nixosTests.dhparams: fix with openssl3
This commit is contained in:
ajs124
parent
6cbb6bc3a0
commit
8bb4c87281
|
|
@ -1,81 +1,69 @@
|
|||
let
|
||||
common = { pkgs, ... }: {
|
||||
security.dhparams.enable = true;
|
||||
environment.systemPackages = [ pkgs.openssl ];
|
||||
};
|
||||
|
||||
in import ./make-test-python.nix {
|
||||
import ./make-test-python.nix {
|
||||
name = "dhparams";
|
||||
|
||||
nodes.generation1 = { pkgs, config, ... }: {
|
||||
imports = [ common ];
|
||||
security.dhparams.params = {
|
||||
# Use low values here because we don't want the test to run for ages.
|
||||
foo.bits = 16;
|
||||
# Also use the old format to make sure the type is coerced in the right
|
||||
# way.
|
||||
bar = 17;
|
||||
};
|
||||
nodes.machine = { pkgs, ... }: {
|
||||
security.dhparams.enable = true;
|
||||
environment.systemPackages = [ pkgs.openssl ];
|
||||
|
||||
systemd.services.foo = {
|
||||
description = "Check systemd Ordering";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
unitConfig = {
|
||||
# This is to make sure that the dhparams generation of foo occurs
|
||||
# before this service so we need this service to start as early as
|
||||
# possible to provoke a race condition.
|
||||
DefaultDependencies = false;
|
||||
specialisation = {
|
||||
gen1.configuration = { config, ... }: {
|
||||
security.dhparams.params = {
|
||||
# Use low values here because we don't want the test to run for ages.
|
||||
foo.bits = 1024;
|
||||
# Also use the old format to make sure the type is coerced in the right
|
||||
# way.
|
||||
bar = 1025;
|
||||
};
|
||||
|
||||
# We check later whether the service has been started or not.
|
||||
ConditionPathExists = config.security.dhparams.params.foo.path;
|
||||
systemd.services.foo = {
|
||||
description = "Check systemd Ordering";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
unitConfig = {
|
||||
# This is to make sure that the dhparams generation of foo occurs
|
||||
# before this service so we need this service to start as early as
|
||||
# possible to provoke a race condition.
|
||||
DefaultDependencies = false;
|
||||
|
||||
# We check later whether the service has been started or not.
|
||||
ConditionPathExists = config.security.dhparams.params.foo.path;
|
||||
};
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
# The reason we only provide an ExecStop here is to ensure that we don't
|
||||
# accidentally trigger an error because a file system is not yet ready
|
||||
# during very early startup (we might not even have the Nix store
|
||||
# available, for example if future changes in NixOS use systemd mount
|
||||
# units to do early file system initialisation).
|
||||
serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
|
||||
};
|
||||
};
|
||||
gen2.configuration = {
|
||||
security.dhparams.params.foo.bits = 1026;
|
||||
};
|
||||
gen3.configuration = {};
|
||||
gen4.configuration = {
|
||||
security.dhparams.stateful = false;
|
||||
security.dhparams.params.foo2.bits = 1027;
|
||||
security.dhparams.params.bar2.bits = 1028;
|
||||
};
|
||||
gen5.configuration = {
|
||||
security.dhparams.defaultBitSize = 1029;
|
||||
security.dhparams.params.foo3 = {};
|
||||
security.dhparams.params.bar3 = {};
|
||||
};
