Merge pull request #75084 from tfc/nixos-tests-ports

Nixos tests ports
This commit is contained in:
Florian Klink 2019-12-06 09:41:22 +01:00 committed by GitHub
commit dac791a67d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 125 additions and 124 deletions

View File

@ -4,7 +4,7 @@ let
environment.systemPackages = [ pkgs.openssl ]; environment.systemPackages = [ pkgs.openssl ];
}; };
in import ./make-test.nix { in import ./make-test-python.nix {
name = "dhparams"; name = "dhparams";
nodes.generation1 = { pkgs, config, ... }: { nodes.generation1 = { pkgs, config, ... }: {
@ -66,79 +66,77 @@ in import ./make-test.nix {
node = "generation${toString gen}"; node = "generation${toString gen}";
in nodes.${node}.config.security.dhparams.params.${name}.path; in nodes.${node}.config.security.dhparams.params.${name}.path;
assertParamBits = gen: name: bits: let
path = getParamPath gen name;
in ''
$machine->nest('check bit size of ${path}', sub {
my $out = $machine->succeed('openssl dhparam -in ${path} -text');
$out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;
die "bit size should be ${toString bits} but it is $1 instead."
if $1 != ${toString bits};
});
'';
switchToGeneration = gen: let switchToGeneration = gen: let
node = "generation${toString gen}"; node = "generation${toString gen}";
inherit (nodes.${node}.config.system.build) toplevel; inherit (nodes.${node}.config.system.build) toplevel;
switchCmd = "${toplevel}/bin/switch-to-configuration test"; switchCmd = "${toplevel}/bin/switch-to-configuration test";
in '' in ''
$machine->nest('switch to generation ${toString gen}', sub { with machine.nested("switch to generation ${toString gen}"):
$machine->succeed('${switchCmd}'); machine.succeed(
$main::machine = ''$${node}; "${switchCmd}"
}); )
machine = ${node}
''; '';
in '' in ''
my $machine = $generation1; import re
$machine->waitForUnit('multi-user.target');
subtest "verify startup order", sub { def assert_param_bits(path, bits):
$machine->succeed('systemctl is-active foo.service'); with machine.nested(f"check bit size of {path}"):
}; output = machine.succeed(f"openssl dhparam -in {path} -text")
pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)
match = pattern.match(output)
if match is None:
raise Exception("bla")
if match[1] != str(bits):
raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
subtest "check bit sizes of dhparam files", sub {
${assertParamBits 1 "foo" 16} machine = generation1
${assertParamBits 1 "bar" 17}
}; machine.wait_for_unit("multi-user.target")
with subtest("verify startup order"):
machine.succeed("systemctl is-active foo.service")
with subtest("check bit sizes of dhparam files"):
assert_param_bits("${getParamPath 1 "foo"}", 16)
assert_param_bits("${getParamPath 1 "bar"}", 17)
${switchToGeneration 2} ${switchToGeneration 2}
subtest "check whether bit size has changed", sub { with subtest("check whether bit size has changed"):
${assertParamBits 2 "foo" 18} assert_param_bits("${getParamPath 2 "foo"}", 18)
};
subtest "ensure that dhparams file for 'bar' was deleted", sub { with subtest("ensure that dhparams file for 'bar' was deleted"):
$machine->fail('test -e ${getParamPath 1 "bar"}'); machine.fail("test -e ${getParamPath 1 "bar"}")
};
${switchToGeneration 3} ${switchToGeneration 3}
subtest "ensure that 'security.dhparams.path' has been deleted", sub { with subtest("ensure that 'security.dhparams.path' has been deleted"):
$machine->fail( machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")
'test -e ${nodes.generation3.config.security.dhparams.path}'
);
};
${switchToGeneration 4} ${switchToGeneration 4}
subtest "check bit sizes dhparam files", sub { with subtest("check bit sizes dhparam files"):
${assertParamBits 4 "foo2" 18} assert_param_bits(
${assertParamBits 4 "bar2" 19} "${getParamPath 4 "foo2"}", 18
}; )
assert_param_bits(
"${getParamPath 4 "bar2"}", 19
)
subtest "check whether dhparam files are in the Nix store", sub { with subtest("check whether dhparam files are in the Nix store"):
$machine->succeed( machine.succeed(
'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}', "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",
'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}', "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",
); )
};
${switchToGeneration 5} ${switchToGeneration 5}
subtest "check whether defaultBitSize works as intended", sub { with subtest("check whether defaultBitSize works as intended"):
${assertParamBits 5 "foo3" 30} assert_param_bits("${getParamPath 5 "foo3"}", 30)
${assertParamBits 5 "bar3" 30} assert_param_bits("${getParamPath 5 "bar3"}", 30)
};
''; '';
} }

