alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/tests/systemd-initrd-networkd-ssh: Test with backdoor not LUKS

Browse source
This commit is contained in:
Will Fancher 2023-09-20 18:19:22 -04:00
parent 8900b027c7
commit b41cbee0fd
1 changed files with 13 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
nixos/tests/systemd-initrd-networkd-ssh.nix
View file

@ -4,34 +4,16 @@ import ./make-test-python.nix ({ lib, ... }: {
nodes = { nodes = {
server = { config, pkgs, ... }: { server = { config, pkgs, ... }: {
environment.systemPackages = [ pkgs.cryptsetup ]; testing.initrdBackdoor = true;
boot.loader.systemd-boot.enable = true; boot.initrd.systemd.enable = true;
boot.loader.timeout = 0; boot.initrd.systemd.contents."/etc/msg".text = "foo";
virtualisation = { boot.initrd.network = {
emptyDiskImages = [ 4096 ]; enable = true;
useBootLoader = true; ssh = {
# Booting off the encrypted disk requires an available init script from
# the Nix store
mountHostNixStore = true;
useEFIBoot = true;
};
specialisation.encrypted-root.configuration = {
virtualisation.rootDevice = "/dev/mapper/root";
virtualisation.fileSystems."/".autoFormat = true;
boot.initrd.luks.devices = lib.mkVMOverride {
root.device = "/dev/vdb";
};
boot.initrd.systemd.enable = true;
boot.initrd.network = {
enable = true; enable = true;
ssh = { authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
enable = true; port = 22;
authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ]; hostKeys = [ ./initrd-network-ssh/ssh_host_ed25519_key ];
port = 22;
# Terrible hack so it works with useBootLoader
hostKeys = [ { outPath = "${./initrd-network-ssh/ssh_host_ed25519_key}"; } ];
};
}; };
}; };
}; };
@ -63,24 +45,16 @@ import ./make-test-python.nix ({ lib, ... }: {
status, _ = client.execute("nc -z server 22") status, _ = client.execute("nc -z server 22")
return status == 0 return status == 0
server.wait_for_unit("multi-user.target")
server.succeed(
"echo somepass | cryptsetup luksFormat --type=luks2 /dev/vdb",
"bootctl set-default nixos-generation-1-specialisation-encrypted-root.conf",
"sync",
)
server.shutdown()
server.start()
client.wait_for_unit("network.target") client.wait_for_unit("network.target")
with client.nested("waiting for SSH server to come up"): with client.nested("waiting for SSH server to come up"):
retry(ssh_is_up) retry(ssh_is_up)
client.succeed( msg = client.succeed(
"echo somepass | ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'systemd-tty-ask-password-agent' & exit" "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'cat /etc/msg'"
) )
assert "foo" in msg
server.switch_root()
server.wait_for_unit("multi-user.target") server.wait_for_unit("multi-user.target")
server.succeed("mount | grep '/dev/mapper/root on /'")
''; '';
}) })