Whamcloud - gitweb
LU-5396 mdc: (and lmv, mgc, osc) make some functions static
[fs/lustre-release.git] / lustre / tests / sanity-sec.sh
index 4050bd3..b67ef95 100644 (file)
@@ -7,8 +7,8 @@
 set -e
 
 ONLY=${ONLY:-"$*"}
-# bug number for skipped test: 19430 19967 19967
-ALWAYS_EXCEPT="                2     5     6    $SANITY_SEC_EXCEPT"
+# bug number for skipped test: 19430 LU-5423 19967 19967
+ALWAYS_EXCEPT="                2     4       5     6    $SANITY_SEC_EXCEPT"
 # UPDATE THE COMMENT ABOVE WITH BUG NUMBERS WHEN CHANGING ALWAYS_EXCEPT!
 
 [ "$ALWAYS_EXCEPT$EXCEPT" ] && \
@@ -34,10 +34,10 @@ FAIL_ON_ERROR=false
 
 HOSTNAME_CHECKSUM=$(hostname | sum | awk '{ print $1 }')
 SUBNET_CHECKSUM=$(expr $HOSTNAME_CHECKSUM % 250 + 1)
-NODEMAP_COUNT=10
+NODEMAP_COUNT=16
 NODEMAP_RANGE_COUNT=3
-NODEMAP_IPADDR_COUNT=30
-NODEMAP_ID_COUNT=200
+NODEMAP_IPADDR_LIST="1 10 64 128 200 250"
+NODEMAP_MAX_ID=128
 
 require_dsh_mds || exit 0
 require_dsh_ost || exit 0
@@ -604,7 +604,6 @@ delete_nodemaps() {
 }
 
 add_range() {
-       local i
        local j
        local cmd="$LCTL nodemap_add_range"
        local range
@@ -620,8 +619,7 @@ add_range() {
        return $rc
 }
 
-del_range() {
-       local i
+delete_range() {
        local j
        local cmd="$LCTL nodemap_del_range"
        local range
@@ -634,6 +632,63 @@ del_range() {
                        rc=$(($rc + 1))
                fi
        done
+
+       return $rc
+}
+
+add_idmaps() {
+       local i
+       local j
+       local client_id
+       local fs_id
+       local cmd="$LCTL nodemap_add_idmap"
+       local rc=0
+
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               for ((j = 500; j < NODEMAP_MAX_ID; j++)); do
+                       client_id=$j
+                       fs_id=$(($j + 1))
+                       if ! do_facet mgs $cmd                          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}                \
+                       --idtype uid --idmap $client_id:$fs_id; then
+                               rc=$(($rc + 1))
+                       fi
+                       if ! do_facet mgs $cmd                          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}                \
+                       --idtype gid --idmap $client_id:$fs_id; then
+                               rc=$(($rc + 1))
+                       fi
+               done
+       done
+
+       return $rc
+}
+
+delete_idmaps() {
+       local i
+       local j
+       local client_id
+       local fs_id
+       local cmd="$LCTL nodemap_del_idmap"
+       local rc=0
+
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               for ((j = 500; j < NODEMAP_MAX_ID; j++)); do
+                       client_id=$j
+                       fs_id=$(($j + 1))
+                       if ! do_facet mgs $cmd                          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}                \
+                       --idtype uid --idmap $client_id:$fs_id; then
+                               rc=$(($rc + 1))
+                       fi
+                       if ! do_facet mgs $cmd                          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}                \
+                       --idtype gid --idmap $client_id:$fs_id; then
+                               rc=$(($rc + 1))
+                       fi
+               done
+       done
+
        return $rc
 }
 
@@ -677,6 +732,10 @@ squash_id() {
        fi
 }
 
+# ensure that the squash defaults are the expected defaults
+squash_id default 99 0
+squash_id default 99 1
+
 test_nid() {
        local cmd
 
