projects/guix·blob mpd-fix-groups · refs

240 lines · 8.0 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2022 muradm <[email protected]>
3;;;
4;;; This file is part of GNU Guix.
5;;;
6;;; GNU Guix is free software; you can redistribute it and/or modify it
7;;; under the terms of the GNU General Public License as published by
8;;; the Free Software Foundation; either version 3 of the License, or (at
9;;; your option) any later version.
10;;;
11;;; GNU Guix is distributed in the hope that it will be useful, but
12;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14;;; GNU General Public License for more details.
15;;;
16;;; You should have received a copy of the GNU General Public License
17;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
18
19(define-module (gnu tests security)
20 #:use-module (guix gexp)
21 #:use-module (gnu packages admin)
22 #:use-module (gnu services)
23 #:use-module (gnu services base)
24 #:use-module (gnu services security)
25 #:use-module (gnu services ssh)
26 #:use-module (gnu system)
27 #:use-module (gnu system vm)
28 #:use-module (gnu tests)
29 #:export (%test-fail2ban-basic
30 %test-fail2ban-extension
31 %test-fail2ban-simple))
32
33
34;;;
35;;; fail2ban tests
36;;;
37
38(define-syntax-rule (fail2ban-test test-name test-os tests-more ...)
39 (lambda ()
40 (define os
41 (marionette-operating-system
42 test-os
43 #:imported-modules '((gnu services herd))))
44
45 (define vm
46 (virtual-machine
47 (operating-system os)
48 (port-forwardings '())))
49
50 (define test
51 (with-imported-modules '((gnu build marionette)
52 (guix build utils))
53 #~(begin
54 (use-modules (srfi srfi-64)
55 (gnu build marionette))
56
57 (define marionette (make-marionette (list #$vm)))
58
59 (test-runner-current (system-test-runner #$output))
60 (test-begin test-name)
61
62 (test-assert "fail2ban running"
63 (marionette-eval
64 '(begin
65 (use-modules (gnu services herd))
66 (start-service 'fail2ban))
67 marionette))
68
69 (test-assert "fail2ban socket ready"
70 (wait-for-unix-socket
71 "/var/run/fail2ban/fail2ban.sock" marionette))
72
73 (test-assert "fail2ban running after restart"
74 (marionette-eval
75 '(begin
76 (use-modules (gnu services herd))
77 (restart-service 'fail2ban))
78 marionette))
79
80 (test-assert "fail2ban socket ready after restart"
81 (wait-for-unix-socket
82 "/var/run/fail2ban/fail2ban.sock" marionette))
83
84 (test-assert "fail2ban pid ready"
85 (marionette-eval
86 '(file-exists? "/var/run/fail2ban/fail2ban.pid")
87 marionette))
88
89 (test-assert "fail2ban log file"
90 (marionette-eval
91 '(file-exists? "/var/log/fail2ban.log")
92 marionette))
93
94 tests-more ...
95
96 (test-end))))
97
98 (gexp->derivation test-name test)))
99
100;; The /var/log/secure file that is monitored by fail2ban has to be present
101;; before the service starts. This limitation is discussed here:
102;; https://github.com/fail2ban/fail2ban/issues/1593.
103(define %auth-log-activation-service
104 (simple-service 'create-authlog-file
105 activation-service-type
106 #~(begin
107 (call-with-output-file "/var/log/secure"
108 (lambda (port)
109 (display "" port))))))
110
111(define run-fail2ban-basic-test
112 (fail2ban-test
113 "fail2ban-basic-test"
114
115 (simple-operating-system
116 (service fail2ban-service-type))))
117
118(define %test-fail2ban-basic
119 (system-test
120 (name "fail2ban-basic")
121 (description "Test basic fail2ban running capability.")
