c4fd7cf16d
This patch is about removing `wireguardPeerConfig`, `dhcpServerStaticLeaseConfig` - a.k.a. the AbstractSingletonProxyFactoryBean of nixpkgs - and friends. As a former colleague said > worst abstraction ever I second that. I've written enough networkd config for NixOS systems so far to have a strong dislike. In fact, these don't even make sense: `netdevs.wireguardPeers._.wireguardPeerConfig` will be rendered into the key `[WireGuardPeer]` and every key from `wireguardPeerConfig` is in there. Since it's INI, there's no place where sections on the same level as wireguardPeerConfig fit into. Hence, get rid of it all. For the transition, using the old way is still allowed, but gives a warning. I think we could drop this after one release. The tests of rosenpass and systemd-networkd-dhcpserver-static-leases were broken on the rev before, hence they were updated, but are still not building.
251 lines
7.4 KiB
Nix
251 lines
7.4 KiB
Nix
# This test verifies that we can ping an IPv4-only server from an IPv6-only
|
|
# client via a NAT64 router. The hosts and networks are configured as follows:
|
|
#
|
|
# +------
|
|
# Client | eth1 Address: 2001:db8::2/64
|
|
# | | Route: 64:ff9b::/96 via 2001:db8::1
|
|
# +--|---
|
|
# | VLAN 3
|
|
# +--|---
|
|
# | eth2 Address: 2001:db8::1/64
|
|
# Router |
|
|
# | nat64 Address: 64:ff9b::1/128
|
|
# | Route: 64:ff9b::/96
|
|
# | Address: 192.0.2.0/32
|
|
# | Route: 192.0.2.0/24
|
|
# |
|
|
# | eth1 Address: 100.64.0.1/24
|
|
# +--|---
|
|
# | VLAN 2
|
|
# +--|---
|
|
# Server | eth1 Address: 100.64.0.2/24
|
|
# | Route: 192.0.2.0/24 via 100.64.0.1
|
|
# +------
|
|
|
|
import ./make-test-python.nix ({ pkgs, lib, ... }:
|
|
|
|
{
|
|
name = "tayga";
|
|
meta = with pkgs.lib.maintainers; {
|
|
maintainers = [ hax404 ];
|
|
};
|
|
|
|
nodes = {
|
|
# The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
|
|
# disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
|
|
# Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
|
|
# documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
|
|
# RFC 6589 (Carrier Grade NAT) is used here.
|
|
# To reach the IPv4 address pool of the NAT64 gateway, there is a static
|
|
# route configured. In normal cases, where the router would also source NAT
|
|
# the pool addresses to one IPv4 addresses, this would not be needed.
|
|
server = {
|
|
virtualisation.vlans = [
|
|
2 # towards router
|
|
];
|
|
networking = {
|
|
useDHCP = false;
|
|
interfaces.eth1 = lib.mkForce {};
|
|
};
|
|
systemd.network = {
|
|
enable = true;
|
|
networks."vlan1" = {
|
|
matchConfig.Name = "eth1";
|
|
address = [
|
|
"100.64.0.2/24"
|
|
];
|
|
routes = [
|
|
{ Destination = "192.0.2.0/24"; Gateway = "100.64.0.1"; }
|
|
];
|
|
};
|
|
};
|
|
programs.mtr.enable = true;
|
|
};
