Commit graph

866 commits

Author SHA1 Message Date
aszlig 81fc2c3509
nixos/dhparams: Add a defaultBitSize option
This allows to set the default bit size for all the Diffie-Hellman
parameters defined in security.dhparams.params and it's particularly
useful so that we can set it to a very low value in tests (so it doesn't
take ages to generate).

Regardless for the use in testing, this also has an impact in production
systems if the owner wants to set all of them to a different size than
2048, they don't need to set it individually for every params that are
set.

I've added a subtest to the "dhparams" NixOS test to ensure this is
working properly.

Signed-off-by: aszlig <aszlig@nix.build>
2018-05-07 04:58:52 +02:00
aszlig 3e11ff6e0d
nixos/dhparams: Introduce a 'stateful' option
This option allows us to turn off stateful generation of Diffie-Hellman
parameters, which in some way is still stateful as the generated DH
params file is non-deterministic.

However what we can avoid with this is to have an increased surface for
failures during system startup, because generation of the parameters is
done during build-time.

Another advantage of this is that we no longer need to take care of
cleaning up the files that are no longer used and in my humble opinion I
would have preferred that #11505 (which puts the dhparams in the Nix
store) would have been merged instead of #22634 (which we have now).

Luckily we can still change that and this change gives the user the
option to put the dhparams into the Nix store.

Beside of the more obvious advantages pointed out here, this also
effects test runtime if more services are starting to use this (for
example see #39507 and #39288), because generating DH params could take
a long time depending on the bit size which adds up to test runtime.

If we generate the DH params in a separate derivation, subsequent test
runs won't need to wait for DH params generation during bootup.

Of course, tests could still mock this by force-disabling the service
and adding a service or activation script that places pre-generated DH
params in /var/lib/dhparams but this would make tests less readable and
the workaround would have to be made for each test affected.

Note that the 'stateful' option is still true by default so that we are
backwards-compatible with existing systems.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @Ekleog, @abbradar, @fpletz
2018-04-26 08:04:50 +02:00
aszlig 761266bd18
nixos/dhparams: Turn params into a submodule
We're going to implement an option which allows us to turn off stateful
handling of Diffie-Hellman parameter files by putting them into the Nix
store.

However, modules now might need a way to reference these files, so we
add a now path option to every param specified, which carries a
read-only value of the path where to find the corresponding DH params
file.

I've also improved the description of security.dhparams.params a bit so
that it uses <warning/> and <note/>.

The NixOS VM test also reflects this change and checks whether the old
way to specify the bit size still works.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @Ekleog
2018-04-26 08:04:48 +02:00
aszlig 4de774a63b
nixos/dhparams: Add a VM test
We're going to make changes to the dhparams module so we really want to
make sure we don't break it, so having a NixOS VM test is to make sure
we don't blow things up and can iterate on it.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @Ekleog
2018-04-26 08:04:45 +02:00
Matthew Justin Bauer e4d2d32a32
Merge pull request #33679 from flokli/deluge-module
Deluge: use mkEnableOption, add test
2018-04-25 14:54:34 -05:00
Sarah Brofeldt 25abc29f47
Merge pull request #39473 from xeji/update-keymap-test
nixos/tests/keymap: wait for xdotool to succeed
2018-04-25 11:17:53 +02:00
xeji 6891bda370 nixos/tests/keymap: wait for xdotool to succeed
xdotool failed in rare cases when a window was already created
but not yet decorated by the window manager.
also prevent a (never observed but possible) race condition
2018-04-25 10:16:52 +02:00
Peter Hoeg 45f1205bab
Merge pull request #39304 from peterhoeg/f/ha
home-assistant: add a few knobs and make config YAML
2018-04-25 01:35:12 +00:00
Sarah Brofeldt 65abd2e63f
Merge pull request #39400 from xeji/improve-keymap-tests
nixos/tests/keymap: improve keymap tests
2018-04-24 11:49:53 +02:00
xeji 84a6e18947 nixos/tests/keymap: improve keymap tests
simplify tests, prevent timeouts and non-deterministic failures
2018-04-24 11:13:48 +02:00
Peter Hoeg b886faa6b6 home-assistant: use remarshal to convert configuration to YAML
HA doesn't mind the configuration being JSON instead of YAML but since YAML is
the official language, use that as it allows users to easily exchange config
data with other parties in the community.
2018-04-23 16:53:13 +08:00
Matthew Justin Bauer e4717c902f
Merge pull request #27958 from LumiGuide/strongswan-swanctl
nixos: add the strongswan-swanctl service
2018-04-21 15:47:39 -05:00
Jörg Thalheim dc0653f54f
Merge pull request #38816 from Ekleog/dovecot-lda-test
dovecot module: test dovecot's LDA
2018-04-21 19:55:23 +01:00
Jörg Thalheim bf6998bdfa
Merge pull request #39297 from xeji/tests/gnome3-gdm
nixos/tests/gnome3-gdm: fix broken test
2018-04-21 11:40:52 +01:00
xeji 4c14202bd1 nixos/tests/gnome3-gdm: fix broken test
test always failed due to multiple bugs
2018-04-21 12:09:30 +02:00
Matthew Justin Bauer 6b11a5ff13
Merge pull request #38979 from xeji/tests-systemd
nixos/tests/systemd: fix broken test
2018-04-20 18:04:12 -05:00
aszlig a9cd8ef23e
nixos/tests/containers-imperative: Fix eval
The commit c6f7d43678 changed the system
attribute to be below config.nixpkgs.localSystem, but the test still
uses the old attribute.