View File

@ -1,6 +1,6 @@
# this test creates a simple GNU image with docker tools and sees if it executes # this test creates a simple GNU image with docker tools and sees if it executes
import ./make-test.nix ({ pkgs, ... }: import ./make-test-python.nix ({ pkgs, ... }:
{ {
name = "docker-tools-overlay"; name = "docker-tools-overlay";
meta = with pkgs.stdenv.lib.maintainers; { meta = with pkgs.stdenv.lib.maintainers; {
@ -16,17 +16,18 @@ import ./make-test.nix ({ pkgs, ... }:
}; };
}; };
testScript = testScript = ''
'' docker.wait_for_unit("sockets.target")
$docker->waitForUnit("sockets.target");
$docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'"); docker.succeed(
$docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version"); "docker load --input='${pkgs.dockerTools.examples.bash}'",
"docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version",
)
# Check if the nix store has correct user permissions depending on what # Check if the nix store has correct user permissions depending on what
# storage driver is used, incorrectly built images can show up as readonly. # storage driver is used, incorrectly built images can show up as readonly.
# drw------- 3 0 0 3 Apr 14 11:36 /nix # drw------- 3 0 0 3 Apr 14 11:36 /nix
# drw------- 99 0 0 100 Apr 14 11:36 /nix/store # drw------- 99 0 0 100 Apr 14 11:36 /nix/store
$docker->succeed("docker run --rm -u 1000:1000 ${pkgs.dockerTools.examples.bash.imageName} bash --version"); docker.succeed("docker run --rm -u 1000:1000 ${pkgs.dockerTools.examples.bash.imageName} bash --version")
''; '';
}) })

