freeipa/ipatests/test_cmdline/test_cli.py

import contextlib
import os
from io import StringIO
import shlex
import subprocess
import sys
import tempfile

import six

from ipatests import util
from ipatests.test_ipalib.test_x509 import goodcert_headers
from ipalib import api, errors
import pytest

if six.PY3:
    unicode = str

TEST_ZONE = u'zoneadd.%(domain)s' % api.env

HERE = os.path.abspath(os.path.dirname(__file__))
BASE_DIR = os.path.abspath(os.path.join(HERE, os.pardir, os.pardir))


@pytest.mark.tier0
@pytest.mark.needs_ipaapi
class TestCLIParsing:
    """Tests that commandlines are correctly parsed to Command keyword args
    """
    def check_command(self, commandline, expected_command_name, **kw_expected):
        argv = shlex.split(commandline)
        executioner = api.Backend.cli

        cmd = executioner.get_command(argv)
        kw_got = executioner.parse(cmd, argv[1:])
        kw_got = executioner.process_keyword_arguments(cmd, kw_got)
        util.assert_deepequal(expected_command_name, cmd.name, 'Command name')
        util.assert_deepequal(kw_expected, kw_got)

    def run_command(self, command_name, **kw):
        """Run a command on the server"""
        if not api.Backend.rpcclient.isconnected():
            api.Backend.rpcclient.connect()
        try:
            api.Command[command_name](**kw)
        except errors.NetworkError:
            pytest.skip('%r: Server not available: %r' %
                        (self.__module__, api.env.xmlrpc_uri))

    @contextlib.contextmanager
    def fake_stdin(self, string_in):
        """Context manager that temporarily replaces stdin to read a string"""
        old_stdin = sys.stdin
        sys.stdin = StringIO(string_in)
        yield
        sys.stdin = old_stdin

    def test_ping(self):
        self.check_command('ping', 'ping')

    def test_plugins(self):
        self.check_command('plugins', 'plugins')

    def test_user_show(self):
        self.check_command('user-show admin', 'user_show', uid=u'admin')

    def test_user_show_underscore(self):
        self.check_command('user_show admin', 'user_show', uid=u'admin')

    def test_group_add(self):
        self.check_command(
            'group-add tgroup1 --desc="Test group"',
            'group_add',
            cn=u'tgroup1',
            description=u'Test group',
        )

    def test_sudocmdgroup_add_member(self):
        # Test CSV splitting is not done
        self.check_command(
            # The following is as it would appear on the command line:
            r'sudocmdgroup-add-member tcmdgroup1 --sudocmds=ab,c --sudocmds=d',
            'sudocmdgroup_add_member',
            cn=u'tcmdgroup1',
            sudocmd=[u'ab,c', u'd'],
        )

    def test_group_add_nonposix(self):
        self.check_command(
            'group-add tgroup1 --desc="Test group" --nonposix',
            'group_add',
            cn=u'tgroup1',
            description=u'Test group',
            nonposix=True,
        )

    def test_group_add_gid(self):
        self.check_command(
            'group-add tgroup1 --desc="Test group" --gid=1234',
            'group_add',
            cn=u'tgroup1',
            description=u'Test group',
            gidnumber=u'1234',
        )

    def test_group_add_interactive(self):
        with self.fake_stdin('Test group\n'):
            self.check_command(
                'group-add tgroup1', 'group_add',
                cn=u'tgroup1',
            )

    def test_dnsrecord_add(self):
        self.check_command(
            'dnsrecord-add %s ns --a-rec=1.2.3.4' % TEST_ZONE,
            'dnsrecord_add',
            dnszoneidnsname=TEST_ZONE,
            idnsname=u'ns',
            arecord=u'1.2.3.4',
        )

    def test_dnsrecord_del_all(self):
        try:
            self.run_command('dnszone_add', idnsname=TEST_ZONE)
        except errors.NotFound:
            pytest.skip('DNS is not configured')
        try:
            self.run_command('dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'ns', arecord=u'1.2.3.4', force=True)
            with self.fake_stdin('yes\n'):
                self.check_command(
                    'dnsrecord_del %s ns' % TEST_ZONE,
                    'dnsrecord_del',
                    dnszoneidnsname=TEST_ZONE,
                    idnsname=u'ns',
                    del_all=True,
                )
            with self.fake_stdin('YeS\n'):
                self.check_command(
                    'dnsrecord_del %s ns' % TEST_ZONE,
                    'dnsrecord_del',
                    dnszoneidnsname=TEST_ZONE,
                    idnsname=u'ns',
                    del_all=True,
                )
        finally:
            self.run_command('dnszone_del', idnsname=TEST_ZONE)