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
# The reason we only provide an ExecStop here is to ensure that we don't
|
||||
# accidentally trigger an error because a file system is not yet ready
|
||||
# during very early startup (we might not even have the Nix store
|
||||
# available, for example if future changes in NixOS use systemd mount
|
||||
# units to do early file system initialisation).
|
||||
serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
|
||||
};
|
||||
};
|
||||
|
||||
nodes.generation2 = {
|
||||
imports = [ common ];
|
||||
security.dhparams.params.foo.bits = 18;
|
||||
};
|
||||
|
||||
nodes.generation3 = common;
|
||||
|
||||
nodes.generation4 = {
|
||||
imports = [ common ];
|
||||
security.dhparams.stateful = false;
|
||||
security.dhparams.params.foo2.bits = 18;
|
||||
security.dhparams.params.bar2.bits = 19;
|
||||
};
|
||||
|
||||
nodes.generation5 = {
|
||||
imports = [ common ];
|
||||
security.dhparams.defaultBitSize = 30;
|
||||
security.dhparams.params.foo3 = {};
|
||||
security.dhparams.params.bar3 = {};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: let
|
||||
getParamPath = gen: name: let
|
||||
node = "generation${toString gen}";
|
||||
in nodes.${node}.config.security.dhparams.params.${name}.path;
|
||||
node = "gen${toString gen}";
|
||||
in nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path;
|
||||
|
||||
switchToGeneration = gen: let
|
||||
node = "generation${toString gen}";
|
||||
inherit (nodes.${node}.config.system.build) toplevel;
|
||||
switchCmd = "${toplevel}/bin/switch-to-configuration test";
|
||||
switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test";
|
||||
in ''
|
||||
with machine.nested("switch to generation ${toString gen}"):
|
||||
machine.succeed(
|
||||
"${switchCmd}"
|
||||
)
|
||||
machine = ${node}
|
||||
machine.succeed("${switchCmd}")
|
||||
'';
|
||||
|
||||
in ''
|
||||
|
|
@ -92,22 +80,20 @@ in import ./make-test-python.nix {
|
|||
if match[1] != str(bits):
|
||||
raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
|
||||
|
||||
|
||||
machine = generation1
|
||||
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
${switchToGeneration 1}
|
||||
|
||||
with subtest("verify startup order"):
|
||||
machine.succeed("systemctl is-active foo.service")
|
||||
|
||||
with subtest("check bit sizes of dhparam files"):
|
||||
assert_param_bits("${getParamPath 1 "foo"}", 16)
|
||||
assert_param_bits("${getParamPath 1 "bar"}", 17)
|
||||
assert_param_bits("${getParamPath 1 "foo"}", 1024)
|
||||
assert_param_bits("${getParamPath 1 "bar"}", 1025)
|
||||
|
||||
${switchToGeneration 2}
|
||||
|
||||
with subtest("check whether bit size has changed"):
|
||||
assert_param_bits("${getParamPath 2 "foo"}", 18)
|
||||
assert_param_bits("${getParamPath 2 "foo"}", 1026)
|
||||
|
||||
with subtest("ensure that dhparams file for 'bar' was deleted"):
|
||||
machine.fail("test -e ${getParamPath 1 "bar"}")
|
||||
|
|
@ -115,16 +101,16 @@ in import ./make-test-python.nix {
|
|||
${switchToGeneration 3}
|
||||
|
||||
with subtest("ensure that 'security.dhparams.path' has been deleted"):
|
||||
machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")
|
||||
machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")
|
||||
|
||||
${switchToGeneration 4}
|
||||
|
||||
with subtest("check bit sizes dhparam files"):
|
||||
assert_param_bits(
|
||||
"${getParamPath 4 "foo2"}", 18
|
||||
"${getParamPath 4 "foo2"}", 1027
|
||||
)
|
||||
assert_param_bits(
|
||||
"${getParamPath 4 "bar2"}", 19
|
||||
"${getParamPath 4 "bar2"}", 1028
|
||||
)
|
||||
|
||||
with subtest("check whether dhparam files are in the Nix store"):
|
||||
|
|
@ -136,7 +122,7 @@ in import ./make-test-python.nix {
|
|||
${switchToGeneration 5}
|
||||
|
||||
with subtest("check whether defaultBitSize works as intended"):
|
||||
assert_param_bits("${getParamPath 5 "foo3"}", 30)
|
||||
assert_param_bits("${getParamPath 5 "bar3"}", 30)
|
||||
assert_param_bits("${getParamPath 5 "foo3"}", 1029)
|
||||
assert_param_bits("${getParamPath 5 "bar3"}", 1029)
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue