salt.py 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399
  1. # -*- encoding: utf-8 -*-
  2. #
  3. # The Qubes OS Project, http://www.qubes-os.org
  4. #
  5. # Copyright (C) 2017 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. #
  8. # This program is free software; you can redistribute it and/or modify
  9. # it under the terms of the GNU General Public License as published by
  10. # the Free Software Foundation; either version 2 of the License, or
  11. # (at your option) any later version.
  12. #
  13. # This program is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. # GNU General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU General Public License along
  19. # with this program; if not, see <http://www.gnu.org/licenses/>.
  20. import asyncio
  21. import json
  22. import os
  23. import shutil
  24. import subprocess
  25. import sys
  26. import qubes.tests
  27. class SaltTestMixin(object):
  28. def setUp(self):
  29. super().setUp()
  30. self.salt_testdir = '/srv/salt/test_salt'
  31. os.makedirs(self.salt_testdir, exist_ok=True)
  32. def tearDown(self):
  33. shutil.rmtree(self.salt_testdir)
  34. try:
  35. tops = '/srv/salt/_tops/base'
  36. for top_link in os.listdir(tops):
  37. path = os.path.join(tops, top_link)
  38. target = os.readlink(path)
  39. if target.startswith(self.salt_testdir):
  40. os.unlink(path)
  41. except FileNotFoundError:
  42. pass
  43. super().tearDown()
  44. def salt_call(self, cmd):
  45. full_cmd = ['qubesctl']
  46. if '--dom0-only' in cmd:
  47. full_cmd.insert(1, '--dom0-only')
  48. cmd.remove('--dom0-only')
  49. full_cmd.extend(cmd)
  50. full_cmd.append('--out=json')
  51. p = self.loop.run_until_complete(asyncio.create_subprocess_exec(
  52. *full_cmd, stdout=subprocess.PIPE))
  53. output, _ = self.loop.run_until_complete(p.communicate())
  54. if p.returncode != 0:
  55. raise subprocess.CalledProcessError(p.returncode, full_cmd, output)
  56. return output.decode()
  57. def dom0_salt_call_json(self, cmd):
  58. return json.loads(self.salt_call(['--dom0-only'] + cmd))
  59. class TC_00_Dom0(SaltTestMixin, qubes.tests.SystemTestCase):
  60. def test_000_top_enable_disable(self):
  61. with open(os.path.join(self.salt_testdir, 'something.sls'), 'w') as f:
  62. f.write('test-top-enable:\n')
  63. f.write(' test.succeed_without_changes: []\n')
  64. with open(os.path.join(self.salt_testdir, 'something.top'), 'w') as f:
  65. f.write('base:\n')
  66. f.write(' dom0:\n')
  67. f.write(' - test_salt.something\n')
  68. cmd_output = self.dom0_salt_call_json(
  69. ['top.enable', 'test_salt.something'])
  70. self.assertEqual(cmd_output,
  71. {'local': {'test_salt.something.top': {'status': 'enabled'}}})
  72. cmd_output = self.dom0_salt_call_json(['state.show_top'])
  73. self.assertIn('local', cmd_output)
  74. self.assertIn('base', cmd_output['local'])
  75. self.assertIn('test_salt.something', cmd_output['local']['base'])
  76. cmd_output = self.dom0_salt_call_json(
  77. ['top.disable', 'test_salt.something'])
  78. #self.assertEqual(cmd_output,
  79. # {'local': {'test_salt.something.top': {'status': 'disabled'}}})
  80. cmd_output = self.dom0_salt_call_json(['state.show_top'])
  81. self.assertIn('local', cmd_output)
  82. self.assertIn('base', cmd_output['local'])
  83. self.assertNotIn('test_salt.something', cmd_output['local']['base'])
  84. def test_001_state_sls(self):
  85. with open(os.path.join(self.salt_testdir, 'something.sls'), 'w') as f:
  86. f.write('test-top-enable:\n')
  87. f.write(' test.succeed_without_changes: []\n')
