cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/tests/systemd-initrd-networkd-ssh: Test with backdoor not LUKS

Browse source
This commit is contained in:
Will Fancher 2023-09-20 18:19:22 -04:00
parent 8900b027c7
commit b41cbee0fd
1 changed files with 13 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
nixos/tests/systemd-initrd-networkd-ssh.nix
View file

@ -4,34 +4,16 @@ import ./make-test-python.nix ({ lib, ... }: {
nodes = {
server = { config, pkgs, ... }: {
environment.systemPackages = [ pkgs.cryptsetup ];
boot.loader.systemd-boot.enable = true;
boot.loader.timeout = 0;
virtualisation = {
emptyDiskImages = [ 4096 ];
useBootLoader = true;
# Booting off the encrypted disk requires an available init script from
# the Nix store
mountHostNixStore = true;
useEFIBoot = true;
};
specialisation.encrypted-root.configuration = {
virtualisation.rootDevice = "/dev/mapper/root";
virtualisation.fileSystems."/".autoFormat = true;
boot.initrd.luks.devices = lib.mkVMOverride {
root.device = "/dev/vdb";
};
boot.initrd.systemd.enable = true;
boot.initrd.network = {
testing.initrdBackdoor = true;
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/msg".text = "foo";
boot.initrd.network = {
enable = true;
ssh = {
enable = true;
ssh = {
enable = true;
authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
port = 22;
# Terrible hack so it works with useBootLoader
hostKeys = [ { outPath = "${./initrd-network-ssh/ssh_host_ed25519_key}"; } ];
};
authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
port = 22;
hostKeys = [ ./initrd-network-ssh/ssh_host_ed25519_key ];
};
};
};
@ -63,24 +45,16 @@ import ./make-test-python.nix ({ lib, ... }: {
status, _ = client.execute("nc -z server 22")
return status == 0
server.wait_for_unit("multi-user.target")
server.succeed(
"echo somepass | cryptsetup luksFormat --type=luks2 /dev/vdb",
"bootctl set-default nixos-generation-1-specialisation-encrypted-root.conf",
"sync",
)
server.shutdown()
server.start()
client.wait_for_unit("network.target")
with client.nested("waiting for SSH server to come up"):
retry(ssh_is_up)
client.succeed(
"echo somepass | ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'systemd-tty-ask-password-agent' & exit"
msg = client.succeed(
"ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'cat /etc/msg'"
)
assert "foo" in msg
server.switch_root()
server.wait_for_unit("multi-user.target")
server.succeed("mount | grep '/dev/mapper/root on /'")
'';
})