nixos/tests/opensnitch.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

import ./make-test-python.nix ({ pkgs, ... }: {
  name = "opensnitch";

  meta = with pkgs.lib.maintainers; {
    maintainers = [ onny ];
  };

  nodes = {
    server =
      { ... }: {
        networking.firewall.allowedTCPPorts = [ 80 ];
        services.caddy = {
          enable = true;
          virtualHosts."localhost".extraConfig = ''
            respond "Hello, world!"
          '';
        };
      };

    clientBlocked =
      { ... }: {
        services.opensnitch = {
          enable = true;
          settings.DefaultAction = "deny";
        };
      };

    clientAllowed =
      { ... }: {
        services.opensnitch = {
          enable = true;
          settings.DefaultAction = "deny";
          rules = {
            opensnitch = {
              name = "curl";
              enabled = true;
              action = "allow";
              duration = "always";
              operator = {
                type ="simple";
                sensitive = false;
                operand = "process.path";
                data = "${pkgs.curl}/bin/curl";
              };
            };
          };
        };
      };
  };

  testScript = ''
    start_all()
    server.wait_for_unit("caddy.service")
    server.wait_for_open_port(80)

    clientBlocked.wait_for_unit("opensnitchd.service")
    clientBlocked.fail("curl http://server")

    clientAllowed.wait_for_unit("opensnitchd.service")
    clientAllowed.succeed("curl http://server")
  '';
})