depot/third_party/nixpkgs/nixos/tests/rosenpass.nix

215 lines
6.5 KiB
Nix
Raw Normal View History

import ./make-test-python.nix ({ pkgs, ... }:
let
deviceName = "rp0";
server = {
ip = "fe80::1";
wg = {
public = "mQufmDFeQQuU/fIaB2hHgluhjjm1ypK4hJr1cW3WqAw=";
secret = "4N5Y1dldqrpsbaEiY8O0XBUGUFf8vkvtBtm8AoOX7Eo=";
listen = 10000;
};
};
client = {
ip = "fe80::2";
wg = {
public = "Mb3GOlT7oS+F3JntVKiaD7SpHxLxNdtEmWz/9FMnRFU=";
secret = "uC5dfGMv7Oxf5UDfdPkj6rZiRZT2dRWp5x8IQxrNcUE=";
};
};
in
{
name = "rosenpass";
nodes =
let
shared = peer: { config, modulesPath, ... }: {
imports = [ "${modulesPath}/services/networking/rosenpass.nix" ];
boot.kernelModules = [ "wireguard" ];
services.rosenpass = {
enable = true;
defaultDevice = deviceName;
settings = {
verbosity = "Verbose";
public_key = "/etc/rosenpass/pqpk";
secret_key = "/etc/rosenpass/pqsk";
};
};
networking.firewall.allowedUDPPorts = [ 9999 ];
systemd.network = {
enable = true;
networks."rosenpass" = {
matchConfig.Name = deviceName;
networkConfig.IPv4Forwarding = true;
networkConfig.IPv6Forwarding = true;
address = [ "${peer.ip}/64" ];
};
netdevs."10-rp0" = {
netdevConfig = {
Kind = "wireguard";
Name = deviceName;
};
wireguardConfig.PrivateKeyFile = "/etc/wireguard/wgsk";
};
};
environment.etc."wireguard/wgsk" = {
text = peer.wg.secret;
user = "systemd-network";
group = "systemd-network";
};
};
in
{
server = {
imports = [ (shared server) ];
networking.firewall.allowedUDPPorts = [ server.wg.listen ];
systemd.network.netdevs."10-${deviceName}" = {
wireguardConfig.ListenPort = server.wg.listen;
wireguardPeers = [
{
AllowedIPs = [ "::/0" ];
PublicKey = client.wg.public;
}
];
};
services.rosenpass.settings = {
listen = [ "0.0.0.0:9999" ];
peers = [
{
public_key = "/etc/rosenpass/peers/client/pqpk";
peer = client.wg.public;
}
];
};
};
client = {
imports = [ (shared client) ];
systemd.network.netdevs."10-${deviceName}".wireguardPeers = [
{
AllowedIPs = [ "::/0" ];
PublicKey = server.wg.public;
Endpoint = "server:${builtins.toString server.wg.listen}";
}
];
services.rosenpass.settings.peers = [
{
public_key = "/etc/rosenpass/peers/server/pqpk";
endpoint = "server:9999";
peer = server.wg.public;
}
];
};
};
testScript = { ... }: ''
from os import system
# Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
rosenpass = "${pkgs.rosenpass}/bin/rosenpass"
# Path in `/etc` where keys will be placed.
etc = "/etc/rosenpass"
start_all()
for machine in [server, client]:
machine.wait_for_unit("multi-user.target")
# Gently stop Rosenpass to avoid crashes during key generation/distribution.
for machine in [server, client]:
machine.execute("systemctl stop rosenpass.service")
for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
pk, sk = f"{name}.pqpk", f"{name}.pqsk"
system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
machine.copy_from_host(sk, f"{etc}/pqsk")
machine.copy_from_host(pk, f"{etc}/pqpk")
remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")
for machine in [server, client]:
machine.execute("systemctl start rosenpass.service")
for machine in [server, client]:
machine.wait_for_unit("rosenpass.service")
with subtest("ping"):
client.succeed("ping -c 2 -i 0.5 ${server.ip}%${deviceName}")
with subtest("preshared-keys"):
# Rosenpass works by setting the WireGuard preshared key at regular intervals.
# Thus, if it is not active, then no key will be set, and the output of `wg show` will contain "none".
# Otherwise, if it is active, then the key will be set and "none" will not be found in the output of `wg show`.
for machine in [server, client]:
machine.wait_until_succeeds("wg show all preshared-keys | grep --invert-match none", timeout=5)
'';
# NOTE: Below configuration is for "interactive" (=developing/debugging) only.
interactive.nodes =
let
inherit (import ./ssh-keys.nix pkgs) snakeOilPublicKey snakeOilPrivateKey;
sshAndKeyGeneration = {
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
environment.systemPackages = [
(pkgs.writeShellApplication {
name = "gen-keys";
runtimeInputs = [ pkgs.rosenpass ];
text = ''
HOST="$(hostname)"
if [ "$HOST" == "server" ]
then
PEER="client"
else
PEER="server"
fi
# Generate keypair.
mkdir -vp /etc/rosenpass/peers/$PEER
rosenpass gen-keys --force --secret-key /etc/rosenpass/pqsk --public-key /etc/rosenpass/pqpk
# Set up SSH key.
mkdir -p /root/.ssh
cp ${snakeOilPrivateKey} /root/.ssh/id_ecdsa
chmod 0400 /root/.ssh/id_ecdsa
# Copy public key to other peer.
# shellcheck disable=SC2029
ssh -o StrictHostKeyChecking=no $PEER "mkdir -pv /etc/rosenpass/peers/$HOST"
scp /etc/rosenpass/pqpk "$PEER:/etc/rosenpass/peers/$HOST/pqpk"
'';
})
];
};
# Use kmscon <https://www.freedesktop.org/wiki/Software/kmscon/>
# to provide a slightly nicer console, and while we're at it,
# also use a nice font.
# With kmscon, we can for example zoom in/out using [Ctrl] + [+]
# and [Ctrl] + [-]
niceConsoleAndAutologin.services.kmscon = {
enable = true;
autologinUser = "root";
fonts = [{
name = "Fira Code";
package = pkgs.fira-code;
}];
};
in
{
server = sshAndKeyGeneration // niceConsoleAndAutologin;
client = sshAndKeyGeneration // niceConsoleAndAutologin;
};
})