    def test_dnsrecord_del_one_by_one(self):
        try:
            self.run_command('dnszone_add', idnsname=TEST_ZONE)
        except errors.NotFound:
            pytest.skip('DNS is not configured')
        try:
            records = (u'1 1 E3B72BA346B90570EED94BE9334E34AA795CED23',
                       u'2 1 FD2693C1EFFC11A8D2BE57229212A04B45663791')
            for record in records:
                self.run_command('dnsrecord_add',
                    dnszoneidnsname=TEST_ZONE, idnsname=u'ns',
                    sshfprecord=record)
            with self.fake_stdin('no\nyes\nyes\n'):
                self.check_command(
                    'dnsrecord_del %s ns' % TEST_ZONE,
                    'dnsrecord_del',
                    dnszoneidnsname=TEST_ZONE,
                    idnsname=u'ns',
                    sshfprecord=records,
                )
        finally:
            self.run_command('dnszone_del', idnsname=TEST_ZONE)

    def test_dnsrecord_add_ask_for_missing_fields(self):
        sshfp_parts = (1, 1, u'E3B72BA346B90570EED94BE9334E34AA795CED23')

        with self.fake_stdin('SSHFP\n%d\n%d\n%s' % sshfp_parts):
            self.check_command(
                'dnsrecord-add %s sshfp' % TEST_ZONE,
                'dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'sshfp',
                sshfp_part_fp_type=sshfp_parts[0],
                sshfp_part_algorithm=sshfp_parts[1],
                sshfp_part_fingerprint=sshfp_parts[2],
            )

        # test with lowercase record type
        with self.fake_stdin('sshfp\n%d\n%d\n%s' % sshfp_parts):
            self.check_command(
                'dnsrecord-add %s sshfp' % TEST_ZONE,
                'dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'sshfp',
                sshfp_part_fp_type=sshfp_parts[0],
                sshfp_part_algorithm=sshfp_parts[1],
                sshfp_part_fingerprint=sshfp_parts[2],
            )

        # NOTE: when a DNS record part is passed via command line, it is not
        # converted to its base type when transfered via wire
        with self.fake_stdin('%d\n%s' % (sshfp_parts[1], sshfp_parts[2])):
            self.check_command(
                'dnsrecord-add %s sshfp --sshfp-algorithm=%d' % (
                    TEST_ZONE, sshfp_parts[0]),
                'dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'sshfp',
                sshfp_part_fp_type=sshfp_parts[0],
                # passed via cmdline
                sshfp_part_algorithm=unicode(sshfp_parts[1]),
                sshfp_part_fingerprint=sshfp_parts[2],
            )

        with self.fake_stdin(sshfp_parts[2]):
            self.check_command(
                'dnsrecord-add %s sshfp --sshfp-algorithm=%d '
                '--sshfp-fp-type=%d' % (
                    TEST_ZONE, sshfp_parts[0], sshfp_parts[1]),
                'dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'sshfp',
                # passed via cmdline
                sshfp_part_fp_type=unicode(sshfp_parts[0]),
                # passed via cmdline
                sshfp_part_algorithm=unicode(sshfp_parts[1]),
                sshfp_part_fingerprint=sshfp_parts[2],
            )

    def test_dnsrecord_del_comma(self):
        try:
            self.run_command(
                'dnszone_add', idnsname=TEST_ZONE)
        except errors.NotFound:
            pytest.skip('DNS is not configured')
        try:
            self.run_command(
                'dnsrecord_add',
                dnszoneidnsname=TEST_ZONE,
                idnsname=u'test',
                txtrecord=u'"A pretty little problem," said Holmes.')
            with self.fake_stdin('no\nyes\n'):
                self.check_command(
                    'dnsrecord_del %s test' % TEST_ZONE,
                    'dnsrecord_del',
                    dnszoneidnsname=TEST_ZONE,
                    idnsname=u'test',
                    txtrecord=[u'"A pretty little problem," said Holmes.'])
        finally:
            self.run_command('dnszone_del', idnsname=TEST_ZONE)

    def test_idrange_add(self):
        """
        Test idrange-add with interative prompt
        """
        def test_with_interactive_input():
            with self.fake_stdin('5\n500000\n'):
                self.check_command(
                    'idrange_add range1 --base-id=1 --range-size=1',
                    'idrange_add',
                    cn=u'range1',
                    ipabaseid=u'1',
                    ipaidrangesize=u'1',
                    ipabaserid=5,
                    ipasecondarybaserid=500000,
                )

        def test_with_command_line_options():
            self.check_command(
                'idrange_add range1 --base-id=1 --range-size=1 '
                '--rid-base=5 --secondary-rid-base=500000',
                'idrange_add',
                cn=u'range1',
                ipabaseid=u'1',
                ipaidrangesize=u'1',
                ipabaserid=u'5',
                ipasecondarybaserid=u'500000',
            )