@@ -691,6 +750,124 @@ test_nid() {
        return 1
 }
 
+test_idmap() {
+       local i
+       local j
+       local fs_id
+       local cmd="$LCTL nodemap_test_id"
+       local rc=0
+
+       ## nodemap deactivated
+       if ! do_facet mgs lctl nodemap_activate 0; then
+               return 1
+       fi
+       for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
+               for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
+                       nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
+                       fs_id=$(do_facet mgs $cmd --nid $nid    \
+                               --idtype uid --id $id)
+                       if [ $fs_id != $id ]; then
+                               rc=$((rc + 1))
+                       fi
+               done
+       done
+
+       ## nodemap activated
+       if ! do_facet mgs lctl nodemap_activate 1; then
+               return 2
+       fi
+
+       for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
+               for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
+                       nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
+                       fs_id=$(do_facet mgs $cmd --nid $nid    \
+                               --idtype uid --id $id)
+                       expected_id=$((id + 1))
+                       if [ $fs_id != $expected_id ]; then
+                               rc=$((rc + 1))
+                       fi
+               done
+       done
+
+       ## trust client ids
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               if ! do_facet mgs $LCTL nodemap_modify                  \
+                               --name ${HOSTNAME_CHECKSUM}_${i}        \
+                               --property trusted --value 1; then
+                       error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
+                               "failed with $rc"
+                       return 3
+               fi
+       done
+
+       for ((id = 500; id < NODEMAP_MAX_ID; id++)); do
+               for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
+                       nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
+                       fs_id=$(do_facet mgs $cmd --nid $nid    \
+                               --idtype uid --id $id)
+                       expected_id=$((id + 1))
+                       if [ $fs_id != $id ]; then
+                               rc=$((rc + 1))
+                       fi
+               done
+       done
+
+       ## ensure allow_root_access is enabled
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               if ! do_facet mgs $LCTL nodemap_modify          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}        \
+                       --property admin --value 1; then
+                       error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
+                               "failed with $rc"
+                       return 3
+               fi
+       done
+
+       ## check that root is mapped to 99
+       for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
+               nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
+               fs_id=$(do_facet mgs $cmd --nid $nid --idtype uid --id 0)
+               expected_id=$((id + 1))
+               if [ $fs_id != 0 ]; then
+                       rc=$((rc + 1))
+               fi
+       done
+
+       ## ensure allow_root_access is disabled
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               if ! do_facet mgs $LCTL nodemap_modify          \
+                               --name ${HOSTNAME_CHECKSUM}_${i}        \
+                               --property admin --value 0; then
+                       error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
+                               "failed with $rc"
+                       return 3
+               fi
+       done
+
+       ## check that root allowed
+       for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
+               nid="$SUBNET_CHECKSUM.0.${j}.100@tcp"
+               fs_id=$(do_facet mgs $cmd --nid $nid --idtype uid --id 0)
+               expected_id=$((id + 1))
+               if [ $fs_id != 99 ]; then
+                       rc=$((rc + 1))
+               fi
+       done
+
+       ## reset client trust to 0
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               if ! do_facet mgs $LCTL nodemap_modify          \
+                       --name ${HOSTNAME_CHECKSUM}_${i}        \
+                       --property trusted --value 0; then
+                       error "nodemap_modify ${HOSTNAME_CHECKSUM}_${i} "
+                               "failed with $rc"
+                       return 3
+               fi
+       done
+
+       return $rc
+}
+
 test_7() {
        local rc
 
@@ -765,7 +942,7 @@ test_9() {
 
        rc=0
        for ((i = 0; i < NODEMAP_COUNT; i++)); do
-               if ! del_range ${HOSTNAME_CHECKSUM}_${i} $i; then
+               if ! delete_range ${HOSTNAME_CHECKSUM}_${i} $i; then
                        rc=$((rc + 1))
                fi
        done
@@ -813,7 +990,7 @@ test_10() {
 
        rc=0
        for ((i = 0; i < NODEMAP_COUNT; i++)); do
-               if ! del_range ${HOSTNAME_CHECKSUM}_${i} $i; then
+               if ! delete_range ${HOSTNAME_CHECKSUM}_${i} $i; then
                        rc=$((rc + 1))
                fi
        done
@@ -919,7 +1096,7 @@ test_13() {
        rc=0
        for ((i = 0; i < NODEMAP_COUNT; i++)); do
                for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
-                       for ((k = 1; k < 253; k++)); do
+                       for k in $NODEMAP_IPADDR_LIST; do
                                if ! test_nid $SUBNET_CHECKSUM.$i.$j.$k \
                                       ${HOSTNAME_CHECKSUM}_${i}; then
                                        rc=$((rc + 1))
@@ -954,7 +1131,7 @@ test_14() {
        rc=0
        for ((i = 0; i < NODEMAP_COUNT; i++)); do
                for ((j = 0; j < NODEMAP_RANGE_COUNT; j++)); do
-                       for ((k = 1; k < 253; k++)); do
+                       for k in $NODEMAP_IPADDR_LIST; do
                                if ! test_nid $SUBNET_CHECKSUM.$i.$j.$k \
                                        default; then
                                        rc=$((rc + 1))
@@ -973,15 +1150,62 @@ test_14() {
 }
 run_test 14 "test default nodemap nid lookup"
 
+test_15() {
+       local rc
+
+       remote_mgs_nodsh && skip "remote MGS with nodsh" && return
+       [ $(lustre_version_code $SINGLEMGS) -lt $(version_code 2.5.53) ] &&
+               skip "No nodemap on $(get_lustre_version) MGS, need 2.5.53+" &&
+               return
+
+       rc=0
+       create_nodemaps
+       rc=$?
+       [[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
+
+       rc=0
+       for ((i = 0; i < NODEMAP_COUNT; i++)); do
+               if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
+                       rc=$((rc + 1))
+               fi
+       done
+       [[ $rc != 0 ]] && error "nodemap_add_range failed with $rc" && return 2
+
+       rc=0
+       add_idmaps
+       rc=$?
+       [[ $rc != 0 ]] && error "nodemap_add_idmap failed with $rc" && return 3
+
+       rc=0
+       test_idmap
+       rc=$?
+       [[ $rc != 0 ]] && error "nodemap_test_id failed with $rc" && return 4
+
+       rc=0
+       delete_idmaps
+       rc=$?
+       [[ $rc != 0 ]] && error "nodemap_del_idmap failed with $rc" && return 5
+
+       rc=0
+       delete_nodemaps
+       rc=$?
+       [[ $rc != 0 ]] && error "nodemap_delete failed with $rc" && return 6
+
+       return 0
+}
+run_test 15 "test id mapping"
 
 log "cleanup: ======================================================"
 
 sec_unsetup() {
-               for num in `seq $MDSCOUNT`; do
+       ## nodemap deactivated
+       do_facet mgs lctl nodemap_activate 0
+
+       for num in $(seq $MDSCOUNT); do
                if [ "${identity_old[$num]}" = 1 ]; then
-                               switch_identity $num false || identity_old[$num]=$?
+                       switch_identity $num false || identity_old[$num]=$?
                fi
-               done
+       done
 
        $RUNAS -u $ID0 ls $DIR
        $RUNAS -u $ID1 ls $DIR