  88. cmd_output = self.dom0_salt_call_json(
  89. ['state.sls', 'test_salt.something'])
  90. state_id = 'test_|-test-top-enable_|-test-top-enable_|-succeed_without_changes'
  91. self.assertIn('local', cmd_output)
  92. self.assertIn(state_id, cmd_output['local'])
  93. self.assertIn('start_time', cmd_output['local'][state_id])
  94. del cmd_output['local'][state_id]['start_time']
  95. self.assertIn('duration', cmd_output['local'][state_id])
  96. del cmd_output['local'][state_id]['duration']
  97. self.assertEqual(cmd_output,
  98. {'local': {state_id: {
  99. 'name': 'test-top-enable',
  100. 'comment': 'Success!',
  101. 'result': True,
  102. '__run_num__': 0,
  103. '__sls__': 'test_salt.something',
  104. 'changes': {},
  105. '__id__': 'test-top-enable'
  106. }}})
  107. def test_010_create_vm(self):
  108. vmname = self.make_vm_name('appvm')
  109. with open(os.path.join(self.salt_testdir, 'create_vm.sls'), 'w') as f:
  110. f.write(vmname + ':\n')
  111. f.write(' qvm.vm:\n')
  112. f.write(' - present:\n')
  113. f.write(' - label: orange\n')
  114. f.write(' - prefs:\n')
  115. f.write(' - vcpus: 1\n')
  116. cmd_output = self.dom0_salt_call_json(
  117. ['state.sls', 'test_salt.create_vm'])
  118. state_out = list(cmd_output['local'].values())[0]
  119. del state_out['start_time']
  120. del state_out['duration']
  121. self.assertEqual(state_out, {
  122. 'comment': '====== [\'present\'] ======\n'
  123. '/usr/bin/qvm-create {} --class=AppVM --label=orange \n'
  124. '\n'
  125. '====== [\'prefs\'] ======\n'.format(vmname),
  126. 'name': vmname,
  127. 'result': True,
  128. 'changes': {
  129. 'qvm.prefs': {'qvm.create': {
  130. 'vcpus': {'new': 1, 'old': '*default*'}
  131. }
  132. },
  133. },
  134. '__sls__': 'test_salt.create_vm',
  135. '__run_num__': 0,
  136. '__id__': vmname,
  137. })
  138. self.assertIn(vmname, self.app.domains)
  139. vm = self.app.domains[vmname]
  140. self.assertEqual(str(vm.label), 'orange')
  141. self.assertEqual(vm.vcpus, 1)
  142. def test_011_set_prefs(self):
  143. vmname = self.make_vm_name('appvm')
  144. vm = self.app.add_new_vm('AppVM', label='red',
  145. name=vmname)
  146. self.loop.run_until_complete(vm.create_on_disk())
  147. with open(os.path.join(self.salt_testdir, 'create_vm.sls'), 'w') as f:
  148. f.write(vmname + ':\n')
  149. f.write(' qvm.vm:\n')
  150. f.write(' - present:\n')
  151. f.write(' - label: orange\n')
  152. f.write(' - prefs:\n')
  153. f.write(' - vcpus: 1\n')
  154. cmd_output = self.dom0_salt_call_json(
  155. ['state.sls', 'test_salt.create_vm'])
  156. state_out = list(cmd_output['local'].values())[0]
  157. del state_out['start_time']
  158. del state_out['duration']
  159. self.assertEqual(state_out, {
  160. 'comment': '====== [\'present\'] ======\n'
  161. '[SKIP] A VM with the name \'{}\' already exists.\n'
  162. '\n'
  163. '====== [\'prefs\'] ======\n'.format(vmname),
  164. 'name': vmname,
  165. 'result': True,
  166. 'changes': {
  167. 'qvm.prefs': {'qvm.create': {
  168. 'vcpus': {'new': 1, 'old': '*default*'}
  169. }
  170. },
  171. },
  172. '__sls__': 'test_salt.create_vm',
  173. '__run_num__': 0,
  174. '__id__': vmname,
  175. })
  176. self.assertIn(vmname, self.app.domains)
  177. vm = self.app.domains[vmname]
  178. self.assertEqual(str(vm.label), 'red')
  179. self.assertEqual(vm.vcpus, 1)
  180. def test_012_tags(self):
  181. vmname = self.make_vm_name('appvm')
  182. vm = self.app.add_new_vm('AppVM', label='red',
  183. name=vmname)
  184. self.loop.run_until_complete(vm.create_on_disk())
  185. vm.tags.add('tag1')
