From b33575d05d8c00c4d9763c68e3d42aefa36d7fa0 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 10 Aug 2025 16:06:57 +0200 Subject: [PATCH 1/6] nixosTests.tayga: set hostName router_systemd and router_nixos are not valid hostnames and get ignored, showing a warning. Set them to something different instead. --- nixos/tests/tayga.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix index 32512224bb58..fa439b19f9b9 100644 --- a/nixos/tests/tayga.nix +++ b/nixos/tests/tayga.nix @@ -87,6 +87,7 @@ ]; networking = { + hostName = "router-systemd"; useDHCP = false; useNetworkd = true; firewall.enable = false; @@ -152,6 +153,7 @@ ]; networking = { + hostName = "router-nixos"; useDHCP = false; firewall.enable = false; interfaces.eth1 = lib.mkForce { From 73582e4158a1d365ae11ee504075efb6759a89bd Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 10 Aug 2025 16:24:13 +0200 Subject: [PATCH 2/6] nixos/tayga: fix config reload Use a trampoline at /etc/tayga.conf for the config, so reload actually picks up a changed config file. --- nixos/modules/services/networking/tayga.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/tayga.nix b/nixos/modules/services/networking/tayga.nix index 062d8fe52317..bac0005781b2 100644 --- a/nixos/modules/services/networking/tayga.nix +++ b/nixos/modules/services/networking/tayga.nix @@ -171,13 +171,16 @@ in }; }; + environment.etc."tayga.conf".source = configFile; + systemd.services.tayga = { description = "Stateless NAT64 implementation"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + reloadTriggers = [ configFile ]; serviceConfig = { - ExecStart = "${cfg.package}/bin/tayga -d --nodetach --config ${configFile}"; + ExecStart = "${cfg.package}/bin/tayga -d --nodetach --config /etc/tayga.conf"; ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; Restart = "always"; From c6c3bb09d8f3166cb1511e3fe4a61de31df92895 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 10 Aug 2025 15:37:55 +0200 Subject: [PATCH 3/6] tayga: 0.9.2 -> 0.9.5 Upstream has changed to there, and it's actively maintained. --- pkgs/by-name/ta/tayga/package.nix | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/ta/tayga/package.nix b/pkgs/by-name/ta/tayga/package.nix index bc6052464938..5e6adac35c75 100644 --- a/pkgs/by-name/ta/tayga/package.nix +++ b/pkgs/by-name/ta/tayga/package.nix @@ -1,23 +1,32 @@ { lib, stdenv, - fetchurl, + fetchFromGitHub, nixosTests, }: stdenv.mkDerivation (finalAttrs: { - version = "0.9.2"; + version = "0.9.5"; pname = "tayga"; - src = fetchurl { - url = "http://www.litech.org/tayga/tayga-${finalAttrs.version}.tar.bz2"; - hash = "sha256-Kx95J6nS3P+Qla/zwnGSSwUsz9L6ypWIsndDGkTwAJw="; + src = fetchFromGitHub { + owner = "apalrd"; + repo = "tayga"; + tag = finalAttrs.version; + hash = "sha256-xOm4fetFq2UGuhOojrT8WOcX78c6MLTMVbDv+O62x2E="; }; - env.NIX_CFLAGS_COMPILE = toString [ - "-Wno-address-of-packed-member" - "-Wno-implicit-function-declaration" - ]; + preBuild = '' + echo "#define TAYGA_VERSION \"${finalAttrs.version}\"" > version.h + ''; + + installPhase = '' + install -Dm755 tayga $out/bin/tayga + install -D tayga.conf.5 $out/share/man/man5/tayga.conf.5 + install -D tayga.8 $out/share/man/man8/tayga.8 + cp -R docs $out/share/ + cp tayga.conf.example $out/share/docs/ + ''; passthru.tests.tayga = nixosTests.tayga; @@ -30,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: { It is intended to provide production-quality NAT64 service for networks where dedicated NAT64 hardware would be overkill. ''; - homepage = "http://www.litech.org/tayga"; + homepage = "https://github.com/apalrd/tayga"; license = licenses.gpl2Plus; maintainers = with maintainers; [ _0x4A6F ]; platforms = platforms.linux; From c204edcb7cd1b60342655e595b1d01d5f711b2bc Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 10 Aug 2025 16:10:06 +0200 Subject: [PATCH 4/6] nixosTests.tayga: add tcpdump to systemPackages This makes it much easier to debug broken connectivity interactively, especially if networking is broken. --- nixos/tests/tayga.