nixos/tests/3proxy.nix

   1 { lib, pkgs, ... }: {
   2   name = "3proxy";
   3   meta = with lib.maintainers; {
   4     maintainers = [ misuzu ];
   5   };
   6
   7   nodes = {
   8     peer0 = { lib, ... }: {
   9       networking.useDHCP = false;
  10       networking.interfaces.eth1 = {
  11         ipv4.addresses = [
  12           {
  13             address = "192.168.0.1";
  14             prefixLength = 24;
  15           }
  16           {
  17             address = "216.58.211.111";
  18             prefixLength = 24;
  19           }
  20         ];
  21       };
  22     };
  23
  24     peer1 = { lib, ... }: {
  25       networking.useDHCP = false;
  26       networking.interfaces.eth1 = {
  27         ipv4.addresses = [
  28           {
  29             address = "192.168.0.2";
  30             prefixLength = 24;
  31           }
  32           {
  33             address = "216.58.211.112";
  34             prefixLength = 24;
  35           }
  36         ];
  37       };
  38       # test that binding to [::] is working when ipv6 is disabled
  39       networking.enableIPv6 = false;
  40       services._3proxy = {
  41         enable = true;
  42         services = [
  43           {
  44             type = "admin";
  45             bindPort = 9999;
  46             auth = [ "none" ];
  47           }
  48           {
  49             type = "proxy";
  50             bindPort = 3128;
  51             auth = [ "none" ];
  52           }
  53         ];
  54       };
  55       networking.firewall.allowedTCPPorts = [ 3128 9999 ];
  56     };
  57
  58     peer2 = { lib, ... }: {
  59       networking.useDHCP = false;
  60       networking.interfaces.eth1 = {
  61         ipv4.addresses = [
  62           {
  63             address = "192.168.0.3";
  64             prefixLength = 24;
  65           }
  66           {
  67             address = "216.58.211.113";
  68             prefixLength = 24;
  69           }
  70         ];
  71       };
  72       services._3proxy = {
  73         enable = true;
  74         services = [
  75           {
  76             type = "admin";
  77             bindPort = 9999;
  78             auth = [ "none" ];
  79           }
  80           {
  81             type = "proxy";
  82             bindPort = 3128;
  83             auth = [ "iponly" ];
  84             acl = [
  85               {
  86                 rule = "allow";
  87               }
  88             ];
  89           }
  90         ];
  91       };
  92       networking.firewall.allowedTCPPorts = [ 3128 9999 ];
  93     };
  94
  95     peer3 = { lib, pkgs, ... }: {
  96       networking.useDHCP = false;
  97       networking.interfaces.eth1 = {
  98         ipv4.addresses = [
  99           {
 100             address = "192.168.0.4";
 101             prefixLength = 24;
 102           }
 103           {
 104             address = "216.58.211.114";
 105             prefixLength = 24;
 106           }
 107         ];
 108       };
 109       services._3proxy = {
 110         enable = true;
 111         usersFile = pkgs.writeText "3proxy.passwd" ''
 112           admin:CR:$1$.GUV4Wvk$WnEVQtaqutD9.beO5ar1W/
 113         '';
 114         services = [
 115           {
 116             type = "admin";
 117             bindPort = 9999;
 118             auth = [ "none" ];
 119           }
 120           {
 121             type = "proxy";
 122             bindPort = 3128;
 123             auth = [ "strong" ];
 124             acl = [
 125               {
 126                 rule = "allow";
 127               }
 128             ];
 129           }
 130         ];
 131       };
 132       networking.firewall.allowedTCPPorts = [ 3128 9999 ];
 133     };
 134   };
 135
 136   testScript = ''
 137     start_all()
 138
 139     peer0.wait_for_unit("network-online.target")
 140
 141     peer1.wait_for_unit("3proxy.service")
 142     peer1.wait_for_open_port(9999)
 143
 144     # test none auth
 145     peer0.succeed(
 146         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://216.58.211.112:9999"
 147     )
 148     peer0.succeed(
 149         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://192.168.0.2:9999"
 150     )
 151     peer0.succeed(
 152         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.2:3128 -S -O /dev/null http://127.0.0.1:9999"
 153     )
 154
 155     peer2.wait_for_unit("3proxy.service")
 156     peer2.wait_for_open_port(9999)
 157
 158     # test iponly auth
 159     peer0.succeed(
 160         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://216.58.211.113:9999"
 161     )
 162     peer0.fail(
 163         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://192.168.0.3:9999"
 164     )
 165     peer0.fail(
 166         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.3:3128 -S -O /dev/null http://127.0.0.1:9999"
 167     )
 168
 169     peer3.wait_for_unit("3proxy.service")
 170     peer3.wait_for_open_port(9999)
 171
 172     # test strong auth
 173     peer0.succeed(
 174         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://admin:bigsecret\@192.168.0.4:3128 -S -O /dev/null http://216.58.211.114:9999"
 175     )
 176     peer0.fail(
 177         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://admin:bigsecret\@192.168.0.4:3128 -S -O /dev/null http://192.168.0.4:9999"
 178     )
 179     peer0.fail(
 180         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://216.58.211.114:9999"
 181     )
 182     peer0.fail(
 183         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://192.168.0.4:9999"
 184     )
 185     peer0.fail(
 186         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://127.0.0.1:9999"
 187     )
 188   '';
 189 }