b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixosTests.dhparams: Port to Python

Browse source
This commit is contained in:
Jacek Galowicz 2019-12-06 07:05:06 +01:00
parent 0fef5b45e7
commit 86a9d80b45
1 changed files with 48 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

98
nixos/tests/dhparams.nix
View file

@ -4,7 +4,7 @@ let
environment.systemPackages = [ pkgs.openssl ]; environment.systemPackages = [ pkgs.openssl ];
}; };
in import ./make-test.nix { in import ./make-test-python.nix {
name = "dhparams"; name = "dhparams";
nodes.generation1 = { pkgs, config, ... }: { nodes.generation1 = { pkgs, config, ... }: {
@ -66,79 +66,77 @@ in import ./make-test.nix {
node = "generation${toString gen}"; node = "generation${toString gen}";
in nodes.${node}.config.security.dhparams.params.${name}.path; in nodes.${node}.config.security.dhparams.params.${name}.path;
assertParamBits = gen: name: bits: let
path = getParamPath gen name;
in ''
$machine->nest('check bit size of ${path}', sub {
my $out = $machine->succeed('openssl dhparam -in ${path} -text');
$out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;
die "bit size should be ${toString bits} but it is $1 instead."
if $1 != ${toString bits};
});
'';
switchToGeneration = gen: let switchToGeneration = gen: let
node = "generation${toString gen}"; node = "generation${toString gen}";
inherit (nodes.${node}.config.system.build) toplevel; inherit (nodes.${node}.config.system.build) toplevel;
switchCmd = "${toplevel}/bin/switch-to-configuration test"; switchCmd = "${toplevel}/bin/switch-to-configuration test";
in '' in ''
$machine->nest('switch to generation ${toString gen}', sub { with machine.nested("switch to generation ${toString gen}"):
$machine->succeed('${switchCmd}'); machine.succeed(
$main::machine = ''$${node}; "${switchCmd}"
}); )
machine = ${node}
''; '';
in '' in ''
my $machine = $generation1; import re
$machine->waitForUnit('multi-user.target');
subtest "verify startup order", sub { def assert_param_bits(path, bits):
$machine->succeed('systemctl is-active foo.service'); with machine.nested(f"check bit size of {path}"):
}; output = machine.succeed(f"openssl dhparam -in {path} -text")
pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)
match = pattern.match(output)
if match is None:
raise Exception("bla")
if match[1] != str(bits):
raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
subtest "check bit sizes of dhparam files", sub {
${assertParamBits 1 "foo" 16} machine = generation1
${assertParamBits 1 "bar" 17}
}; machine.wait_for_unit("multi-user.target")
with subtest("verify startup order"):
machine.succeed("systemctl is-active foo.service")
with subtest("check bit sizes of dhparam files"):
assert_param_bits("${getParamPath 1 "foo"}", 16)
assert_param_bits("${getParamPath 1 "bar"}", 17)
${switchToGeneration 2} ${switchToGeneration 2}
subtest "check whether bit size has changed", sub { with subtest("check whether bit size has changed"):
${assertParamBits 2 "foo" 18} assert_param_bits("${getParamPath 2 "foo"}", 18)
};
subtest "ensure that dhparams file for 'bar' was deleted", sub { with subtest("ensure that dhparams file for 'bar' was deleted"):
$machine->fail('test -e ${getParamPath 1 "bar"}'); machine.fail("test -e ${getParamPath 1 "bar"}")
};
${switchToGeneration 3} ${switchToGeneration 3}
subtest "ensure that 'security.dhparams.path' has been deleted", sub { with subtest("ensure that 'security.dhparams.path' has been deleted"):
$machine->fail( machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")
'test -e ${nodes.generation3.config.security.dhparams.path}'
);
};
${switchToGeneration 4} ${switchToGeneration 4}
subtest "check bit sizes dhparam files", sub { with subtest("check bit sizes dhparam files"):
${assertParamBits 4 "foo2" 18} assert_param_bits(
${assertParamBits 4 "bar2" 19} "${getParamPath 4 "foo2"}", 18
}; )
assert_param_bits(
"${getParamPath 4 "bar2"}", 19
)
subtest "check whether dhparam files are in the Nix store", sub { with subtest("check whether dhparam files are in the Nix store"):
$machine->succeed( machine.succeed(
'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}', "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",
'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}', "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",
); )
};
${switchToGeneration 5} ${switchToGeneration 5}
subtest "check whether defaultBitSize works as intended", sub { with subtest("check whether defaultBitSize works as intended"):
${assertParamBits 5 "foo3" 30} assert_param_bits("${getParamPath 5 "foo3"}", 30)
${assertParamBits 5 "bar3" 30} assert_param_bits("${getParamPath 5 "bar3"}", 30)
};
''; '';
} }