From 33895c7300d6e43e4d3df30cb192d17891d799be Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 18:09:42 +0200 Subject: Adding debian version 4.3-2+deb12u1. Signed-off-by: Daniel Baumann --- debian/tests/control | 28 ++++++++++++++ debian/tests/dynamically-add-source | 27 +++++++++++++ debian/tests/fragmented-configuration | 17 +++++++++ debian/tests/helper-functions | 53 ++++++++++++++++++++++++++ debian/tests/ntp-server-and-nts-auth | 59 +++++++++++++++++++++++++++++ debian/tests/time-sources-from-dhcp-servers | 44 +++++++++++++++++++++ debian/tests/upstream-simulation-test-suite | 41 ++++++++++++++++++++ debian/tests/upstream-system-tests | 24 ++++++++++++ 8 files changed, 293 insertions(+) create mode 100644 debian/tests/control create mode 100644 debian/tests/dynamically-add-source create mode 100644 debian/tests/fragmented-configuration create mode 100644 debian/tests/helper-functions create mode 100644 debian/tests/ntp-server-and-nts-auth create mode 100644 debian/tests/time-sources-from-dhcp-servers create mode 100644 debian/tests/upstream-simulation-test-suite create mode 100755 debian/tests/upstream-system-tests (limited to 'debian/tests') diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 0000000..5586711 --- /dev/null +++ b/debian/tests/control @@ -0,0 +1,28 @@ +Tests: upstream-simulation-test-suite +Depends: @builddeps@, build-essential, ca-certificates, wget +Restrictions: isolation-container, build-needed, skippable, needs-root, needs-internet + +Tests: time-sources-from-dhcp-servers +Depends: @, isc-dhcp-server, isc-dhcp-client, iproute2, kmod +Restrictions: isolation-machine, needs-root + +Features: test-name=run_system_tests +Test-Command: debian/tests/upstream-system-tests +Depends: @builddeps@ +Restrictions: build-needed, isolation-container, needs-root + +Features: test-name=run_destructive_system_tests +Test-Command: debian/tests/upstream-system-tests -d 1[0-9][0-9]-* +Depends: @, @builddeps@, ethtool +Restrictions: build-needed, isolation-machine, needs-root + +Tests: fragmented-configuration +Restrictions: isolation-container, needs-root + +Tests: dynamically-add-source +Depends: @, dpkg-dev +Restrictions: isolation-container, needs-root, skippable + +Tests: ntp-server-and-nts-auth +Depends: @, dpkg-dev, gnutls-bin +Restrictions: isolation-container, needs-root, skippable diff --git a/debian/tests/dynamically-add-source b/debian/tests/dynamically-add-source new file mode 100644 index 0000000..1e4c160 --- /dev/null +++ b/debian/tests/dynamically-add-source @@ -0,0 +1,27 @@ +#!/bin/sh +# Make sure that NTP sources from /etc/chrony/sources.d are usable. + +set -e + +. debian/tests/helper-functions + +server_addr="192.0.2.1" + +printf "Preparing chronyd configuration: " +__no_system_clock_control +__restart_chronyd && __test_ok || __test_skip + +printf "Adding a dummy server to the list of NTP sources: " +printf "server $server_addr\n" > /etc/chrony/sources.d/dummy-server.sources && __test_ok || __test_fail + +printf "Reloading NTP sources: " +__reload_sources + +printf "Checking for dummy server availability: " +__check_sources "$server_addr" + +printf "Checking for dummy server availability after restarting chronyd: " +__restart_chronyd +__check_sources "$server_addr" + +exit 0 diff --git a/debian/tests/fragmented-configuration b/debian/tests/fragmented-configuration new file mode 100644 index 0000000..2135df3 --- /dev/null +++ b/debian/tests/fragmented-configuration @@ -0,0 +1,17 @@ +#!