qa/083

   1 #! /bin/sh
   2 # PCP QA Test No. 083
   3 # Test pmlogger access control stuff and pmlc
   4 #
   5 # Copyright (c) 1995-2002 Silicon Graphics, Inc.  All Rights Reserved.
   6 #
   7
   8 seq=`basename $0`
   9 echo "QA output created by $seq"
  10
  11 # get standard environment, filters and checks
  12 . ./common.product
  13 . ./common.filter
  14 . ./common.check
  15
  16 trap "rm -rf $tmp $tmp.*; exit" 0 1 2 3 15
  17
  18 # real QA test starts here
  19
  20 echo "this tests access control for pmlogger and exercises pmlc"
  21
  22 # Remember that we cd into $tmp
  23 #
  24 here=`pwd`
  25 signal=$PCP_BINADM_DIR/pmsignal
  26 tmp=/var/tmp/qa083.$$
  27 config=$tmp/pmlogger.conf
  28 log=$tmp/pmlogger.log
  29 me=`_get_fqdn`
  30 shortme=`hostname`
  31 errors=$tmp/errors.pmlc
  32
  33 echo "me=$me" >$here/$seq.full
  34 echo "shortme=$shortme" >>$here/$seq.full
  35
  36 _filter()
  37 {
  38     # for Linux sometimes see "Connection reset by peer" ... this is believed
  39     # to be a timing issue, and the results are semantically equivalent for
  40     # the purposes of this test, so ...
  41     # and the "receiving response from pmlogger" part of the no permission
  42     # error message may not be there for older pmlc versions, so ...
  43     #
  44     tee -a $here/$seq.full \
  45     | sed -e "s/$me/ME/" \
  46         -e "s/local:/ME/" \
  47         -e "s/$shortme/ME/" \
  48         -e "s/$other1/OTHER1/" \
  49         -e "s/$other2/OTHER2/" \
  50         -e 's/Connection reset by peer/Address already in use/' \
  51         -e '/No permission to perform/s/ receiving response from pmlogger//'
  52 }
  53
  54 # Wait for appearance ($1 is true) or disappearance ($1 is false) of primary
  55 # pmlogger
  56 #
  57 _await_logger()
  58 {
  59     for i in 1 2 3 4 5
  60     do
  61         if $PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep '[p]mlogger.*-P' | grep -v sudo >/dev/null
  62         then
  63             # if it's there and we're waiting for it, break
  64             $1 && break
  65         else
  66             # if it's not there and we're waiting for it to disappear, break
  67             $1 || break
  68         fi
  69         sleep 2
  70     done
  71     logger_pid=`$PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep '[p]mlogger.*-P' | grep -v sudo | $PCP_AWK_PROG '{ print $2 }'`
  72     if [ ! -z "$logger_pid" ]
  73     then
  74         # it's alive...
  75         if $1
  76         then
  77             echo "primary pmlogger alive"
  78         else
  79             # ...but meant to die
  80             echo
  81             echo "primary pmlogger won't die, can't do QA test, ...giving up!"
  82             $PCP_PS_PROG $PCP_PS_ALL_FLAGS | egrep '[p]m|[P]PID'
  83             exit 1
  84         fi
  85     else
  86         # it's not alive...
  87         if $1
  88         then
  89             # ...but should be
  90             echo
  91             echo "primary pmlogger won't start, can't do QA test, ...giving up!"
  92             echo "pmlogger log file:"
  93             cat $log
  94             echo "pmlogger sh log:"
  95             cat $tmp/sh.log
  96             $PCP_PS_PROG $PCP_PS_ALL_FLAGS | egrep '[p]m|[P]PID'
  97             exit 1
  98         else
  99             echo "primary pmlogger terminated"
 100         fi
 101     fi
 102 }
 103
 104 interrupt()
 105 {
 106     echo "Interrupted"
 107     exit
 108 }
 109
 110 cleanup()
 111 {
 112     cd $here
 113     rm -rf $tmp $tmp.*
 114     # kill off any surviving pmloggers
 115     #
 116     $sudo $signal -a -s TERM pmlogger
 117     _await_logger false
 118     echo "Restarting pmcd and friends..."
