public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/tests/nat: add test for conntrack helper autoloading

Browse Source
This commit is contained in:
Franz Pletz 2017-01-22 19:42:59 +01:00
parent 8322a12ef2
commit 2d9152d509
No known key found for this signature in database
GPG Key ID: 846FDED7792617B4
2 changed files with 33 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/release.nix
View File

@ -273,6 +273,7 @@ in rec {
tests.mysql = callTest tests/mysql.nix {}; tests.mysql = callTest tests/mysql.nix {};
tests.mysqlReplication = callTest tests/mysql-replication.nix {}; tests.mysqlReplication = callTest tests/mysql-replication.nix {};
tests.nat.firewall = callTest tests/nat.nix { withFirewall = true; }; tests.nat.firewall = callTest tests/nat.nix { withFirewall = true; };
tests.nat.firewall-conntrack = callTest tests/nat.nix { withFirewall = true; withConntrackHelpers = true; };
tests.nat.standalone = callTest tests/nat.nix { withFirewall = false; }; tests.nat.standalone = callTest tests/nat.nix { withFirewall = false; };
tests.networking.networkd = callSubTests tests/networking.nix { networkd = true; }; tests.networking.networkd = callSubTests tests/networking.nix { networkd = true; };
tests.networking.scripted = callSubTests tests/networking.nix { networkd = false; }; tests.networking.scripted = callSubTests tests/networking.nix { networkd = false; };

47
nixos/tests/nat.nix
View File

@ -3,34 +3,47 @@
# client on the inside network, a server on the outside network, and a # client on the inside network, a server on the outside network, and a
# router connected to both that performs Network Address Translation # router connected to both that performs Network Address Translation
# for the client. # for the client.
import ./make-test.nix ({ pkgs, withFirewall, ... }: import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
let let
unit = if withFirewall then "firewall" else "nat"; unit = if withFirewall then "firewall" else "nat";
in in
{ {
name = "nat${if withFirewall then "WithFirewall" else "Standalone"}"; name = "nat" + (if withFirewall then "WithFirewall" else "Standalone")
meta = with pkgs.stdenv.lib.maintainers; { + (lib.optionalString withConntrackHelpers "withConntrackHelpers");
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ eelco chaoflow rob wkennington ]; maintainers = [ eelco chaoflow rob wkennington ];
}; };
nodes = nodes =
{ client = { client =
{ config, pkgs, nodes, ... }: { config, pkgs, nodes, ... }:
{ virtualisation.vlans = [ 1 ]; lib.mkMerge [
networking.firewall.allowPing = true; { virtualisation.vlans = [ 1 ];
networking.defaultGateway = networking.firewall.allowPing = true;
(pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address; networking.defaultGateway =
}; (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address;
}
(lib.optionalAttrs withConntrackHelpers {
networking.firewall.connectionTrackingModules = [ "ftp" ];
networking.firewall.autoLoadConntrackHelpers = true;
})
];
router = router =
{ config, pkgs, ... }: { config, pkgs, ... }:
{ virtualisation.vlans = [ 2 1 ]; lib.mkMerge [
networking.firewall.enable = withFirewall; { virtualisation.vlans = [ 2 1 ];
networking.firewall.allowPing = true; networking.firewall.enable = withFirewall;
networking.nat.enable = true; networking.firewall.allowPing = true;
networking.nat.internalIPs = [ "192.168.1.0/24" ]; networking.nat.enable = true;
networking.nat.externalInterface = "eth1"; networking.nat.internalIPs = [ "192.168.1.0/24" ];
}; networking.nat.externalInterface = "eth1";
}
(lib.optionalAttrs withConntrackHelpers {
networking.firewall.connectionTrackingModules = [ "ftp" ];
networking.firewall.autoLoadConntrackHelpers = true;
})
];
server = server =
{ config, pkgs, ... }: { config, pkgs, ... }:
@ -65,6 +78,10 @@ import ./make-test.nix ({ pkgs, withFirewall, ... }:
$server->succeed("echo Hello World > /home/ftp/foo.txt"); $server->succeed("echo Hello World > /home/ftp/foo.txt");
$client->succeed("curl -v ftp://server/foo.txt >&2"); $client->succeed("curl -v ftp://server/foo.txt >&2");
# Test whether active FTP works.
$client->${if withConntrackHelpers then "succeed" else "fail"}(
"curl -v -P - ftp://server/foo.txt >&2");
# Test ICMP. # Test ICMP.
$client->succeed("ping -c 1 router >&2"); $client->succeed("ping -c 1 router >&2");
$router->succeed("ping -c 1 client >&2"); $router->succeed("ping -c 1 client >&2");