nixos/tests/systemd-networkd.nix

   1 let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
   2       imports = [ common/user-account.nix ];
   3       systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
   4       networking.useNetworkd = true;
   5       networking.useDHCP = false;
   6       networking.firewall.enable = false;
   7       virtualisation.vlans = [ 1 ];
   8       environment.systemPackages = with pkgs; [ wireguard-tools ];
   9       systemd.network = {
  10         enable = true;
  11         config = {
  12           routeTables.custom = 23;
  13         };
  14         netdevs = {
  15           "90-wg0" = {
  16             netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
  17             wireguardConfig = {
  18               # NOTE: we're storing the wireguard private key in the
  19               #       store for this test. Do not do this in the real
  20               #       world. Keep in mind the nix store is
  21               #       world-readable.
  22               PrivateKeyFile = pkgs.writeText "wg0-priv" privk;
  23               ListenPort = 51820;
  24               FirewallMark = 42;
  25             };
  26             wireguardPeers = [ {wireguardPeerConfig={
  27               Endpoint = "192.168.1.${peerId}:51820";
  28               PublicKey = pubk;
  29               PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
  30               AllowedIPs = [ "10.0.0.${peerId}/32" ];
  31               PersistentKeepalive = 15;
  32             };}];
  33           };
  34         };
  35         networks = {
  36           "99-nope" = {
  37             matchConfig.Name = "eth*";
  38             linkConfig.Unmanaged = true;
  39           };
  40           "90-wg0" = {
  41             matchConfig = { Name = "wg0"; };
  42             address = [ "10.0.0.${nodeId}/32" ];
  43             routes = [
  44               { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
  45               { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; Table = "custom"; }; }
  46             ];
  47           };
  48           "30-eth1" = {
  49             matchConfig = { Name = "eth1"; };
  50             address = [
  51               "192.168.1.${nodeId}/24"
  52               "fe80::${nodeId}/64"
  53             ];
  54             routingPolicyRules = [
  55               { routingPolicyRuleConfig = { Table = 10; IncomingInterface = "eth1"; Family = "both"; };}
  56               { routingPolicyRuleConfig = { Table = 20; OutgoingInterface = "eth1"; };}
  57               { routingPolicyRuleConfig = { Table = 30; From = "192.168.1.1"; To = "192.168.1.2"; SourcePort = 666 ; DestinationPort = 667; };}
  58               { routingPolicyRuleConfig = { Table = 40; IPProtocol = "tcp"; InvertRule = true; };}
  59               { routingPolicyRuleConfig = { Table = 50; IncomingInterface = "eth1"; Family = "ipv4"; };}
  60             ];
  61           };
  62         };
  63       };
  64     };
  65 in import ./make-test-python.nix ({pkgs, ... }: {
  66   name = "networkd";
  67   meta = with pkgs.lib.maintainers; {
  68     maintainers = [ ninjatrappeur ];
  69   };
  70   nodes = {
  71     node1 = { pkgs, ... }@attrs:
  72     let localConf = {
  73         privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
  74         pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
  75         nodeId = "1";
  76         peerId = "2";
  77     };
  78     in generateNodeConf (attrs // localConf);
  79
  80     node2 = { pkgs, ... }@attrs:
  81     let localConf = {
  82         privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
  83         pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
  84         nodeId = "2";
  85         peerId = "1";
  86     };
  87     in generateNodeConf (attrs // localConf);
  88   };
  89 testScript = ''
  90     start_all()
  91     node1.wait_for_unit("systemd-networkd-wait-online.service")
  92     node2.wait_for_unit("systemd-networkd-wait-online.service")
  93
  94     # ================================
  95     # Networkd Config
  96     # ================================
  97     node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
  98     node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")
  99
 100     # ================================
 101     # Wireguard
 102     # ================================
 103     node1.succeed("ping -c 5 10.0.0.2")
 104     node2.succeed("ping -c 5 10.0.0.1")
 105     # Is the fwmark set?
 106     node2.succeed("wg | grep -q 42")
 107
 108     # ================================
 109     # Routing Policies
 110     # ================================
 111     # Testing all the routingPolicyRuleConfig members:
 112     # Table + IncomingInterface
 113     node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
 114     # OutgoingInterface
 115     node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
 116     # From + To + SourcePort + DestinationPort
 117     node1.succeed(
 118         "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
 119     )
 120     # IPProtocol + InvertRule
 121     node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
 122 '';
 123 })