Merge pull request #74504 from xwvvvvwx/wg-quick-tests

tests/wireguard: init wg-quick

nixos/tests/all-tests.nix

@@ -309,6 +309,7 @@ in
   vault = handleTest ./vault.nix {};
   victoriametrics = handleTest ./victoriametrics.nix {};
   virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
+  wg-quick = handleTest ./wireguard/wg-quick.nix {};
   wireguard = handleTest ./wireguard {};
   wireguard-generated = handleTest ./wireguard/generated.nix {};
   wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};

nixos/tests/wireguard/default.nix

@@ -1,97 +1,71 @@
-let
+import ../make-test-python.nix ({ pkgs, lib, ...} :
-  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  let
-in
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+  in
+  {
+    name = "wireguard";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ ma27 ];
+    };
 
-import ../make-test-python.nix ({ pkgs, ...} : {
+    nodes = {
-  name = "wireguard";
+      peer0 = peer {
-  meta = with pkgs.stdenv.lib.maintainers; {
+        ip4 = "192.168.0.1";
-    maintainers = [ ma27 ];
+        ip6 = "fd00::1";
-  };
+        extraConfig = {
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wireguard.interfaces.wg0 = {
+            ips = [ "10.23.42.1/32" "fc00::1/128" ];
+            listenPort = 23542;
 
-  nodes = {
+            inherit (wg-snakeoil-keys.peer0) privateKey;
-    peer0 = { lib, ... }: {
-      boot.kernel.sysctl = {
-        "net.ipv6.conf.all.forwarding" = "1";
-        "net.ipv6.conf.default.forwarding" = "1";
-        "net.ipv4.ip_forward" = "1";
-      };
 
-      networking.useDHCP = false;
+            peers = lib.singleton {
-      networking.interfaces.eth1 = {
+              allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
-        ipv4.addresses = lib.singleton {
+
-          address = "192.168.0.1";
+              inherit (wg-snakeoil-keys.peer1) publicKey;
-          prefixLength = 24;
+            };
-        };
+          };
-        ipv6.addresses = lib.singleton {
-          address = "fd00::1";
-          prefixLength = 64;
         };
       };
 
-      networking.firewall.allowedUDPPorts = [ 23542 ];
+      peer1 = peer {
-      networking.wireguard.interfaces.wg0 = {
+        ip4 = "192.168.0.2";
-        ips = [ "10.23.42.1/32" "fc00::1/128" ];
+        ip6 = "fd00::2";
-        listenPort = 23542;
+        extraConfig = {
+          networking.wireguard.interfaces.wg0 = {
+            ips = [ "10.23.42.2/32" "fc00::2/128" ];
+            listenPort = 23542;
+            allowedIPsAsRoutes = false;
 
-        inherit (wg-snakeoil-keys.peer0) privateKey;
+            inherit (wg-snakeoil-keys.peer1) privateKey;
 
-        peers = lib.singleton {
+            peers = lib.singleton {
-          allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpoint = "192.168.0.1:23542";
+              persistentKeepalive = 25;
 
-          inherit (wg-snakeoil-keys.peer1) publicKey;
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+
+            postSetup = let inherit (pkgs) iproute; in ''
+              ${iproute}/bin/ip route replace 10.23.42.1/32 dev wg0
+              ${iproute}/bin/ip route replace fc00::1/128 dev wg0
+            '';
+          };
         };
       };
     };
 
-    peer1 = { pkgs, lib, ... }: {
+    testScript = ''
-      boot.kernel.sysctl = {
+      start_all()
-        "net.ipv6.conf.all.forwarding" = "1";
-        "net.ipv6.conf.default.forwarding" = "1";
-        "net.ipv4.ip_forward" = "1";
-      };
 
-      networking.useDHCP = false;
+      peer0.wait_for_unit("wireguard-wg0.service")
-      networking.interfaces.eth1 = {
+      peer1.wait_for_unit("wireguard-wg0.service")
-        ipv4.addresses = lib.singleton {
-          address = "192.168.0.2";
-          prefixLength = 24;
-        };
-        ipv6.addresses = lib.singleton {
-          address = "fd00::2";
-          prefixLength = 64;
-        };
-      };
 
-      networking.wireguard.interfaces.wg0 = {
+      peer1.succeed("ping -c5 fc00::1")
-        ips = [ "10.23.42.2/32" "fc00::2/128" ];
+      peer1.succeed("ping -c5 10.23.42.1")
-        listenPort = 23542;
+    '';
-        allowedIPsAsRoutes = false;
+  }
-
+)
-        inherit (wg-snakeoil-keys.peer1) privateKey;
-
-        peers = lib.singleton {
-          allowedIPs = [ "0.0.0.0/0" "::/0" ];
-          endpoint = "192.168.0.1:23542";
-          persistentKeepalive = 25;
-
-          inherit (wg-snakeoil-keys.peer0) publicKey;
-        };
-
-        postSetup = let inherit (pkgs) iproute; in ''
-          ${iproute}/bin/ip route replace 10.23.42.1/32 dev wg0
-          ${iproute}/bin/ip route replace fc00::1/128 dev wg0
-        '';
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    peer0.wait_for_unit("wireguard-wg0.service")
-    peer1.wait_for_unit("wireguard-wg0.service")
-
-    peer1.succeed("ping -c5 fc00::1")
-    peer1.succeed("ping -c5 10.23.42.1")
-  '';
-})

nixos/tests/wireguard/make-peer.nix

@@ -0,0 +1,23 @@
+{ lib, ... }: { ip4, ip6, extraConfig }:
+lib.mkMerge [
+  {
+    boot.kernel.sysctl = {
+      "net.ipv6.conf.all.forwarding" = "1";
+      "net.ipv6.conf.default.forwarding" = "1";
+      "net.ipv4.ip_forward" = "1";
+    };
+
+    networking.useDHCP = false;
+    networking.interfaces.eth1 = {
+      ipv4.addresses = [{
+        address = ip4;
+        prefixLength = 24;
+      }];
+      ipv6.addresses = [{
+        address = ip6;
+        prefixLength = 64;
+      }];
+    };
+  }
+  extraConfig
+]

nixos/tests/wireguard/wg-quick.nix

@@ -0,0 +1,63 @@
+import ../make-test-python.nix ({ pkgs, lib, ... }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+  in
+  {
+    name = "wg-quick";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ xwvvvvwx ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wg-quick.interfaces.wg0 = {
+            address = [ "10.23.42.1/32" "fc00::1/128" ];
+            listenPort = 23542;
+
+            inherit (wg-snakeoil-keys.peer0) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
+
+              inherit (wg-snakeoil-keys.peer1) publicKey;
+            };
+          };
+        };
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
+          networking.wg-quick.interfaces.wg0 = {
+            address = [ "10.23.42.2/32" "fc00::2/128" ];
+            inherit (wg-snakeoil-keys.peer1) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpoint = "192.168.0.1:23542";
+              persistentKeepalive = 25;
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("wg-quick-wg0.service")
+      peer1.wait_for_unit("wg-quick-wg0.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)