commit 86a9d80b45a1b9aed0c1b0f94fdbec614703ff4a · pyrox.dev/nixpkgs

+48 -50

nixos/tests/dhparams.nix

···

       4
        
           environment.systemPackages = [ pkgs.openssl ];

     

       5
        
         };

     

       6
        
       

     

       7
       -
       in import ./make-test.nix {

     

       8
        
         name = "dhparams";

     

       9
        
       

     

       10
        
         nodes.generation1 = { pkgs, config, ... }: {

     
···

       66
        
             node = "generation${toString gen}";

     

       67
        
           in nodes.${node}.config.security.dhparams.params.${name}.path;

     

       68
        
       

     

       69
       -
           assertParamBits = gen: name: bits: let

     

       70
       -
             path = getParamPath gen name;

     

       71
       -
           in ''

     

       72
       -
             $machine->nest('check bit size of ${path}', sub {

     

       73
       -
               my $out = $machine->succeed('openssl dhparam -in ${path} -text');

     

       74
       -
               $out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;

     

       75
       -
               die "bit size should be ${toString bits} but it is $1 instead."

     

       76
       -
                 if $1 != ${toString bits};

     

       77
       -
             });

     

       78
       -
           '';

     

       79
       -
       

     

       80
        
           switchToGeneration = gen: let

     

       81
        
             node = "generation${toString gen}";

     

       82
        
             inherit (nodes.${node}.config.system.build) toplevel;

     

       83
        
             switchCmd = "${toplevel}/bin/switch-to-configuration test";

     

       84
        
           in ''

     

       85
       -
             $machine->nest('switch to generation ${toString gen}', sub {

     

       86
       -
               $machine->succeed('${switchCmd}');

     

       87
       -
               $main::machine = ''$${node};

     

       88
       -
             });

     

       0
        
       
     

       89
        
           '';

     

       90
        
       

     

       91
        
         in ''

     

       92
       -
           my $machine = $generation1;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       93
        
       

     

       94
       -
           $machine->waitForUnit('multi-user.target');

     

       0
        
       
     

       95
        
       

     

       96
       -
           subtest "verify startup order", sub {

     

       97
       -
             $machine->succeed('systemctl is-active foo.service');

     

       98
       -
           };

     

       99
        
       

     

       100
       -
           subtest "check bit sizes of dhparam files", sub {

     

       101
       -
             ${assertParamBits 1 "foo" 16}

     

       102
       -
             ${assertParamBits 1 "bar" 17}

     

       103
       -
           };

     

       0
        
       
     

       0
        
       
     

       104
        
       

     

       105
        
           ${switchToGeneration 2}

     

       106
        
       

     

       107
       -
           subtest "check whether bit size has changed", sub {

     

       108
       -
             ${assertParamBits 2 "foo" 18}

     

       109
       -
           };

     

       110
        
       

     

       111
       -
           subtest "ensure that dhparams file for 'bar' was deleted", sub {

     

       112
       -
             $machine->fail('test -e ${getParamPath 1 "bar"}');

     

       113
       -
           };

     

       114
        
       

     

       115
        
           ${switchToGeneration 3}

     

       116
        
       

     

       117
       -
           subtest "ensure that 'security.dhparams.path' has been deleted", sub {

     

       118
       -
             $machine->fail(

     

       119
       -
               'test -e ${nodes.generation3.config.security.dhparams.path}'

     

       120
       -
             );

     

       121
       -
           };

     

       122
        
       

     

       123
        
           ${switchToGeneration 4}

     

       124
        
       

     

       125
       -
           subtest "check bit sizes dhparam files", sub {

     

       126
       -
             ${assertParamBits 4 "foo2" 18}

     

       127
       -
             ${assertParamBits 4 "bar2" 19}

     

       128
       -
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       129
        
       

     

       130
       -
           subtest "check whether dhparam files are in the Nix store", sub {

     

       131
       -
             $machine->succeed(

     

       132
       -
               'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}',

     

       133
       -
               'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}',

     

       134
       -
             );

     

       135
       -
           };

     

       136
        
       

     

       137
        
           ${switchToGeneration 5}

     

       138
        
       

     

       139
       -
           subtest "check whether defaultBitSize works as intended", sub {

     

       140
       -
             ${assertParamBits 5 "foo3" 30}

     

       141
       -
             ${assertParamBits 5 "bar3" 30}

     

