pyrox.dev
1# Test the firewall module.
2
3import ./make-test-python.nix ( { pkgs, nftables, ... } : {
4 name = "firewall" + pkgs.lib.optionalString nftables "-nftables";
5 meta = with pkgs.lib.maintainers; {
6 maintainers = [ eelco ];
7 };
8
9 nodes =
10 { walled =
11 { ... }:
12 { networking.firewall.enable = true;
13 networking.firewall.logRefusedPackets = true;
14 networking.nftables.enable = nftables;
15 services.httpd.enable = true;
16 services.httpd.adminAddr = "foo@example.org";
17 };
18
19 # Dummy configuration to check whether firewall.service will be honored
20 # during system activation. This only needs to be different to the
21 # original walled configuration so that there is a change in the service
22 # file.
23 walled2 =
24 { ... }:
25 { networking.firewall.enable = true;
26 networking.firewall.rejectPackets = true;
27 networking.nftables.enable = nftables;
28 };
29
30 attacker =
31 { ... }:
32 { services.httpd.enable = true;
33 services.httpd.adminAddr = "foo@example.org";
34 networking.firewall.enable = false;
35 };
36 };
37
38 testScript = { nodes, ... }: let
39 newSystem = nodes.walled2.config.system.build.toplevel;
40 unit = if nftables then "nftables" else "firewall";
41 in ''
42 start_all()
43
44 walled.wait_for_unit("${unit}")
45 walled.wait_for_unit("httpd")
46 attacker.wait_for_unit("network.target")
47
48 # Local connections should still work.
49 walled.succeed("curl -v http://localhost/ >&2")
50
51 # Connections to the firewalled machine should fail, but ping should succeed.
52 attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
53 attacker.succeed("ping -c 1 walled >&2")
54
55 # Outgoing connections/pings should still work.
56 walled.succeed("curl -v http://attacker/ >&2")
57 walled.succeed("ping -c 1 attacker >&2")
58
59 # If we stop the firewall, then connections should succeed.
60 walled.stop_job("${unit}")
61 attacker.succeed("curl -v http://walled/ >&2")
62
63 # Check whether activation of a new configuration reloads the firewall.
64 walled.succeed(
65 "${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
66 )
67 '';
68})