View File

@ -1,4 +1,4 @@
import ./make-test.nix ({ ... }: import ./make-test-python.nix ({ ... }:
{ {
name = "ecryptfs"; name = "ecryptfs";
@ -10,75 +10,76 @@ import ./make-test.nix ({ ... }:
}; };
testScript = '' testScript = ''
$machine->waitForUnit("default.target"); def login_as_alice():
machine.wait_until_tty_matches(1, "login: ")
machine.send_chars("alice\n")
machine.wait_until_tty_matches(1, "Password: ")
machine.send_chars("foobar\n")
machine.wait_until_tty_matches(1, "alice\@machine")
# Set alice up with a password and a home
$machine->succeed("(echo foobar; echo foobar) | passwd alice");
$machine->succeed("chown -R alice.users ~alice");
# Migrate alice's home def logout():
my $out = $machine->succeed("echo foobar | ecryptfs-migrate-home -u alice"); machine.send_chars("logout\n")
$machine->log("ecryptfs-migrate-home said: $out"); machine.wait_until_tty_matches(1, "login: ")
# Log alice in (ecryptfs passwhrase is wrapped during first login)
$machine->waitUntilTTYMatches(1, "login: "); machine.wait_for_unit("default.target")
$machine->sendChars("alice\n");
$machine->waitUntilTTYMatches(1, "Password: "); with subtest("Set alice up with a password and a home"):
$machine->sendChars("foobar\n"); machine.succeed("(echo foobar; echo foobar) | passwd alice")
$machine->waitUntilTTYMatches(1, "alice\@machine"); machine.succeed("chown -R alice.users ~alice")
$machine->sendChars("logout\n");
$machine->waitUntilTTYMatches(1, "login: "); with subtest("Migrate alice's home"):
out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice")
machine.log(f"ecryptfs-migrate-home said: {out}")
with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"):
login_as_alice()
machine.send_chars("logout\n")
machine.wait_until_tty_matches(1, "login: ")
# Why do I need to do this?? # Why do I need to do this??
$machine->succeed("su alice -c ecryptfs-umount-private || true"); machine.succeed("su alice -c ecryptfs-umount-private || true")
$machine->sleep(1); machine.sleep(1)
$machine->fail("mount | grep ecryptfs"); # check that encrypted home is not mounted
# Show contents of the user keyring with subtest("check that encrypted home is not mounted"):
my $out = $machine->succeed("su - alice -c 'keyctl list \@u'"); machine.fail("mount | grep ecryptfs")
$machine->log("keyctl unlink said: " . $out);
# Log alice again with subtest("Show contents of the user keyring"):
$machine->waitUntilTTYMatches(1, "login: "); out = machine.succeed("su - alice -c 'keyctl list \@u'")
$machine->sendChars("alice\n"); machine.log(f"keyctl unlink said: {out}")
$machine->waitUntilTTYMatches(1, "Password: ");
$machine->sendChars("foobar\n");
$machine->waitUntilTTYMatches(1, "alice\@machine");
# Create some files in encrypted home with subtest("Log alice again"):
$machine->succeed("su alice -c 'touch ~alice/a'"); login_as_alice()
$machine->succeed("su alice -c 'echo c > ~alice/b'");
# Logout with subtest("Create some files in encrypted home"):
$machine->sendChars("logout\n"); machine.succeed("su alice -c 'touch ~alice/a'")
$machine->waitUntilTTYMatches(1, "login: "); machine.succeed("su alice -c 'echo c > ~alice/b'")
with subtest("Logout"):
logout()
# Why do I need to do this?? # Why do I need to do this??
$machine->succeed("su alice -c ecryptfs-umount-private || true"); machine.succeed("su alice -c ecryptfs-umount-private || true")
$machine->sleep(1); machine.sleep(1)
# Check that the filesystem is not accessible with subtest("Check that the filesystem is not accessible"):
$machine->fail("mount | grep ecryptfs"); machine.fail("mount | grep ecryptfs")
$machine->succeed("su alice -c 'test \! -f ~alice/a'"); machine.succeed("su alice -c 'test \! -f ~alice/a'")
$machine->succeed("su alice -c 'test \! -f ~alice/b'"); machine.succeed("su alice -c 'test \! -f ~alice/b'")
# Log alice once more with subtest("Log alice once more"):
$machine->waitUntilTTYMatches(1, "login: "); login_as_alice()
$machine->sendChars("alice\n");
$machine->waitUntilTTYMatches(1, "Password: ");
$machine->sendChars("foobar\n");
$machine->waitUntilTTYMatches(1, "alice\@machine");
# Check that the files are there with subtest("Check that the files are there"):
$machine->sleep(1); machine.sleep(1)
$machine->succeed("su alice -c 'test -f ~alice/a'"); machine.succeed("su alice -c 'test -f ~alice/a'")
$machine->succeed("su alice -c 'test -f ~alice/b'"); machine.succeed("su alice -c 'test -f ~alice/b'")
$machine->succeed(qq%test "\$(cat ~alice/b)" = "c"%); machine.succeed('test "$(cat ~alice/b)" = "c"')
# Catch https://github.com/NixOS/nixpkgs/issues/16766 with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"):
$machine->succeed("su alice -c 'ls -lh ~alice/'"); machine.succeed("su alice -c 'ls -lh ~alice/'")
$machine->sendChars("logout\n"); logout()
$machine->waitUntilTTYMatches(1, "login: ");
''; '';
}) })

View File

@ -1,4 +1,4 @@
import ./make-test.nix ({ pkgs, ...} : { import ./make-test-python.nix ({ pkgs, ...} : {
name = "environment"; name = "environment";
meta = with pkgs.stdenv.lib.maintainers; { meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ nequissimus ]; maintainers = [ nequissimus ];
@ -20,16 +20,17 @@ import ./make-test.nix ({ pkgs, ...} : {
}; };
}; };
testScript = testScript = ''
'' machine.succeed('[ -L "/etc/plainFile" ]')
$machine->succeed('[ -L "/etc/plainFile" ]'); assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
$machine->succeed('cat "/etc/plainFile" | grep "Hello World"'); machine.succeed('[ -d "/etc/folder" ]')
$machine->succeed('[ -d "/etc/folder" ]'); machine.succeed('[ -d "/etc/folder/with" ]')
$machine->succeed('[ -d "/etc/folder/with" ]'); machine.succeed('[ -L "/etc/folder/with/file" ]')
$machine->succeed('[ -L "/etc/folder/with/file" ]'); assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
$machine->succeed('cat "/etc/plainFile" | grep "Hello World"');
$machine->succeed('echo ''${TERMINFO_DIRS} | grep "/run/current-system/sw/share/terminfo"'); assert "/run/current-system/sw/share/terminfo" in machine.succeed(
$machine->succeed('echo ''${NIXCON} | grep "awesome"'); "echo ''${TERMINFO_DIRS}"
)
assert "awesome" in machine.succeed("echo ''${NIXCON}")
''; '';
}) })