139 lines
5.4 KiB
Nix
139 lines
5.4 KiB
Nix
let generateNodeConf = { lib, pkgs, config, privk, pubk, systemdCreds, peerId, nodeId, ...}: {
|
|
imports = [ common/user-account.nix ];
|
|
systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
|
|
networking.useNetworkd = true;
|
|
networking.useDHCP = false;
|
|
networking.firewall.enable = false;
|
|
virtualisation.vlans = [ 1 ];
|
|
environment.systemPackages = with pkgs; [ wireguard-tools ];
|
|
environment.etc."credstore/network.wireguard.private" = lib.mkIf systemdCreds { text = privk; };
|
|
systemd.network = {
|
|
enable = true;
|
|
config = {
|
|
routeTables.custom = 23;
|
|
};
|
|
netdevs = {
|
|
"90-wg0" = {
|
|
netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
|
|
wireguardConfig = {
|
|
# Test storing wireguard private key using systemd credentials.
|
|
PrivateKey = lib.mkIf systemdCreds "@network.wireguard.private";
|
|
|
|
# NOTE: we're storing the wireguard private key in the
|
|
# store for this test. Do not do this in the real
|
|
# world. Keep in mind the nix store is
|
|
# world-readable.
|
|
PrivateKeyFile = lib.mkIf (!systemdCreds) (pkgs.writeText "wg0-priv" privk);
|
|
ListenPort = 51820;
|
|
FirewallMark = 42;
|
|
};
|
|
wireguardPeers = [ {
|
|
Endpoint = "192.168.1.${peerId}:51820";
|
|
PublicKey = pubk;
|
|
PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
|
|
AllowedIPs = [ "10.0.0.${peerId}/32" ];
|
|
PersistentKeepalive = 15;
|
|
} ];
|
|
};
|
|
};
|
|
networks = {
|
|
"99-nope" = {
|
|
matchConfig.Name = "eth*";
|
|
linkConfig.Unmanaged = true;
|
|
};
|
|
"90-wg0" = {
|
|
matchConfig = { Name = "wg0"; };
|
|
address = [ "10.0.0.${nodeId}/32" ];
|
|
routes = [
|
|
{ Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }
|
|
{ Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; Table = "custom"; }
|
|
];
|
|
};
|
|
"30-eth1" = {
|
|
matchConfig = { Name = "eth1"; };
|
|
address = [
|
|
"192.168.1.${nodeId}/24"
|
|
"fe80::${nodeId}/64"
|
|
];
|
|
routingPolicyRules = [
|
|
{ Table = 10; IncomingInterface = "eth1"; Family = "both"; }
|
|
{ Table = 20; OutgoingInterface = "eth1"; }
|
|
{ Table = 30; From = "192.168.1.1"; To = "192.168.1.2"; SourcePort = 666 ; DestinationPort = 667; }
|
|
{ Table = 40; IPProtocol = "tcp"; InvertRule = true; }
|
|
{ Table = 50; IncomingInterface = "eth1"; Family = "ipv4"; }
|
|
{ Table = 60; FirewallMark = 4; }
|
|
{ Table = 70; FirewallMark = "16/0x1f"; }
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
in import ./make-test-python.nix ({pkgs, ... }: {
|
|
name = "networkd";
|
|
meta = with pkgs.lib.maintainers; {
|
|
maintainers = [ picnoir ];
|
|
};
|
|
nodes = {
|
|
node1 = { pkgs, ... }@attrs:
|
|
let localConf = {
|
|
privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
|
|
pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
|
|
systemdCreds = false;
|
|
nodeId = "1";
|
|
peerId = "2";
|
|
};
|
|
in generateNodeConf (attrs // localConf);
|
|
|
|
node2 = { pkgs, ... }@attrs:
|
|
let localConf = {
|
|
privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
|
|
pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
|
|
systemdCreds = true;
|
|
nodeId = "2";
|
|
peerId = "1";
|
|
};
|
|
in generateNodeConf (attrs // localConf);
|
|
};
|
|
testScript = ''
|
|
start_all()
|
|
node1.succeed("systemctl start systemd-networkd-wait-online@eth1.service")
|
|
node1.wait_for_unit("systemd-networkd-wait-online@eth1.service")
|
|
node1.wait_for_unit("systemd-networkd-wait-online.service")
|
|
node2.succeed("systemctl start systemd-networkd-wait-online@eth1.service")
|
|
node2.wait_for_unit("systemd-networkd-wait-online@eth1.service")
|
|
node2.wait_for_unit("systemd-networkd-wait-online.service")
|
|
|
|
# ================================
|
|
# Networkd Config
|
|
# ================================
|
|
node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
|
|
node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")
|
|
|
|
# ================================
|
|
# Wireguard
|
|
# ================================
|
|
node1.succeed("ping -c 5 10.0.0.2")
|
|
node2.succeed("ping -c 5 10.0.0.1")
|
|
# Is the fwmark set?
|
|
node2.succeed("wg | grep -q 42")
|
|
|
|
# ================================
|
|
# Routing Policies
|
|
# ================================
|
|
# Testing all the routingPolicyRuleConfig members:
|
|
# Table + IncomingInterface
|
|
node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
|
|
# OutgoingInterface
|
|
node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
|
|
# From + To + SourcePort + DestinationPort
|
|
node1.succeed(
|
|
"sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
|
|
)
|
|
# IPProtocol + InvertRule
|
|
node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
|
|
# FirewallMark without a mask
|
|
node1.succeed("sudo ip rule | grep 'from all fwmark 0x4 lookup 60'")
|
|
# FirewallMark with a mask
|
|
node1.succeed("sudo ip rule | grep 'from all fwmark 0x10/0x1f lookup 70'")
|
|
'';
|
|
})
|