nixpkgs/nixos/tests/dhparams.nix

import ./make-test-python.nix {
  name = "dhparams";

  nodes.machine =
    { pkgs, ... }:
    {
      security.dhparams.enable = true;
      environment.systemPackages = [ pkgs.openssl ];

      specialisation = {
        gen1.configuration =
          { config, ... }:
          {
            security.dhparams.params = {
              # Use low values here because we don't want the test to run for ages.
              foo.bits = 1024;
              # Also use the old format to make sure the type is coerced in the right
              # way.
              bar = 1025;
            };

            systemd.services.foo = {
              description = "Check systemd Ordering";
              wantedBy = [ "multi-user.target" ];
              before = [ "shutdown.target" ];
              conflicts = [ "shutdown.target" ];
              unitConfig = {
                # This is to make sure that the dhparams generation of foo occurs
                # before this service so we need this service to start as early as
                # possible to provoke a race condition.
                DefaultDependencies = false;

                # We check later whether the service has been started or not.
                ConditionPathExists = config.security.dhparams.params.foo.path;
              };
              serviceConfig.Type = "oneshot";
              serviceConfig.RemainAfterExit = true;
              # The reason we only provide an ExecStop here is to ensure that we don't
              # accidentally trigger an error because a file system is not yet ready
              # during very early startup (we might not even have the Nix store
              # available, for example if future changes in NixOS use systemd mount
              # units to do early file system initialisation).
              serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
            };
          };
        gen2.configuration = {
          security.dhparams.params.foo.bits = 1026;
        };
        gen3.configuration = { };
        gen4.configuration = {
          security.dhparams.stateful = false;
          security.dhparams.params.foo2.bits = 1027;
          security.dhparams.params.bar2.bits = 1028;
        };
        gen5.configuration = {
          security.dhparams.defaultBitSize = 1029;
          security.dhparams.params.foo3 = { };
          security.dhparams.params.bar3 = { };
        };
      };
    };

  testScript =
    { nodes, ... }:
    let
      getParamPath =
        gen: name:
        let
          node = "gen${toString gen}";
        in
        nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path;

      switchToGeneration =
        gen:
        let
          switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test";
        in
        ''
          with machine.nested("switch to generation ${toString gen}"):
            machine.succeed("${switchCmd}")
        '';

    in
    ''
      import re


      def assert_param_bits(path, bits):
          with machine.nested(f"check bit size of {path}"):
              output = machine.succeed(f"openssl dhparam -in {path} -text")
              pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)
              match = pattern.match(output)
              if match is None:
                  raise Exception("bla")
              if match[1] != str(bits):
                  raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")

      machine.wait_for_unit("multi-user.target")
      ${switchToGeneration 1}

      with subtest("verify startup order"):
          machine.succeed("systemctl is-active foo.service")

      with subtest("check bit sizes of dhparam files"):
          assert_param_bits("${getParamPath 1 "foo"}", 1024)
          assert_param_bits("${getParamPath 1 "bar"}", 1025)

      ${switchToGeneration 2}

      with subtest("check whether bit size has changed"):
          assert_param_bits("${getParamPath 2 "foo"}", 1026)

      with subtest("ensure that dhparams file for 'bar' was deleted"):
          machine.fail("test -e ${getParamPath 1 "bar"}")

      ${switchToGeneration 3}

      with subtest("ensure that 'security.dhparams.path' has been deleted"):
          machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")

      ${switchToGeneration 4}

      with subtest("check bit sizes dhparam files"):
          assert_param_bits(
              "${getParamPath 4 "foo2"}", 1027
          )
          assert_param_bits(
              "${getParamPath 4 "bar2"}", 1028
          )

      with subtest("check whether dhparam files are in the Nix store"):
          machine.succeed(
              "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",
              "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",
          )

      ${switchToGeneration 5}

      with subtest("check whether defaultBitSize works as intended"):
          assert_param_bits("${getParamPath 5 "foo3"}", 1029)
          assert_param_bits("${getParamPath 5 "bar3"}", 1029)
    '';
}