I have not tested whether the test actually succeeds but just checked
whether evaluation works and it evaluates successfully now.

Signed-off-by: aszlig <aszlig@nix.build>
2018-04-20 12:25:04 +02:00
xeji 9d5af5871d nixos/test/systemd: fix broken test
timing bug resulted in sporadic test failures on hydra
2018-04-16 00:43:33 +02:00
Daiderd Jordan d538fc06e2
docker-tools: add a test for permissions issues with AUFS/overlay
docker# [   11.054736] d24d6cdd57c9[763]: /bin/bash: error while loading
shared libraries: libreadline.so.7: cannot open shared object file:
Permission denied
docker# /bin/bash: error while loading shared libraries:
libreadline.so.7: cannot open shared object file: Permission denied
docker: exit status 127
docker: output:
error: command `docker run --rm -u 1000:1000 bash /bin/bash --version'
did not succeed (exit code 127)
command `docker run --rm -u 1000:1000 bash /bin/bash --version' did not
succeed (exit code 127)
2018-04-14 14:11:14 +02:00
Tim Steinbach 0625f77256
Fix kernel-copperhead test 2018-04-13 09:02:26 -04:00
Florian Klink fe840cd333 deluge: add test 2018-04-13 10:30:22 +02:00
Léo Gaspard 4fddb8b9c3
dovecot module: test dovecot's LDA
That's apparently not enough to catch the bug I ran into with the update
to 2.3.1, but at least it will check the LDA appears to work.
2018-04-12 01:35:14 +02:00
Michael Raskin c78c764547 nixos/tests.chromium: actually notice the tab crash
Argh, debugging NixOS tests takes forever…

(cherry picked from commit 1afb6e790a6a28a4fc5f310a2b0e5e012eb416fd)
2018-04-09 13:21:53 +02:00
Maximilian Bosch 50a34e55b2
nixos/iftop: add module
This patch is heavily inspired by bd0d8ed807 which added
a setcap wrapper for `mtr` in order to allow running `mtr` without
`sudo`. The need for the capability `cap_net_raw` that can be registered using
`setcap` has been documented in the Arch Wiki: https://wiki.archlinux.org/index.php/Capabilities#iftop

A simple testcase has been added which starts two machines, one with a
setcap wrapper for `iftop`, one without. Both testcases monitor the
bandwidth usage of the machine using the options `-t -s 1` once, the
machine with setcap wrapper is expected to succeed, the `iftop` on the
machine without setcap wrapper is expected to return a non-zero exit
code.
2018-04-07 15:06:51 +02:00
Corey O'Connor d0d05024d1 nixos/transmission: add basic nixos test 2018-04-05 22:07:49 +02:00
Charles Strahan 5c066e2bba
Merge pull request #37218 from cstrahan/kube-test-fix
nixos: kubernetes fixes
2018-04-04 19:14:48 -04:00
Tuomas Tynkkynen bbc80227ab nixos/tests/openldap: Fix name 2018-04-04 18:26:41 +03:00
Vladimír Čunát 75e4d3f2f0
nixos.tests.containers-imperative: fix impurity failure
I can't claim to fully understand this, but the change seems safe,
and it fixes the test on my machine.
2018-04-02 11:40:46 +02:00
Jörg Thalheim 0526d015b6 nixos/containers-physical_interfaces: use new bond option interface 2018-03-31 19:01:10 +01:00
Charles Strahan 709b6f664e
nixos: kubernetes fixes
* Fix reference CNI plugins
  * The plugins were split out of the upstream cni repo around version
    0.6.0

* Fix RBAC and DNS tests
  * Fix broken apiVersion fields
  * Change plugin linking to look in ${package}/bin rather than
    ${package.plugins}

* Initial work towards a working e2e test
  * Test still fails, but at least the expression evaluates now

