nixos/tests/systemd-networkd.nix

   1 let generateNodeConf = { lib, pkgs, config, privk, pubk, systemdCreds, peerId, nodeId, ...}: {
   2       imports = [ common/user-account.nix ];
   3       systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
   4       networking.useNetworkd = true;
   5       networking.useDHCP = false;
   6       networking.firewall.enable = false;
   7       virtualisation.vlans = [ 1 ];
   8       environment.systemPackages = with pkgs; [ wireguard-tools ];
   9       environment.etc."credstore/network.wireguard.private" = lib.mkIf systemdCreds { text = privk; };
  10       systemd.network = {
  11         enable = true;
  12         config = {
  13           routeTables.custom = 23;
  14         };
  15         netdevs = {
  16           "90-wg0" = {
  17             netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
  18             wireguardConfig = {
  19               # Test storing wireguard private key using systemd credentials.
  20               PrivateKey = lib.mkIf systemdCreds "@network.wireguard.private";
  21
  22               # NOTE: we're storing the wireguard private key in the
  23               #       store for this test. Do not do this in the real
  24               #       world. Keep in mind the nix store is
  25               #       world-readable.
  26               PrivateKeyFile = lib.mkIf (!systemdCreds) (pkgs.writeText "wg0-priv" privk);
  27               ListenPort = 51820;
  28               FirewallMark = 42;
  29             };
  30             wireguardPeers = [ {
  31               Endpoint = "192.168.1.${peerId}:51820";
  32               PublicKey = pubk;
  33               PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
  34               AllowedIPs = [ "10.0.0.${peerId}/32" ];
  35               PersistentKeepalive = 15;
  36             } ];
  37           };
  38         };
  39         networks = {
  40           "99-nope" = {
  41             matchConfig.Name = "eth*";
  42             linkConfig.Unmanaged = true;
  43           };
  44           "90-wg0" = {
  45             matchConfig = { Name = "wg0"; };
  46             address = [ "10.0.0.${nodeId}/32" ];
  47             routes = [
  48               { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }
  49               { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; Table = "custom"; }
  50             ];
  51           };
  52           "30-eth1" = {
  53             matchConfig = { Name = "eth1"; };
  54             address = [
  55               "192.168.1.${nodeId}/24"
  56               "fe80::${nodeId}/64"
  57             ];
  58             routingPolicyRules = [
  59               { Table = 10; IncomingInterface = "eth1"; Family = "both"; }
  60               { Table = 20; OutgoingInterface = "eth1"; }
  61               { Table = 30; From = "192.168.1.1"; To = "192.168.1.2"; SourcePort = 666 ; DestinationPort = 667; }
  62               { Table = 40; IPProtocol = "tcp"; InvertRule = true; }
  63               { Table = 50; IncomingInterface = "eth1"; Family = "ipv4"; }
  64               { Table = 60; FirewallMark = 4; }
  65               { Table = 70; FirewallMark = "16/0x1f"; }
  66             ];
  67           };
  68         };
  69       };
  70     };
  71 in import ./make-test-python.nix ({pkgs, ... }: {
  72   name = "networkd";
  73   meta = with pkgs.lib.maintainers; {
  74     maintainers = [ picnoir ];
  75   };
  76   nodes = {
  77     node1 = { pkgs, ... }@attrs:
  78     let localConf = {
  79         privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
  80         pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
  81         systemdCreds = false;
  82         nodeId = "1";
  83         peerId = "2";
  84     };
  85     in generateNodeConf (attrs // localConf);
  86
  87     node2 = { pkgs, ... }@attrs:
  88     let localConf = {
  89         privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
  90         pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
  91         systemdCreds = true;
  92         nodeId = "2";
  93         peerId = "1";
  94     };
  95     in generateNodeConf (attrs // localConf);
  96   };
  97 testScript = ''
  98     start_all()
  99     node1.wait_for_unit("systemd-networkd-wait-online.service")
 100     node2.wait_for_unit("systemd-networkd-wait-online.service")
 101
 102     # ================================
 103     # Networkd Config
 104     # ================================
 105     node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
 106     node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")
 107
 108     # ================================
 109     # Wireguard
 110     # ================================
 111     node1.succeed("ping -c 5 10.0.0.2")
 112     node2.succeed("ping -c 5 10.0.0.1")
 113     # Is the fwmark set?
 114     node2.succeed("wg | grep -q 42")
 115
 116     # ================================
 117     # Routing Policies
 118     # ================================
 119     # Testing all the routingPolicyRuleConfig members:
 120     # Table + IncomingInterface
 121     node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
 122     # OutgoingInterface
 123     node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
 124     # From + To + SourcePort + DestinationPort
 125     node1.succeed(
 126         "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
 127     )
 128     # IPProtocol + InvertRule
 129     node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
 130     # FirewallMark without a mask
 131     node1.succeed("sudo ip rule | grep 'from all fwmark 0x4 lookup 60'")
 132     # FirewallMark with a mask
 133     node1.succeed("sudo ip rule | grep 'from all fwmark 0x10/0x1f lookup 70'")
 134 '';
 135 })