commit 86a9d80b45a1b9aed0c1b0f94fdbec614703ff4a · pyrox.dev/nixpkgs

+48 -50
nixos/tests/dhparams.nix
···

       4
       4
        
           environment.systemPackages = [ pkgs.openssl ];

     

       5
       5
        
         };

     

       6
       6
        
       

     

       7
       7
       -
       in import ./make-test.nix {

     

       7
       7
       +
       in import ./make-test-python.nix {

     

       8
       8
        
         name = "dhparams";

     

       9
       9
        
       

     

       10
       10
        
         nodes.generation1 = { pkgs, config, ... }: {

     
···

       66
       66
        
             node = "generation${toString gen}";

     

       67
       67
        
           in nodes.${node}.config.security.dhparams.params.${name}.path;

     

       68
       68
        
       

     

       69
       69
       -
           assertParamBits = gen: name: bits: let

     

       70
       70
       -
             path = getParamPath gen name;

     

       71
       71
       -
           in ''

     

       72
       72
       -
             $machine->nest('check bit size of ${path}', sub {

     

       73
       73
       -
               my $out = $machine->succeed('openssl dhparam -in ${path} -text');

     

       74
       74
       -
               $out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;

     

       75
       75
       -
               die "bit size should be ${toString bits} but it is $1 instead."

     

       76
       76
       -
                 if $1 != ${toString bits};

     

       77
       77
       -
             });

     

       78
       78
       -
           '';

     

       79
       79
       -
       

     

       80
       69
        
           switchToGeneration = gen: let

     

       81
       70
        
             node = "generation${toString gen}";

     

       82
       71
        
             inherit (nodes.${node}.config.system.build) toplevel;

     

       83
       72
        
             switchCmd = "${toplevel}/bin/switch-to-configuration test";

     

       84
       73
        
           in ''

     

       85
       85
       -
             $machine->nest('switch to generation ${toString gen}', sub {

     

       86
       86
       -
               $machine->succeed('${switchCmd}');

     

       87
       87
       -
               $main::machine = ''$${node};

     

       88
       88
       -
             });

     

       74
       74
       +
             with machine.nested("switch to generation ${toString gen}"):

     

       75
       75
       +
                 machine.succeed(

     

       76
       76
       +
                     "${switchCmd}"

     

       77
       77
       +
                 )

     

       78
       78
       +
                 machine = ${node}

     

       89
       79
        
           '';

     

       90
       80
        
       

     

       91
       81
        
         in ''

     

       92
       92
       -
           my $machine = $generation1;

     

       82
       82
       +
           import re

     

       83
       83
       +
       

     

       84
       84
       +
       

     

       85
       85
       +
           def assert_param_bits(path, bits):

     

       86
       86
       +
               with machine.nested(f"check bit size of {path}"):

     

       87
       87
       +
                   output = machine.succeed(f"openssl dhparam -in {path} -text")

     

       88
       88
       +
                   pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)

     

       89
       89
       +
                   match = pattern.match(output)

     

       90
       90
       +
                   if match is None:

     

       91
       91
       +
                       raise Exception("bla")

     

       92
       92
       +
                   if match[1] != str(bits):

     

       93
       93
       +
                       raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")

     

       93
       94
        
       

     

       94
       94
       -
           $machine->waitForUnit('multi-user.target');

     

       95
       95
       +
       

     

       96
       96
       +
           machine = generation1

     

       95
       97
        
       

     

       96
       96
       -
           subtest "verify startup order", sub {

     

       97
       97
       -
             $machine->succeed('systemctl is-active foo.service');

     

       98
       98
       -
           };

     

       98
       98
       +
           machine.wait_for_unit("multi-user.target")

     

       99
       99
        
       

     

       100
       100
       -
           subtest "check bit sizes of dhparam files", sub {

     

       101
       101
       -
             ${assertParamBits 1 "foo" 16}

     

       102
       102
       -
             ${assertParamBits 1 "bar" 17}

     

       103
       103
       -
           };

     

       100
       100
       +
           with subtest("verify startup order"):

     