 119     $sudo $PCP_RC_DIR/pcp restart | _filter_pcp_start
 120     _wait_for_pmcd
 121     _wait_for_pmlogger
 122 }
 123
 124 trap interrupt 1 2 3 15
 125 trap cleanup 0
 126
 127 # real QA test starts here
 128
 129 echo
 130 echo "Running the access tests"
 131
 132 # ideally want a host with only 1 network interface ... getpmcdhosts
 133 # cannot express this, so we used to go for 1 CPU as a likely co-condition,
 134 # but even that has been dropped now that single CPU systems are so
 135 # rare
 136 #
 137 eval `./getpmcdhosts -L -n2 -v 'pcp>=2' | sed -e 's/^/other1=/' -e 's/ / other2=/'`
 138 if [ -z "$other1" ]
 139 then
 140     echo "Cannot find first remote host running pmcd v2.x" >$seq.notrun
 141     status=1
 142     exit
 143 fi
 144 if [ -z "$other2" ]
 145 then
 146     echo "Cannot find second remote host running pmcd v2.x" >$seq.notrun
 147     status=1
 148     exit
 149 fi
 150 echo "other1=$other1" >>$here/$seq.full
 151 echo "other2=$other2" >>$here/$seq.full
 152
 153 # kill off any existing primary pmlogger
 154 #
 155 $sudo $signal -a -s TERM pmlogger
 156 _await_logger false
 157
 158 if mkdir $tmp
 159 then
 160     cd $tmp
 161     # since we now run pmlogger as user/group pcp/pcp when -P is
 162     # specified, need to make this directory writeable
 163     #
 164     chmod 777 .
 165 else
 166     echo "Unable to create working directory $tmp, ...giving up!"
 167     exit 1
 168 fi
 169
 170 cat >$config <<End-Of-File
 171 # test various "all" commands
 172 log mandatory on 1 hour {
 173     kernel.all.load [ "1 minute" ]
 174 }
 175
 176 log mandatory maybe sample.bin["bin-100","bin-200","bin-300","bin-400"]
 177 log mandatory off   sample.bin["bin-600","bin-700","bin-800","bin-900"]
 178
 179 [access]
 180 allow $other1 :         all except mandatory;
 181 disallow $other2 :      all;
 182 allow $me :             all;
 183 allow localhost :       all;
 184 End-Of-File
 185
 186 echo >>$here/$seq.full
 187 cat $config >>$here/$seq.full
 188
 189 echo "starting test pmlogger..."
 190 #
 191 # extra parentheses and I/O redirection so that shell doesn't print pid
 192 #
 193 ( sh -c "$sudo $PCP_BINADM_DIR/pmlogger -P -c $config -l $log TEST" >$tmp/sh.log 2>&1 & ) >/dev/null 2>&1
 194 _await_logger true
 195 _wait_for_pmlogger $logger_pid $log
 196
 197 # Check connect and enquire access
 198
 199 echo | tee -a $here/$seq.full
 200 echo "================" | tee -a $here/$seq.full
 201 echo "checking enquire access for this host..." | tee -a $here/$seq.full
 202 pmlc -P <<End-Of-File 2>$errors \
 203 | _filter
 204 query kernel.all.load[1,5,15]
 205 quit
 206 End-Of-File
 207 if [ -s $errors ]
 208 then
 209     echo Errors: | tee -a $here/$seq.full
 210     _filter < $errors
 211     $PCP_PS_PROG $PCP_PS_ALL_FLAGS | egrep '[p]m|[P]PID'
 212     exit 1
 213 fi
 214
 215
 216 echo | tee -a $here/$seq.full
 217 echo "================" | tee -a $here/$seq.full
 218 echo "checking enquire access for other1..." | tee -a $here/$seq.full
 219 ssh -q pcpqa@$other1 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 220 | _filter
 221 query kernel.all.load[1,5,15]
 222 quit
 223 End-Of-File
 224 if [ -s $errors ]
 225 then
 226     echo Errors: | tee -a $here/$seq.full
 227     _filter < $errors
 228     echo FAILED ... sleeping
 229     exit 1
 230 fi
 231
 232 echo | tee -a $here/$seq.full
 233 echo "================" | tee -a $here/$seq.full
 234 echo "checking enquire access for other2 (should fail)..." | tee -a $here/$seq.full
 235 ssh -q pcpqa@$other2 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 236 | _filter
 237 query kernel.all.load[1,5,15]
 238 quit
 239 End-Of-File
 240 if [ -s $errors ]
 241 then
 242     echo Errors: | tee -a $here/$seq.full
 243     _filter < $errors
 244 fi
 245
 246 echo | tee -a $here/$seq.full
 247 echo "================" | tee -a $here/$seq.full
 248 echo "re-checking enquire access for this host..." | tee -a $here/$seq.full
 249 pmlc -P <<End-Of-File 2>$errors \
 250 | _filter
 251 query kernel.all.load[1,5,15]
 252 quit
 253 End-Of-File
 254 if [ -s $errors ]
 255 then
 256     echo Errors: | tee -a $here/$seq.full
 257     _filter < $errors
 258     exit 1
 259 fi
 260
 261 # Now check advisory access using sample.bin
 262
 263 cat >$config <<End-Of-File
 264 # test various explicit access commands
 265
 266 log mandatory maybe sample.bin["bin-100","bin-200","bin-300"]
 267 log mandatory off   sample.bin["bin-700","bin-800","bin-900"]
 268
 269 [access]
 270 allow $me :             enquire, advisory, mandatory;
 271 allow localhost :       enquire, advisory, mandatory;
 272 allow $other1 :         enquire, advisory;
 273 allow $other2 :         enquire;
 274 disallow *: all;
 275 End-Of-File
 276
 277 echo >>$here/$seq.full
 278 cat $config >>$here/$seq.full
 279
 280 echo "killing pmlogger used for enquire tests..."
