nixpkgs/nixos/tests/dhparams.nix

import ./make-test-python.nix {
  name = "dhparams";

  nodes.machine = { pkgs, ... }: {
    security.dhparams.enable = true;
    environment.systemPackages = [ pkgs.openssl ];

    specialisation = {
      gen1.configuration = { config, ... }: {
        security.dhparams.params = {
          # Use low values here because we don't want the test to run for ages.
          foo.bits = 1024;
          # Also use the old format to make sure the type is coerced in the right
          # way.
          bar = 1025;
        };

        systemd.services.foo = {
          description = "Check systemd Ordering";
          wantedBy = [ "multi-user.target" ];
          before = [ "shutdown.target" ];
          conflicts = [ "shutdown.target" ];
          unitConfig = {
            # This is to make sure that the dhparams generation of foo occurs
            # before this service so we need this service to start as early as
            # possible to provoke a race condition.
            DefaultDependencies = false;

            # We check later whether the service has been started or not.
            ConditionPathExists = config.security.dhparams.params.foo.path;
          };
          serviceConfig.Type = "oneshot";
          serviceConfig.RemainAfterExit = true;
          # The reason we only provide an ExecStop here is to ensure that we don't
          # accidentally trigger an error because a file system is not yet ready
          # during very early startup (we might not even have the Nix store
          # available, for example if future changes in NixOS use systemd mount
          # units to do early file system initialisation).
          serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
        };
      };
      gen2.configuration = {
        security.dhparams.params.foo.bits = 1026;
      };
      gen3.configuration =  {};
      gen4.configuration = {
        security.dhparams.stateful = false;
        security.dhparams.params.foo2.bits = 1027;
        security.dhparams.params.bar2.bits = 1028;
      };
      gen5.configuration = {
        security.dhparams.defaultBitSize = 1029;
        security.dhparams.params.foo3 = {};
        security.dhparams.params.bar3 = {};
      };
    };
  };

  testScript = { nodes, ... }: let
    getParamPath = gen: name: let
      node = "gen${toString gen}";
    in nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path;

    switchToGeneration = gen: let
      switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test";
    in ''
      with machine.nested("switch to generation ${toString gen}"):
        machine.succeed("${switchCmd}")
    '';

  in ''
    import re


    def assert_param_bits(path, bits):
        with machine.nested(f"check bit size of {path}"):
            output = machine.succeed(f"openssl dhparam -in {path} -text")
            pattern = re.compile(r"^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$", re.M)
            match = pattern.match(output)
            if match is None:
                raise Exception("bla")
            if match[1] != str(bits):
                raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")

    machine.wait_for_unit("multi-user.target")
    ${switchToGeneration 1}

    with subtest("verify startup order"):
        machine.succeed("systemctl is-active foo.service")

    with subtest("check bit sizes of dhparam files"):
        assert_param_bits("${getParamPath 1 "foo"}", 1024)
        assert_param_bits("${getParamPath 1 "bar"}", 1025)

    ${switchToGeneration 2}

    with subtest("check whether bit size has changed"):
        assert_param_bits("${getParamPath 2 "foo"}", 1026)

    with subtest("ensure that dhparams file for 'bar' was deleted"):
        machine.fail("test -e ${getParamPath 1 "bar"}")

    ${switchToGeneration 3}

    with subtest("ensure that 'security.dhparams.path' has been deleted"):
        machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")

    ${switchToGeneration 4}

    with subtest("check bit sizes dhparam files"):
        assert_param_bits(
            "${getParamPath 4 "foo2"}", 1027
        )
        assert_param_bits(
            "${getParamPath 4 "bar2"}", 1028
        )

    with subtest("check whether dhparam files are in the Nix store"):
        machine.succeed(
            "expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}",
            "expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}",
        )

    ${switchToGeneration 5}

    with subtest("check whether defaultBitSize works as intended"):
        assert_param_bits("${getParamPath 5 "foo3"}", 1029)
        assert_param_bits("${getParamPath 5 "bar3"}", 1029)
  '';
}