diff options
author | Félix Baylac-Jacqué <felix@alternativebit.fr> | 2019-06-24 17:36:08 +0200 |
---|---|---|
committer | David Guibert <david.guibert@gmail.com> | 2019-08-21 11:11:28 +0200 |
commit | 0528816570bf5a80ee396c1eb171b4cefae5ca62 (patch) | |
tree | a88ab3a35c56dd0c844a0abba9dd4aeb17c4afb4 | |
parent | 7fd91a898b0d61f7c5e2d7c2b1fb5272c9b6d8af (diff) | |
download | nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar.gz nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar.bz2 nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar.lz nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar.xz nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.tar.zst nixlib-0528816570bf5a80ee396c1eb171b4cefae5ca62.zip |
systemd-networkd: add tests
(cherry picked from commit ec073e41a0dc8273cd81cf61fa37004310120af2)
-rw-r--r-- | nixos/modules/system/boot/networkd.nix | 42 | ||||
-rw-r--r-- | nixos/tests/all-tests.nix | 1 | ||||
-rw-r--r-- | nixos/tests/systemd-networkd-wireguard.nix | 80 |
3 files changed, 114 insertions, 9 deletions
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix index 2109b0cb1594..f2060e21509c 100644 --- a/nixos/modules/system/boot/networkd.nix +++ b/nixos/modules/system/boot/networkd.nix @@ -55,18 +55,25 @@ let (assertMacAddress "MACAddress") ]; + # NOTE The PrivateKey directive is missing on purpose here, please + # do not add it to this list. The nix store is world-readable let's + # refrain ourselves from providing a footgun. checkWireGuard = checkUnitConfig "WireGuard" [ (assertOnlyFields [ - "PrivateKey" "PrivateKeyFile" "ListenPort" "FwMark" + "PrivateKeyFile" "ListenPort" "FwMark" ]) - #(assertRange "ListenPort" 1 65535) # Or "auto" + (assertRange "FwMark" 1 4294967295) ]; + # NOTE The PresharedKey directive is missing on purpose here, please + # do not add it to this list. The nix store is world-readable,let's + # refrain ourselves from providing a footgun. checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [ (assertOnlyFields [ - "PublicKey" "PresharedKey" "AllowedIPs" "Endpoint" "PersistentKeepalive" + "PublicKey" "PresharedKeyFile" "AllowedIPs" + "Endpoint" "PersistentKeepalive" ]) - # (assertRange "PersistentKeepalive" 1 65535) # defined as "nullOr int" + (assertRange "PersistentKeepalive" 1 65535) ]; checkVlan = checkUnitConfig "VLAN" [ @@ -336,24 +343,41 @@ let wireguardConfig = mkOption { default = {}; - example = { ListenPort="auto"; }; + example = { + PrivateKeyFile = "/etc/wireguard/secret.key"; + ListenPort = 51820; + FwMark = 42; + }; type = types.addCheck (types.attrsOf unitOption) checkWireGuard; description = '' Each attribute in this set specifies an option in the - <literal>[WireGuard]</literal> section of the unit. See + <literal>[WireGuard]</literal> section of the unit. See <citerefentry><refentrytitle>systemd.netdev</refentrytitle> <manvolnum>5</manvolnum></citerefentry> for details. + Use <literal>PrivateKeyFile</literal> instead of + <literal>PrivateKey</literal>: the nix store is + world-readable. ''; }; wireguardPeers = mkOption { - default = [ ]; + default = []; + example = [ { wireguardPeerConfig={ + Endpoint = "192.168.1.1:51820"; + PublicKey = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g="; + PresharedKeyFile = "/etc/wireguard/psk.key"; + AllowedIPs = [ "10.0.0.1/32" ]; + PersistentKeepalive = 15; + };}]; type = with types; listOf (submodule wireguardPeerOptions); description = '' - Each attribute in this set specifies an option in the - <literal>[WireGuardPeer]</literal> section of the unit. See + Each item in this array specifies an option in the + <literal>[WireGuardPeer]</literal> section of the unit. See <citerefentry><refentrytitle>systemd.netdev</refentrytitle> <manvolnum>5</manvolnum></citerefentry> for details. + Use <literal>PresharedKeyFile</literal> instead of + <literal>PresharedKey</literal>: the nix store is + world-readable. ''; }; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 45ddf27c85e9..a99ac401a8ca 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -253,6 +253,7 @@ in systemd = handleTest ./systemd.nix {}; systemd-confinement = handleTest ./systemd-confinement.nix {}; systemd-timesyncd = handleTest ./systemd-timesyncd.nix {}; + systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {}; pdns-recursor = handleTest ./pdns-recursor.nix {}; taskserver = handleTest ./taskserver.nix {}; telegraf = handleTest ./telegraf.nix {}; diff --git a/nixos/tests/systemd-networkd-wireguard.nix b/nixos/tests/systemd-networkd-wireguard.nix new file mode 100644 index 000000000000..f1ce1e791ce3 --- /dev/null +++ b/nixos/tests/systemd-networkd-wireguard.nix @@ -0,0 +1,80 @@ +let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: { + imports = [ common/user-account.nix ]; + systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug"; + networking.useNetworkd = true; + networking.firewall.enable = false; + virtualisation.vlans = [ 1 ]; + environment.systemPackages = with pkgs; [ wireguard-tools ]; + boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ]; + systemd.network = { + enable = true; + netdevs = { + "90-wg0" = { + netdevConfig = { Kind = "wireguard"; Name = "wg0"; }; + wireguardConfig = { + PrivateKeyFile = privkpath ; + ListenPort = 51820; + FwMark = 42; + }; + wireguardPeers = [ {wireguardPeerConfig={ + Endpoint = "192.168.1.${peerId}:51820"; + PublicKey = pubk; + PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU="; + AllowedIPs = [ "10.0.0.${peerId}/32" ]; + PersistentKeepalive = 15; + };}]; + }; + }; + networks = { + "99-nope" = { + matchConfig.Name = "eth*"; + linkConfig.Unmanaged = true; + }; + "90-wg0" = { + matchConfig = { Name = "wg0"; }; + address = [ "10.0.0.${nodeId}/32" ]; + routes = [ + { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; } + ]; + }; + "90-eth1" = { + matchConfig = { Name = "eth1"; }; + address = [ "192.168.1.${nodeId}/24" ]; + }; + }; + }; + }; +in import ./make-test.nix ({pkgs, ... }: { + name = "networkd-wireguard"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ ninjatrappeur ]; + }; + nodes = { + node1 = { pkgs, ... }@attrs: + let localConf = { + privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00="; + pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE="; + nodeId = "1"; + peerId = "2"; + }; + in generateNodeConf (attrs // localConf); + + node2 = { pkgs, ... }@attrs: + let localConf = { + privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k="; + pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g="; + nodeId = "2"; + peerId = "1"; + }; + in generateNodeConf (attrs // localConf); + }; +testScript = '' + startAll; + $node1->waitForUnit('systemd-networkd-wait-online.service'); + $node2->waitForUnit('systemd-networkd-wait-online.service'); + $node1->succeed('ping -c 5 10.0.0.2'); + $node2->succeed('ping -c 5 10.0.0.1'); + # Is the fwmark set? + $node2->succeed('wg | grep -q 42'); +''; +}) |