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix index fa439b19f9b9..4a7d1e304f6a 100644 --- a/nixos/tests/tayga.nix +++ b/nixos/tests/tayga.nix @@ -63,6 +63,7 @@ }; }; programs.mtr.enable = true; + environment.systemPackages = [ pkgs.tcpdump ]; }; # The router is configured with static IPv4 addresses towards the server @@ -139,6 +140,7 @@ "192.0.2.42" = "2001:db8::2"; }; }; + environment.systemPackages = [ pkgs.tcpdump ]; }; router_nixos = { @@ -204,6 +206,7 @@ "192.0.2.42" = "2001:db8::2"; }; }; + environment.systemPackages = [ pkgs.tcpdump ]; }; # The client is configured with static IPv6 addresses. It has also a static @@ -235,6 +238,7 @@ }; }; programs.mtr.enable = true; + environment.systemPackages = [ pkgs.tcpdump ]; }; }; From b45ba94a0ed9b0a04c5d569d4994f546c1849797 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sun, 10 Aug 2025 16:34:57 +0200 Subject: [PATCH 5/6] nixos/tayga: add log option This allows configuring logging in tayga, and enables it for the NixOS test. --- nixos/modules/services/networking/tayga.nix | 13 +++++++++++++ nixos/tests/tayga.nix | 12 ++++++++++++ 2 files changed, 25 insertions(+) diff --git a/nixos/modules/services/networking/tayga.nix b/nixos/modules/services/networking/tayga.nix index bac0005781b2..047c9ba396be 100644 --- a/nixos/modules/services/networking/tayga.nix +++ b/nixos/modules/services/networking/tayga.nix @@ -23,6 +23,10 @@ let data-dir ${cfg.dataDir} ${concatStringsSep "\n" (mapAttrsToList (ipv4: ipv6: "map " + ipv4 + " " + ipv6) cfg.mappings)} + + ${optionalString ((builtins.length cfg.log) > 0) '' + log ${concatStringsSep " " cfg.log} + ''} ''; addrOpts = @@ -132,6 +136,15 @@ in } ''; }; + + log = mkOption { + type = types.listOf types.str; + default = [ ]; + description = "Packet errors to log (drop, reject, icmp, self)"; + example = literalExpression '' + [ "drop" "reject" "icmp" "self" ] + ''; + }; }; }; diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix index 4a7d1e304f6a..5076a05c884b 100644 --- a/nixos/tests/tayga.nix +++ b/nixos/tests/tayga.nix @@ -139,6 +139,12 @@ mappings = { "192.0.2.42" = "2001:db8::2"; }; + log = [ + "drop" + "reject" + "icmp" + "self" + ]; }; environment.systemPackages = [ pkgs.tcpdump ]; }; @@ -205,6 +211,12 @@ mappings = { "192.0.2.42" = "2001:db8::2"; }; + log = [ + "drop" + "reject" + "icmp" + "self" + ]; }; environment.systemPackages = [ pkgs.tcpdump ]; }; From 4548324aae5650a39e9a77816f6f2de4f16e0ed6 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sun, 10 Aug 2025 16:41:43 +0200 Subject: [PATCH 6/6] nixos/tayga: add option to allow toggling WKPF strict compliance The RFC requires that we don't allow access to non-global v4 addresses using the well-known 64:ff9b:: prefix, but there are some deployments where it's convenient to permit this. To make this work in tests, disable wkpf-strictness via the config option introduced in bc18503e2ff1ee48ac472a67ba982dae76a5c2d3. Tayga added 100.64.0.0 to the set of WKPF in 4dff17ef61821f5bc1996ce687a3dc317fd4fa50. --- nixos/modules/services/networking/tayga.nix | 8 ++++++++ nixos/tests/tayga.nix | 11 ++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/networking/tayga.nix b/nixos/modules/services/networking/tayga.nix index 047c9ba396be..8a039aa75abf 100644 --- a/nixos/modules/services/networking/tayga.nix +++ b/nixos/modules/services/networking/tayga.nix @@ -27,6 +27,8 @@ let ${optionalString ((builtins.length cfg.log) > 0) '' log ${concatStringsSep " " cfg.log} ''} + + wkpf-strict ${if cfg.wkpfStrict then "yes" else "no"} ''; addrOpts = @@ -145,6 +147,12 @@ in [ "drop" "reject" "icmp" "self" ] ''; }; + + wkpfStrict = mkOption { + type = types.bool; + default = true; + description = "Enable restrictions on the use of the well-known prefix (64:ff9b::/96) - prevents translation of non-global IPv4 ranges when using the well-known prefix. Must be enabled for RFC 6052 compatibility."; + }; }; }; diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix index 5076a05c884b..61e7724a9413 100644 --- a/nixos/tests/tayga.nix +++ b/nixos/tests/tayga.nix @@ -31,11 +31,10 @@ }; nodes = { - # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1 - # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the - # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of - # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from - # RFC 6589 (Carrier Grade NAT) is used here. + # The server is configured with static IPv4 addresses. We have to disable the + # well-known prefix restrictions (as required by RFC 6052 Section 3.1) because + # we're using private space (TAYGA also considers documentation space non-global, + # unfortunately). # To reach the IPv4 address pool of the NAT64 gateway, there is a static # route configured. In normal cases, where the router would also source NAT # the pool addresses to one IPv4 addresses, this would not be needed. @@ -145,6 +144,7 @@ "icmp" "self" ]; + wkpfStrict = false; }; environment.systemPackages = [ pkgs.tcpdump ]; }; @@ -217,6 +217,7 @@ "icmp" "self" ]; + wkpfStrict = false; }; environment.systemPackages = [ pkgs.tcpdump ]; };