       142
       -
           };

     

       143
        
         '';

     

       144
        
       }

···

       4
        
           environment.systemPackages = [ pkgs.openssl ];

     

       5
        
         };

     

       6
        
       

     

       7
       +
       in import ./make-test-python.nix {

     

       8
        
         name = "dhparams";

     

       9
        
       

     

       10
        
         nodes.generation1 = { pkgs, config, ... }: {

     
···

       66
        
             node = "generation${toString gen}";

     

       67
        
           in nodes.${node}.config.security.dhparams.params.${name}.path;

     

       68
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       69
        
           switchToGeneration = gen: let

     

       70
        
             node = "generation${toString gen}";

     

       71
        
             inherit (nodes.${node}.config.system.build) toplevel;

     

       72
        
             switchCmd = "${toplevel}/bin/switch-to-configuration test";

     

       73
        
           in ''

     

       74
       +
             with machine.nested("switch to generation ${toString gen}"):

     

       75
       +
                 machine.succeed(

     

       76
       +
                     "${switchCmd}"

     

       77
       +
                 )

     

       78
       +
                 machine = ${node}

     

       79
        
           '';

     

       80
        
       

     

       81
        
         in ''

     

       82
       +
           import re

     

       83
       +
       

     

       84
       +
       

     

       85
       +
           def assert_param_bits(path, bits):

     

       86
       +
               with machine.nested(f"check bit size of {path}"):

     

       87
       +
                   output = machine.succeed(f"openssl dhparam -in {path} -text")

     

       88
       +
                   pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)

     

       89
       +
                   match = pattern.match(output)

     

       90
       +
                   if match is None:

     

       91
       +
                       raise Exception("bla")

     

       92
       +
                   if match[1] != str(bits):

     

       93
       +
                       raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")

     

       94
        
       

     

       95
       +
       

     

       96
       +
           machine = generation1

     

       97
        
       

     

       98
       +
           machine.wait_for_unit("multi-user.target")

     

       0
        
       
     

       0
        
       
     

       99
        
       

     

       100
       +
           with subtest("verify startup order"):

     

       101
       +
               machine.succeed("systemctl is-active foo.service")

     

       102
       +
       

     

       103
       +
           with subtest("check bit sizes of dhparam files"):

     

       104
       +
               assert_param_bits("${getParamPath 1 "foo"}", 16)

     

       105
       +
               assert_param_bits("${getParamPath 1 "bar"}", 17)

     

       106
        
       

     

       107
        
           ${switchToGeneration 2}

     

       108
        
       

     

       109
       +
           with subtest("check whether bit size has changed"):

     

       110
       +
               assert_param_bits("${getParamPath 2 "foo"}", 18)

     

       0
        
       
     

       111
        
       

     

       112
       +
           with subtest("ensure that dhparams file for 'bar' was deleted"):

     

       113
       +
               machine.fail("test -e ${getParamPath 1 "bar"}")

     

       0
        
       
     

       114
        
       

     

       115
        
           ${switchToGeneration 3}

     

       116
        
       

     

       117
       +
           with subtest("ensure that 'security.dhparams.path' has been deleted"):

     

       118
       +
               machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       119
        
       

     

       120
        
           ${switchToGeneration 4}

     

       121
        
       

     

       122
       +
           with subtest("check bit sizes dhparam files"):

     

       123
       +
               assert_param_bits(

     

       124
       +
                   "${getParamPath 4 "foo2"}", 18

     

       125
       +
               )

     

       126
       +
               assert_param_bits(

     

       127
       +
                   "${getParamPath 4 "bar2"}", 19

     

       128
       +
               )

     

       129
        
       

     

       130
       +
           with subtest("check whether dhparam files are in the Nix store"):

     

       131
       +
               machine.succeed(

     

       132
       +
                   "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",

     

       133
       +
                   "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",

     

       134
       +
               )

     

       0
        
       
     

       135
        
       

     

       136
        
           ${switchToGeneration 5}

     

       137
        
       

     

       138
       +
           with subtest("check whether defaultBitSize works as intended"):

     

       139
       +
               assert_param_bits("${getParamPath 5 "foo3"}", 30)

     

       140
       +
               assert_param_bits("${getParamPath 5 "bar3"}", 30)

     

       0
        
       
     

       141
        
         '';

     

       142
        
       }