/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.server.tools;
|
|
import static org.testng.Assert.assertFalse;
|
import static org.testng.Assert.assertTrue;
|
|
import java.io.File;
|
|
import org.opends.server.DirectoryServerTestCase;
|
import org.opends.server.TestCaseUtils;
|
import org.testng.annotations.DataProvider;
|
import org.testng.annotations.Test;
|
|
import com.forgerock.opendj.cli.ArgumentException;
|
|
/**
|
* Tests the arguments which let {@code setup} provision the trust store used for server
|
* to server communication from a key store the operator already holds.
|
*/
|
public class InstallDSArgumentParserTestCase extends DirectoryServerTestCase
|
{
|
/** A fragment of the message reporting that the key pair to present has to come from a key store. */
|
private static final String KEY_STORE_REQUIRED = "requires an existing key store";
|
/** A fragment of the message reporting a certificate file which cannot be read. */
|
private static final String CERT_FILE_INVALID = "does not exist";
|
/** A fragment of the message reporting an argument the parser does not know. */
|
private static final String UNKNOWN_ARGUMENT = "is not allowed for use with this program";
|
|
/**
|
* The key pair presented on the replication port is imported from an existing key
|
* store, so asking for a self-signed certificate to be generated cannot satisfy it.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testUseKeyStoreForReplicationRejectsAGeneratedCertificate() throws Exception
|
{
|
assertReportsUseKeyStoreForReplication(true,
|
"--cli", "-n", "-w", "password", "-b", "dc=example,dc=com",
|
"--generateSelfSignedCertificate", "--enableStartTLS", "--useKeyStoreForReplication");
|
}
|
|
/**
|
* The private key of a PKCS#11 token cannot be exported, so it cannot be copied into
|
* the trust store used for replication.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testUseKeyStoreForReplicationRejectsAPkcs11Token() throws Exception
|
{
|
assertReportsUseKeyStoreForReplication(true,
|
"--cli", "-n", "-w", "password", "-b", "dc=example,dc=com",
|
"--usePkcs11Keystore", "--keyStorePassword", "password", "--enableStartTLS",
|
"--useKeyStoreForReplication");
|
}
|
|
/**
|
* A key store the installer can read the key pair from is accepted, whichever of the
|
* four key store arguments names it.
|
*
|
* @param keyStoreArgument
|
* The argument naming the key store.
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test(dataProvider = "keyStoreArguments")
|
public void testUseKeyStoreForReplicationAcceptsAKeyStore(String keyStoreArgument) throws Exception
|
{
|
final File tmpDir = TestCaseUtils.createTemporaryDirectory("useKeyStoreForReplication");
|
try
|
{
|
final File keyStore = new File(tmpDir, "server.keystore");
|
assertTrue(keyStore.createNewFile());
|
assertReportsUseKeyStoreForReplication(false,
|
"--cli", "-n", "-w", "password", "-b", "dc=example,dc=com",
|
keyStoreArgument, keyStore.getAbsolutePath(), "--keyStorePassword", "password",
|
"--enableStartTLS", "--useKeyStoreForReplication");
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(tmpDir);
|
}
|
}
|
|
@DataProvider
|
public Object[][] keyStoreArguments()
|
{
|
return new Object[][] {
|
{ "--useJavaKeystore" }, { "--useJCEKS" }, { "--usePkcs12keyStore" }, { "--useBcfksKeystore" } };
|
}
|
|
/**
|
* Certificates to trust on the replication port are only meaningful together with the
|
* key pair to present there: a server which trusts an authority but keeps presenting
|
* its self-signed certificate is the half-configured state this provisioning exists to
|
* avoid.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testReplicationCaCertFileRequiresUseKeyStoreForReplication() throws Exception
|
{
|
final File tmpDir = TestCaseUtils.createTemporaryDirectory("replicationCaCertFile");
|
try
|
{
|
final File caFile = new File(tmpDir, "ca.crt");
|
assertTrue(caFile.createNewFile());
|
final String error = parseAndReturnError(
|
"--cli", "-n", "-w", "password", "-b", "dc=example,dc=com",
|
"--usePkcs12keyStore", new File(tmpDir, "server.p12").getAbsolutePath(),
|
"--keyStorePassword", "password", "--enableStartTLS",
|
"--replicationCaCertFile", caFile.getAbsolutePath());
|
assertTrue(error.contains("replicationCaCertFile") && error.contains("useKeyStoreForReplication"), error);
|
assertFalse(error.contains(UNKNOWN_ARGUMENT), error);
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(tmpDir);
|
}
|
}
|
|
/**
|
* A certificate file which does not exist is reported while the arguments are checked,
|
* rather than half way through the installation.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testReplicationCaCertFileMustExist() throws Exception
|
{
|
final File tmpDir = TestCaseUtils.createTemporaryDirectory("replicationCaCertMissing");
|
try
|
{
|
final File missing = new File(tmpDir, "nonexistent.crt");
|
final String error = parseAndReturnError(
|
"--cli", "-n", "-w", "password", "-b", "dc=example,dc=com",
|
"--usePkcs12keyStore", new File(tmpDir, "server.p12").getAbsolutePath(),
|
"--keyStorePassword", "password", "--enableStartTLS", "--useKeyStoreForReplication",
|
"--replicationCaCertFile", missing.getAbsolutePath());
|
assertTrue(error.contains(missing.getAbsolutePath()) && error.contains(CERT_FILE_INVALID), error);
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(tmpDir);
|
}
|
}
|
|
/**
|
* Asserts whether the arguments are rejected because {@code --useKeyStoreForReplication}
|
* cannot be satisfied. Other errors, such as a port which happens to be in use on the
|
* machine running the tests, are ignored: only the message under test is looked for. The
|
* wording is matched as well as the argument name, so that an argument the parser does
|
* not know at all, which is reported by name too, does not pass for the check under test.
|
*/
|
private void assertReportsUseKeyStoreForReplication(boolean expected, String... args) throws Exception
|
{
|
final String error = parseAndReturnError(args);
|
final boolean reported =
|
error.contains("useKeyStoreForReplication") && error.contains(KEY_STORE_REQUIRED);
|
if (expected)
|
{
|
assertTrue(reported, error);
|
}
|
else
|
{
|
assertFalse(reported, error);
|
assertFalse(error.contains(UNKNOWN_ARGUMENT), error);
|
}
|
}
|
|
/** Parses the provided arguments and returns the reported errors, empty if there is none. */
|
private String parseAndReturnError(String... args) throws Exception
|
{
|
final InstallDSArgumentParser parser = new InstallDSArgumentParser(InstallDS.class.getName());
|
parser.initializeArguments();
|
try
|
{
|
parser.parseArguments(args);
|
return "";
|
}
|
catch (ArgumentException e)
|
{
|
return e.getMessage();
|
}
|
}
|
}
|
