1459N/A/*
1459N/A * CDDL HEADER START
1459N/A *
1459N/A * The contents of this file are subject to the terms of the
1459N/A * Common Development and Distribution License, Version 1.0 only
1459N/A * (the "License"). You may not use this file except in compliance
1459N/A * with the License.
1459N/A *
1459N/A * You can obtain a copy of the license at
1459N/A * trunk/opends/resource/legal-notices/OpenDS.LICENSE
1459N/A * or https://OpenDS.dev.java.net/OpenDS.LICENSE.
1459N/A * See the License for the specific language governing permissions
1459N/A * and limitations under the License.
1459N/A *
1459N/A * When distributing Covered Code, include this CDDL HEADER in each
1459N/A * file and include the License file at
1459N/A * trunk/opends/resource/legal-notices/OpenDS.LICENSE. If applicable,
1459N/A * add the following below this CDDL HEADER, with the fields enclosed
1459N/A * by brackets "[]" replaced with your own identifying information:
1459N/A * Portions Copyright [yyyy] [name of copyright owner]
1459N/A *
1459N/A * CDDL HEADER END
1459N/A *
1459N/A *
3232N/A * Copyright 2008 Sun Microsystems, Inc.
1459N/A */
1459N/Apackage org.opends.server.tasks;
1459N/A
1459N/A
1459N/A
1459N/Aimport java.net.InetAddress;
1459N/A
1459N/Aimport org.testng.annotations.Test;
1459N/Aimport org.testng.annotations.AfterClass;
1459N/Aimport org.testng.annotations.BeforeClass;
1459N/A
1459N/Aimport org.opends.server.TestCaseUtils;
1459N/Aimport org.opends.server.backends.task.Task;
1459N/Aimport org.opends.server.backends.task.TaskState;
1459N/Aimport org.opends.server.core.DirectoryServer;
1459N/Aimport org.opends.server.tools.LDAPSearch;
1459N/Aimport org.opends.server.tools.LDAPModify;
1459N/Aimport org.opends.server.types.DN;
1459N/A
1459N/Aimport static org.testng.Assert.*;
1459N/A
1459N/A
1459N/A
1459N/A/**
1459N/A * Tests the enter and leave lockdown mode tasks.
1459N/A */
1459N/Apublic class LockdownModeTaskTestCase
1459N/A extends TasksTestCase
1459N/A{
1459N/A /**
1459N/A * Make sure that the Directory Server is running.
1459N/A *
1459N/A * @throws Exception If an unexpected problem occurs.
1459N/A */
1459N/A @BeforeClass()
1459N/A public void startServer()
1459N/A throws Exception
1459N/A {
1459N/A TestCaseUtils.startServer();
1459N/A }
1459N/A
1459N/A
1459N/A
1459N/A /**
1459N/A * Make sure that no matter what, when these tests are done the server is no
1459N/A * longer in lockdown mode.
1459N/A */
1459N/A @AfterClass()
1459N/A public void disableLockdownMode()
1459N/A {
1459N/A DirectoryServer.setLockdownMode(false);
1459N/A }
1459N/A
1459N/A
1459N/A
1459N/A /**
1459N/A * Test to ensure that the enter and leave lockdown tasks work as expected.
1459N/A *
1459N/A * @throws Exception If an unexpected problem occurs.
1459N/A */
2342N/A @Test
1459N/A public void testLockdownModeTasks()
1459N/A throws Exception
1459N/A {
1459N/A // Add a test user that has the bypass-acl privilege but isn't a root user.
1459N/A TestCaseUtils.initializeTestBackend(true);
1459N/A TestCaseUtils.addEntry(
1459N/A "dn: cn=Admin,o=test",
1459N/A "objectClass: top",
1459N/A "objectClass: person",
1459N/A "cn: Admin",
1459N/A "sn: Admin",
1459N/A "userPassword: password",
1459N/A "ds-privilege-name: bypass-acl");
1459N/A
1459N/A
1459N/A // Make sure that the server isn't currently in lockdown mode.
1459N/A assertFalse(DirectoryServer.lockdownMode());
1459N/A
1459N/A
1459N/A // Make sure that we can retrieve the server's root DSE over an
1459N/A // unauthenticated client connection.
1459N/A InetAddress localAddress = InetAddress.getLocalHost();
1459N/A String localIP = localAddress.getHostAddress();
1459N/A boolean isLoopback = localAddress.isLoopbackAddress();
1459N/A String[] args =
1459N/A {
1459N/A "-h", localIP,
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertEquals(LDAPSearch.mainSearch(args, false, null, System.err), 0);
1459N/A
1459N/A
1459N/A // Create a file that holds the LDIF for putting the server in lockdown
1459N/A // mode.
1459N/A String taskFile = TestCaseUtils.createTempFile(
1459N/A "dn: ds-task-id=Enter Lockdown Mode,cn=Scheduled Tasks,cn=tasks",
1459N/A "changetype: add",
1459N/A "objectClass: top",
1459N/A "objectClass: ds-task",
1459N/A "ds-task-id: Enter Lockdown Mode",
1459N/A "ds-task-class-name: org.opends.server.tasks.EnterLockdownModeTask");
1459N/A
1459N/A DN taskDN = DN.decode(
1459N/A "ds-task-id=Enter Lockdown Mode,cn=Scheduled Tasks,cn=tasks");
1459N/A
1459N/A
1459N/A // Ensure that we can't put the server in lockdown mode as a non-root user.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
3853N/A "-p", String.valueOf(TestCaseUtils.getServerAdminPort()),
3853N/A "-Z", "-X",
1459N/A "-D", "cn=Admin,o=test",
1459N/A "-w", "password",
3634N/A "--noPropertiesFile",
1459N/A "-f", taskFile
1459N/A };
1459N/A assertFalse(LDAPModify.mainModify(args, false, null, System.err) == 0);
1459N/A
1459N/A
1459N/A // If the local address isn't a loopback address, then verify that we can't
1459N/A // put the server in lockdown mode using it.