       101
       101
       +
               machine.succeed("systemctl is-active foo.service")

     

       102
       102
       +
       

     

       103
       103
       +
           with subtest("check bit sizes of dhparam files"):

     

       104
       104
       +
               assert_param_bits("${getParamPath 1 "foo"}", 16)

     

       105
       105
       +
               assert_param_bits("${getParamPath 1 "bar"}", 17)

     

       104
       106
        
       

     

       105
       107
        
           ${switchToGeneration 2}

     

       106
       108
        
       

     

       107
       107
       -
           subtest "check whether bit size has changed", sub {

     

       108
       108
       -
             ${assertParamBits 2 "foo" 18}

     

       109
       109
       -
           };

     

       109
       109
       +
           with subtest("check whether bit size has changed"):

     

       110
       110
       +
               assert_param_bits("${getParamPath 2 "foo"}", 18)

     

       110
       111
        
       

     

       111
       111
       -
           subtest "ensure that dhparams file for 'bar' was deleted", sub {

     

       112
       112
       -
             $machine->fail('test -e ${getParamPath 1 "bar"}');

     

       113
       113
       -
           };

     

       112
       112
       +
           with subtest("ensure that dhparams file for 'bar' was deleted"):

     

       113
       113
       +
               machine.fail("test -e ${getParamPath 1 "bar"}")

     

       114
       114
        
       

     

       115
       115
        
           ${switchToGeneration 3}

     

       116
       116
        
       

     

       117
       117
       -
           subtest "ensure that 'security.dhparams.path' has been deleted", sub {

     

       118
       118
       -
             $machine->fail(

     

       119
       119
       -
               'test -e ${nodes.generation3.config.security.dhparams.path}'

     

       120
       120
       -
             );

     

       121
       121
       -
           };

     

       117
       117
       +
           with subtest("ensure that 'security.dhparams.path' has been deleted"):

     

       118
       118
       +
               machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")

     

       122
       119
        
       

     

       123
       120
        
           ${switchToGeneration 4}

     

       124
       121
        
       

     

       125
       125
       -
           subtest "check bit sizes dhparam files", sub {

     

       126
       126
       -
             ${assertParamBits 4 "foo2" 18}

     

       127
       127
       -
             ${assertParamBits 4 "bar2" 19}

     

       128
       128
       -
           };

     

       122
       122
       +
           with subtest("check bit sizes dhparam files"):

     

       123
       123
       +
               assert_param_bits(

     

       124
       124
       +
                   "${getParamPath 4 "foo2"}", 18

     

       125
       125
       +
               )

     

       126
       126
       +
               assert_param_bits(

     

       127
       127
       +
                   "${getParamPath 4 "bar2"}", 19

     

       128
       128
       +
               )

     

       129
       129
        
       

     

       130
       130
       -
           subtest "check whether dhparam files are in the Nix store", sub {

     

       131
       131
       -
             $machine->succeed(

     

       132
       132
       -
               'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}',

     

       133
       133
       -
               'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}',

     

       134
       134
       -
             );

     

       135
       135
       -
           };

     

       130
       130
       +
           with subtest("check whether dhparam files are in the Nix store"):

     

       131
       131
       +
               machine.succeed(

     

       132
       132
       +
                   "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",

     

       133
       133
       +
                   "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",

     

       134
       134
       +
               )

     

       136
       135
        
       

     

       137
       136
        
           ${switchToGeneration 5}

     

       138
       137
        
       

     

       139
       139
       -
           subtest "check whether defaultBitSize works as intended", sub {

     

       140
       140
       -
             ${assertParamBits 5 "foo3" 30}

     

       141
       141
       -
             ${assertParamBits 5 "bar3" 30}

     

       142
       142
       -
           };

     

       138
       138
       +
           with subtest("check whether defaultBitSize works as intended"):

     

       139
       139
       +
               assert_param_bits("${getParamPath 5 "foo3"}", 30)

     

       140
       140
       +
               assert_param_bits("${getParamPath 5 "bar3"}", 30)

     

       143
       141
        
         '';

     

       144
       142
        
       }