Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228{ pkgs, ... }:
let port = 1888; tlsPort = 1889; anonPort = 1890; password = "VERY_secret"; hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw=="; topic = "test/foo";
snakeOil = pkgs.runCommand "snakeoil-certs" { buildInputs = [ pkgs.gnutls.bin ]; caTemplate = pkgs.writeText "snakeoil-ca.template" '' cn = server expiration_days = -1 cert_signing_key ca ''; certTemplate = pkgs.writeText "snakeoil-cert.template" '' cn = server expiration_days = -1 tls_www_server encryption_key signing_key ''; userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" '' organization = snakeoil cn = client1 expiration_days = -1 tls_www_client encryption_key signing_key ''; } '' mkdir "$out"
certtool -p --bits 2048 --outfile "$out/ca.key" certtool -s --template "$caTemplate" --load-privkey "$out/ca.key" \ --outfile "$out/ca.crt" certtool -p --bits 2048 --outfile "$out/server.key" certtool -c --template "$certTemplate" \ --load-ca-privkey "$out/ca.key" \ --load-ca-certificate "$out/ca.crt" \ --load-privkey "$out/server.key" \ --outfile "$out/server.crt"
certtool -p --bits 2048 --outfile "$out/client1.key" certtool -c --template "$userCertTemplate" \ --load-privkey "$out/client1.key" \ --load-ca-privkey "$out/ca.key" \ --load-ca-certificate "$out/ca.crt" \ --outfile "$out/client1.crt" '';
in{ name = "mosquitto"; meta = with pkgs.lib; { maintainers = with maintainers; [ peterhoeg ]; };
nodes = let client = { pkgs, ... }: { environment.systemPackages = with pkgs; [ mosquitto ]; }; in { server = { pkgs, ... }: { networking.firewall.allowedTCPPorts = [ port tlsPort anonPort ]; networking.useNetworkd = true; services.mosquitto = { enable = true; settings = { sys_interval = 1; }; listeners = [ { inherit port; users = { password_store = { inherit password; }; password_file = { passwordFile = pkgs.writeText "mqtt-password" password; }; hashed_store = { inherit hashedPassword; }; hashed_file = { hashedPasswordFile = pkgs.writeText "mqtt-hashed-password" hashedPassword; };
reader = { inherit password; acl = [ "read ${topic}" "read $SYS/#" # so we always have something to read ]; }; writer = { inherit password; acl = [ "write ${topic}" ]; }; }; } { port = tlsPort; users.client1 = { acl = [ "read $SYS/#" ]; }; settings = { cafile = "${snakeOil}/ca.crt"; certfile = "${snakeOil}/server.crt"; keyfile = "${snakeOil}/server.key"; require_certificate = true; use_identity_as_username = true; }; } { port = anonPort; omitPasswordAuth = true; settings.allow_anonymous = true; acl = [ "pattern read #" ]; users = { anonWriter = { password = "<ignored>" + password; acl = [ "write ${topic}" ]; }; }; } ]; }; };
client1 = client; client2 = client; };
testScript = '' def mosquitto_cmd(binary, user, topic, port): return ( "mosquitto_{} " "-V mqttv311 " "-h server " "-p {} " "-u {} " "-P '${password}' " "-t '{}'" ).format(binary, port, user, topic)
def publish(args, user, topic="${topic}", port=${toString port}): return "{} {}".format(mosquitto_cmd("pub", user, topic, port), args)
def subscribe(args, user, topic="${topic}", port=${toString port}): return "{} -W 5 -C 1 {}".format(mosquitto_cmd("sub", user, topic, port), args)
def parallel(*fns): from threading import Thread threads = [ Thread(target=fn) for fn in fns ] for t in threads: t.start() for t in threads: t.join()
def wait_uuid(uuid): server.wait_for_console_text(uuid) return None
start_all() server.wait_for_unit("mosquitto.service")
with subtest("check passwords"): client1.succeed(publish("-m test", "password_store")) client1.succeed(publish("-m test", "password_file")) client1.succeed(publish("-m test", "hashed_store")) client1.succeed(publish("-m test", "hashed_file"))
with subtest("check acl"): client1.succeed(subscribe("", "reader", topic="$SYS/#")) client1.fail(subscribe("", "writer", topic="$SYS/#"))
parallel( lambda: client1.succeed(subscribe("-i 3688cdd7-aa07-42a4-be22-cb9352917e40", "reader")), lambda: [ wait_uuid("3688cdd7-aa07-42a4-be22-cb9352917e40"), client2.succeed(publish("-m test", "writer")) ])
parallel( lambda: client1.fail(subscribe("-i 24ff16a2-ae33-4a51-9098-1b417153c712", "reader")), lambda: [ wait_uuid("24ff16a2-ae33-4a51-9098-1b417153c712"), client2.succeed(publish("-m test", "reader")) ])
with subtest("check tls"): client1.succeed( subscribe( "--cafile ${snakeOil}/ca.crt " "--cert ${snakeOil}/client1.crt " "--key ${snakeOil}/client1.key", topic="$SYS/#", port=${toString tlsPort}, user="no_such_user"))
with subtest("check omitPasswordAuth"): parallel( lambda: client1.succeed(subscribe("-i fd56032c-d9cb-4813-a3b4-6be0e04c8fc3", "anonReader", port=${toString anonPort})), lambda: [ wait_uuid("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"), client2.succeed(publish("-m test", "anonWriter", port=${toString anonPort})) ]) '';}