From 90581c977ff1dc2442a79fd9d173ae1e307f6e53 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Wed, 28 Dec 2022 19:48:59 -0800 Subject: nixos/nebula: don't run as root; support relays --- nixos/tests/nebula.nix | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) (limited to 'nixos/tests') diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix index 372cfebdf801b..1617430b38907 100644 --- a/nixos/tests/nebula.nix +++ b/nixos/tests/nebula.nix @@ -123,12 +123,13 @@ in testScript = let setUpPrivateKey = name: '' - ${name}.succeed( - "mkdir -p /root/.ssh", - "chown 700 /root/.ssh", - "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil", - "chown 600 /root/.ssh/id_snakeoil", - ) + ${name}.start() + ${name}.succeed( + "mkdir -p /root/.ssh", + "chown 700 /root/.ssh", + "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil", + "chown 600 /root/.ssh/id_snakeoil", + ) ''; # From what I can tell, StrictHostKeyChecking=no is necessary for ssh to work between machines. @@ -154,18 +155,18 @@ in ${name}.succeed( "scp ${sshOpts} 192.168.1.1:/tmp/${name}.crt /etc/nebula/${name}.crt", "scp ${sshOpts} 192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt", + '(id nebula-smoke >/dev/null && chown -R nebula-smoke:nebula-smoke /etc/nebula) || true' ) ''; in '' - start_all() - # Create the certificate and sign the lighthouse's keys. ${setUpPrivateKey "lighthouse"} lighthouse.succeed( "mkdir -p /etc/nebula", 'nebula-cert ca -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key', 'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key', + 'chown -R nebula-smoke:nebula-smoke /etc/nebula' ) # Reboot the lighthouse and verify that the nebula service comes up on boot. -- cgit 1.4.1 From 9d649fd78c30944dfe12b80bb55f8b4a9de567ed Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Wed, 28 Dec 2022 23:30:33 -0800 Subject: nixos/nebula: add tests for relays; clean up nebula passthru test --- nixos/modules/services/networking/nebula.nix | 1 + nixos/tests/nebula.nix | 82 ++++++++++++++++++++++++++++ pkgs/tools/networking/nebula/default.nix | 4 +- 3 files changed, 86 insertions(+), 1 deletion(-) (limited to 'nixos/tests') diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix index c5d395b3406ed..71f8991b70ae6 100644 --- a/nixos/modules/services/networking/nebula.nix +++ b/nixos/modules/services/networking/nebula.nix @@ -175,6 +175,7 @@ in relay = { am_relay = netCfg.isRelay; relays = netCfg.relays; + use_relays = true; }; listen = { host = netCfg.listen.host; diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix index 1617430b38907..95d6d510555a6 100644 --- a/nixos/tests/nebula.nix +++ b/nixos/tests/nebula.nix @@ -37,6 +37,7 @@ in services.nebula.networks.smoke = { isLighthouse = true; + isRelay = true; firewall = { outbound = [ { port = "any"; proto = "any"; host = "any"; } ]; inbound = [ { port = "any"; proto = "any"; host = "any"; } ]; @@ -55,6 +56,7 @@ in staticHostMap = { "10.0.100.1" = [ "192.168.1.1:4242" ]; }; isLighthouse = false; lighthouses = [ "10.0.100.1" ]; + relays = [ "10.0.100.1" ]; firewall = { outbound = [ { port = "any"; proto = "any"; host = "any"; } ]; inbound = [ { port = "any"; proto = "any"; host = "any"; } ]; @@ -73,6 +75,7 @@ in staticHostMap = { "10.0.100.1" = [ "192.168.1.1:4242" ]; }; isLighthouse = false; lighthouses = [ "10.0.100.1" ]; + relays = [ "10.0.100.1" ]; firewall = { outbound = [ { port = "any"; proto = "any"; host = "any"; } ]; inbound = [ { port = "any"; proto = "any"; host = "lighthouse"; } ]; @@ -92,6 +95,7 @@ in staticHostMap = { "10.0.100.1" = [ "192.168.1.1:4242" ]; }; isLighthouse = false; lighthouses = [ "10.0.100.1" ]; + relays = [ "10.0.100.1" ]; firewall = { outbound = [ { port = "any"; proto = "any"; host = "lighthouse"; } ]; inbound = [ { port = "any"; proto = "any"; host = "any"; } ]; @@ -111,6 +115,7 @@ in staticHostMap = { "10.0.100.1" = [ "192.168.1.1:4242" ]; }; isLighthouse = false; lighthouses = [ "10.0.100.1" ]; + relays = [ "10.0.100.1" ]; firewall = { outbound = [ { port = "any"; proto = "any"; host = "lighthouse"; } ]; inbound = [ { port = "any"; proto = "any"; host = "any"; } ]; @@ -159,6 +164,28 @@ in ) ''; + getPublicIp = node: '' + ${node}.succeed("ip --brief addr show eth1 | awk '{print $3}' | tail -n1 | cut -d/ -f1").strip() + ''; + + # Never do this for anything security critical! (Thankfully it's just a test.) + # Restart Nebula right after the mutual block and/or restore so the state is fresh. + blockTrafficBetween = nodeA: nodeB: '' + node_a = ${getPublicIp nodeA} + node_b = ${getPublicIp nodeB} + ${nodeA}.succeed("iptables -I INPUT -s " + node_b + " -j DROP") + ${nodeB}.succeed("iptables -I INPUT -s " + node_a + " -j DROP") + ${nodeA}.systemctl("restart nebula@smoke.service") + ${nodeB}.systemctl("restart nebula@smoke.service") + ''; + allowTrafficBetween = nodeA: nodeB: '' + node_a = ${getPublicIp nodeA} + node_b = ${getPublicIp nodeB} + ${nodeA}.succeed("iptables -D INPUT -s " + node_b + " -j DROP") + ${nodeB}.succeed("iptables -D INPUT -s " + node_a + " -j DROP") + ${nodeA}.systemctl("restart nebula@smoke.service") + ${nodeB}.systemctl("restart nebula@smoke.service") + ''; in '' # Create the certificate and sign the lighthouse's keys. ${setUpPrivateKey "lighthouse"} @@ -210,6 +237,12 @@ in node3.succeed("ping -c3 10.0.100.1") node3.succeed("ping -c3 10.0.100.2") + # block node3 <-> node2, and node3 -> node2 should still work. + ${blockTrafficBetween "node3" "node2"} + node3.succeed("ping -c10 10.0.100.2") + ${allowTrafficBetween "node3" "node2"} + node3.succeed("ping -c10 10.0.100.2") + # node4 can ping the lighthouse but not node2 or node3 node4.succeed("ping -c3 10.0.100.1") node4.fail("ping -c3 10.0.100.2") @@ -217,8 +250,57 @@ in # node2 can ping node3 now that node3 pinged it first node2.succeed("ping -c3 10.0.100.3") + + # block node2 <-> node3, and node2 -> node3 should still work. + ${blockTrafficBetween "node2" "node3"} + node3.succeed("ping -c10 10.0.100.2") + node2.succeed("ping -c10 10.0.100.3") + ${allowTrafficBetween "node2" "node3"} + node3.succeed("ping -c10 10.0.100.2") + node2.succeed("ping -c10 10.0.100.3") + # node4 can ping node2 if node2 pings it first node2.succeed("ping -c3 10.0.100.4") node4.succeed("ping -c3 10.0.100.2") + + # block node4 <-> node2, and node2 <-> node4 should still work. + ${blockTrafficBetween "node2" "node4"} + node2.succeed("ping -c10 10.0.100.4") + node4.succeed("ping -c10 10.0.100.2") + ${allowTrafficBetween "node2" "node4"} + node2.succeed("ping -c10 10.0.100.4") + node4.succeed("ping -c10 10.0.100.2") + + # block lighthouse <-> node3 and node2 <-> node3; node3 won't get to node2 + ${blockTrafficBetween "node3" "lighthouse"} + ${blockTrafficBetween "node3" "node2"} + node3.fail("ping -c3 10.0.100.2") + ${allowTrafficBetween "node3" "lighthouse"} + ${allowTrafficBetween "node3" "node2"} + node3.succeed("ping -c3 10.0.100.2") + + # block lighthouse <-> node2, node2 <-> node3, and node2 <-> node4; it won't get to node3 or node4 + ${blockTrafficBetween "node2" "lighthouse"} + ${blockTrafficBetween "node2" "node3"} + ${blockTrafficBetween "node2" "node4"} + node3.fail("ping -c3 10.0.100.2") + node2.fail("ping -c3 10.0.100.3") + node2.fail("ping -c3 10.0.100.4") + ${allowTrafficBetween "node2" "lighthouse"} + ${allowTrafficBetween "node2" "node3"} + ${allowTrafficBetween "node2" "node4"} + node3.succeed("ping -c3 10.0.100.2") + node2.succeed("ping -c3 10.0.100.3") + node2.succeed("ping -c3 10.0.100.4") + + # block lighthouse <-> node4 and node4 <-> node2; it won't get to node2 + ${blockTrafficBetween "node4" "lighthouse"} + ${blockTrafficBetween "node4" "node2"} + node2.fail("ping -c3 10.0.100.4") + node4.fail("ping -c3 10.0.100.2") + ${allowTrafficBetween "node4" "lighthouse"} + ${allowTrafficBetween "node4" "node2"} + node2.succeed("ping -c3 10.0.100.4") + node4.succeed("ping -c3 10.0.100.2") ''; }) diff --git a/pkgs/tools/networking/nebula/default.nix b/pkgs/tools/networking/nebula/default.nix index bd99c16be4f60..6f4483cd7283c 100644 --- a/pkgs/tools/networking/nebula/default.nix +++ b/pkgs/tools/networking/nebula/default.nix @@ -17,7 +17,9 @@ buildGoModule rec { ldflags = [ "-X main.Build=${version}" ]; - passthru.tests.nebula = nixosTests.nebula; + passthru.tests = { + inherit (nixosTests) nebula; + }; meta = with lib; { description = "A scalable overlay networking tool with a focus on performance, simplicity and security"; -- cgit 1.4.1 From eeb37db7cff2c864df9a1d61349433d92ab65254 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sat, 28 Jan 2023 21:58:10 -0800 Subject: nixos/nebula: rename test nodes to be more descriptive --- nixos/tests/nebula.nix | 204 ++++++++++++++++++++++++------------------------- 1 file changed, 102 insertions(+), 102 deletions(-) (limited to 'nixos/tests') diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix index 95d6d510555a6..df5323f51a8d7 100644 --- a/nixos/tests/nebula.nix +++ b/nixos/tests/nebula.nix @@ -45,8 +45,8 @@ in }; }; - node2 = { ... } @ args: - makeNebulaNode args "node2" { + allowAny = { ... } @ args: + makeNebulaNode args "allowAny" { networking.interfaces.eth1.ipv4.addresses = [{ address = "192.168.1.2"; prefixLength = 24; @@ -64,8 +64,8 @@ in }; }; - node3 = { ... } @ args: - makeNebulaNode args "node3" { + allowFromLighthouse = { ... } @ args: + makeNebulaNode args "allowFromLighthouse" { networking.interfaces.eth1.ipv4.addresses = [{ address = "192.168.1.3"; prefixLength = 24; @@ -83,8 +83,8 @@ in }; }; - node4 = { ... } @ args: - makeNebulaNode args "node4" { + allowToLighthouse = { ... } @ args: + makeNebulaNode args "allowToLighthouse" { networking.interfaces.eth1.ipv4.addresses = [{ address = "192.168.1.4"; prefixLength = 24; @@ -103,8 +103,8 @@ in }; }; - node5 = { ... } @ args: - makeNebulaNode args "node5" { + disabled = { ... } @ args: + makeNebulaNode args "disabled" { networking.interfaces.eth1.ipv4.addresses = [{ address = "192.168.1.5"; prefixLength = 24; @@ -152,13 +152,13 @@ in ${name}.succeed( "mkdir -p /etc/nebula", "nebula-cert keygen -out-key /etc/nebula/${name}.key -out-pub /etc/nebula/${name}.pub", - "scp ${sshOpts} /etc/nebula/${name}.pub 192.168.1.1:/tmp/${name}.pub", + "scp ${sshOpts} /etc/nebula/${name}.pub 192.168.1.1:/var/tmp/${name}.pub", ) lighthouse.succeed( - 'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /tmp/${name}.pub -out-crt /tmp/${name}.crt', + 'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /var/tmp/${name}.pub -out-crt /var/tmp/${name}.crt', ) ${name}.succeed( - "scp ${sshOpts} 192.168.1.1:/tmp/${name}.crt /etc/nebula/${name}.crt", + "scp ${sshOpts} 192.168.1.1:/var/tmp/${name}.crt /etc/nebula/${name}.crt", "scp ${sshOpts} 192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt", '(id nebula-smoke >/dev/null && chown -R nebula-smoke:nebula-smoke /etc/nebula) || true' ) @@ -203,104 +203,104 @@ in lighthouse.wait_for_unit("nebula@smoke.service") lighthouse.succeed("ping -c5 10.0.100.1") - # Create keys for node2's nebula service and test that it comes up. - ${setUpPrivateKey "node2"} - ${signKeysFor "node2" "10.0.100.2/24"} - ${restartAndCheckNebula "node2" "10.0.100.2"} + # Create keys for allowAny's nebula service and test that it comes up. + ${setUpPrivateKey "allowAny"} + ${signKeysFor "allowAny" "10.0.100.2/24"} + ${restartAndCheckNebula "allowAny" "10.0.100.2"} - # Create keys for node3's nebula service and test that it comes up. - ${setUpPrivateKey "node3"} - ${signKeysFor "node3" "10.0.100.3/24"} - ${restartAndCheckNebula "node3" "10.0.100.3"} + # Create keys for allowFromLighthouse's nebula service and test that it comes up. + ${setUpPrivateKey "allowFromLighthouse"} + ${signKeysFor "allowFromLighthouse" "10.0.100.3/24"} + ${restartAndCheckNebula "allowFromLighthouse" "10.0.100.3"} - # Create keys for node4's nebula service and test that it comes up. - ${setUpPrivateKey "node4"} - ${signKeysFor "node4" "10.0.100.4/24"} - ${restartAndCheckNebula "node4" "10.0.100.4"} + # Create keys for allowToLighthouse's nebula service and test that it comes up. + ${setUpPrivateKey "allowToLighthouse"} + ${signKeysFor "allowToLighthouse" "10.0.100.4/24"} + ${restartAndCheckNebula "allowToLighthouse" "10.0.100.4"} - # Create keys for node4's nebula service and test that it does not come up. - ${setUpPrivateKey "node5"} - ${signKeysFor "node5" "10.0.100.5/24"} - node5.fail("systemctl status nebula@smoke.service") - node5.fail("ping -c5 10.0.100.5") + # Create keys for disabled's nebula service and test that it does not come up. + ${setUpPrivateKey "disabled"} + ${signKeysFor "disabled" "10.0.100.5/24"} + disabled.fail("systemctl status nebula@smoke.service") + disabled.fail("ping -c5 10.0.100.5") - # The lighthouse can ping node2 and node3 but not node5 + # The lighthouse can ping allowAny and allowFromLighthouse but not disabled lighthouse.succeed("ping -c3 10.0.100.2") lighthouse.succeed("ping -c3 10.0.100.3") lighthouse.fail("ping -c3 10.0.100.5") - # node2 can ping the lighthouse, but not node3 