movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/tests/shadow: new hashes support with libxcrypt

Browse source
This commit is contained in:
Franz Pletz 2022-09-26 22:45:24 +02:00 • committed by Martin Weinelt
parent f9090d5862
commit 32e7482074
No known key found for this signature in database
GPG key ID: 87C1E9888F856759
2 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/config/users-groups.nix
View file

@ -697,7 +697,7 @@ in {
value = "[a-zA-Z0-9/+.-]+"; value = "[a-zA-Z0-9/+.-]+";
options = "${id}(=${value})?(,${id}=${value})*"; options = "${id}(=${value})?(,${id}=${value})*";
scheme = "${id}(${sep}${options})?"; scheme = "${id}(${sep}${options})?";
content = "${base64}${sep}${base64}"; content = "${base64}${sep}${base64}(${sep}${base64})?";
mcf = "^${sep}${scheme}${sep}${content}$"; mcf = "^${sep}${scheme}${sep}${content}$";
in in
if (allowsLogin user.hashedPassword if (allowsLogin user.hashedPassword

30
nixos/tests/shadow.nix
View file

@ -3,6 +3,8 @@ let
password2 = "helloworld"; password2 = "helloworld";
password3 = "bazqux"; password3 = "bazqux";
password4 = "asdf123"; password4 = "asdf123";
hashed_bcrypt = "$2b$05$8xIEflrk2RxQtcVXbGIxs.Vl0x7dF1/JSv3cyX6JJt0npzkTCWvxK"; # fnord
hashed_yeshash = "$y$j9T$d8Z4EAf8P1SvM/aDFbxMS0$VnTXMp/Hnc7QdCBEaLTq5ZFOAFo2/PM0/xEAFuOE88."; # fnord
in import ./make-test-python.nix ({ pkgs, ... }: { in import ./make-test-python.nix ({ pkgs, ... }: {
name = "shadow"; name = "shadow";
meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; };
@ -27,6 +29,16 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
password = password4; password = password4;
shell = pkgs.bash; shell = pkgs.bash;
}; };
users.berta = {
isNormalUser = true;
hashedPassword = hashed_bcrypt;
shell = pkgs.bash;
};
users.yesim = {
isNormalUser = true;
hashedPassword = hashed_yeshash;
shell = pkgs.bash;
};
}; };
}; };
@ -115,5 +127,23 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
shadow.wait_until_succeeds("pgrep login") shadow.wait_until_succeeds("pgrep login")
shadow.send_chars("${password2}\n") shadow.send_chars("${password2}\n")
shadow.wait_until_tty_matches("5", "login:") shadow.wait_until_tty_matches("5", "login:")
with subtest("check alternate password hashes"):
shadow.send_key("alt-f6")
shadow.wait_until_succeeds("[ $(fgconsole) = 6 ]")
for u in ["berta", "yesim"]:
shadow.wait_for_unit("getty@tty6.service")
shadow.wait_until_succeeds("pgrep -f 'agetty.*tty6'")
shadow.wait_until_tty_matches("6", "login: ")
shadow.send_chars(f"{u}\n")
shadow.wait_until_tty_matches("6", f"login: {u}")
shadow.wait_until_succeeds("pgrep login")
shadow.sleep(2)
shadow.send_chars("fnord\n")
shadow.send_chars(f"whoami > /tmp/{u}\n")
shadow.wait_for_file(f"/tmp/{u}")
print(shadow.succeed(f"cat /tmp/{u}"))
assert u in shadow.succeed(f"cat /tmp/{u}")
shadow.send_chars("logout\n")
''; '';
}) })