public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/taskserver/helper: Implement deletion

Browse Source 
Now we finally can delete organisations, groups and users along with
certificate revocation. The new subtests now make sure that the client
certificate is also revoked (both when removing the whole organisation
and just a single user).

If we use the imperative way to add and delete users, we have to restart
the Taskserver in order for the CRL to be effective.

However, by using the declarative configuration we now get this for
free, because removing a user will also restart the service and thus its
client certificate will end up in the CRL.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This commit is contained in:
aszlig
2016-04-12 01:41:41 +02:00
parent 3008836fee
commit 7889fcfa41
2 changed files with 168 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/tests/taskserver.nix
+54 -7
View File
@@ -15,7 +15,7 @@ import ./make-test.nix {
client1 = { pkgs, ... }: {
networking.firewall.enable = false;
environment.systemPackages = [ pkgs.taskwarrior ];
environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
users.users.alice.isNormalUser = true;
users.users.bob.isNormalUser = true;
users.users.foo.isNormalUser = true;
@@ -60,6 +60,22 @@ import ./make-test.nix {
}
}
sub restartServer {
$server->succeed("systemctl restart taskserver.service");
$server->waitForOpenPort(${portStr});
}
sub readdImperativeUser {
$server->nest("(re-)add imperative user bar", sub {
$server->execute("nixos-taskserver del-org imperativeOrg");
$server->succeed(
"nixos-taskserver add-org imperativeOrg",
"nixos-taskserver add-user imperativeOrg bar"
);
setupClientsFor "imperativeOrg", "bar";
});
}
sub testSync ($) {
my $user = $_[0];
subtest "sync for user $user", sub {
@@ -71,6 +87,16 @@ import ./make-test.nix {
};
}
sub checkClientCert ($) {
my $user = $_[0];
my $cmd = "gnutls-cli".
" --x509cafile=/home/$user/.task/keys/ca.cert".
" --x509keyfile=/home/$user/.task/keys/private.key".
" --x509certfile=/home/$user/.task/keys/public.cert".
" --port=${portStr} server < /dev/null";
return su $user, $cmd;
}
startAll;
$server->waitForUnit("taskserver.service");
@@ -93,13 +119,34 @@ import ./make-test.nix {
testSync $_ for ("alice", "bob", "foo");
$server->fail("nixos-taskserver add-user imperativeOrg bar");
$server->succeed(
"nixos-taskserver add-org imperativeOrg",
"nixos-taskserver add-user imperativeOrg bar"
);
setupClientsFor "imperativeOrg", "bar";
readdImperativeUser;
testSync "bar";
subtest "checking certificate revocation of user bar", sub {
$client1->succeed(checkClientCert "bar");
$server->succeed("nixos-taskserver del-user imperativeOrg bar");
restartServer;
$client1->fail(checkClientCert "bar");
$client1->succeed(su "bar", "task add destroy everything >&2");
$client1->fail(su "bar", "task sync >&2");
};
readdImperativeUser;
subtest "checking certificate revocation of org imperativeOrg", sub {
$client1->succeed(checkClientCert "bar");
$server->succeed("nixos-taskserver del-org imperativeOrg");
restartServer;
$client1->fail(checkClientCert "bar");
$client1->succeed(su "bar", "task add destroy even more >&2");
$client1->fail(su "bar", "task sync >&2");
};
'';
}