because of its inbound firewall - node2.succeed("ping -c3 10.0.100.1") - node2.fail("ping -c3 10.0.100.3") - - # node3 can ping the lighthouse and node2 - node3.succeed("ping -c3 10.0.100.1") - node3.succeed("ping -c3 10.0.100.2") - - # block node3 <-> node2, and node3 -> node2 should still work. - ${blockTrafficBetween "node3" "node2"} - node3.succeed("ping -c10 10.0.100.2") - ${allowTrafficBetween "node3" "node2"} - node3.succeed("ping -c10 10.0.100.2") - - # node4 can ping the lighthouse but not node2 or node3 - node4.succeed("ping -c3 10.0.100.1") - node4.fail("ping -c3 10.0.100.2") - node4.fail("ping -c3 10.0.100.3") - - # node2 can ping node3 now that node3 pinged it first - node2.succeed("ping -c3 10.0.100.3") - - # block node2 <-> node3, and node2 -> node3 should still work. - ${blockTrafficBetween "node2" "node3"} - node3.succeed("ping -c10 10.0.100.2") - node2.succeed("ping -c10 10.0.100.3") - ${allowTrafficBetween "node2" "node3"} - node3.succeed("ping -c10 10.0.100.2") - node2.succeed("ping -c10 10.0.100.3") - - # node4 can ping node2 if node2 pings it first - node2.succeed("ping -c3 10.0.100.4") - node4.succeed("ping -c3 10.0.100.2") - - # block node4 <-> node2, and node2 <-> node4 should still work. - ${blockTrafficBetween "node2" "node4"} - node2.succeed("ping -c10 10.0.100.4") - node4.succeed("ping -c10 10.0.100.2") - ${allowTrafficBetween "node2" "node4"} - node2.succeed("ping -c10 10.0.100.4") - node4.succeed("ping -c10 10.0.100.2") - - # block lighthouse <-> node3 and node2 <-> node3; node3 won't get to node2 - ${blockTrafficBetween "node3" "lighthouse"} - ${blockTrafficBetween "node3" "node2"} - node3.fail("ping -c3 10.0.100.2") - ${allowTrafficBetween "node3" "lighthouse"} - ${allowTrafficBetween "node3" "node2"} - node3.succeed("ping -c3 10.0.100.2") - - # block lighthouse <-> node2, node2 <-> node3, and node2 <-> node4; it won't get to node3 or node4 - ${blockTrafficBetween "node2" "lighthouse"} - ${blockTrafficBetween "node2" "node3"} - ${blockTrafficBetween "node2" "node4"} - node3.fail("ping -c3 10.0.100.2") - node2.fail("ping -c3 10.0.100.3") - node2.fail("ping -c3 10.0.100.4") - ${allowTrafficBetween "node2" "lighthouse"} - ${allowTrafficBetween "node2" "node3"} - ${allowTrafficBetween "node2" "node4"} - node3.succeed("ping -c3 10.0.100.2") - node2.succeed("ping -c3 10.0.100.3") - node2.succeed("ping -c3 10.0.100.4") - - # block lighthouse <-> node4 and node4 <-> node2; it won't get to node2 - ${blockTrafficBetween "node4" "lighthouse"} - ${blockTrafficBetween "node4" "node2"} - node2.fail("ping -c3 10.0.100.4") - node4.fail("ping -c3 10.0.100.2") - ${allowTrafficBetween "node4" "lighthouse"} - ${allowTrafficBetween "node4" "node2"} - node2.succeed("ping -c3 10.0.100.4") - node4.succeed("ping -c3 10.0.100.2") + # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall + allowAny.succeed("ping -c3 10.0.100.1") + allowAny.fail("ping -c3 10.0.100.3") + + # allowFromLighthouse can ping the lighthouse and allowAny + allowFromLighthouse.succeed("ping -c3 10.0.100.1") + allowFromLighthouse.succeed("ping -c3 10.0.100.2") + + # block allowFromLighthouse <-> allowAny, and allowFromLighthouse -> allowAny should still work. + ${blockTrafficBetween "allowFromLighthouse" "allowAny"} + allowFromLighthouse.succeed("ping -c10 10.0.100.2") + ${allowTrafficBetween "allowFromLighthouse" "allowAny"} + allowFromLighthouse.succeed("ping -c10 10.0.100.2") + + # allowToLighthouse can ping the lighthouse but not allowAny or allowFromLighthouse + allowToLighthouse.succeed("ping -c3 10.0.100.1") + allowToLighthouse.fail("ping -c3 10.0.100.2") + allowToLighthouse.fail("ping -c3 10.0.100.3") + + # allowAny can ping allowFromLighthouse now that allowFromLighthouse pinged it first + allowAny.succeed("ping -c3 10.0.100.3") + + # block allowAny <-> allowFromLighthouse, and allowAny -> allowFromLighthouse should still work. + ${blockTrafficBetween "allowAny" "allowFromLighthouse"} + allowFromLighthouse.succeed("ping -c10 10.0.100.2") + allowAny.succeed("ping -c10 10.0.100.3") + ${allowTrafficBetween "allowAny" "allowFromLighthouse"} + allowFromLighthouse.succeed("ping -c10 10.0.100.2") + allowAny.succeed("ping -c10 10.0.100.3") + + # allowToLighthouse can ping allowAny if allowAny pings it first + allowAny.succeed("ping -c3 10.0.100.4") + allowToLighthouse.succeed("ping -c3 10.0.100.2") + + # block allowToLighthouse <-> allowAny, and allowAny <-> allowToLighthouse should still work. + ${blockTrafficBetween "allowAny" "allowToLighthouse"} + allowAny.succeed("ping -c10 10.0.100.4") + allowToLighthouse.succeed("ping -c10 10.0.100.2") + ${allowTrafficBetween "allowAny" "allowToLighthouse"} + allowAny.succeed("ping -c10 10.0.100.4") + allowToLighthouse.succeed("ping -c10 10.0.100.2") + + # block lighthouse <-> allowFromLighthouse and allowAny <-> allowFromLighthouse; allowFromLighthouse won't get to allowAny + ${blockTrafficBetween "allowFromLighthouse" "lighthouse"} + ${blockTrafficBetween "allowFromLighthouse" "allowAny"} + allowFromLighthouse.fail("ping -c3 10.0.100.2") + ${allowTrafficBetween "allowFromLighthouse" "lighthouse"} + ${allowTrafficBetween "allowFromLighthouse" "allowAny"} + allowFromLighthouse.succeed("ping -c3 10.0.100.2") + + # block lighthouse <-> allowAny, allowAny <-> allowFromLighthouse, and allowAny <-> allowToLighthouse; it won't get to allowFromLighthouse or allowToLighthouse + ${blockTrafficBetween "allowAny" "lighthouse"} + ${blockTrafficBetween "allowAny" "allowFromLighthouse"} + ${blockTrafficBetween "allowAny" "allowToLighthouse"} + allowFromLighthouse.fail("ping -c3 10.0.100.2") + allowAny.fail("ping -c3 10.0.100.3") + allowAny.fail("ping -c3 10.0.100.4") + ${allowTrafficBetween "allowAny" "lighthouse"} + ${allowTrafficBetween "allowAny" "allowFromLighthouse"} + ${allowTrafficBetween "allowAny" "allowToLighthouse"} + allowFromLighthouse.succeed("ping -c3 10.0.100.2") + allowAny.succeed("ping -c3 10.0.100.3") + allowAny.succeed("ping -c3 10.0.100.4") + + # block lighthouse <-> allowToLighthouse and allowToLighthouse <-> allowAny; it won't get to allowAny + ${blockTrafficBetween "allowToLighthouse" "lighthouse"} + ${blockTrafficBetween "allowToLighthouse" "allowAny"} + allowAny.fail("ping -c3 10.0.100.4") + allowToLighthouse.fail("ping -c3 10.0.100.2") + ${allowTrafficBetween "allowToLighthouse" "lighthouse"} + ${allowTrafficBetween "allowToLighthouse" "allowAny"} + allowAny.succeed("ping -c3 10.0.100.4") + allowToLighthouse.succeed("ping -c3 