nixos/tests/tayga: init
This commit is contained in:
parent
16b7892876
commit
8d47058b32
|
@ -638,6 +638,7 @@ in {
|
||||||
systemd-misc = handleTest ./systemd-misc.nix {};
|
systemd-misc = handleTest ./systemd-misc.nix {};
|
||||||
tandoor-recipes = handleTest ./tandoor-recipes.nix {};
|
tandoor-recipes = handleTest ./tandoor-recipes.nix {};
|
||||||
taskserver = handleTest ./taskserver.nix {};
|
taskserver = handleTest ./taskserver.nix {};
|
||||||
|
tayga = handleTest ./tayga.nix {};
|
||||||
teeworlds = handleTest ./teeworlds.nix {};
|
teeworlds = handleTest ./teeworlds.nix {};
|
||||||
telegraf = handleTest ./telegraf.nix {};
|
telegraf = handleTest ./telegraf.nix {};
|
||||||
teleport = handleTest ./teleport.nix {};
|
teleport = handleTest ./teleport.nix {};
|
||||||
|
|
235
nixos/tests/tayga.nix
Normal file
235
nixos/tests/tayga.nix
Normal file
|
@ -0,0 +1,235 @@
|
||||||
|
# This test verifies that we can ping an IPv4-only server from an IPv6-only
|
||||||
|
# client via a NAT64 router. The hosts and networks are configured as follows:
|
||||||
|
#
|
||||||
|
# +------
|
||||||
|
# Client | eth1 Address: 2001:db8::2/64
|
||||||
|
# | | Route: 64:ff9b::/96 via 2001:db8::1
|
||||||
|
# +--|---
|
||||||
|
# | VLAN 3
|
||||||
|
# +--|---
|
||||||
|
# | eth2 Address: 2001:db8::1/64
|
||||||
|
# Router |
|
||||||
|
# | nat64 Address: 64:ff9b::1/128
|
||||||
|
# | Route: 64:ff9b::/96
|
||||||
|
# | Address: 192.0.2.0/32
|
||||||
|
# | Route: 192.0.2.0/24
|
||||||
|
# |
|
||||||
|
# | eth1 Address: 100.64.0.1/24
|
||||||
|
# +--|---
|
||||||
|
# | VLAN 2
|
||||||
|
# +--|---
|
||||||
|
# Server | eth1 Address: 100.64.0.2/24
|
||||||
|
# | Route: 192.0.2.0/24 via 100.64.0.1
|
||||||
|
# +------
|
||||||
|
|
||||||
|
import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
name = "tayga";
|
||||||
|
meta = with pkgs.lib.maintainers; {
|
||||||
|
maintainers = [ hax404 ];
|
||||||
|
};
|
||||||
|
|
||||||
|
nodes = {
|
||||||
|
# The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
|
||||||
|
# disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
|
||||||
|
# Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
|
||||||
|
# documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
|
||||||
|
# RFC 6589 (Carrier Grade NAT) is used here.
|
||||||
|
# To reach the IPv4 address pool of the NAT64 gateway, there is a static
|
||||||
|
# route configured. In normal cases, where the router would also source NAT
|
||||||
|
# the pool addresses to one IPv4 addresses, this would not be needed.
|
||||||
|
server = {
|
||||||
|
virtualisation.vlans = [
|
||||||
|
2 # towards router
|
||||||
|
];
|
||||||
|
networking = {
|
||||||
|
useDHCP = false;
|
||||||
|
interfaces.eth1 = lib.mkForce {};
|
||||||
|
};
|
||||||
|
systemd.network = {
|
||||||
|
enable = true;
|
||||||
|
networks."vlan1" = {
|
||||||
|
matchConfig.Name = "eth1";
|
||||||
|
address = [
|
||||||
|
"100.64.0.2/24"
|
||||||
|
];
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = { Destination = "192.0.2.0/24"; Gateway = "100.64.0.1"; }; }
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# The router is configured with static IPv4 addresses towards the server
