uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead
https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
This commit is contained in:
Anton Arapov
Alan Daniels
commit
56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
283
nixos/tests/taskserver.nix
Normal file
283
nixos/tests/taskserver.nix
Normal file
|
|
@ -0,0 +1,283 @@
|
|||
import ./make-test-python.nix ({ pkgs, ... }: let
|
||||
snakeOil = pkgs.runCommand "snakeoil-certs" {
|
||||
outputs = [ "out" "cacert" "cert" "key" "crl" ];
|
||||
buildInputs = [ pkgs.gnutls.bin ];
|
||||
caTemplate = pkgs.writeText "snakeoil-ca.template" ''
|
||||
cn = server
|
||||
expiration_days = -1
|
||||
cert_signing_key
|
||||
ca
|
||||
'';
|
||||
certTemplate = pkgs.writeText "snakeoil-cert.template" ''
|
||||
cn = server
|
||||
expiration_days = -1
|
||||
tls_www_server
|
||||
encryption_key
|
||||
signing_key
|
||||
'';
|
||||
crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
|
||||
expiration_days = -1
|
||||
'';
|
||||
userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
|
||||
organization = snakeoil
|
||||
cn = server
|
||||
expiration_days = -1
|
||||
tls_www_client
|
||||
encryption_key
|
||||
signing_key
|
||||
'';
|
||||
} ''
|
||||
certtool -p --bits 4096 --outfile ca.key
|
||||
certtool -s --template "$caTemplate" --load-privkey ca.key \
|
||||
--outfile "$cacert"
|
||||
certtool -p --bits 4096 --outfile "$key"
|
||||
certtool -c --template "$certTemplate" \
|
||||
--load-ca-privkey ca.key \
|
||||
--load-ca-certificate "$cacert" \
|
||||
--load-privkey "$key" \
|
||||
--outfile "$cert"
|
||||
certtool --generate-crl --template "$crlTemplate" \
|
||||
--load-ca-privkey ca.key \
|
||||
--load-ca-certificate "$cacert" \
|
||||
--outfile "$crl"
|
||||
|
||||
mkdir "$out"
|
||||
|
||||
# Stripping key information before the actual PEM-encoded values is solely
|
||||
# to make test output a bit less verbose when copying the client key to the
|
||||
# actual client.
|
||||
certtool -p --bits 4096 | sed -n \
|
||||
-e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
|
||||
|
||||
certtool -c --template "$userCertTemplate" \
|
||||
--load-privkey "$out/alice.key" \
|
||||
--load-ca-privkey ca.key \
|
||||
--load-ca-certificate "$cacert" \
|
||||
--outfile "$out/alice.cert"
|
||||
'';
|
||||
|
||||
in {
|
||||
name = "taskserver";
|
||||
|
||||
nodes = rec {
|
||||
server = {
|
||||
services.taskserver.enable = true;
|
||||
services.taskserver.listenHost = "::";
|
||||
services.taskserver.openFirewall = true;
|
||||
services.taskserver.fqdn = "server";
|
||||
services.taskserver.organisations = {
|
||||
testOrganisation.users = [ "alice" "foo" ];
|
||||
anotherOrganisation.users = [ "bob" ];
|
||||
};
|
||||
};
|
||||
|
||||
# New generation of the server with manual config
|
||||
newServer = { lib, nodes, ... }: {
|
||||
imports = [ server ];
|
||||
services.taskserver.pki.manual = {
|
||||
ca.cert = snakeOil.cacert;
|
||||
server.cert = snakeOil.cert;
|
||||
server.key = snakeOil.key;
|
||||
server.crl = snakeOil.crl;
|
||||
};
|
||||
# This is to avoid assigning a different network address to the new
|
||||
# generation.
|
||||
networking = lib.mapAttrs (lib.const lib.mkForce) {
|
||||
interfaces.eth1.ipv4 = nodes.server.config.networking.interfaces.eth1.ipv4;
|
||||
inherit (nodes.server.config.networking)
|
||||
hostName primaryIPAddress extraHosts;
|
||||
};
|
||||
};
|
||||
|
||||
client1 = { pkgs, ... }: {
|
||||
environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
|
||||
users.users.alice.isNormalUser = true;
|
||||
users.users.bob.isNormalUser = true;
|
||||
users.users.foo.isNormalUser = true;
|
||||
users.users.bar.isNormalUser = true;
|
||||
};
|
||||
|
||||
client2 = client1;
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: let
|
||||
cfg = nodes.server.config.services.taskserver;
|
||||
portStr = toString cfg.listenPort;
|
||||
newServerSystem = nodes.newServer.config.system.build.toplevel;
|
||||
switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
|
||||
in ''
|
||||
from shlex import quote
|
||||
|
||||
|
||||
def su(user, cmd):
|
||||
return f"su - {user} -c {quote(cmd)}"
|
||||
|
||||
|
||||
def no_extra_init(client, org, user):
|
||||
pass
|
||||
|
||||
|
||||
def setup_clients_for(org, user, extra_init=no_extra_init):
|
||||
for client in [client1, client2]:
|
||||
with client.nested(f"initialize client for user {user}"):
|
||||
client.succeed(
|
||||
su(user, f"rm -rf /home/{user}/.task"),
|
||||
su(user, "task rc.confirmation=no config confirmation no"),
|
||||
)
|
||||
|
||||
exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
|
||||
|
||||
with client.nested("importing taskwarrior configuration"):
|
||||
client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
|
||||
|
||||
extra_init(client, org, user)
|
||||
|
||||
client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