/bin/sh +# Make sure that fragmented configuration works as expected. + +set -e + +. debian/tests/helper-functions + +printf 'Setting "authselectmode prefer" as authentication policy: ' +echo "authselectmode prefer" > /etc/chrony/conf.d/authentication-policy.conf && __test_ok || __test_fail + +printf "Restart chronyd: " +systemctl --quiet restart chrony.service && __test_ok || __test_fail + +printf "Checking that chronyd uses the defined authentication policy: " +chronyd -p | grep -q "authselectmode prefer" && __test_ok || __test_fail + +exit 0 diff --git a/debian/tests/helper-functions b/debian/tests/helper-functions new file mode 100644 index 0000000..7df6ee9 --- /dev/null +++ b/debian/tests/helper-functions @@ -0,0 +1,53 @@ +__no_system_clock_control() { + if ! dpkg-vendor --derives-from Ubuntu; then + sed -i '/^DAEMON_OPTS=/s/"\(.*\)"/"\1 -x"/' /etc/default/chrony + mkdir -p /etc/systemd/system/chrony.service.d + cat < /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + systemctl daemon-reload + fi +} + +__test_fail() { + printf 'FAIL\n' >&2 + return 1 +} + +__test_ok() { + printf 'OK\n' + return 0 +} + +__test_skip() { + [ -n "$1" ] && printf 'SKIP: (%s)\n' "$1" || printf 'SKIP\n' + exit 77 +} + +__reload_sources() { + chronyc reload sources > /dev/null 2>&1 && __test_ok || __test_fail +} + +__restart_chronyd() { + systemctl --quiet restart chrony.service + rc=$? + sleep 3 + return $rc +} + +__check_sources() { + chronyc sources | grep -q "$1" && __test_ok || __test_fail +} + +__check_auth() { + chronyc -c authdata | grep -q "$1" && __test_ok || __test_fail +} + +# Ubuntu's default config is fully populated causing issues with the test +# If any of those tests run on Ubuntu, clear some and restart the daemon +# to pick this up before entering the tests. +if grep -q "^pool.*ubuntu.pool.ntp.org" /etc/chrony/chrony.conf; then + sudo sed -i -e '/^pool.*ubuntu.pool.ntp.org/d' /etc/chrony/chrony.conf + __restart_chronyd +fi diff --git a/debian/tests/ntp-server-and-nts-auth b/debian/tests/ntp-server-and-nts-auth new file mode 100644 index 0000000..b7d8877 --- /dev/null +++ b/debian/tests/ntp-server-and-nts-auth @@ -0,0 +1,59 @@ +#!/bin/sh +# Check that chronyd is able to authenticate NTP packets when NTS is enabled +# on the server. + +set -e + +. debian/tests/helper-functions + +cert_dir="/var/lib/chrony" +cert_template="$cert_dir/cert.cfg" +cert_file="$cert_dir/server.crt" +priv_key="$cert_dir/server.key" +server_addr="127.0.1.1" +server_name="chrony-nts-test" + +create_cert_template() { + printf "Creating certificate template: " + cat < "$cert_template" +cn = "$server_name" +serial = 001 +activation_date = "$(date -d '1 year ago' +'%Y-%m-%d') 00:00:00 UTC" +expiration_date = "$(date -d '1 year' +'%Y-%m-%d') 00:00:00 UTC" +signing_key +encryption_key +EOF +} + +generate_cert() { + printf "Generating self-signed certificate: " + certtool --generate-privkey --key-type=ed25519 --outfile "$priv_key" > /dev/null 2>&1 + certtool --generate-self-signed --load-privkey "$priv_key" --template "$cert_template" \ + --outfile "$cert_file" > /dev/null 2>&1 +} + +server_config() { + printf "Preparing chronyd configuration: " + cat < /etc/chrony/conf.d/local-server-config.conf +server $server_name nts minpoll -6 maxpoll -6 +ntsserverkey $priv_key +ntsservercert $cert_file +ntstrustedcerts $cert_file +EOF + + __no_system_clock_control + __restart_chronyd +} + +echo "$server_addr $server_name" >> /etc/hosts + +create_cert_template && __test_ok || __test_skip "unable to create certificate template" + +generate_cert && __test_ok || __test_skip "unable to generate self-signed certificate" + +server_config && __test_ok || __test_skip + +printf "Checking if server authenticates NTP packets: " +__check_auth "$server_addr,NTS" + +exit 0 diff --git a/debian/tests/time-sources-from-dhcp-servers b/debian/tests/time-sources-from-dhcp-servers new file mode 100644 index 0000000..f5e7899 --- /dev/null +++ b/debian/tests/time-sources-from-dhcp-servers @@ -0,0 +1,44 @@ +#!