pyrox.dev
1import ./make-test-python.nix {
2 name = "dhparams";
3
4 nodes.machine = { pkgs, ... }: {
5 security.dhparams.enable = true;
6 environment.systemPackages = [ pkgs.openssl ];
7
8 specialisation = {
9 gen1.configuration = { config, ... }: {
10 security.dhparams.params = {
11 # Use low values here because we don't want the test to run for ages.
12 foo.bits = 1024;
13 # Also use the old format to make sure the type is coerced in the right
14 # way.
15 bar = 1025;
16 };
17
18 systemd.services.foo = {
19 description = "Check systemd Ordering";
20 wantedBy = [ "multi-user.target" ];
21 unitConfig = {
22 # This is to make sure that the dhparams generation of foo occurs
23 # before this service so we need this service to start as early as
24 # possible to provoke a race condition.
25 DefaultDependencies = false;
26
27 # We check later whether the service has been started or not.
28 ConditionPathExists = config.security.dhparams.params.foo.path;
29 };
30 serviceConfig.Type = "oneshot";
31 serviceConfig.RemainAfterExit = true;
32 # The reason we only provide an ExecStop here is to ensure that we don't
33 # accidentally trigger an error because a file system is not yet ready
34 # during very early startup (we might not even have the Nix store
35 # available, for example if future changes in NixOS use systemd mount
36 # units to do early file system initialisation).
37 serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
38 };
39 };
40 gen2.configuration = {
41 security.dhparams.params.foo.bits = 1026;
42 };
43 gen3.configuration = {};
44 gen4.configuration = {
45 security.dhparams.stateful = false;
46 security.dhparams.params.foo2.bits = 1027;
47 security.dhparams.params.bar2.bits = 1028;
48 };
49 gen5.configuration = {
50 security.dhparams.defaultBitSize = 1029;
51 security.dhparams.params.foo3 = {};
52 security.dhparams.params.bar3 = {};
53 };
54 };
55 };
56
57 testScript = { nodes, ... }: let
58 getParamPath = gen: name: let
59 node = "gen${toString gen}";
60 in nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path;
61
62 switchToGeneration = gen: let
63 switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test";
64 in ''
65 with machine.nested("switch to generation ${toString gen}"):
66 machine.succeed("${switchCmd}")
67 '';
68
69 in ''
70 import re
71
72
73 def assert_param_bits(path, bits):
74 with machine.nested(f"check bit size of {path}"):
75 output = machine.succeed(f"openssl dhparam -in {path} -text")
76 pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)
77 match = pattern.match(output)
78 if match is None:
79 raise Exception("bla")
80 if match[1] != str(bits):
81 raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
82
83 machine.wait_for_unit("multi-user.target")
84 ${switchToGeneration 1}
85
86 with subtest("verify startup order"):
87 machine.succeed("systemctl is-active foo.service")
88
89 with subtest("check bit sizes of dhparam files"):
90 assert_param_bits("${getParamPath 1 "foo"}", 1024)
91 assert_param_bits("${getParamPath 1 "bar"}", 1025)
92
93 ${switchToGeneration 2}
94
95 with subtest("check whether bit size has changed"):
96 assert_param_bits("${getParamPath 2 "foo"}", 1026)
97
98 with subtest("ensure that dhparams file for 'bar' was deleted"):
99 machine.fail("test -e ${getParamPath 1 "bar"}")
100
101 ${switchToGeneration 3}
102
103 with subtest("ensure that 'security.dhparams.path' has been deleted"):
104 machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")
105
106 ${switchToGeneration 4}
107
108 with subtest("check bit sizes dhparam files"):
109 assert_param_bits(
110 "${getParamPath 4 "foo2"}", 1027
111 )
112 assert_param_bits(
113 "${getParamPath 4 "bar2"}", 1028
114 )
115
116 with subtest("check whether dhparam files are in the Nix store"):
117 machine.succeed(
118 "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",
119 "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",
120 )
121
122 ${switchToGeneration 5}
123
124 with subtest("check whether defaultBitSize works as intended"):
125 assert_param_bits("${getParamPath 5 "foo3"}", 1029)
126 assert_param_bits("${getParamPath 5 "bar3"}", 1029)
127 '';
128}