|
||||
|
||||
client.succeed(su(user, "task sync init >&2"))
|
||||
|
||||
|
||||
def restart_server():
|
||||
server.systemctl("restart taskserver.service")
|
||||
server.wait_for_open_port(${portStr})
|
||||
|
||||
|
||||
def re_add_imperative_user():
|
||||
with server.nested("(re-)add imperative user bar"):
|
||||
server.execute("nixos-taskserver org remove imperativeOrg")
|
||||
server.succeed(
|
||||
"nixos-taskserver org add imperativeOrg",
|
||||
"nixos-taskserver user add imperativeOrg bar",
|
||||
)
|
||||
setup_clients_for("imperativeOrg", "bar")
|
||||
|
||||
|
||||
def test_sync(user):
|
||||
with subtest(f"sync for user {user}"):
|
||||
client1.succeed(su(user, "task add foo >&2"))
|
||||
client1.succeed(su(user, "task sync >&2"))
|
||||
client2.fail(su(user, "task list >&2"))
|
||||
client2.succeed(su(user, "task sync >&2"))
|
||||
client2.succeed(su(user, "task list >&2"))
|
||||
|
||||
|
||||
def check_client_cert(user):
|
||||
# debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
|
||||
cmd = (
|
||||
f"gnutls-cli -d 3"
|
||||
f" --x509cafile=/home/{user}/.task/keys/ca.cert"
|
||||
f" --x509keyfile=/home/{user}/.task/keys/private.key"
|
||||
f" --x509certfile=/home/{user}/.task/keys/public.cert"
|
||||
f" --port=${portStr} server < /dev/null"
|
||||
)
|
||||
return su(user, cmd)
|
||||
|
||||
|
||||
# Explicitly start the VMs so that we don't accidentally start newServer
|
||||
server.start()
|
||||
client1.start()
|
||||
client2.start()
|
||||
|
||||
server.wait_for_unit("taskserver.service")
|
||||
|
||||
server.succeed(
|
||||
"nixos-taskserver user list testOrganisation | grep -qxF alice",
|
||||
"nixos-taskserver user list testOrganisation | grep -qxF foo",
|
||||
"nixos-taskserver user list anotherOrganisation | grep -qxF bob",
|
||||
)
|
||||
|
||||
server.wait_for_open_port(${portStr})
|
||||
|
||||
client1.wait_for_unit("multi-user.target")
|
||||
client2.wait_for_unit("multi-user.target")
|
||||
|
||||
setup_clients_for("testOrganisation", "alice")
|
||||
setup_clients_for("testOrganisation", "foo")
|
||||
setup_clients_for("anotherOrganisation", "bob")
|
||||
|
||||
for user in ["alice", "bob", "foo"]:
|
||||
test_sync(user)
|
||||
|
||||
server.fail("nixos-taskserver user add imperativeOrg bar")
|
||||
re_add_imperative_user()
|
||||
|
||||
test_sync("bar")
|
||||
|
||||
with subtest("checking certificate revocation of user bar"):
|
||||
client1.succeed(check_client_cert("bar"))
|
||||
|
||||
server.succeed("nixos-taskserver user remove imperativeOrg bar")
|
||||
restart_server()
|
||||
|
||||
client1.fail(check_client_cert("bar"))
|
||||
|
||||
client1.succeed(su("bar", "task add destroy everything >&2"))
|
||||
client1.fail(su("bar", "task sync >&2"))
|
||||
|
||||
re_add_imperative_user()
|
||||
|
||||
with subtest("checking certificate revocation of org imperativeOrg"):
|
||||
client1.succeed(check_client_cert("bar"))
|
||||
|
||||
server.succeed("nixos-taskserver org remove imperativeOrg")
|
||||
restart_server()
|
||||
|
||||
client1.fail(check_client_cert("bar"))
|
||||
|
||||
client1.succeed(su("bar", "task add destroy even more >&2"))
|
||||
client1.fail(su("bar", "task sync >&2"))
|
||||
|
||||
re_add_imperative_user()
|
||||
|
||||
with subtest("check whether declarative config overrides user bar"):
|
||||
restart_server()
|
||||
test_sync("bar")
|
||||
|
||||
|
||||
def init_manual_config(client, org, user):
|
||||
cfgpath = f"/home/{user}/.task"
|
||||
|
||||
client.copy_from_host(
|
||||
"${snakeOil.cacert}",
|
||||
f"{cfgpath}/ca.cert",
|
||||
)
|
||||
for file in ["alice.key", "alice.cert"]:
|
||||
client.copy_from_host(
|
||||
f"${snakeOil}/{file}",
|
||||
f"{cfgpath}/{file}",
|
||||
)
|
||||
|
||||
for file in [f"{user}.key", f"{user}.cert"]:
|
||||
client.copy_from_host(
|
||||
f"${snakeOil}/{file}",
|
||||
f"{cfgpath}/{file}",
|
||||
)
|
||||
|
||||
client.succeed(
|
||||
su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
|
||||
su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
|
||||
su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
|
||||
)
|
||||
|
||||
|
||||
with subtest("check manual configuration"):
|
||||
# Remove the keys from automatic CA creation, to make sure the new
|
||||
# generation doesn't use keys from before.
|
||||
server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
|
||||
|
||||
server.succeed(
|
||||
"${switchToNewServer} >&2"
|
||||
)
|
||||
server.wait_for_unit("taskserver.service")
|
||||
server.wait_for_open_port(${portStr})
|
||||
|
||||
server.succeed(
|
||||
"nixos-taskserver org add manualOrg",
|
||||
"nixos-taskserver user add manualOrg alice",
|
||||
)
|
||||
|
||||
setup_clients_for("manualOrg", "alice", init_manual_config)
|
||||
|
||||
test_sync("alice")
|
||||
'';
|
||||
})
|
||||
Loading…
Add table
Add a link
Reference in a new issue