let aliceIp6 = "202:b70:9b0b:cf34:f93c:8f18:bbfd:7034"; aliceKeys = { PublicKey = "3e91ec9e861960d86e1ce88051f97c435bdf2859640ab681dfa906eb45ad5182"; PrivateKey = "a867f9e078e4ce58d310cf5acd4622d759e2a21df07e1d6fc380a2a26489480d3e91ec9e861960d86e1ce88051f97c435bdf2859640ab681dfa906eb45ad5182"; }; bobIp6 = "202:a483:73a4:9f2d:a559:4a19:bc9:8458"; bobPrefix = "302:a483:73a4:9f2d"; bobConfig = { InterfacePeers = { eth1 = [ "tcp://192.168.1.200:12345" ]; }; MulticastInterfaces = [ { Regex = ".*"; Beacon = true; Listen = true; Port = 54321; Priority = 0; } ]; PublicKey = "2b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186"; PrivateKey = "0c4a24acd3402722ce9277ed179f4a04b895b49586493c25fbaed60653d857d62b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186"; }; danIp6 = bobPrefix + "::2"; in import ./make-test-python.nix ({ pkgs, ...} : { name = "yggdrasil"; meta = with pkgs.lib.maintainers; { maintainers = [ gazally ]; }; nodes = rec { # Alice is listening for peerings on a specified port, # but has multicast peering disabled. Alice has part of her # yggdrasil config in Nix and part of it in a file. alice = { ... }: { networking = { interfaces.eth1.ipv4.addresses = [{ address = "192.168.1.200"; prefixLength = 24; }]; firewall.allowedTCPPorts = [ 80 12345 ]; }; services.httpd.enable = true; services.httpd.adminAddr = "foo@example.org"; services.yggdrasil = { enable = true; settings = { Listen = ["tcp://0.0.0.0:12345"]; MulticastInterfaces = [ ]; }; configFile = toString (pkgs.writeTextFile { name = "yggdrasil-alice-conf"; text = builtins.toJSON aliceKeys; }); }; }; # Bob is set up to peer with Alice, and also to do local multicast # peering. Bob's yggdrasil config is in a file. bob = { ... }: { networking.firewall.allowedTCPPorts = [ 54321 ]; services.yggdrasil = { enable = true; openMulticastPort = true; configFile = toString (pkgs.writeTextFile { name = "yggdrasil-bob-conf"; text = builtins.toJSON bobConfig; }); }; boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1; networking = { bridges.br0.interfaces = [ ]; interfaces.br0 = { ipv6.addresses = [{ address = bobPrefix + "::1"; prefixLength = 64; }]; }; }; # dan is a node inside a container running on bob's host. containers.dan = { autoStart = true; privateNetwork = true; hostBridge = "br0"; config = { config, pkgs, ... }: { networking.interfaces.eth0.ipv6 = { addresses = [{ address = bobPrefix + "::2"; prefixLength = 64; }]; routes = [{ address = "200::"; prefixLength = 7; via = bobPrefix + "::1"; }]; }; services.httpd.enable = true; services.httpd.adminAddr = "foo@example.org"; networking.firewall.allowedTCPPorts = [ 80 ]; }; }; }; # Carol only does local peering. Carol's yggdrasil config is all Nix. carol = { ... }: { networking.firewall.allowedTCPPorts = [ 43210 ]; services.yggdrasil = { enable = true; extraArgs = [ "-loglevel" "error" ]; denyDhcpcdInterfaces = [ "ygg0" ]; settings = { IfTAPMode = true; IfName = "ygg0"; MulticastInterfaces = [ { Port = 43210; } ]; openMulticastPort = true; }; persistentKeys = true; }; }; }; testScript = '' import re # Give Alice a head start so she is ready when Bob calls. alice.start() alice.wait_for_unit("yggdrasil.service") bob.start() carol.start() bob.wait_for_unit("default.target") carol.wait_for_unit("yggdrasil.service") ip_addr_show = "ip -o -6 addr show dev ygg0 scope global" carol.wait_until_succeeds(f"[ `{ip_addr_show} | grep -v tentative | wc -l` -ge 1 ]") carol_ip6 = re.split(" +|/", carol.succeed(ip_addr_show))[3] # If Alice can talk to Carol, then Bob's outbound peering and Carol's # local peering have succeeded and everybody is connected. alice.wait_until_succeeds(f"ping -c 1 {carol_ip6}") alice.succeed("ping -c 1 ${bobIp6}") bob.succeed("ping -c 1 ${aliceIp6}") bob.succeed(f"ping -c 1 {carol_ip6}") carol.succeed("ping -c 1 ${aliceIp6}") carol.succeed("ping -c 1 ${bobIp6}") carol.succeed("ping -c 1 ${bobPrefix}::1") carol.succeed("ping -c 8 ${danIp6}") carol.fail("journalctl -u dhcpcd | grep ygg0") alice.wait_for_unit("httpd.service") carol.succeed("curl --fail -g http://[${aliceIp6}]") carol.succeed("curl --fail -g http://[${danIp6}]") ''; })