pyrox.dev
1# This test verifies that we can ping an IPv4-only server from an IPv6-only
2# client via a NAT64 router. The hosts and networks are configured as follows:
3#
4# +------
5# Client | eth1 Address: 2001:db8::2/64
6# | | Route: 64:ff9b::/96 via 2001:db8::1
7# +--|---
8# | VLAN 3
9# +--|---
10# | eth2 Address: 2001:db8::1/64
11# Router |
12# | nat64 Address: 64:ff9b::1/128
13# | Route: 64:ff9b::/96
14# | Address: 192.0.2.0/32
15# | Route: 192.0.2.0/24
16# |
17# | eth1 Address: 100.64.0.1/24
18# +--|---
19# | VLAN 2
20# +--|---
21# Server | eth1 Address: 100.64.0.2/24
22# | Route: 192.0.2.0/24 via 100.64.0.1
23# +------
24
25import ./make-test-python.nix ({ pkgs, lib, ... }:
26
27{
28 name = "tayga";
29 meta = with pkgs.lib.maintainers; {
30 maintainers = [ hax404 ];
31 };
32
33 nodes = {
34 # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
35 # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
36 # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
37 # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
38 # RFC 6589 (Carrier Grade NAT) is used here.
39 # To reach the IPv4 address pool of the NAT64 gateway, there is a static
40 # route configured. In normal cases, where the router would also source NAT
41 # the pool addresses to one IPv4 addresses, this would not be needed.
42 server = {
43 virtualisation.vlans = [
44 2 # towards router
45 ];
46 networking = {
47 useDHCP = false;
48 interfaces.eth1 = lib.mkForce {};
49 };
50 systemd.network = {
51 enable = true;
52 networks."vlan1" = {
53 matchConfig.Name = "eth1";
54 address = [
55 "100.64.0.2/24"
56 ];
57 routes = [
58 { routeConfig = { Destination = "192.0.2.0/24"; Gateway = "100.64.0.1"; }; }
59 ];
60 };
61 };
62 };
63
64 # The router is configured with static IPv4 addresses towards the server
65 # and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
66 # 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
67 # tun-interface nat64 and does the translation over it. The IPv6 packets
68 # are sent to this interfaces and received as IPv4 packets and vice versa.
69 # As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
70 # needs a pool of IPv4 addresses which must be at least as big as the
71 # expected amount of clients. In this test, the packets from the pool are
72 # directly routed towards the client. In normal cases, there would be a
73 # second source NAT44 to map all clients behind one IPv4 address.
74 router_systemd = {
75 boot.kernel.sysctl = {
76 "net.ipv4.ip_forward" = 1;
77 "net.ipv6.conf.all.forwarding" = 1;
78 };
79
80 virtualisation.vlans = [
81 2 # towards server
82 3 # towards client
83 ];
84
85 networking = {
86 useDHCP = false;
87 useNetworkd = true;
88 firewall.enable = false;
89 interfaces.eth1 = lib.mkForce {
90 ipv4 = {
91 addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
92 };
93 };
94 interfaces.eth2 = lib.mkForce {
95 ipv6 = {
96 addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
97 };
98 };
99 };
100
101 services.tayga = {
102 enable = true;
103 ipv4 = {
104 address = "192.0.2.0";
105 router = {
106 address = "192.0.2.1";
107 };
108 pool = {
109 address = "192.0.2.0";
110 prefixLength = 24;
111 };
112 };
113 ipv6 = {
114 address = "2001:db8::1";
115 router = {
116 address = "64:ff9b::1";
117 };
118 pool = {
119 address = "64:ff9b::";
120 prefixLength = 96;
121 };
122 };
123 };
124 };
125
126 router_nixos = {
127 boot.kernel.sysctl = {
128 "net.ipv4.ip_forward" = 1;
129 "net.ipv6.conf.all.forwarding" = 1;
130 };
131
132 virtualisation.vlans = [
133 2 # towards server
134 3 # towards client
135 ];
136
137 networking = {
138 useDHCP = false;
139 firewall.enable = false;
140 interfaces.eth1 = lib.mkForce {
141 ipv4 = {
142 addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
143 };
144 };
145 interfaces.eth2 = lib.mkForce {
146 ipv6 = {
147 addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
148 };
149 };
150 };
151
152 services.tayga = {
153 enable = true;
154 ipv4 = {
155 address = "192.0.2.0";
156 router = {
157 address = "192.0.2.1";
158 };
159 pool = {
160 address = "192.0.2.0";
161 prefixLength = 24;
162 };
163 };
164 ipv6 = {
165 address = "2001:db8::1";
166 router = {
167 address = "64:ff9b::1";
168 };
169 pool = {
170 address = "64:ff9b::";
171 prefixLength = 96;
172 };
173 };
174 };
175 };
176
177 # The client is configured with static IPv6 addresses. It has also a static
178 # route for the NAT64 IP space where the IPv4 addresses are mapped in. In
179 # normal cases, there would be only a default route.
180 client = {
181 virtualisation.vlans = [
182 3 # towards router
183 ];
184
185 networking = {
186 useDHCP = false;
187 interfaces.eth1 = lib.mkForce {};
188 };
189
190 systemd.network = {
191 enable = true;
192 networks."vlan1" = {
193 matchConfig.Name = "eth1";
194 address = [
195 "2001:db8::2/64"
196 ];
197 routes = [
198 { routeConfig = { Destination = "64:ff9b::/96"; Gateway = "2001:db8::1"; }; }
199 ];
200 };
201 };
202 environment.systemPackages = [ pkgs.mtr ];
203 };
204 };
205
206 testScript = ''
207 # start client and server
208 for machine in client, server:
209 machine.wait_for_unit("network-online.target")
210 machine.log(machine.execute("ip addr")[1])
211 machine.log(machine.execute("ip route")[1])
212 machine.log(machine.execute("ip -6 route")[1])
213
214 # test systemd-networkd and nixos-scripts based router
215 for router in router_systemd, router_nixos:
216 router.start()
217 router.wait_for_unit("network-online.target")
218 router.wait_for_unit("tayga.service")
219 router.log(machine.execute("ip addr")[1])
220 router.log(machine.execute("ip route")[1])
221 router.log(machine.execute("ip -6 route")[1])
222
223 with subtest("Wait for tayga"):
224 router.wait_for_unit("tayga.service")
225
226 with subtest("Test ICMP"):
227 client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")
228
229 with subtest("Test ICMP and show a traceroute"):
230 client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")
231
232 router.log(router.execute("systemd-analyze security tayga.service")[1])
233 router.shutdown()
234 '';
235})