commit 353a572642c825c5bd815bb7ee3fec3e88142da3 · pyrox.dev/nixpkgs

-44
nixos/tests/openssh.nix
···

       35
       35
        
                 ];

     

       36
       36
        
               };

     

       37
       37
        
       

     

       38
       38
       -
             server-x11 =

     

       39
       39
       -
               { ... }:

     

       40
       40
       -
       

     

       41
       41
       -
               {

     

       42
       42
       -
                 environment.systemPackages = [ pkgs.xorg.xauth ];

     

       43
       43
       -
                 services.openssh = {

     

       44
       44
       -
                   enable = true;

     

       45
       45
       -
                   settings.X11Forwarding = true;

     

       46
       46
       -
                 };

     

       47
       47
       -
                 users.users.root.openssh.authorizedKeys.keys = [

     

       48
       48
       -
                   snakeOilPublicKey

     

       49
       49
       -
                 ];

     

       50
       50
       -
               };

     

       51
       51
       -
       

     

       52
       52
       -
             server-x11-disable =

     

       53
       53
       -
               { ... }:

     

       54
       54
       -
       

     

       55
       55
       -
               {

     

       56
       56
       -
                 environment.systemPackages = [ pkgs.xorg.xauth ];

     

       57
       57
       -
                 services.openssh = {

     

       58
       58
       -
                   enable = true;

     

       59
       59
       -
                   settings = {

     

       60
       60
       -
                     X11Forwarding = true;

     

       61
       61
       -
                     # CVE-2025-32728: the following line is ineffectual

     

       62
       62
       -
                     DisableForwarding = true;

     

       63
       63
       -
                   };

     

       64
       64
       -
                 };

     

       65
       65
       -
                 users.users.root.openssh.authorizedKeys.keys = [

     

       66
       66
       -
                   snakeOilPublicKey

     

       67
       67
       -
                 ];

     

       68
       68
       -
               };

     

       69
       69
       -
       

     

       70
       38
        
             server-allowed-users =

     

       71
       39
        
               { ... }:

     

       72
       40
        
       

     
···

       272
       240
        
             start_all()

     

       273
       241
        
       

     

       274
       242
        
             server.wait_for_unit("sshd", timeout=30)

     

       275
       275
       -
             server_x11.wait_for_unit("sshd", timeout=30)

     

       276
       276
       -
             server_x11_disable.wait_for_unit("sshd", timeout=30)

     

       277
       243
        
             server_allowed_users.wait_for_unit("sshd", timeout=30)

     

       278
       244
        
             server_localhost_only.wait_for_unit("sshd", timeout=30)

     

       279
       245
        
             server_match_rule.wait_for_unit("sshd", timeout=30)

     
···

       338
       304
        
                 )

     

       339
       305
        
                 client.succeed(

     

       340
       306
        
                     "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-lazy true",

     

       341
       341
       -
                     timeout=30

     

       342
       342
       -
                 )

     

       343
       343
       -
       

     

       344
       344
       -
             with subtest("x11-forwarding"):

     

       345
       345
       -
                 client.succeed(

     

       346
       346
       -
                     "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11 'xauth list' | tee /dev/stderr | wc -l)\" -eq 1 ]",

     

       347
       347
       -
                     timeout=30

     

       348
       348
       -
                 )

     

       349
       349
       -
                 client.succeed(

     

       350
       350
       -
                     "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11-disable 'xauth list' | tee /dev/stderr | wc -l)\" -eq 0 ]",

     

       351
       307
        
                     timeout=30

     

       352
       308
        
                 )

     

       353
       309