d09952f · typeable/nixpkgs

git.iko.soy/typeable/nixpkgs

nixos/mosquitto: restore passwordless system feature

during the rewrite the checkPasswords=false feature of the old module was lost. restore it, and with it systems that allow any client to use any username.

commitd09952fea85538ff72fb25a9fe8e473f853a58ec authorpennae <github@quasiparticle.net> dateSun 24 Oct 2021, 19:34 (5 years ago) parent81175b4

2 files changed+33−2

compare with master

unifiedsplit

nixos/modules/services/networking/mosquitto.nix+10−1 nixos/tests/mosquitto.nix+23−1

nixos/modules/services/networking/mosquitto.nix+10−1

@@ -264,6 +264,15 @@ let

264264 default = {};

265265 };

266266

267+ omitPasswordAuth = mkOption {

268+ type = bool;

269+ description = ''

270+ Omits password checking, allowing anyone to log in with any user name unless

271+ other mandatory authentication methods (eg TLS client certificates) are configured.

272+ '';

273+ default = false;

274+ };

275+

267276 acl = mkOption {

268277 type = listOf str;

269278 description = ''

@@ -294,9 +303,9 @@ let

294303 formatListener = idx: listener:

295304 [

296305 "listener ${toString listener.port} ${toString listener.address}"

297− "password_file ${cfg.dataDir}/passwd-${toString idx}"

298306 "acl_file ${makeACLFile idx listener.users listener.acl}"

299307 ]

308+ ++ optional (! listener.omitPasswordAuth) "password_file ${cfg.dataDir}/passwd-${toString idx}"

300309 ++ formatFreeform {} listener.settings

301310 ++ concatMap formatAuthPlugin listener.authPlugins;

302311

nixos/tests/mosquitto.nix+23−1

@@ -3,6 +3,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:

33let

44 port = 1888;

55 tlsPort = 1889;

6+ anonPort = 1890;

67 password = "VERY_secret";

78 hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";

89 topic = "test/foo";

@@ -63,7 +64,7 @@ in {

6364 };

6465 in {

6566 server = { pkgs, ... }: {

66− networking.firewall.allowedTCPPorts = [ port tlsPort ];

67+ networking.firewall.allowedTCPPorts = [ port tlsPort anonPort ];

6768 services.mosquitto = {

6869 enable = true;

6970 settings = {

@@ -112,6 +113,18 @@ in {

112113 use_identity_as_username = true;

113114 };

114115 }

116+ {

117+ port = anonPort;

118+ omitPasswordAuth = true;

119+ settings.allow_anonymous = true;

120+ acl = [ "pattern read #" ];

121+ users = {

122+ anonWriter = {

123+ password = "<ignored>" + password;

124+ acl = [ "write ${topic}" ];

125+ };

126+ };

127+ }

115128 ];

116129 };

117130 };

@@ -182,5 +195,14 @@ in {

182195 topic="$SYS/#",

183196 port=${toString tlsPort},

184197 user="no_such_user"))

198+

199+ with subtest("check omitPasswordAuth"):

200+ parallel(

201+ lambda: client1.succeed(subscribe("-i fd56032c-d9cb-4813-a3b4-6be0e04c8fc3",

202+ "anonReader", port=${toString anonPort})),

203+ lambda: [

204+ server.wait_for_console_text("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"),

205+ client2.succeed(publish("-m test", "anonWriter", port=${toString anonPort}))

206+ ])

185207 '';

186208})