1459N/A if (! isLoopback)
1459N/A {
1459N/A args = new String[]
1459N/A {
1459N/A "-h", localIP,
3853N/A "-p", String.valueOf(TestCaseUtils.getServerAdminPort()),
3853N/A "-Z", "-X",
1459N/A "-D", "cn=Directory Manager",
1459N/A "-w", "password",
3634N/A "--noPropertiesFile",
1459N/A "-f", taskFile
1459N/A };
1459N/A assertFalse(LDAPModify.mainModify(args, false, null, System.err) == 0);
1459N/A }
1459N/A
1459N/A
1459N/A // Verify that we can put the server in lockdown mode as a root user over
1459N/A // a loopback address.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
3853N/A "-p", String.valueOf(TestCaseUtils.getServerAdminPort()),
3853N/A "-Z", "-X",
1459N/A "-D", "cn=Directory Manager",
1459N/A "-w", "password",
3634N/A "--noPropertiesFile",
1459N/A "-f", taskFile
1459N/A };
1459N/A assertEquals(LDAPModify.mainModify(args, false, null, System.err), 0);
1459N/A Task task = getCompletedTask(taskDN);
1459N/A assertNotNull(task);
1459N/A assertEquals(task.getTaskState(), TaskState.COMPLETED_SUCCESSFULLY);
1459N/A assertTrue(DirectoryServer.lockdownMode());
1459N/A
1459N/A
1459N/A // If the local IP isn't the loopback address, then verify that we can't
1459N/A // connect using it even as a root user.
1459N/A if (! isLoopback)
1459N/A {
1459N/A args = new String[]
1459N/A {
1459N/A "-h", localIP,
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-D", "cn=Directory Manager",
1459N/A "-w", "password",
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertFalse(LDAPSearch.mainSearch(args, false, null, null) == 0);
1459N/A }
1459N/A
1459N/A
1459N/A // Make sure that we can no longer retrieve the server's root DSE over an
1459N/A // unauthenticated connection. In this case, we'll make sure to use a
1459N/A // loopback connection.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertFalse(LDAPSearch.mainSearch(args, false, null, null) == 0);
1459N/A
1459N/A
1459N/A // Make sure that we can no longer retrieve the server's root DSE over an
1459N/A // authenticated connection. In this case, we'll make sure to use a
1459N/A // loopback connection.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-D", "cn=Admin,o=test",
1459N/A "-w", "password",
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertFalse(LDAPSearch.mainSearch(args, false, null, null) == 0);
1459N/A
1459N/A
1459N/A // Make sure that we can retrieve the server's root DSE over a
1459N/A // root-authenticated loopback connection.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-D", "cn=Directory Manager",
1459N/A "-w", "password",
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertEquals(LDAPSearch.mainSearch(args, false, null, null), 0);
1459N/A
1459N/A
1459N/A // Use another task to take the server out of lockdown mode and make sure it
1459N/A // works.
1459N/A taskFile = TestCaseUtils.createTempFile(
1459N/A "dn: ds-task-id=Leave Lockdown Mode,cn=Scheduled Tasks,cn=tasks",
1459N/A "changetype: add",
1459N/A "objectClass: top",
1459N/A "objectClass: ds-task",
1459N/A "ds-task-id: Leave Lockdown Mode",
1459N/A "ds-task-class-name: org.opends.server.tasks.LeaveLockdownModeTask");
1459N/A
1459N/A taskDN = DN.decode(
1459N/A "ds-task-id=Leave Lockdown Mode,cn=Scheduled Tasks,cn=tasks");
1459N/A
1459N/A args = new String[]
1459N/A {
1459N/A "-h", "127.0.0.1",
3853N/A "-p", String.valueOf(TestCaseUtils.getServerAdminPort()),
3853N/A "-Z", "-X",
1459N/A "-D", "cn=Directory Manager",
1459N/A "-w", "password",
3634N/A "--noPropertiesFile",
1459N/A "-f", taskFile
1459N/A };
1459N/A assertEquals(LDAPModify.mainModify(args, false, null, System.err), 0);
1459N/A task = getCompletedTask(taskDN);
1459N/A assertNotNull(task);
1459N/A assertEquals(task.getTaskState(), TaskState.COMPLETED_SUCCESSFULLY);
1459N/A assertFalse(DirectoryServer.lockdownMode());
1459N/A
1459N/A
1459N/A // Make sure that we can once again retrieve the server's root DSE over an
1459N/A // anonymous connection.
1459N/A args = new String[]
1459N/A {
1459N/A "-h", localIP,
1459N/A "-p", String.valueOf(TestCaseUtils.getServerLdapPort()),
1459N/A "-b", "",
1459N/A "-s", "base",
3634N/A "--noPropertiesFile",
1459N/A "(objectClass=*)"
1459N/A };
1459N/A assertEquals(LDAPSearch.mainSearch(args, false, null, System.err), 0);
1459N/A }
1459N/A}
1459N/A