2020-09-25 04:45:31 +00:00
|
|
|
# These tests will:
|
2021-07-04 02:40:35 +00:00
|
|
|
# * Set up a vaultwarden server
|
2024-06-20 14:57:18 +00:00
|
|
|
# * Have Firefox use the web vault to create an account, log in, and save a password to the vault
|
2020-09-25 04:45:31 +00:00
|
|
|
# * Have the bw cli log in and read that password from the vault
|
|
|
|
#
|
|
|
|
# Note that Firefox must be on the same machine as the server for WebCrypto APIs to be available (or HTTPS must be configured)
|
|
|
|
#
|
|
|
|
# The same tests should work without modification on the official bitwarden server, if we ever package that.
|
|
|
|
|
|
|
|
let
|
2024-06-20 14:57:18 +00:00
|
|
|
makeVaultwardenTest = name: {
|
|
|
|
backend ? name,
|
|
|
|
withClient ? true,
|
|
|
|
testScript ? null,
|
|
|
|
}: import ./make-test-python.nix ({ lib, pkgs, ...}: let
|
|
|
|
dbPassword = "please_dont_hack";
|
|
|
|
userEmail = "meow@example.com";
|
|
|
|
userPassword = "also_super_secret_ZJWpBKZi668QGt"; # Must be complex to avoid interstitial warning on the signup page
|
|
|
|
storedPassword = "seeeecret";
|
|
|
|
|
|
|
|
testRunner = pkgs.writers.writePython3Bin "test-runner" {
|
|
|
|
libraries = [ pkgs.python3Packages.selenium ];
|
|
|
|
flakeIgnore = [ "E501" ];
|
|
|
|
} ''
|
|
|
|
|
|
|
|
from selenium.webdriver.common.by import By
|
|
|
|
from selenium.webdriver import Firefox
|
|
|
|
from selenium.webdriver.firefox.options import Options
|
|
|
|
from selenium.webdriver.support.ui import WebDriverWait
|
|
|
|
from selenium.webdriver.support import expected_conditions as EC
|
|
|
|
|
|
|
|
options = Options()
|
|
|
|
options.add_argument('--headless')
|
|
|
|
driver = Firefox(options=options)
|
|
|
|
|
|
|
|
driver.implicitly_wait(20)
|
|
|
|
driver.get('http://localhost:8080/#/register')
|
|
|
|
|
|
|
|
wait = WebDriverWait(driver, 10)
|
|
|
|
|
|
|
|
wait.until(EC.title_contains("Vaultwarden Web"))
|
|
|
|
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_email').send_keys(
|
|
|
|
'${userEmail}'
|
|
|
|
)
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_name').send_keys(
|
|
|
|
'A Cat'
|
|
|
|
)
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_master-password').send_keys(
|
|
|
|
'${userPassword}'
|
|
|
|
)
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_confirm-master-password').send_keys(
|
|
|
|
'${userPassword}'
|
|
|
|
)
|
|
|
|
if driver.find_element(By.CSS_SELECTOR, 'input#checkForBreaches').is_selected():
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#checkForBreaches').click()
|
|
|
|
|
|
|
|
driver.find_element(By.XPATH, "//button[contains(., 'Create account')]").click()
|
|
|
|
|
|
|
|
wait.until_not(EC.title_contains("Create account"))
|
|
|
|
|
|
|
|
driver.find_element(By.XPATH, "//button[contains(., 'Continue')]").click()
|
|
|
|
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#login_input_master-password').send_keys(
|
|
|
|
'${userPassword}'
|
|
|
|
)
|
|
|
|
driver.find_element(By.XPATH, "//button[contains(., 'Log in')]").click()
|
|
|
|
|
|
|
|
wait.until(EC.title_contains("Vaults"))
|
|
|
|
|
|
|
|