  186. vm.tags.add('tag3')
  187. with open(os.path.join(self.salt_testdir, 'test_state.sls'), 'w') as f:
  188. f.write(vmname + ':\n')
  189. f.write(' qvm.vm:\n')
  190. f.write(' - tags:\n')
  191. f.write(' - present:\n')
  192. f.write(' - tag1\n')
  193. f.write(' - tag2\n')
  194. f.write(' - absent:\n')
  195. f.write(' - tag3\n')
  196. f.write(' - tag4\n')
  197. cmd_output = self.dom0_salt_call_json(
  198. ['state.sls', 'test_salt.test_state'])
  199. state_out = list(cmd_output['local'].values())[0]
  200. del state_out['start_time']
  201. del state_out['duration']
  202. self.assertEqual(state_out, {
  203. 'comment': '====== [\'tags\'] ======\n',
  204. 'name': vmname,
  205. 'result': True,
  206. 'changes': {
  207. 'qvm.tags': {'qvm.tags': {
  208. 'new': ['tag1', 'tag2'], 'old': ['tag1', 'tag3'],
  209. }
  210. },
  211. },
  212. '__sls__': 'test_salt.test_state',
  213. '__run_num__': 0,
  214. '__id__': vmname,
  215. })
  216. self.assertIn(vmname, self.app.domains)
  217. vm = self.app.domains[vmname]
  218. self.assertEqual(set(vm.tags), {'tag1', 'tag2'})
  219. def test_020_qubes_pillar(self):
  220. vmname = self.make_vm_name('appvm')
  221. vm = self.app.add_new_vm('AppVM', label='red',
  222. name=vmname)
  223. self.loop.run_until_complete(vm.create_on_disk())
  224. cmd_output = self.dom0_salt_call_json(
  225. ['pillar.items', '--id=' + vmname])
  226. self.assertIn('local', cmd_output)
  227. self.assertIn('qubes', cmd_output['local'])
  228. qubes_pillar = cmd_output['local']['qubes']
  229. self.assertEqual(qubes_pillar, {
  230. 'type': 'app',
  231. 'netvm': str(vm.netvm),
  232. 'template': str(vm.template),
  233. })
  234. class SaltVMTestMixin(SaltTestMixin):
  235. template = None
  236. def setUp(self):
  237. if self.template.startswith('whonix'):
  238. self.skipTest('Whonix not supported as salt VM')
  239. super(SaltVMTestMixin, self).setUp()
  240. self.init_default_template(self.template)
  241. dispvm_tpl_name = self.make_vm_name('disp-tpl')
  242. dispvm_tpl = self.app.add_new_vm('AppVM', label='red',
  243. template_for_dispvms=True, name=dispvm_tpl_name)
  244. self.loop.run_until_complete(dispvm_tpl.create_on_disk())
  245. self.app.default_dispvm = dispvm_tpl
  246. def tearDown(self):
  247. self.app.default_dispvm = None
  248. super(SaltVMTestMixin, self).tearDown()
  249. def test_000_simple_sls(self):
  250. vmname = self.make_vm_name('target')
  251. self.vm = self.app.add_new_vm('AppVM', name=vmname, label='red')
  252. self.loop.run_until_complete(self.vm.create_on_disk())
  253. # start the VM manually, so it stays running after applying salt state
  254. self.loop.run_until_complete(self.vm.start())
  255. with open(os.path.join(self.salt_testdir, 'something.sls'), 'w') as f:
  256. f.write('/home/user/testfile:\n')
  257. f.write(' file.managed:\n')
  258. f.write(' - contents: |\n')
  259. f.write(' this is test\n')
  260. with open(os.path.join(self.salt_testdir, 'something.top'), 'w') as f:
  261. f.write('base:\n')
  262. f.write(' {}:\n'.format(vmname))
  263. f.write(' - test_salt.something\n')
  264. # enable so state.show_top will not be empty, otherwise qubesctl will
  265. # skip the VM; but we don't use state.highstate
  266. self.dom0_salt_call_json(['top.enable', 'test_salt.something'])
  267. state_output = self.salt_call(
  268. ['--skip-dom0', '--show-output', '--targets=' + vmname,
  269. 'state.sls', 'test_salt.something'])
  270. expected_output = vmname + ':\n'
  271. self.assertTrue(state_output.startswith(expected_output),
  272. 'Full output: ' + state_output)
