Justin !andTom Hubrecht
32d7c02b96
This bump nixpkgs input to 25.11 and fix the two warnings that were coming with the update: 1. `pkgs.system` => `pkgs.stdenv.hostPlatform.system` 2. `runCommandNoCC` => `runCommand` also: 1. remove cppnix 2.3 compat tests (cppnix 2.3 is officially dead now) 2. remove lowdown 1.3 compat tests (nixpkgs no longer carries it) Co-authored-by: Tom Hubrecht <github@mail.hubrecht.ovh> Change-Id: I78526b5d8992a6c63ecd7f0c7c1fa6346a6a6964
85 lines
2.7 KiB
Nix
85 lines
2.7 KiB
Nix
# Test whether builtin:fetchurl properly performs TLS certificate
|
|
# checks on HTTPS servers.
|
|
|
|
{ lib, config, pkgs, ... }:
|
|
|
|
let
|
|
|
|
makeTlsCert = name: pkgs.runCommand name {
|
|
nativeBuildInputs = with pkgs; [ openssl ];
|
|
} ''
|
|
mkdir -p $out
|
|
openssl req -x509 \
|
|
-subj '/CN=${name}/' -days 49710 \
|
|
-addext 'subjectAltName = DNS:${name}' \
|
|
-keyout "$out/key.pem" -newkey ed25519 \
|
|
-out "$out/cert.pem" -noenc
|
|
'';
|
|
|
|
goodCert = makeTlsCert "good";
|
|
badCert = makeTlsCert "bad";
|
|
|
|
in
|
|
|
|
{
|
|
name = "fetchurl";
|
|
|
|
nodes = {
|
|
machine = { lib, pkgs, ... }: {
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
virtualHosts."good" = {
|
|
addSSL = true;
|
|
sslCertificate = "${goodCert}/cert.pem";
|
|
sslCertificateKey = "${goodCert}/key.pem";
|
|
root = pkgs.runCommand "nginx-root" {} ''
|
|
mkdir "$out"
|
|
echo 'hello world' > "$out/index.html"
|
|
'';
|
|
};
|
|
|
|
virtualHosts."bad" = {
|
|
addSSL = true;
|
|
sslCertificate = "${badCert}/cert.pem";
|
|
sslCertificateKey = "${badCert}/key.pem";
|
|
root = pkgs.runCommand "nginx-root" {} ''
|
|
mkdir "$out"
|
|
echo 'foobar' > "$out/index.html"
|
|
'';
|
|
};
|
|
};
|
|
|
|
security.pki.certificateFiles = [ "${goodCert}/cert.pem" ];
|
|
|
|
networking.hosts."192.168.1.1" = [ "good" "bad" ];
|
|
|
|
virtualisation.writableStore = true;
|
|
|
|
nix.settings.experimental-features = "nix-command";
|
|
};
|
|
};
|
|
|
|
testScript = { nodes, ... }: ''
|
|
machine.wait_for_unit("nginx")
|
|
machine.wait_for_open_port(443)
|
|
|
|
out = machine.succeed("curl https://good/index.html")
|
|
assert out == "hello world\n"
|
|
|
|
out = machine.succeed("cat ${badCert}/cert.pem > /tmp/cafile.pem; curl --cacert /tmp/cafile.pem https://bad/index.html")
|
|
assert out == "foobar\n"
|
|
|
|
# Fetching from a server with a trusted cert should work.
|
|
machine.succeed("nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://good/index.html\"; hash = \"sha256-qUiQTy8PR5uPgZdpSzAYSw0u0cHNKh7A+4XSmaGSpEc=\"; }'")
|
|
|
|
# Fetching from a server with an untrusted cert should fail.
|
|
err = machine.fail("nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1")
|
|
print(err)
|
|
assert "SSL certificate OpenSSL verify result: self-signed certificate" in err
|
|
|
|
# Fetching from a server with a trusted cert should work via environment variable override.
|
|
machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem NIX_REMOTE=local nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'")
|
|
'';
|
|
}
|