driver.find_element(By.XPATH, "//button[contains(., 'New item')]").click()
|
|
|
|
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys(
|
|
|
|
'secrets'
|
|
|
|
)
|
|
|
|
driver.find_element(By.CSS_SELECTOR, 'input#loginPassword').send_keys(
|
|
|
|
'${storedPassword}'
|
|
|
|
)
|
|
|
|
|
|
|
|
driver.find_element(By.XPATH, "//button[contains(., 'Save')]").click()
|
|
|
|
'';
|
|
|
|
in {
|
|
|
|
inherit name;
|
2020-09-25 04:45:31 +00:00
|
|
|
|
|
|
|
meta = {
|
2024-06-20 14:57:18 +00:00
|
|
|
maintainers = with pkgs.lib.maintainers; [ dotlambda SuperSandro2000 ];
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
nodes = {
|
2024-06-20 14:57:18 +00:00
|
|
|
server = { pkgs, ... }: lib.mkMerge [
|
|
|
|
{
|
2020-09-25 04:45:31 +00:00
|
|
|
mysql = {
|
|
|
|
services.mysql = {
|
|
|
|
enable = true;
|
|
|
|
initialScript = pkgs.writeText "mysql-init.sql" ''
|
|
|
|
CREATE DATABASE bitwarden;
|
|
|
|
CREATE USER 'bitwardenuser'@'localhost' IDENTIFIED BY '${dbPassword}';
|
|
|
|
GRANT ALL ON `bitwarden`.* TO 'bitwardenuser'@'localhost';
|
|
|
|
FLUSH PRIVILEGES;
|
|
|
|
'';
|
2021-06-06 07:54:09 +00:00
|
|
|
package = pkgs.mariadb;
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
2021-07-04 02:40:35 +00:00
|
|
|
services.vaultwarden.config.databaseUrl = "mysql://bitwardenuser:${dbPassword}@localhost/bitwarden";
|
2020-09-25 04:45:31 +00:00
|
|
|
|
2021-07-04 02:40:35 +00:00
|
|
|
systemd.services.vaultwarden.after = [ "mysql.service" ];
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
postgresql = {
|
|
|
|
services.postgresql = {
|
|
|
|
enable = true;
|
2024-06-20 14:57:18 +00:00
|
|
|
ensureDatabases = [ "vaultwarden" ];
|
|
|
|
ensureUsers = [{
|
|
|
|
name = "vaultwarden";
|
|
|
|
ensureDBOwnership = true;
|
|
|
|
}];
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
2024-06-20 14:57:18 +00:00
|
|
|
services.vaultwarden.config.databaseUrl = "postgresql:///vaultwarden?host=/run/postgresql";
|
2020-09-25 04:45:31 +00:00
|
|
|
|
2021-07-04 02:40:35 +00:00
|
|
|
systemd.services.vaultwarden.after = [ "postgresql.service" ];
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
2024-06-20 14:57:18 +00:00
|
|
|
sqlite = {
|
2024-09-19 14:19:46 +00:00
|
|
|
services.vaultwarden.backupDir = "/srv/backups/vaultwarden";
|
2024-06-20 14:57:18 +00:00
|
|
|
|
|
|
|
environment.systemPackages = [ pkgs.sqlite ];
|
|
|
|
};
|
|
|
|
}.${backend}
|
2020-09-25 04:45:31 +00:00
|
|
|
|
|
|
|
{
|
2024-06-20 14:57:18 +00:00
|
|
|
services.vaultwarden = {
|
|
|
|
enable = true;
|
|
|
|
dbBackend = backend;
|
|
|
|
config = {
|
2024-07-27 06:49:29 +00:00
|
|
|
rocketAddress = "::";
|
2024-06-20 14:57:18 +00:00
|
|
|
rocketPort = 8080;
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
networking.firewall.allowedTCPPorts = [ 8080 ];
|
|
|
|
|
|
|
|
environment.systemPackages = [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
|
|
|
|
}
|
|
|
|
];
|
|
|
|
} // lib.optionalAttrs withClient {
|
|
|
|
client = { pkgs, ... }: {
|
|
|
|
environment.systemPackages = [ pkgs.bitwarden-cli ];
|
|
|
|
};
|
2020-09-25 04:45:31 +00:00
|
|
|
};
|
|
|
|
|
2024-06-20 14:57:18 +00:00
|
|
|
