1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
let
common = { pkgs, ... }: {
security.dhparams.enable = true;
environment.systemPackages = [ pkgs.openssl ];
};
in import ./make-test.nix {
name = "dhparams";
nodes.generation1 = { pkgs, config, ... }: {
imports = [ common ];
security.dhparams.params.foo = 16;
security.dhparams.params.bar = 17;
systemd.services.foo = {
description = "Check systemd Ordering";
wantedBy = [ "multi-user.target" ];
unitConfig = {
# This is to make sure that the dhparams generation of foo occurs
# before this service so we need this service to start as early as
# possible to provoke a race condition.
DefaultDependencies = false;
# We check later whether the service has been started or not.
ConditionPathExists = "${config.security.dhparams.path}/foo.pem";
};
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
# The reason we only provide an ExecStop here is to ensure that we don't
# accidentally trigger an error because a file system is not yet ready
# during very early startup (we might not even have the Nix store
# available, for example if future changes in NixOS use systemd mount
# units to do early file system initialisation).
serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
};
};
nodes.generation2 = {
imports = [ common ];
security.dhparams.params.foo = 18;
};
nodes.generation3 = common;
testScript = { nodes, ... }: let
getParamPath = gen: name: let
node = "generation${toString gen}";
inherit (nodes.${node}.config.security.dhparams) path;
in "${path}/${name}.pem";
assertParamBits = gen: name: bits: let
path = getParamPath gen name;
in ''
$machine->nest('check bit size of ${path}', sub {
my $out = $machine->succeed('openssl dhparam -in ${path} -text');
$out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;
die "bit size should be ${toString bits} but it is $1 instead."
if $1 != ${toString bits};
});
'';
switchToGeneration = gen: let
node = "generation${toString gen}";
inherit (nodes.${node}.config.system.build) toplevel;
switchCmd = "${toplevel}/bin/switch-to-configuration test";
in ''
$machine->nest('switch to generation ${toString gen}', sub {
$machine->succeed('${switchCmd}');
$main::machine = ''$${node};
});
'';
in ''
my $machine = $generation1;
$machine->waitForUnit('multi-user.target');
subtest "verify startup order", sub {
$machine->succeed('systemctl is-active foo.service');
};
subtest "check bit sizes of dhparam files", sub {
${assertParamBits 1 "foo" 16}
${assertParamBits 1 "bar" 17}
};
${switchToGeneration 2}
subtest "check whether bit size has changed", sub {
${assertParamBits 2 "foo" 18}
};
subtest "ensure that dhparams file for 'bar' was deleted", sub {
$machine->fail('test -e ${getParamPath 1 "bar"}');
};
${switchToGeneration 3}
subtest "ensure that 'security.dhparams.path' has been deleted", sub {
$machine->fail(
'test -e ${nodes.generation3.config.security.dhparams.path}'
);
};
'';
}
|