pyrox.dev
1import ./make-test-python.nix {
2 name = "sslh";
3
4 nodes = {
5 server =
6 { pkgs, lib, ... }:
7 {
8 networking.firewall.allowedTCPPorts = [ 443 ];
9 networking.interfaces.eth1.ipv6.addresses = [
10 {
11 address = "fe00:aa:bb:cc::2";
12 prefixLength = 64;
13 }
14 ];
15 services.sslh = {
16 enable = true;
17 settings.transparent = true;
18 settings.protocols = [
19 {
20 name = "ssh";
21 service = "ssh";
22 host = "localhost";
23 port = "22";
24 probe = "builtin";
25 }
26 {
27 name = "http";
28 host = "localhost";
29 port = "80";
30 probe = "builtin";
31 }
32 ];
33 };
34 services.openssh.enable = true;
35 users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
36 services.nginx = {
37 enable = true;
38 virtualHosts."localhost" = {
39 addSSL = false;
40 default = true;
41 root = pkgs.runCommand "testdir" { } ''
42 mkdir "$out"
43 echo hello world > "$out/index.html"
44 '';
45 };
46 };
47 };
48 client =
49 { ... }:
50 {
51 networking.interfaces.eth1.ipv6.addresses = [
52 {
53 address = "fe00:aa:bb:cc::1";
54 prefixLength = 64;
55 }
56 ];
57 networking.hosts."fe00:aa:bb:cc::2" = [ "server" ];
58 environment.etc.sshKey = {
59 source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
60 mode = "0600";
61 };
62 };
63 };
64
65 testScript = ''
66 start_all()
67
68 server.wait_for_unit("sslh.service")
69 server.wait_for_unit("nginx.service")
70 server.wait_for_unit("sshd.service")
71 server.wait_for_open_port(80)
72 server.wait_for_open_port(443)
73 server.wait_for_open_port(22)
74
75 for arg in ["-6", "-4"]:
76 client.wait_until_succeeds(f"ping {arg} -c1 server")
77
78 # check that ssh through sslh works
79 client.succeed(
80 f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
81 )
82
83 # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
84 ip = "fe00:aa:bb:cc::1" if arg == "-6" else "192.168.1."
85 server.succeed(f"grep '{ip}' /tmp/foo{arg}")
86
87 # check that http through sslh works
88 assert client.succeed(f"curl -f {arg} http://server:443").strip() == "hello world"
89 '';
90}