122 (value (run-fail2ban-basic-test))))
123
124(define %fail2ban-server-cmd
125 (program-file
126 "fail2ban-server-cmd"
127 #~(begin
128 (let ((cmd #$(file-append fail2ban "/bin/fail2ban-server")))
129 (apply execl cmd cmd `("-p" "/var/run/fail2ban/fail2ban.pid"
130 "-s" "/var/run/fail2ban/fail2ban.sock"
131 ,@(cdr (program-arguments))))))))
132
133(define run-fail2ban-simple-test
134 (fail2ban-test
135 "fail2ban-simple-test"
136
137 (simple-operating-system
138 %auth-log-activation-service
139 (service fail2ban-service-type
140 (fail2ban-configuration
141 (jails (list (fail2ban-jail-configuration
142 (name "sshd")))))))
143
144 (test-equal "fail2ban sshd jail running status output"
145 '("Status for the jail: sshd"
146 "|- Filter"
147 "| |- Currently failed:\t0"
148 "| |- Total failed:\t0"
149 "| `- File list:\t/var/log/secure"
150 "`- Actions"
151 " |- Currently banned:\t0"
152 " |- Total banned:\t0"
153 " `- Banned IP list:\t"
154 "")
155 (marionette-eval
156 '(begin
157 (use-modules (ice-9 rdelim) (ice-9 popen) (rnrs io ports))
158 (let ((call-command
159 (lambda (cmd)
160 (let* ((err-cons (pipe))
161 (port (with-error-to-port (cdr err-cons)
162 (lambda () (open-input-pipe cmd))))
163 (_ (setvbuf (car err-cons) 'block
164 (* 1024 1024 16)))
165 (result (read-delimited "" port)))
166 (close-port (cdr err-cons))
167 (values result (read-delimited "" (car err-cons)))))))
168 (string-split
169 (call-command
170 (string-join (list #$%fail2ban-server-cmd "status" "sshd") " "))
171 #\newline)))
172 marionette))
173
174 (test-equal "fail2ban sshd jail running exit code"
175 0
176 (marionette-eval
177 '(status:exit-val (system* #$%fail2ban-server-cmd "status" "sshd"))
178 marionette))))
179
180(define %test-fail2ban-simple
181 (system-test
182 (name "fail2ban-simple")
183 (description "Test simple fail2ban running capability.")
184 (value (run-fail2ban-simple-test))))
185
186(define run-fail2ban-extension-test
187 (fail2ban-test
188 "fail2ban-extension-test"
189
190 (simple-operating-system
191 %auth-log-activation-service
192 (service (fail2ban-jail-service openssh-service-type
193 (fail2ban-jail-configuration
194 (name "sshd")
195 (enabled? #t)))
196 (openssh-configuration))
197 (service static-networking-service-type
198 (list %qemu-static-networking)))
199
200 (test-equal "fail2ban sshd jail running status output"
201 '("Status for the jail: sshd"
202 "|- Filter"
203 "| |- Currently failed:\t0"
204 "| |- Total failed:\t0"
205 "| `- File list:\t/var/log/secure"
206 "`- Actions"
207 " |- Currently banned:\t0"
208 " |- Total banned:\t0"
209 " `- Banned IP list:\t"
210 "")
211 (marionette-eval
212 '(begin
213 (use-modules (ice-9 rdelim) (ice-9 popen) (rnrs io ports))
214 (let ((call-command
215 (lambda (cmd)
216 (let* ((err-cons (pipe))
217 (port (with-error-to-port (cdr err-cons)
218 (lambda () (open-input-pipe cmd))))
219 (_ (setvbuf (car err-cons) 'block
220 (* 1024 1024 16)))
221 (result (read-delimited "" port)))
222 (close-port (cdr err-cons))
223 (values result (read-delimited "" (car err-cons)))))))
224 (string-split
225 (call-command
226 (string-join (list #$%fail2ban-server-cmd "status" "sshd") " "))
227 #\newline)))
228 marionette))
229
230 (test-equal "fail2ban sshd jail running exit code"
231 0
232 (marionette-eval
233 '(status:exit-val (system* #$%fail2ban-server-cmd "status" "sshd"))
234 marionette))))
235
236(define %test-fail2ban-extension
237 (system-test
238 (name "fail2ban-extension")
239 (description "Test extension fail2ban running capability.")
240 (value (run-fail2ban-extension-test))))