nixos/tests/sslh.nix

   1 import ./make-test-python.nix {
   2   name = "sslh";
   3
   4   nodes = {
   5     server = { pkgs, lib, ... }: {
   6       networking.firewall.allowedTCPPorts = [ 443 ];
   7       networking.interfaces.eth1.ipv6.addresses = [
   8         {
   9           address = "fe00:aa:bb:cc::2";
  10           prefixLength = 64;
  11         }
  12       ];
  13       # sslh is really slow when reverse dns does not work
  14       networking.hosts = {
  15         "fe00:aa:bb:cc::2" = [ "server" ];
  16         "fe00:aa:bb:cc::1" = [ "client" ];
  17       };
  18       services.sslh = {
  19         enable = true;
  20         transparent = true;
  21         appendConfig = ''
  22           protocols:
  23           (
  24             { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
  25             { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
  26           );
  27         '';
  28       };
  29       services.openssh.enable = true;
  30       users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
  31       services.nginx = {
  32         enable = true;
  33         virtualHosts."localhost" = {
  34           addSSL = false;
  35           default = true;
  36           root = pkgs.runCommand "testdir" {} ''
  37             mkdir "$out"
  38             echo hello world > "$out/index.html"
  39           '';
  40         };
  41       };
  42     };
  43     client = { ... }: {
  44       networking.interfaces.eth1.ipv6.addresses = [
  45         {
  46           address = "fe00:aa:bb:cc::1";
  47           prefixLength = 64;
  48         }
  49       ];
  50       networking.hosts."fe00:aa:bb:cc::2" = [ "server" ];
  51       environment.etc.sshKey = {
  52         source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
  53         mode = "0600";
  54       };
  55     };
  56   };
  57
  58   testScript = ''
  59     start_all()
  60
  61     server.wait_for_unit("sslh.service")
  62     server.wait_for_unit("nginx.service")
  63     server.wait_for_unit("sshd.service")
  64     server.wait_for_open_port(80)
  65     server.wait_for_open_port(443)
  66     server.wait_for_open_port(22)
  67
  68     for arg in ["-6", "-4"]:
  69         client.wait_until_succeeds(f"ping {arg} -c1 server")
  70
  71         # check that ssh through sslh works
  72         client.succeed(
  73             f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
  74         )
  75
  76         # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
  77         ip = "fe00:aa:bb:cc::1" if arg == "-6" else "192.168.1."
  78         server.succeed(f"grep '{ip}' /tmp/foo{arg}")
  79
  80         # check that http through sslh works
  81         assert client.succeed(f"curl -f {arg} http://server:443").strip() == "hello world"
  82   '';
  83 }