|
||||||
|
# and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
|
||||||
|
# 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
|
||||||
|
# tun-interface nat64 and does the translation over it. The IPv6 packets
|
||||||
|
# are sent to this interfaces and received as IPv4 packets and vice versa.
|
||||||
|
# As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
|
||||||
|
# needs a pool of IPv4 addresses which must be at least as big as the
|
||||||
|
# expected amount of clients. In this test, the packets from the pool are
|
||||||
|
# directly routed towards the client. In normal cases, there would be a
|
||||||
|
# second source NAT44 to map all clients behind one IPv4 address.
|
||||||
|
router_systemd = {
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
"net.ipv4.ip_forward" = 1;
|
||||||
|
"net.ipv6.conf.all.forwarding" = 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.vlans = [
|
||||||
|
2 # towards server
|
||||||
|
3 # towards client
|
||||||
|
];
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
useDHCP = false;
|
||||||
|
useNetworkd = true;
|
||||||
|
firewall.enable = false;
|
||||||
|
interfaces.eth1 = lib.mkForce {
|
||||||
|
ipv4 = {
|
||||||
|
addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
interfaces.eth2 = lib.mkForce {
|
||||||
|
ipv6 = {
|
||||||
|
addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.tayga = {
|
||||||
|
enable = true;
|
||||||
|
ipv4 = {
|
||||||
|
address = "192.0.2.0";
|
||||||
|
router = {
|
||||||
|
address = "192.0.2.1";
|
||||||
|
};
|
||||||
|
pool = {
|
||||||
|
address = "192.0.2.0";
|
||||||
|
prefixLength = 24;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
ipv6 = {
|
||||||
|
address = "2001:db8::1";
|
||||||
|
router = {
|
||||||
|
address = "64:ff9b::1";
|
||||||
|
};
|
||||||
|
pool = {
|
||||||
|
address = "64:ff9b::";
|
||||||
|
prefixLength = 96;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
router_nixos = {
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
"net.ipv4.ip_forward" = 1;
|
||||||
|
"net.ipv6.conf.all.forwarding" = 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.vlans = [
|
||||||
|
2 # towards server
|
||||||
|
3 # towards client
|
||||||
|
];
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
useDHCP = false;
|
||||||
|
firewall.enable = false;
|
||||||
|
interfaces.eth1 = lib.mkForce {
|
||||||
|
ipv4 = {
|
||||||
|
addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
interfaces.eth2 = lib.mkForce {
|
||||||
|
ipv6 = {
|
||||||
|
addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.tayga = {
|
||||||
|
enable = true;
|
||||||
|
ipv4 = {
|
||||||
|
address = "192.0.2.0";
|
||||||
|
router = {
|
||||||
|
address = "192.0.2.1";
|
||||||
|
};
|
||||||
|
pool = {
|
||||||
|
address = "192.0.2.0";
|
||||||
|
prefixLength = 24;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
ipv6 = {
|
||||||
|
address = "2001:db8::1";
|
||||||
|
router = {
|
||||||
|
address = "64:ff9b::1";
|
||||||
|
};
|
||||||
|
pool = {
|
||||||
|
address = "64:ff9b::";
|
||||||
|
prefixLength = 96;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# The client is configured with static IPv6 addresses. It has also a static
|
||||||
|
# route for the NAT64 IP space where the IPv4 addresses are mapped in. In
|
||||||
|
# normal cases, there would be only a default route.
|
||||||
|
client = {
|
||||||
|
virtualisation.vlans = [
|
||||||
|
3 # towards router
|
||||||
|
];
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
useDHCP = false;
|
||||||
|
interfaces.eth1 = lib.mkForce {};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network = {
|
||||||
|
enable = true;
|
||||||
|
networks."vlan1" = {
|
||||||
|
matchConfig.Name = "eth1";
|
||||||
|
address = [
|
||||||
|
"2001:db8::2/64"
|
||||||
|
];
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = { Destination = "64:ff9b::/96"; Gateway = "2001:db8::1"; }; }
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
environment.systemPackages = [ pkgs.mtr ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
# start client and server
|
||||||
|
for machine in client, server:
|
||||||
|
machine.wait_for_unit("network-online.target")
|
||||||
|
machine.log(machine.execute("ip addr")[1])
|
||||||
|
machine.log(machine.execute("ip route")[1])
|
||||||
|
machine.log(machine.execute("ip -6 route")[1])
|
||||||
|
|
||||||
|
# test systemd-networkd and nixos-scripts based router
|
||||||
|
for router in router_systemd, router_nixos:
|
||||||
|
router.start()
|
||||||
|
router.wait_for_unit("network-online.target")
|
||||||
|
router.wait_for_unit("tayga.service")
|
||||||
|
router.log(machine.execute("ip addr")[1])
|
||||||
|
router.log(machine.execute("ip route")[1])
|
||||||
|
router.log(machine.execute("ip -6 route")[1])
|
||||||
|
|
||||||
|
with subtest("Wait for tayga"):
|
||||||
|
router.wait_for_unit("tayga.service")
|
||||||
|
|
||||||
|
with subtest("Test ICMP"):
|
||||||
|
client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")
|
||||||
|
|
||||||
|
with subtest("Test ICMP and show a traceroute"):
|
||||||
|
client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")
|
||||||
|
|
||||||
|
router.log(router.execute("systemd-analyze security tayga.service")[1])
|
||||||
|
router.shutdown()
|
||||||
|
'';
|
||||||
|
})
|
|
@ -1,4 +1,4 @@
|
||||||
{ lib, stdenv, fetchurl }:
|
{ lib, stdenv, fetchurl, nixosTests }:
|
||||||
|
|
||||||
stdenv.mkDerivation rec {
|
stdenv.mkDerivation rec {
|
||||||
version = "0.9.2";
|
version = "0.9.2";
|
||||||
|
@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
|
||||||
sha256 = "1700y121lhvpna49bjpssb7jq1abj9qw5wxgjn8gzp6jm4kpj7rb";
|
sha256 = "1700y121lhvpna49bjpssb7jq1abj9qw5wxgjn8gzp6jm4kpj7rb";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
passthru.tests.tayga = nixosTests.tayga;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
description = "Userland stateless NAT64 daemon";
|
description = "Userland stateless NAT64 daemon";
|
||||||
longDescription = ''
|
longDescription = ''
|
||||||
|
|
Loading…
Reference in a new issue