diff options
Diffstat (limited to 'nixos/tests/dhparams.nix')
| -rw-r--r-- | nixos/tests/dhparams.nix | 138 |
1 files changed, 62 insertions, 76 deletions
diff --git a/nixos/tests/dhparams.nix b/nixos/tests/dhparams.nix index a0de2911777c7..021042fafdb10 100644 --- a/nixos/tests/dhparams.nix +++ b/nixos/tests/dhparams.nix @@ -1,81 +1,69 @@ -let - common = { pkgs, ... }: { - security.dhparams.enable = true; - environment.systemPackages = [ pkgs.openssl ]; - }; - -in import ./make-test-python.nix { +import ./make-test-python.nix { name = "dhparams"; - nodes.generation1 = { pkgs, config, ... }: { - imports = [ common ]; - security.dhparams.params = { - # Use low values here because we don't want the test to run for ages. - foo.bits = 16; - # Also use the old format to make sure the type is coerced in the right - # way. - bar = 17; - }; + nodes.machine = { pkgs, ... }: { + security.dhparams.enable = true; + environment.systemPackages = [ pkgs.openssl ]; - systemd.services.foo = { - description = "Check systemd Ordering"; - wantedBy = [ "multi-user.target" ]; - unitConfig = { - # This is to make sure that the dhparams generation of foo occurs - # before this service so we need this service to start as early as - # possible to provoke a race condition. - DefaultDependencies = false; - - # We check later whether the service has been started or not. - ConditionPathExists = config.security.dhparams.params.foo.path; + specialisation = { + gen1.configuration = { config, ... }: { + security.dhparams.params = { + # Use low values here because we don't want the test to run for ages. + foo.bits = 1024; + # Also use the old format to make sure the type is coerced in the right + # way. + bar = 1025; + }; + + systemd.services.foo = { + description = "Check systemd Ordering"; + wantedBy = [ "multi-user.target" ]; + unitConfig = { + # This is to make sure that the dhparams generation of foo occurs + # before this service so we need this service to start as early as + # possible to provoke a race condition. + DefaultDependencies = false; + + # We check later whether the service has been started or not. + ConditionPathExists = config.security.dhparams.params.foo.path; + }; + serviceConfig.Type = "oneshot"; + serviceConfig.RemainAfterExit = true; + # The reason we only provide an ExecStop here is to ensure that we don't + # accidentally trigger an error because a file system is not yet ready + # during very early startup (we might not even have the Nix store + # available, for example if future changes in NixOS use systemd mount + # units to do early file system initialisation). + serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true"; + }; + }; + gen2.configuration = { + security.dhparams.params.foo.bits = 1026; + }; + gen3.configuration = {}; + gen4.configuration = { + security.dhparams.stateful = false; + security.dhparams.params.foo2.bits = 1027; + security.dhparams.params.bar2.bits = 1028; + }; + gen5.configuration = { + security.dhparams.defaultBitSize = 1029; + security.dhparams.params.foo3 = {}; + security.dhparams.params.bar3 = {}; }; - serviceConfig.Type = "oneshot"; - serviceConfig.RemainAfterExit = true; - # The reason we only provide an ExecStop here is to ensure that we don't - # accidentally trigger an error because a file system is not yet ready - # during very early startup (we might not even have the Nix store - # available, for example if future changes in NixOS use systemd mount - # units to do early file system initialisation). - serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true"; }; }; - nodes.generation2 = { - imports = [ common ]; - security.dhparams.params.foo.bits = 18; - }; - - nodes.generation3 = common; - - nodes.generation4 = { - imports = [ common ]; - security.dhparams.stateful = false; - security.dhparams.params.foo2.bits = 18; - security.dhparams.params.bar2.bits = 19; - }; - - nodes.generation5 = { - imports = [ common ]; - security.dhparams.defaultBitSize = 30; - security.dhparams.params.foo3 = {}; - security.dhparams.params.bar3 = {}; - }; - testScript = { nodes, ... }: let getParamPath = gen: name: let - node = "generation${toString gen}"; - in nodes.${node}.config.security.dhparams.params.${name}.path; + node = "gen${toString gen}"; + in nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path; switchToGeneration = gen: let - node = "generation${toString gen}"; - inherit (nodes.${node}.config.system.build) toplevel; - switchCmd = "${toplevel}/bin/switch-to-configuration test"; + switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test"; in '' with machine.nested("switch to generation ${toString gen}"): - machine.succeed( - "${switchCmd}" - ) - machine = ${node} + machine.succeed("${switchCmd}") ''; in '' @@ -92,22 +80,20 @@ in import ./make-test-python.nix { if match[1] != str(bits): raise Exception(f"bit size should be {bits} but it is {match[1]} instead.") - - machine = generation1 - machine.wait_for_unit("multi-user.target") + ${switchToGeneration 1} with subtest("verify startup order"): machine.succeed("systemctl is-active foo.service") with subtest("check bit sizes of dhparam files"): - assert_param_bits("${getParamPath 1 "foo"}", 16) - assert_param_bits("${getParamPath 1 "bar"}", 17) + assert_param_bits("${getParamPath 1 "foo"}", 1024) + assert_param_bits("${getParamPath 1 "bar"}", 1025) ${switchToGeneration 2} with subtest("check whether bit size has changed"): - assert_param_bits("${getParamPath 2 "foo"}", 18) + assert_param_bits("${getParamPath 2 "foo"}", 1026) with subtest("ensure that dhparams file for 'bar' was deleted"): machine.fail("test -e ${getParamPath 1 "bar"}") @@ -115,16 +101,16 @@ in import ./make-test-python.nix { ${switchToGeneration 3} with subtest("ensure that 'security.dhparams.path' has been deleted"): - machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}") + machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}") ${switchToGeneration 4} with subtest("check bit sizes dhparam files"): assert_param_bits( - "${getParamPath 4 "foo2"}", 18 + "${getParamPath 4 "foo2"}", 1027 ) assert_param_bits( - "${getParamPath 4 "bar2"}", 19 + "${getParamPath 4 "bar2"}", 1028 ) with subtest("check whether dhparam files are in the Nix store"): @@ -136,7 +122,7 @@ in import ./make-test-python.nix { ${switchToGeneration 5} with subtest("check whether defaultBitSize works as intended"): - assert_param_bits("${getParamPath 5 "foo3"}", 30) - assert_param_bits("${getParamPath 5 "bar3"}", 30) + assert_param_bits("${getParamPath 5 "foo3"}", 1029) + assert_param_bits("${getParamPath 5 "bar3"}", 1029) ''; } |