fetchGroup,
 		// Special tests
 		fetchNoConfig,
+		fetchStateCannotRead,
+		fetchStateInvalid,
+		fetchStateCannotWrite,
+		fetchCannotDeploy,
+		fetchSecondFetchFails,
 	}
 
 	cleanup := []string{
@@ -499,6 +508,97 @@ path = "%[3]s"
 	// Remaining functionality already tested in fetchPasswd()
 }
 
+func fetchGroupEmpty(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		// Empty response
+	}
+
+	err := mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"refusing to use empty group file")
+
+	mustNotExist(t, statePath, passwdPath, plainPath)
+	mustBeOld(t, groupPath)
+}
+
+func fetchGroupInvalid(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/group" {
+			return
+		}
+
+		fmt.Fprintln(w, "root:x::")
+	}
+
+	err := mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"invalid gid in line")
+
+	mustNotExist(t, statePath, passwdPath, plainPath)
+	mustBeOld(t, groupPath)
+}
+
+func fetchGroupLimits(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/group" {
+			return
+		}
+
+		fmt.Fprint(w, "root:x:0:")
+		for i := 0; i < 65536; i++ {
+			fmt.Fprint(w, "x")
+		}
+		fmt.Fprint(w, "\n")
+	}
+
+	err := mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"group too large to serialize")
+
+	mustNotExist(t, statePath, passwdPath, plainPath)
+	mustBeOld(t, groupPath)
+}
+
+func fetchGroup(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+	mustHaveHash(t, groupPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/group" {
+			return
+		}
+
+		fmt.Fprintln(w, "root:x:0:")
+		fmt.Fprintln(w, "daemon:x:1:andariel,duriel,mephisto,diablo,baal")
+	}
+
+	err := mainFetch(configPath)
+	if err != nil {
+		t.Error(err)
+	}
+
+	mustNotExist(t, passwdPath, plainPath)
+	mustBeNew(t, groupPath, statePath)
+	// The actual content of groupPath is verified by the NSS tests
+	mustHaveHash(t, groupPath, "8c27a8403278ba2e392b86d98d4dff1fdefcafdd")
+
+	// Remaining functionality already tested in fetchPasswd()
+}
+
 func fetchNoConfig(a args) {
 	t := a.t
 
@@ -508,3 +608,127 @@ func fetchNoConfig(a args) {
 
 	mustNotExist(t, configPath, statePath, passwdPath, plainPath, groupPath)
 }
+
+func fetchStateCannotRead(a args) {
+	t := a.t
+	mustWritePasswdConfig(t, a.url)
+
+	mustCreate(t, statePath)
+	err := os.Chmod(statePath, 0000)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		statePath+": permission denied")
+
+	mustNotExist(t, passwdPath, plainPath, groupPath)
+}
+
+func fetchStateInvalid(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, statePath)
+
+	err := mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"unexpected end of JSON input")
+
+	mustNotExist(t, groupPath, passwdPath, plainPath)
+	mustBeOld(t, statePath)
+}
+
+func fetchStateCannotWrite(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+	mustHaveHash(t, groupPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		// To prevent mainFetch() from trying to update groupPath
+		// which will also fail
+		w.WriteHeader(http.StatusNotModified)
+	}
+
+	err := os.Chmod("testdata", 0500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chmod("testdata", 0755)
+
+	err = mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"permission denied")
+
+	mustNotExist(t, statePath, passwdPath, plainPath)
+	mustBeOld(t, groupPath)
+}
+
+func fetchCannotDeploy(a args) {
+	t := a.t
+	mustWriteGroupConfig(t, a.url)
+	mustCreate(t, groupPath)
+	mustHaveHash(t, groupPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/group" {
+			return
+		}
+
+		fmt.Fprintln(w, "root:x:0:")
+		fmt.Fprintln(w, "daemon:x:1:andariel,duriel,mephisto,diablo,baal")
+	}
+
+	err := os.Chmod("testdata", 0500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chmod("testdata", 0755)
+
+	err = mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"permission denied")
+
+	mustNotExist(t, statePath, passwdPath, plainPath)
+	mustBeOld(t, groupPath)
+}
+
+func fetchSecondFetchFails(a args) {
+	t := a.t
+	mustWriteConfig(t, fmt.Sprintf(`
+statepath = "%[1]s"
+
+[[file]]
+type = "passwd"
+url = "%[2]s/passwd"
+path = "%[3]s"
+
+[[file]]
+type = "group"
+url = "%[2]s/group"
+path = "%[4]s"
+`, statePath, a.url, passwdPath, groupPath))
+	mustCreate(t, passwdPath)
+	mustCreate(t, groupPath)
+	mustHaveHash(t, passwdPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+	mustHaveHash(t, groupPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+	*a.handler = func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/passwd" {
+			fmt.Fprintln(w, "root:x:0:0:root:/root:/bin/bash")
+		}
+		if r.URL.Path == "/group" {
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}
+
+	err := mainFetch(configPath)
+	mustBeErrorWithSubstring(t, err,
+		"status code 404")
+
+	mustNotExist(t, statePath, plainPath)
+	// Even though passwd was successfully fetched, no files were modified
+	// because the second fetch failed
+	mustBeOld(t, passwdPath, groupPath)
+}