commit 541e2ca6d341f1571b8f57aff42dad641eae8cac · pyrox.dev/nixpkgs

+15 -15
nixos/tests/firewall.nix
···

       1
       1
        
       # Test the firewall module.

     

       2
       2
        
       

     

       3
       3
       -
       import ./make-test.nix ( { pkgs, ... } : {

     

       3
       3
       +
       import ./make-test-python.nix ( { pkgs, ... } : {

     

       4
       4
        
         name = "firewall";

     

       5
       5
        
         meta = with pkgs.stdenv.lib.maintainers; {

     

       6
       6
        
           maintainers = [ eelco ];

     
···

       36
       36
        
         testScript = { nodes, ... }: let

     

       37
       37
        
           newSystem = nodes.walled2.config.system.build.toplevel;

     

       38
       38
        
         in ''

     

       39
       39
       -
           $walled->start;

     

       40
       40
       -
           $attacker->start;

     

       39
       39
       +
           start_all()

     

       41
       40
        
       

     

       42
       42
       -
           $walled->waitForUnit("firewall");

     

       43
       43
       -
           $walled->waitForUnit("httpd");

     

       44
       44
       -
           $attacker->waitForUnit("network.target");

     

       41
       41
       +
           walled.wait_for_unit("firewall")

     

       42
       42
       +
           walled.wait_for_unit("httpd")

     

       43
       43
       +
           attacker.wait_for_unit("network.target")

     

       45
       44
        
       

     

       46
       45
        
           # Local connections should still work.

     

       47
       47
       -
           $walled->succeed("curl -v http://localhost/ >&2");

     

       46
       46
       +
           walled.succeed("curl -v http://localhost/ >&2")

     

       48
       47
        
       

     

       49
       48
        
           # Connections to the firewalled machine should fail, but ping should succeed.

     

       50
       50
       -
           $attacker->fail("curl --fail --connect-timeout 2 http://walled/ >&2");

     

       51
       51
       -
           $attacker->succeed("ping -c 1 walled >&2");

     

       49
       49
       +
           attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")

     

       50
       50
       +
           attacker.succeed("ping -c 1 walled >&2")

     

       52
       51
        
       

     

       53
       52
        
           # Outgoing connections/pings should still work.

     

       54
       54
       -
           $walled->succeed("curl -v http://attacker/ >&2");

     

       55
       55
       -
           $walled->succeed("ping -c 1 attacker >&2");

     

       53
       53
       +
           walled.succeed("curl -v http://attacker/ >&2")

     

       54
       54
       +
           walled.succeed("ping -c 1 attacker >&2")

     

       56
       55
        
       

     

       57
       56
        
           # If we stop the firewall, then connections should succeed.

     

       58
       58
       -
           $walled->stopJob("firewall");

     

       59
       59
       -
           $attacker->succeed("curl -v http://walled/ >&2");

     

       57
       57
       +
           walled.stop_job("firewall")

     

       58
       58
       +
           attacker.succeed("curl -v http://walled/ >&2")

     

       60
       59
        
       

     

       61
       60
        
           # Check whether activation of a new configuration reloads the firewall.

     

       62
       62
       -
           $walled->succeed("${newSystem}/bin/switch-to-configuration test 2>&1" .

     

       63
       63
       -
                            " | grep -qF firewall.service");

     

       61
       61
       +
           walled.succeed(

     

       62
       62
       +
               "${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF firewall.service"

     

       63
       63
       +
           )

     

       64
       64
        
         '';

     

       65
       65
        
       })