nixos/tests/sslh.nix

   1 import ./make-test-python.nix {
   2   name = "sslh";
   3
   4   nodes = {
   5     server = { pkgs, lib, ... }: {
   6       networking.firewall.allowedTCPPorts = [ 443 ];
   7       networking.interfaces.eth1.ipv6.addresses = [
   8         {
   9           address = "fe00:aa:bb:cc::2";
  10           prefixLength = 64;
  11         }
  12       ];
  13       services.sslh = {
  14         enable = true;
  15         settings.transparent = true;
  16         settings.protocols = [
  17           { name = "ssh"; service = "ssh"; host = "localhost"; port = "22"; probe = "builtin"; }
  18           { name = "http"; host = "localhost"; port = "80"; probe = "builtin"; }
  19         ];
  20       };
  21       services.openssh.enable = true;
  22       users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
  23       services.nginx = {
  24         enable = true;
  25         virtualHosts."localhost" = {
  26           addSSL = false;
  27           default = true;
  28           root = pkgs.runCommand "testdir" {} ''
  29             mkdir "$out"
  30             echo hello world > "$out/index.html"
  31           '';
  32         };
  33       };
  34     };
  35     client = { ... }: {
  36       networking.interfaces.eth1.ipv6.addresses = [
  37         {
  38           address = "fe00:aa:bb:cc::1";
  39           prefixLength = 64;
  40         }
  41       ];
  42       networking.hosts."fe00:aa:bb:cc::2" = [ "server" ];
  43       environment.etc.sshKey = {
  44         source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
  45         mode = "0600";
  46       };
  47     };
  48   };
  49
  50   testScript = ''
  51     start_all()
  52
  53     server.wait_for_unit("sslh.service")
  54     server.wait_for_unit("nginx.service")
  55     server.wait_for_unit("sshd.service")
  56     server.wait_for_open_port(80)
  57     server.wait_for_open_port(443)
  58     server.wait_for_open_port(22)
  59
  60     for arg in ["-6", "-4"]:
  61         client.wait_until_succeeds(f"ping {arg} -c1 server")
  62
  63         # check that ssh through sslh works
  64         client.succeed(
  65             f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
  66         )
  67
  68         # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
  69         ip = "fe00:aa:bb:cc::1" if arg == "-6" else "192.168.1."
  70         server.succeed(f"grep '{ip}' /tmp/foo{arg}")
  71
  72         # check that http through sslh works
  73         assert client.succeed(f"curl -f {arg} http://server:443").strip() == "hello world"
  74   '';
  75 }