pyrox.dev
1import ./make-test-python.nix {
2 name = "sslh";
3
4 nodes = {
5 server = { pkgs, lib, ... }: {
6 networking.firewall.allowedTCPPorts = [ 443 ];
7 networking.interfaces.eth1.ipv6.addresses = [
8 {
9 address = "fe00:aa:bb:cc::2";
10 prefixLength = 64;
11 }
12 ];
13 # sslh is really slow when reverse dns does not work
14 networking.hosts = {
15 "fe00:aa:bb:cc::2" = [ "server" ];
16 "fe00:aa:bb:cc::1" = [ "client" ];
17 };
18 services.sslh = {
19 enable = true;
20 transparent = true;
21 appendConfig = ''
22 protocols:
23 (
24 { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
25 { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
26 );
27 '';
28 };
29 services.openssh.enable = true;
30 users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
31 services.nginx = {
32 enable = true;
33 virtualHosts."localhost" = {
34 addSSL = false;
35 default = true;
36 root = pkgs.runCommand "testdir" {} ''
37 mkdir "$out"
38 echo hello world > "$out/index.html"
39 '';
40 };
41 };
42 };
43 client = { ... }: {
44 networking.interfaces.eth1.ipv6.addresses = [
45 {
46 address = "fe00:aa:bb:cc::1";
47 prefixLength = 64;
48 }
49 ];
50 networking.hosts."fe00:aa:bb:cc::2" = [ "server" ];
51 environment.etc.sshKey = {
52 source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
53 mode = "0600";
54 };
55 };
56 };
57
58 testScript = ''
59 start_all()
60
61 server.wait_for_unit("sslh.service")
62 server.wait_for_unit("nginx.service")
63 server.wait_for_unit("sshd.service")
64 server.wait_for_open_port(80)
65 server.wait_for_open_port(443)
66 server.wait_for_open_port(22)
67
68 for arg in ["-6", "-4"]:
69 client.wait_until_succeeds(f"ping {arg} -c1 server")
70
71 # check that ssh through sslh works
72 client.succeed(
73 f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
74 )
75
76 # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
77 ip = "fe00:aa:bb:cc::1" if arg == "-6" else "192.168.1."
78 server.succeed(f"grep '{ip}' /tmp/foo{arg}")
79
80 # check that http through sslh works
81 assert client.succeed(f"curl -f {arg} http://server:443").strip() == "hello world"
82 '';
83}