Continues @srhb's work in #37199

Fixes #37199
2018-03-30 17:33:45 -04:00
Franz Pletz 9f3718fe1d
Merge pull request #37507 from xeji/p/test-atd
nixos/tests/atd : remove non-deterministic test of batch command
2018-03-28 06:31:50 +00:00
Tuomas Tynkkynen d27f7942b7 nixos/tests/misc: Fix on aarch64
The psmouse module is for PS/2 mouse only, which doesn't exist outside
x86. But we can test for the mousedev module just as well which is used
for the '-device usb-tablet' emulated by QEMU.
2018-03-25 18:29:21 +03:00
Tuomas Tynkkynen 3131daace1 nixos/tests/installer: Give eval failure on unsupported boot methods 2018-03-24 16:11:31 +02:00
Matthew Justin Bauer 13051370a5
Merge pull request #36459 from NeQuissimus/zfh_openldap
openldap: Fix test
2018-03-23 14:32:43 -05:00
Robin Gloster 76ea0e1b2e
Merge pull request #32960 from florianjacob/prosody-0.10
Prosody 0.10.0
2018-03-22 14:12:57 +01:00
Tuomas Tynkkynen e58624a877 nixos/tests: Make simpleUefiGrub test work on AArch64
Needs more refactoring for the AArch64 '-enable-kvm' stuff some day...
2018-03-21 23:19:26 +02:00
Florian Jacob 88f06c5ce9 nixos/prosody: add a basic test 2018-03-21 15:33:58 +01:00
xeji b08560fb0a nixos/tests/atd : remove test of batch command
"batch" executes jobs based on system load.
test was not deterministic.
2018-03-21 00:58:41 +01:00
Robert Schütz c484079ac7
Merge pull request #36927 from dotlambda/borg-module
nixos/borgbackup: init
2018-03-19 20:30:32 +01:00
Robert Schütz fdf0f037be nixos/borgbackup: init 2018-03-19 13:12:47 +01:00
Tim Steinbach 3aa3738bb2 vault: Fix test 2018-03-18 19:15:56 +00:00
Tuomas Tynkkynen ef64208eba Merge commit '3ab2949' from staging into master
Conflicts:
	pkgs/development/compilers/llvm/6/llvm.nix
	pkgs/servers/home-assistant/component-packages.nix
2018-03-15 22:30:56 +02:00
Graham Christensen 1a1abb383a
Merge pull request #36706 from Ma27/xautolock-testcase
xautolock: implement basic test to confirm functionality
2018-03-13 18:55:04 -04:00
Tuomas Tynkkynen 2fec9c6e29 Merge remote-tracking branch 'upstream/master' into staging
Conflicts:
	pkgs/development/tools/build-managers/conan/default.nix
2018-03-13 23:04:18 +02:00
aszlig ba816ee087
nixos/tests/virtualbox: Work around test failures
I've started digging into the actual cause of the problem a week ago but
didn't continue fixing this.

The reason why the tests are failing is because
torvalds/linux/commit/72f5e08dbba2d01aa90b592cf76c378ea233b00b has
remapped the location of the TSS into the CPU entry area and we did
update our default kernel to version 4.14 in NixOS/nixpkgs@88530e02b6.

Back to VirtualBox: The guru meditation happens in
selmRCGuestTssPostWriteCheck, which I think is only a followup error. I
believe the right location couldn't be determined by VirtualBox and thus
the write check function triggers that panic because it's reading from
the wrong location.

So the actual problem *only* surfaces whenever we use software
virtualization, which we do for our tests because we don't have nested
virtualization available.

Our tests are also for testing the functionality of VirtualBox itself
and not certain kernel versions or kernel features, so for the time
being and until this is fixed, let's actually use kernel version 4.9 for
the guests within the VM tests. Kernel 4.9 didn't have the mentioned
change of the TSS location and thus the tests succeed.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @dtzWill
2018-03-13 22:00:56 +01:00
Maximilian Bosch 4f225f96d5
xautolock: implement basic test to confirm functionality 2018-03-13 21:04:44 +01:00
Antoine Eiche bc1e8f95d4 tests/docker-tools: add onTopOfPulledImage test 2018-03-13 11:59:22 +01:00
WilliButz ef90ff2d8e grafana: 5.0.0 -> 5.0.1 2018-03-12 23:37:29 +01:00
Franz Pletz b0fa004fa9
nixos/tests/containers-tmpfs: fix test name 2018-03-12 22:28:27 +01:00
Jan Malakhovski 7079e744d4 Merge branch 'master' into staging
Resolved the following conflicts (by carefully applying patches from the both
branches since the fork point):

   pkgs/development/libraries/epoxy/default.nix
   pkgs/development/libraries/gtk+/3.x.nix
   pkgs/development/python-modules/asgiref/default.nix
   pkgs/development/python-modules/daphne/default.nix
   pkgs/os-specific/linux/systemd/default.nix
2018-03-10 20:38:13 +00:00