pyrox.dev
1import ./make-test-python.nix ({ pkgs, ... }:
2let
3 # build a getent that itself doesn't see anything in /etc/hosts and
4 # /etc/nsswitch.conf, by using libredirect to steer its own requests to
5 # /dev/null.
6 # This means is /has/ to go via nscd to actuallly resolve any of the
7 # additionally configured hosts.
8 getent' = pkgs.writeScript "getent-without-etc-hosts" ''
9 export NIX_REDIRECTS=/etc/hosts=/dev/null:/etc/nsswitch.conf=/dev/null
10 export LD_PRELOAD=${pkgs.libredirect}/lib/libredirect.so
11 exec getent $@
12 '';
13in
14{
15 name = "nscd";
16
17 nodes.machine = { pkgs, ... }: {
18 imports = [ common/user-account.nix ];
19 networking.extraHosts = ''
20 2001:db8::1 somehost.test
21 192.0.2.1 somehost.test
22 '';
23
24 systemd.services.sockdump = {
25 wantedBy = [ "multi-user.target" ];
26 path = [
27 # necessary for bcc to unpack kernel headers and invoke modprobe
28 pkgs.gnutar
29 pkgs.xz.bin
30 pkgs.kmod
31 ];
32 environment.PYTHONUNBUFFERED = "1";
33
34 serviceConfig = {
35 ExecStart = "${pkgs.sockdump}/bin/sockdump /var/run/nscd/socket";
36 Restart = "on-failure";
37 RestartSec = "1";
38 Type = "simple";
39 };
40 };
41
42 specialisation = {
43 withUnscd.configuration = { ... }: {
44 services.nscd.package = pkgs.unscd;
45 };
46 withNsncd.configuration = { ... }: {
47 services.nscd.enableNsncd = true;
48 };
49 };
50 };
51
52 testScript = { nodes, ... }:
53 let
54 specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
55 in
56 ''
57 # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
58 def test_dynamic_user():
59 with subtest("DynamicUser actually allocates a user"):
60 assert "iamatest" in machine.succeed(
61 "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
62 )
63
64 # Test resolution of somehost.test with getent', to make sure we go via
65 # nscd protocol
66 def test_host_lookups():
67 with subtest("host lookups via nscd protocol"):
68 # ahosts
69 output = machine.succeed("${getent'} ahosts somehost.test")
70 assert "192.0.2.1" in output
71 assert "2001:db8::1" in output
72
73 # ahostsv4
74 output = machine.succeed("${getent'} ahostsv4 somehost.test")
75 assert "192.0.2.1" in output
76 assert "2001:db8::1" not in output
77
78 # ahostsv6
79 output = machine.succeed("${getent'} ahostsv6 somehost.test")
80 assert "192.0.2.1" not in output
81 assert "2001:db8::1" in output
82
83 # reverse lookups (hosts)
84 assert "somehost.test" in machine.succeed("${getent'} hosts 2001:db8::1")
85 assert "somehost.test" in machine.succeed("${getent'} hosts 192.0.2.1")
86
87
88 # Test host resolution via nss modules works
89 # We rely on nss-myhostname in this case, which resolves *.localhost and
90 # _gateway.
91 # We don't need to use getent' here, as non-glibc nss modules can only be
92 # discovered via nscd.
93 def test_nss_myhostname():
94 with subtest("nss-myhostname provides hostnames (ahosts)"):
95 # ahosts
96 output = machine.succeed("getent ahosts foobar.localhost")
97 assert "::1" in output
98 assert "127.0.0.1" in output
99
100 # ahostsv4
101 output = machine.succeed("getent ahostsv4 foobar.localhost")
102 assert "::1" not in output
103 assert "127.0.0.1" in output
104
105 # ahostsv6
106 output = machine.succeed("getent ahostsv6 foobar.localhost")
107 assert "::1" in output
108 assert "127.0.0.1" not in output
109
110 start_all()
111 machine.wait_for_unit("default.target")
112
113 # give sockdump some time to finish attaching.
114 machine.sleep(5)
115
116 # Test all tests with glibc-nscd.
117 test_dynamic_user()
118 test_host_lookups()
119 test_nss_myhostname()
120
121 with subtest("unscd"):
122 machine.succeed('${specialisations}/withUnscd/bin/switch-to-configuration test')
123 machine.wait_for_unit("default.target")
124
125 # known to fail, unscd doesn't load external NSS modules
126 # test_dynamic_user()
127
128 test_host_lookups()
129
130 # known to fail, unscd doesn't load external NSS modules
131 # test_nss_myhostname()
132
133 with subtest("nsncd"):
134 machine.succeed('${specialisations}/withNsncd/bin/switch-to-configuration test')
135 machine.wait_for_unit("default.target")
136
137 test_dynamic_user()
138 test_host_lookups()
139 test_nss_myhostname()
140 '';
141})