 281 $sudo $signal -a -s TERM pmlogger
 282 _await_logger false
 283
 284 echo
 285 echo "starting new pmlogger for advisory & mandatory tests..."
 286 #
 287 # extra parentheses and I/O redirection so that shell doesn't print pid
 288 #
 289 ( sh -c "$sudo $PCP_BINADM_DIR/pmlogger -P -c $config -l $log TEST2" >$tmp/sh.log 2>&1 & ) >/dev/null 2>&1
 290 _await_logger true
 291 _wait_for_pmlogger $logger_pid $log
 292
 293 echo | tee -a $seq.full
 294 echo "================" | tee -a $seq.full
 295 echo "checking advisory access for this host..." | tee -a $seq.full
 296 echo "(100,400 will change, 700 will not)" | tee -a $seq.full
 297 pmlc -P <<End-Of-File 2>$errors \
 298 | _filter
 299 query sample.bin[100,200,300,400,500,600,700,800,900]
 300 advisory on 1 hour sample.bin[100]
 301 advisory on 2 hour sample.bin[400]
 302 advisory on 3 hour sample.bin[700]
 303 quit
 304 End-Of-File
 305 pmsleep 0.1
 306 pmlc -P <<End-Of-File 2>>$errors \
 307 | _filter
 308 query sample.bin[100,200,300,400,500,600,700,800,900]
 309 quit
 310 End-Of-File
 311 if [ -s $errors ]
 312 then
 313     $PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep pmlc
 314     cat $log
 315     echo Errors: | tee -a $seq.full
 316     _filter < $errors
 317     echo "pmlogger sh log:"
 318     cat $tmp/sh.log
 319     exit 1
 320 fi
 321
 322 echo | tee -a $seq.full
 323 echo "================" | tee -a $seq.full
 324 echo "checking advisory access for other1..." | tee -a $seq.full
 325 echo "(200,500 will change, 800 will not)" | tee -a $seq.full
 326 ssh -q pcpqa@$other1 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 327 | _filter
 328 query sample.bin[100,200,300,400,500,600,700,800,900]
 329 advisory on 1 hour sample.bin[200]
 330 advisory on 2 hour sample.bin[500]
 331 advisory on 3 hour sample.bin[800]
 332 quit
 333 End-Of-File
 334 pmsleep 0.1
 335 pmlc -P <<End-Of-File 2>>$errors \
 336 | _filter
 337 query sample.bin[100,200,300,400,500,600,700,800,900]
 338 quit
 339 End-Of-File
 340 if [ -s $errors ]
 341 then
 342     echo Errors: | tee -a $seq.full
 343     _filter < $errors
 344 fi
 345
 346 echo | tee -a $seq.full
 347 echo "================" | tee -a $seq.full
 348 echo "checking advisory access for other2..." | tee -a $seq.full
 349 echo "(expect 3 permission errors)" | tee -a $seq.full
 350 ssh -q pcpqa@$other2 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 351 | _filter
 352 query sample.bin[100,200,300,400,500,600,700,800,900]
 353 advisory on 1 hour sample.bin[300]
 354 advisory on 2 hour sample.bin[600]
 355 advisory on 3 hour sample.bin[900]
 356 quit
 357 End-Of-File
 358 pmsleep 0.1
 359 pmlc -P <<End-Of-File 2>>$errors \
 360 | _filter
 361 query sample.bin[100,200,300,400,500,600,700,800,900]
 362 quit
 363 End-Of-File
 364 if [ -s $errors ]
 365 then
 366     echo Errors: | tee -a $seq.full
 367     _filter < $errors
 368 fi
 369
 370 # Now check mandatory access using sample.bin (same config file as for advisory
 371 # access)
 372
 373 echo "killing pmlogger used for advisory tests..."