  273. state_id = 'file_|-/home/user/testfile_|-/home/user/testfile_|-managed'
  274. # drop the header
  275. state_output_json = json.loads(state_output[len(expected_output):])
  276. state_output_json = state_output_json[vmname][state_id]
  277. try:
  278. del state_output_json['duration']
  279. del state_output_json['start_time']
  280. except KeyError:
  281. pass
  282. try:
  283. del state_output_json['pchanges']
  284. except KeyError:
  285. pass
  286. try:
  287. # older salt do not report this
  288. self.assertEqual(state_output_json['__id__'], '/home/user/testfile')
  289. del state_output_json['__id__']
  290. except KeyError:
  291. pass
  292. try:
  293. # or sls file
  294. self.assertEqual(state_output_json['__sls__'],
  295. 'test_salt.something')
  296. del state_output_json['__sls__']
  297. except KeyError:
  298. pass
  299. # different output depending on salt version
  300. expected_output = {
  301. '__run_num__': 0,
  302. 'changes': {
  303. 'diff': 'New file',
  304. },
  305. 'name': '/home/user/testfile',
  306. 'comment': 'File /home/user/testfile updated',
  307. 'result': True,
  308. }
  309. self.assertEqual(state_output_json, expected_output)
  310. stdout, stderr = self.loop.run_until_complete(self.vm.run_for_stdio(
  311. 'cat /home/user/testfile'))
  312. self.assertEqual(stdout, b'this is test\n')
  313. self.assertEqual(stderr, b'')
  314. def test_001_multi_state_highstate(self):
  315. vmname = self.make_vm_name('target')
  316. self.vm = self.app.add_new_vm('AppVM', name=vmname, label='red')
  317. self.loop.run_until_complete(self.vm.create_on_disk())
  318. # start the VM manually, so it stays running after applying salt state
  319. self.loop.run_until_complete(self.vm.start())
  320. states = ('something', 'something2')
  321. for state in states:
  322. with open(os.path.join(self.salt_testdir, state + '.sls'), 'w') as f:
  323. f.write('/home/user/{}:\n'.format(state))
  324. f.write(' file.managed:\n')
  325. f.write(' - contents: |\n')
  326. f.write(' this is test\n')
  327. with open(os.path.join(self.salt_testdir, state + '.top'), 'w') as f:
  328. f.write('base:\n')
  329. f.write(' {}:\n'.format(vmname))
  330. f.write(' - test_salt.{}\n'.format(state))
  331. self.dom0_salt_call_json(['top.enable', 'test_salt.something'])
  332. self.dom0_salt_call_json(['top.enable', 'test_salt.something2'])
  333. state_output = self.salt_call(
  334. ['--skip-dom0', '--show-output', '--targets=' + vmname,
  335. 'state.highstate'])
  336. expected_output = vmname + ':\n'
  337. self.assertTrue(state_output.startswith(expected_output),
  338. 'Full output: ' + state_output)
  339. state_output_json = json.loads(state_output[len(expected_output):])
  340. for state in states:
  341. state_id = \
  342. 'file_|-/home/user/{0}_|-/home/user/{0}_|-managed'.format(state)
  343. # drop the header
  344. self.assertIn(state_id, state_output_json[vmname])
  345. state_output_single = state_output_json[vmname][state_id]
  346. self.assertTrue(state_output_single['result'])
  347. self.assertNotEqual(state_output_single['changes'], {})
  348. stdout, stderr = self.loop.run_until_complete(self.vm.run_for_stdio(
  349. 'cat /home/user/' + state))
  350. self.assertEqual(stdout, b'this is test\n')
  351. self.assertEqual(stderr, b'')
  352. def load_tests(loader, tests, pattern):
  353. tests.addTests(loader.loadTestsFromNames(
  354. qubes.tests.create_testcases_for_templates('TC_10_VMSalt',
  355. SaltVMTestMixin, qubes.tests.SystemTestCase,
  356. module=sys.modules[__name__])))
  357. return tests