10.0.100.2") ''; }) -- cgit 1.4.1 From 96e3c9c3923e2c8866a497896bf2be3433fe6202 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sat, 4 Feb 2023 16:59:19 -0800 Subject: nixos/nebula: fix potential address collision in tests --- nixos/tests/nebula.nix | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) (limited to 'nixos/tests') diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix index df5323f51a8d7..89b91d89fcb3f 100644 --- a/nixos/tests/nebula.nix +++ b/nixos/tests/nebula.nix @@ -10,6 +10,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let environment.systemPackages = [ pkgs.nebula ]; users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; services.openssh.enable = true; + networking.interfaces.eth1.useDHCP = false; services.nebula.networks.smoke = { # Note that these paths won't exist when the machine is first booted. @@ -30,7 +31,7 @@ in lighthouse = { ... } @ args: makeNebulaNode args "lighthouse" { - networking.interfaces.eth1.ipv4.addresses = [{ + networking.interfaces.eth1.ipv4.addresses = lib.mkForce [{ address = "192.168.1.1"; prefixLength = 24; }]; @@ -47,7 +48,7 @@ in allowAny = { ... } @ args: makeNebulaNode args "allowAny" { - networking.interfaces.eth1.ipv4.addresses = [{ + networking.interfaces.eth1.ipv4.addresses = lib.mkForce [{ address = "192.168.1.2"; prefixLength = 24; }]; @@ -66,7 +67,7 @@ in allowFromLighthouse = { ... } @ args: makeNebulaNode args "allowFromLighthouse" { - networking.interfaces.eth1.ipv4.addresses = [{ + networking.interfaces.eth1.ipv4.addresses = lib.mkForce [{ address = "192.168.1.3"; prefixLength = 24; }]; @@ -85,7 +86,7 @@ in allowToLighthouse = { ... } @ args: makeNebulaNode args "allowToLighthouse" { - networking.interfaces.eth1.ipv4.addresses = [{ + networking.interfaces.eth1.ipv4.addresses = lib.mkForce [{ address = "192.168.1.4"; prefixLength = 24; }]; @@ -105,7 +106,7 @@ in disabled = { ... } @ args: makeNebulaNode args "disabled" { - networking.interfaces.eth1.ipv4.addresses = [{ + networking.interfaces.eth1.ipv4.addresses = lib.mkForce [{ address = "192.168.1.5"; prefixLength = 24; }]; @@ -134,6 +135,7 @@ in "chown 700 /root/.ssh", "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil", "chown 600 /root/.ssh/id_snakeoil", + "mkdir -p /root" ) ''; @@ -152,14 +154,14 @@ in ${name}.succeed( "mkdir -p /etc/nebula", "nebula-cert keygen -out-key /etc/nebula/${name}.key -out-pub /etc/nebula/${name}.pub", - "scp ${sshOpts} /etc/nebula/${name}.pub 192.168.1.1:/var/tmp/${name}.pub", + "scp ${sshOpts} /etc/nebula/${name}.pub root@192.168.1.1:/root/${name}.pub", ) lighthouse.succeed( - 'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /var/tmp/${name}.pub -out-crt /var/tmp/${name}.crt', + 'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /root/${name}.pub -out-crt /root/${name}.crt' ) ${name}.succeed( - "scp ${sshOpts} 192.168.1.1:/var/tmp/${name}.crt /etc/nebula/${name}.crt", - "scp ${sshOpts} 192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt", + "scp ${sshOpts} root@192.168.1.1:/root/${name}.crt /etc/nebula/${name}.crt", + "scp ${sshOpts} root@192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt", '(id nebula-smoke >/dev/null && chown -R nebula-smoke:nebula-smoke /etc/nebula) || true' ) ''; -- cgit 1.4.1