|
|
|
|
# The router is configured with static IPv4 addresses towards the server
|
|
# and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
|
|
# 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
|
|
# tun-interface nat64 and does the translation over it. The IPv6 packets
|
|
# are sent to this interfaces and received as IPv4 packets and vice versa.
|
|
# As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
|
|
# needs a pool of IPv4 addresses which must be at least as big as the
|
|
# expected amount of clients. In this test, the packets from the pool are
|
|
# directly routed towards the client. In normal cases, there would be a
|
|
# second source NAT44 to map all clients behind one IPv4 address.
|
|
router_systemd = {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
virtualisation.vlans = [
|
|
2 # towards server
|
|
3 # towards client
|
|
];
|
|
|
|
networking = {
|
|
useDHCP = false;
|
|
useNetworkd = true;
|
|
firewall.enable = false;
|
|
interfaces.eth1 = lib.mkForce {
|
|
ipv4 = {
|
|
addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
|
|
};
|
|
};
|
|
interfaces.eth2 = lib.mkForce {
|
|
ipv6 = {
|
|
addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.tayga = {
|
|
enable = true;
|
|
ipv4 = {
|
|
address = "192.0.2.0";
|
|
router = {
|
|
address = "192.0.2.1";
|
|
};
|
|
pool = {
|
|
address = "192.0.2.0";
|
|
prefixLength = 24;
|
|
};
|
|
};
|
|
ipv6 = {
|
|
address = "2001:db8::1";
|
|
router = {
|
|
address = "64:ff9b::1";
|
|
};
|
|
pool = {
|
|
address = "64:ff9b::";
|
|
prefixLength = 96;
|
|
};
|
|
};
|
|
mappings = {
|
|
"192.0.2.42" = "2001:db8::2";
|
|
};
|
|
};
|
|
};
|
|
|
|
router_nixos = {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
virtualisation.vlans = [
|
|
2 # towards server
|
|
3 # towards client
|
|
];
|
|
|
|
networking = {
|
|
useDHCP = false;
|
|
firewall.enable = false;
|
|
interfaces.eth1 = lib.mkForce {
|
|
ipv4 = {
|
|
addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
|
|
};
|
|
};
|
|
interfaces.eth2 = lib.mkForce {
|
|
ipv6 = {
|
|
addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.tayga = {
|
|
enable = true;
|
|
ipv4 = {
|
|
address = "192.0.2.0";
|
|
router = {
|
|
address = "192.0.2.1";
|
|
};
|
|
pool = {
|
|
address = "192.0.2.0";
|
|
prefixLength = 24;
|
|
};
|
|
};
|
|
ipv6 = {
|
|
address = "2001:db8::1";
|
|
router = {
|
|
address = "64:ff9b::1";
|
|
};
|
|
pool = {
|
|
address = "64:ff9b::";
|
|
prefixLength = 96;
|
|
};
|
|
};
|
|
mappings = {
|
|
"192.0.2.42" = "2001:db8::2";
|
|
};
|
|
};
|
|
};
|
|
|
|
# The client is configured with static IPv6 addresses. It has also a static
|
|
# route for the NAT64 IP space where the IPv4 addresses are mapped in. In
|
|
# normal cases, there would be only a default route.
|
|
client = {
|
|
virtualisation.vlans = [
|
|
3 # towards router
|
|
];
|
|
|
|
networking = {
|
|
useDHCP = false;
|
|
interfaces.eth1 = lib.mkForce {};
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
networks."vlan1" = {
|
|
matchConfig.Name = "eth1";
|
|
address = [
|
|
"2001:db8::2/64"
|
|
];
|
|
routes = [
|
|
{ Destination = "64:ff9b::/96"; Gateway = "2001:db8::1"; }
|
|
];
|
|
};
|
|
};
|
|
programs.mtr.enable = true;
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
# start client and server
|
|
for machine in client, server:
|
|
machine.systemctl("start network-online.target")
|
|
machine.wait_for_unit("network-online.target")
|
|
machine.log(machine.execute("ip addr")[1])
|
|
machine.log(machine.execute("ip route")[1])
|
|
machine.log(machine.execute("ip -6 route")[1])
|
|
|
|
# test systemd-networkd and nixos-scripts based router
|
|
for router in router_systemd, router_nixos:
|
|
router.start()
|
|
router.systemctl("start network-online.target")
|
|
router.wait_for_unit("network-online.target")
|
|
router.wait_for_unit("tayga.service")
|
|
router.log(machine.execute("ip addr")[1])
|
|
router.log(machine.execute("ip route")[1])
|
|
router.log(machine.execute("ip -6 route")[1])
|
|
|
|
with subtest("Wait for tayga"):
|
|
router.wait_for_unit("tayga.service")
|
|
|
|
with subtest("Test ICMP server -> client"):
|
|
server.wait_until_succeeds("ping -c 3 192.0.2.42 >&2")
|
|
|
|
with subtest("Test ICMP and show a traceroute server -> client"):
|
|
server.wait_until_succeeds("mtr --show-ips --report-wide 192.0.2.42 >&2")
|
|
|
|
with subtest("Test ICMP client -> server"):
|
|
client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")
|
|
|
|
with subtest("Test ICMP and show a traceroute client -> server"):
|
|
client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")
|
|
|
|
router.log(router.execute("systemd-analyze security tayga.service")[1])
|
|
router.shutdown()
|
|
'';
|
|
})
|