 374 $sudo $signal -a -s TERM pmlogger
 375 _await_logger false
 376
 377 echo
 378 echo "starting new pmlogger for mandatory tests..."
 379 #
 380 # extra parentheses and I/O redirection so that shell doesn't print pid
 381 #
 382 ( sh -c "$sudo $PCP_BINADM_DIR/pmlogger -P -c $config -l $log TEST3" >$tmp/sh.log 2>&1 & ) >/dev/null 2>&1
 383 _await_logger true
 384 _wait_for_pmlogger $logger_pid $log
 385
 386 echo | tee -a $seq.full
 387 echo "================" | tee -a $seq.full
 388 echo "checking mandatory access for this host..." | tee -a $seq.full
 389 echo "(100,400,700 will change)" | tee -a $seq.full
 390 pmlc -P <<End-Of-File 2>$errors \
 391 | _filter
 392 query sample.bin[100,200,300,400,500,600,700,800,900]
 393 mandatory on 3 hour sample.bin[100]
 394 mandatory on 4 hour sample.bin[400]
 395 mandatory on 5 hour sample.bin[700]
 396 quit
 397 End-Of-File
 398 pmsleep 0.1
 399 pmlc -P <<End-Of-File 2>>$errors \
 400 | _filter
 401 query sample.bin[100,200,300,400,500,600,700,800,900]
 402 quit
 403 End-Of-File
 404 if [ -s $errors ]
 405 then
 406     echo Errors: | tee -a $seq.full
 407     _filter < $errors
 408 fi
 409
 410 echo | tee -a $seq.full
 411 echo "================" | tee -a $seq.full
 412 echo "checking mandatory access for other1..." | tee -a $seq.full
 413 echo "Expect 3 permission errors" | tee -a $seq.full
 414 ssh -q pcpqa@$other1 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 415 | _filter
 416 query sample.bin[100,200,300,400,500,600,700,800,900]
 417 mandatory on 3 hour sample.bin[200]
 418 mandatory on 4 hour sample.bin[500]
 419 mandatory on 5 hour sample.bin[800]
 420 quit
 421 End-Of-File
 422 pmsleep 0.1
 423 pmlc -P <<End-Of-File 2>>$errors \
 424 | _filter
 425 query sample.bin[100,200,300,400,500,600,700,800,900]
 426 quit
 427 End-Of-File
 428 if [ -s $errors ]
 429 then
 430     echo Errors: | tee -a $seq.full
 431     _filter < $errors
 432 fi
 433
 434 echo | tee -a $seq.full
 435 echo "================" | tee -a $seq.full
 436 echo "checking mandatory access for other2..." | tee -a $seq.full
 437 echo "Expect 3 permission errors" | tee -a $seq.full
 438 ssh -q pcpqa@$other2 "sh -c 'PMCD_CONNECT_TIMEOUT=60 PMCD_REQUEST_TIMEOUT=60 pmlc -h $me -P'" <<End-Of-File 2>$errors \
 439 | _filter
 440 query sample.bin[100,200,300,400,500,600,700,800,900]
 441 mandatory on 3 hour sample.bin[300]
 442 mandatory on 4 hour sample.bin[600]
 443 mandatory on 5 hour sample.bin[900]
 444 quit
 445 End-Of-File
 446 pmsleep 0.1
 447 pmlc -P <<End-Of-File 2>>$errors \
 448 | _filter
 449 query sample.bin[100,200,300,400,500,600,700,800,900]
 450 quit
 451 End-Of-File
 452 if [ -s $errors ]
 453 then
 454     echo Errors: | tee -a $seq.full
 455     _filter < $errors
 456 fi
 457
 458 # Check that each pmlogger only accepts one pmlc connection at a time
 459
 460 echo | tee -a $seq.full
 461 echo "================" | tee -a $seq.full
 462 echo "checking 2nd pmlc for pmlogger (should fail)..." | tee -a $seq.full
 463 ( ( sleep 5 | pmlc -P ) & ) >/dev/null 2>&1
 464 sleep 3
 465 pmlc -P <<End-Of-File 2>$errors \
 466 | _filter
 467 quit
 468 End-Of-File
 469 if [ -s $errors ]
 470 then
 471     echo Errors: | tee -a $seq.full
 472     _filter < $errors
 473 fi
 474
 475 wait