        def test_without_options():
            self.check_command(
                'idrange_add range1 --base-id=1 --range-size=1',
                'idrange_add',
                cn=u'range1',
                ipabaseid=u'1',
                ipaidrangesize=u'1',
            )

        adtrust_dn = 'cn=ADTRUST,cn=%s,cn=masters,cn=ipa,cn=etc,%s' % \
                     (api.env.host, api.env.basedn)
        adtrust_is_enabled = api.Command['adtrust_is_enabled']()['result']
        mockldap = None

        if not adtrust_is_enabled:
            # ipa-adtrust-install not run - no need to pass rid-base
            # and secondary-rid-base
            test_without_options()

            # Create a mock service object to test against
            adtrust_add = dict(
                ipaconfigstring=b'enabledService',
                objectclass=[b'top', b'nsContainer', b'ipaConfigObject']
            )

            mockldap = util.MockLDAP()
            mockldap.add_entry(adtrust_dn, adtrust_add)

        # Pass rid-base and secondary-rid-base interactively
        test_with_interactive_input()

        # Pass rid-base and secondary-rid-base on the command-line
        test_with_command_line_options()

        if not adtrust_is_enabled:
            mockldap.del_entry(adtrust_dn)

    def test_certfind(self):
        with tempfile.NamedTemporaryFile() as f:
            f.write(goodcert_headers)
            f.flush()
            self.check_command(
                'cert_find --file={}'.format(f.name),
                'cert_find',
                file=goodcert_headers
            )


def test_cli_fsencoding():
    # https://pagure.io/freeipa/issue/5887
    env = {
        key: value for key, value in os.environ.items()
        if not key.startswith(('LC_', 'LANG'))
    }
    env['LC_ALL'] = 'C'
    env['PYTHONPATH'] = BASE_DIR
    # override confdir so test always fails and does not depend on an
    # existing installation.
    env['IPA_CONFDIR'] = '/'
    p = subprocess.Popen(
        [sys.executable, '-m', 'ipaclient', 'help'],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        env=env,
    )
    out, err = p.communicate()

    assert p.returncode != 0, (out, err)
    if sys.version_info >= (3, 7):
        # Python 3.7+ has PEP 538: Legacy C Locale Coercion
        assert b'IPA client is not configured' in err, (out, err)
    else:
        # Python 3.6 does not support UTF-8 fs encoding with non-UTF LC
        assert b'System encoding must be UTF-8' in err, (out, err)


IPA_NOT_CONFIGURED = b'IPA is not configured on this system'
IPA_CLIENT_NOT_CONFIGURED = b'IPA client is not configured on this system'


@pytest.mark.needs_ipaapi
@pytest.mark.skipif(
    os.geteuid() != 0 or os.path.isfile('/etc/ipa/default.conf'),
    reason="Must have root privileges to run this test "
           "and IPA must not be installed")
@pytest.mark.parametrize(
    "args, retcode, output, error",
    [
        # Commands delivered by the client pkg
        (['ipa'], 1, None, IPA_CLIENT_NOT_CONFIGURED),
        (['ipa-certupdate'], 2, None, IPA_CLIENT_NOT_CONFIGURED),
        (['ipa-client-automount'], 2, IPA_CLIENT_NOT_CONFIGURED, None),
        # Commands delivered by the server pkg
        (['ipa-adtrust-install'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-advise'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-backup'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-cacert-manage'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-ca-install'], 1, None,
         b'IPA server is not configured on this system'),
        (['ipa-compat-manage'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-crlgen-manage'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-csreplica-manage'], 1, None, IPA_NOT_CONFIGURED),
        (['ipactl', 'status'], 4, None, b'IPA is not configured'),
        (['ipa-dns-install'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-kra-install'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-ldap-updater',
          '/usr/share/ipa/updates/05-pre_upgrade_plugins.update'],
         2, None, IPA_NOT_CONFIGURED),
        (['ipa-managed-entries'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-nis-manage'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-pkinit-manage'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-replica-manage', 'list'], 1, IPA_NOT_CONFIGURED, None),
        (['ipa-server-certinstall'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-server-upgrade'], 2, None, IPA_NOT_CONFIGURED),
        (['ipa-winsync-migrate'], 1, None, IPA_NOT_CONFIGURED)
    ])
def test_command_ipa_not_installed(args, retcode, output, error):
    """
    Test that the commands properly return that IPA client|server is not
    configured on this system.
    Launch the command specified in args.
    Check that the exit code is as expected and that stdout and stderr
    contain the expected strings.
    """
    p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    out, err = p.communicate()
    assert retcode == p.returncode
    if output:
        assert output in out
    if error:
        assert error in err