testScript = if testScript != null then testScript else ''
|
2020-09-25 04:45:31 +00:00
|
|
|
start_all()
|
2021-07-04 02:40:35 +00:00
|
|
|
server.wait_for_unit("vaultwarden.service")
|
2024-06-20 14:57:18 +00:00
|
|
|
server.wait_for_open_port(8080)
|
2020-09-25 04:45:31 +00:00
|
|
|
|
|
|
|
with subtest("configure the cli"):
|
2024-06-20 14:57:18 +00:00
|
|
|
client.succeed("bw --nointeraction config server http://server:8080")
|
2020-09-25 04:45:31 +00:00
|
|
|
|
2022-12-28 21:21:41 +00:00
|
|
|
with subtest("can't login to nonexistent account"):
|
2020-09-25 04:45:31 +00:00
|
|
|
client.fail(
|
|
|
|
"bw --nointeraction --raw login ${userEmail} ${userPassword}"
|
|
|
|
)
|
|
|
|
|
|
|
|
with subtest("use the web interface to sign up, log in, and save a password"):
|
2023-11-16 04:20:00 +00:00
|
|
|
server.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
|
2020-09-25 04:45:31 +00:00
|
|
|
|
|
|
|
with subtest("log in with the cli"):
|
|
|
|
key = client.succeed(
|
|
|
|
"bw --nointeraction --raw login ${userEmail} ${userPassword}"
|
|
|
|
).strip()
|
|
|
|
|
|
|
|
with subtest("sync with the cli"):
|
|
|
|
client.succeed(f"bw --nointeraction --raw --session {key} sync -f")
|
|
|
|
|
|
|
|
with subtest("get the password with the cli"):
|
2024-06-20 14:57:18 +00:00
|
|
|
password = client.wait_until_succeeds(
|
|
|
|
f"bw --nointeraction --raw --session {key} list items | ${pkgs.jq}/bin/jq -r .[].login.password",
|
|
|
|
timeout=60
|
2020-09-25 04:45:31 +00:00
|
|
|
)
|
|
|
|
assert password.strip() == "${storedPassword}"
|
2024-06-20 14:57:18 +00:00
|
|
|
|
|
|
|
with subtest("Check systemd unit hardening"):
|
|
|
|
server.log(server.succeed("systemd-analyze security vaultwarden.service | grep -v ✓"))
|
2020-09-25 04:45:31 +00:00
|
|
|
'';
|
2024-06-20 14:57:18 +00:00
|
|
|
});
|
2020-09-25 04:45:31 +00:00
|
|
|
in
|
2024-06-20 14:57:18 +00:00
|
|
|
builtins.mapAttrs (k: v: makeVaultwardenTest k v) {
|
|
|
|
mysql = {};
|
|
|
|
postgresql = {};
|
|
|
|
sqlite = {};
|
|
|
|
sqlite-backup = {
|
|
|
|
backend = "sqlite";
|
|
|
|
withClient = false;
|
|
|
|
|
|
|
|
testScript = ''
|
|
|
|
start_all()
|
|
|
|
server.wait_for_unit("vaultwarden.service")
|
|
|
|
server.wait_for_open_port(8080)
|
|
|
|
|
|
|
|
with subtest("Set up vaultwarden"):
|
|
|
|
server.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
|
|
|
|
|
|
|
|
with subtest("Run the backup script"):
|
|
|
|
server.start_job("backup-vaultwarden.service")
|
|
|
|
|
|
|
|
with subtest("Check that backup exists"):
|
2024-09-19 14:19:46 +00:00
|
|
|
server.succeed('[ -d "/srv/backups/vaultwarden" ]')
|
|
|
|
server.succeed('[ -f "/srv/backups/vaultwarden/db.sqlite3" ]')
|
|
|
|
server.succeed('[ -d "/srv/backups/vaultwarden/attachments" ]')
|
|
|
|
server.succeed('[ -f "/srv/backups/vaultwarden/rsa_key.pem" ]')
|
2024-07-01 15:47:52 +00:00
|
|
|
# Ensure only the db backed up with the backup command exists and not the other db files.
|
2024-09-19 14:19:46 +00:00
|
|
|
server.succeed('[ ! -f "/srv/backups/vaultwarden/db.sqlite3-shm" ]')
|
2024-06-20 14:57:18 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
}
|