/bin/sh +# Ensure that NTP servers obtained from DHCP are made available to chronyd and +# that they are removed when releasing the DHCP lease. + +set -e + +prepare_iface() { + modprobe dummy + ip link add name dummy0 type dummy + ip address add 192.168.1.1/24 dev dummy0 + ip link set dev dummy0 up +} + +dhcpd_config() { +cat < /etc/dhcp/dhcpd.conf +default-lease-time 600; +max-lease-time 7200; +authorative; + +subnet 192.168.1.0 netmask 255.255.255.0 { + option subnet-mask 255.255.255.0; + option broadcast-address 192.168.1.255; + option ntp-servers 192.168.1.50; + range 192.168.1.42 192.168.1.100; +} +EOF + +sed -i '/INTERFACESv4=/s/".*"/"dummy0"/' /etc/default/isc-dhcp-server +} + +chk_time_src() { + chronyc -n sources | grep -q -F '192.168.1.50' +} + +printf "Preparing the dummy network interface and dhcpd configuration…\n" +if prepare_iface && dhcpd_config; then + systemctl restart isc-dhcp-server && dhclient dummy0 && printf "Done!\n\n" +fi + +printf "Check if the NTP server is made available to chronyd…\n" +chk_time_src && printf "SUCCESS!\n\n" + +printf "Release the current lease and check if the NTP server has been correctly removed…\n" +dhclient -r dummy0 > /dev/null 2>&1 && ! chk_time_src && printf "SUCCESS!\n\n" diff --git a/debian/tests/upstream-simulation-test-suite b/debian/tests/upstream-simulation-test-suite new file mode 100644 index 0000000..a0b8517 --- /dev/null +++ b/debian/tests/upstream-simulation-test-suite @@ -0,0 +1,41 @@ +#!/bin/sh +# Upstream makes use of “clknetsim” to test how well “chronyd” controls the +# system clocks in various conditions. Due to “clknetsim” not being available +# in Debian, let’s use autopkgtest facility to build it in a container and +# test “chronyd” from there. + +set -e + +testdir="$PWD/test/simulation" +clknetsim_ver=f00531b +clknetsim_src=https://github.com/mlichvar/clknetsim/archive/"$clknetsim_ver"/clknetsim-"$clknetsim_ver".tar.gz +clknetsim_archive=$(basename "$clknetsim_src") + +export CLKNETSIM_PATH="$AUTOPKGTEST_TMP" + +# Always use the same seed to get deterministic results +export CLKNETSIM_RANDOM_SEED=24505 + +DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + +# The simulation tests are only supported on Linux. +dpkg-architecture -ilinux-any || exit 77 + +prepare_clknetsim() { + # This symbolic link is necessary to prevent clknetsim from FTBFS. + ln -s /usr/include/"$DEB_HOST_MULTIARCH"/sys/time.h /usr/include/sys/ + + wget -P "$CLKNETSIM_PATH" "$clknetsim_src" 2>&1 || exit 77 + tar -xvzf "$CLKNETSIM_PATH"/"$clknetsim_archive" \ + -C "$CLKNETSIM_PATH" --strip-components=1 2>&1 || exit 77 + + if [ ! -x "$CLKNETSIM_PATH/clknetsim" ] && [ ! -e "$CLKNETSIM_PATH/clknetsim.so" ]; then + make -C "$CLKNETSIM_PATH" 2>&1 + fi +} + +run_test() { + cd "$testdir" && ./run +} + +prepare_clknetsim && run_test diff --git a/debian/tests/upstream-system-tests b/debian/tests/upstream-system-tests new file mode 100755 index 0000000..bd28a0c --- /dev/null +++ b/debian/tests/upstream-system-tests @@ -0,0 +1,24 @@ +#!/bin/sh +# Run the upstream system tests in a container. Destructive tests will be run in +# a VM as they may adjust/step the system clock, block the RTC, etc. +# In case of failure, test’s logs will be put into the directory specified by +# the $AUTOPKGTEST_ARTIFACTS environment variable. + +set -e + +testdir=$PWD/test/system +logdir="$testdir/tmp/*" + +# some tests need chrony installed, but make sure to avoid the test daemon is +# fighting with the systems chrony service over the clock +systemctl stop chrony.service 2>/dev/null || true + +run_test() { + cd "$testdir" && ./run "$@" +} + +artifacts() { + cp $logdir "$AUTOPKGTEST_ARTIFACTS" && exit 1 +} + +run_test "$@" || artifacts -- cgit v1.2.3