This would be easy and helpful. We should do this when time allows, if there isn't already a way to do this.

Launchpad Details: #LPC Margaret Cullen - 2017-05-08 20:24:45 +0000

from trust-router.

Implemented by #60 (and then changed to -C in the next commit)

from trust-router.

Test

Steps

1. Install an invalid configuration
2. Run the trust router with the -C option
3. It should exit with an error message and echo $? should report non-zero exit status
4. Install a valid configuration
5. Run the trust router with the -C option
6. It should exit with a success message and `echo $? should report zero exit status

Expected results

Output as described above

from trust-router.

• Invalid JSON syntax (leave off a closing brace): ✔️
• Invalid JSON key name (root => "communities" => [0] => "apcs" renamed to "abcs"): ✔️
• Invalid data:
  • "apcs" value of [1, 2, true]: ❌
  • Port numbers of 0, 66500: ❌

What all are you considering part of "invalid"?

from trust-router.

Hm, when I set APCs to an array with non-string values or use 0/66500 as ports, I get errors. Maybe another CentOS-specific issue? I'll try on a CentOS instance.

from trust-router.

Ok, if the "apcs" for a community of type "apc" [1,2,true], it is accepted. I think this is ok - the "apcs" field is ignored for an APC community. If I change the community to a "coi" then it gives an error.

Where are you setting ports?

from trust-router.

ah, must be for the trust router to listen on (I think invalid ports for AAA servers or peer trust routers are being flagged as errors).

I'll fix that. I'm inclined to leave the "apcs" as is (as long as it's only for the APC community). We currently don't do validation of fields that are present but should not be, and I think that'd be the right place to deal with that (i.e., any non-empty "apcs" array for an APC indicates a confused configuration)

from trust-router.

Oh, the fix to add port validation is waiting in #92.

from trust-router.

Ok, if the "apcs" for a community of type "apc" [1,2,true], it is accepted. I think this is ok - the "apcs" field is ignored for an APC community. If I change the community to a "coi" then it gives an error.

That seems reasonable.

Where are you setting ports?

ah, must be for the trust router to listen on

Indeed, it was.

from trust-router.

I'm inclined to leave the "apcs" as is (as long as it's only for the APC community). We currently don't do validation of fields that are present but should not be

That sounds good.

from trust-router.

Passed.

from trust-router.