From ef29596a75e167a624212aad78cbf4346880679e Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Sun, 13 Jul 2025 23:06:35 +0800 Subject: [PATCH] nixosTests.wireguard: handleTest -> runTest (cherry picked from commit 71d0e1c8b5ffc0a4e8b6a85ce85b1a32d2dbcf8a) --- nixos/tests/all-tests.nix | 5 +- nixos/tests/wireguard/amneziawg-quick.nix | 211 +++++++++++----------- nixos/tests/wireguard/amneziawg.nix | 101 +++++------ nixos/tests/wireguard/basic.nix | 81 ++++----- nixos/tests/wireguard/default.nix | 35 ++-- nixos/tests/wireguard/dynamic-refresh.nix | 138 +++++++------- nixos/tests/wireguard/generated.nix | 95 +++++----- nixos/tests/wireguard/make-peer.nix | 53 +++--- nixos/tests/wireguard/namespaces.nix | 87 ++++----- nixos/tests/wireguard/networkd.nix | 85 +++++---- nixos/tests/wireguard/wg-quick.nix | 175 +++++++++--------- 11 files changed, 532 insertions(+), 534 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index f7b1ae0c09fe..5fdeacd8e59b 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1553,7 +1553,10 @@ in whoogle-search = runTest ./whoogle-search.nix; wiki-js = runTest ./wiki-js.nix; wine = handleTest ./wine.nix { }; - wireguard = handleTest ./wireguard { }; + wireguard = import ./wireguard { + inherit pkgs runTest; + inherit (pkgs) lib; + }; wg-access-server = runTest ./wg-access-server.nix; without-nix = runTest ./without-nix.nix; wmderland = runTest ./wmderland.nix; diff --git a/nixos/tests/wireguard/amneziawg-quick.nix b/nixos/tests/wireguard/amneziawg-quick.nix index 0433233a2f96..4ae5a6374ca8 100644 --- a/nixos/tests/wireguard/amneziawg-quick.nix +++ b/nixos/tests/wireguard/amneziawg-quick.nix @@ -1,125 +1,120 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - nftables ? false, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - peer = import ./make-peer.nix { inherit lib; }; - commonConfig = { - boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages; +{ + lib, + kernelPackages ? null, + nftables ? false, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; + peer = import ./make-peer.nix; + commonConfig = + { pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.nftables.enable = nftables; # Make sure iptables doesn't work with nftables enabled boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ]; }; - extraOptions = { - Jc = 5; - Jmin = 10; - Jmax = 42; - S1 = 60; - S2 = 90; - }; - in - { - name = "amneziawg-quick"; - meta = with pkgs.lib.maintainers; { - maintainers = [ - averyanalex - azahi - ]; - }; + extraOptions = { + Jc = 5; + Jmin = 10; + Jmax = 42; + S1 = 60; + S2 = 90; + }; +in +{ + name = "amneziawg-quick"; + meta.maintainers = with lib.maintainers; [ + averyanalex + azahi + ]; - nodes = { - peer0 = peer { - ip4 = "192.168.0.1"; - ip6 = "fd00::1"; - extraConfig = lib.mkMerge [ - commonConfig - { - networking.firewall.allowedUDPPorts = [ 23542 ]; - networking.wg-quick.interfaces.wg0 = { - type = "amneziawg"; + nodes = { + peer0 = peer { + ip4 = "192.168.0.1"; + ip6 = "fd00::1"; + extraConfig = { + imports = [ commonConfig ]; - address = [ - "10.23.42.1/32" - "fc00::1/128" - ]; - listenPort = 23542; + networking.firewall.allowedUDPPorts = [ 23542 ]; + networking.wg-quick.interfaces.wg0 = { + type = "amneziawg"; - inherit (wg-snakeoil-keys.peer0) privateKey; + address = [ + "10.23.42.1/32" + "fc00::1/128" + ]; + listenPort = 23542; - peers = lib.singleton { - allowedIPs = [ - "10.23.42.2/32" - "fc00::2/128" - ]; + inherit (wg-snakeoil-keys.peer0) privateKey; - inherit (wg-snakeoil-keys.peer1) publicKey; - }; + peers = lib.singleton { + allowedIPs = [ + "10.23.42.2/32" + "fc00::2/128" + ]; - dns = [ - "10.23.42.2" - "fc00::2" - "wg0" - ]; + inherit (wg-snakeoil-keys.peer1) publicKey; + }; - inherit extraOptions; - }; - } - ]; - }; + dns = [ + "10.23.42.2" + "fc00::2" + "wg0" + ]; - peer1 = peer { - ip4 = "192.168.0.2"; - ip6 = "fd00::2"; - extraConfig = lib.mkMerge [ - commonConfig - { - networking.useNetworkd = true; - networking.wg-quick.interfaces.wg0 = { - type = "amneziawg"; - - address = [ - "10.23.42.2/32" - "fc00::2/128" - ]; - inherit (wg-snakeoil-keys.peer1) privateKey; - - peers = lib.singleton { - allowedIPs = [ - "0.0.0.0/0" - "::/0" - ]; - endpoint = "192.168.0.1:23542"; - persistentKeepalive = 25; - - inherit (wg-snakeoil-keys.peer0) publicKey; - }; - - dns = [ - "10.23.42.1" - "fc00::1" - "wg0" - ]; - - inherit extraOptions; - }; - } - ]; + inherit extraOptions; + }; }; }; - testScript = '' - start_all() + peer1 = peer { + ip4 = "192.168.0.2"; + ip6 = "fd00::2"; + extraConfig = { + imports = [ commonConfig ]; - peer0.wait_for_unit("wg-quick-wg0.service") - peer1.wait_for_unit("wg-quick-wg0.service") + networking.useNetworkd = true; + networking.wg-quick.interfaces.wg0 = { + type = "amneziawg"; - peer1.succeed("ping -c5 fc00::1") - peer1.succeed("ping -c5 10.23.42.1") - ''; - } -) + address = [ + "10.23.42.2/32" + "fc00::2/128" + ]; + inherit (wg-snakeoil-keys.peer1) privateKey; + + peers = lib.singleton { + allowedIPs = [ + "0.0.0.0/0" + "::/0" + ]; + endpoint = "192.168.0.1:23542"; + persistentKeepalive = 25; + + inherit (wg-snakeoil-keys.peer0) publicKey; + }; + + dns = [ + "10.23.42.1" + "fc00::1" + "wg0" + ]; + + inherit extraOptions; + }; + }; + }; + }; + + testScript = '' + start_all() + + peer0.wait_for_unit("wg-quick-wg0.service") + peer1.wait_for_unit("wg-quick-wg0.service") + + peer1.succeed("ping -c5 fc00::1") + peer1.succeed("ping -c5 10.23.42.1") + ''; +} diff --git a/nixos/tests/wireguard/amneziawg.nix b/nixos/tests/wireguard/amneziawg.nix index 40ab0e002fec..c792597b9d82 100644 --- a/nixos/tests/wireguard/amneziawg.nix +++ b/nixos/tests/wireguard/amneziawg.nix @@ -1,36 +1,34 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - peer = (import ./make-peer.nix) { inherit lib; }; - extraOptions = { - Jc = 5; - Jmin = 10; - Jmax = 42; - S1 = 60; - S2 = 90; - }; - in - { - name = "amneziawg"; - meta = with pkgs.lib.maintainers; { - maintainers = [ - averyanalex - azahi - ]; - }; +{ + lib, + kernelPackages ? null, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; + peer = import ./make-peer.nix; + extraOptions = { + Jc = 5; + Jmin = 10; + Jmax = 42; + S1 = 60; + S2 = 90; + }; +in +{ + name = "amneziawg"; + meta.maintainers = with lib.maintainers; [ + averyanalex + azahi + ]; - nodes = { - peer0 = peer { - ip4 = "192.168.0.1"; - ip6 = "fd00::1"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + nodes = { + peer0 = peer { + ip4 = "192.168.0.1"; + ip6 = "fd00::1"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 23542 ]; networking.wireguard.interfaces.wg0 = { type = "amneziawg"; @@ -54,13 +52,15 @@ import ../make-test-python.nix ( inherit extraOptions; }; }; - }; + }; - peer1 = peer { - ip4 = "192.168.0.2"; - ip6 = "fd00::2"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + peer1 = peer { + ip4 = "192.168.0.2"; + ip6 = "fd00::2"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { type = "amneziawg"; ips = [ @@ -85,27 +85,26 @@ import ../make-test-python.nix ( postSetup = let - inherit (pkgs) iproute2; + ip = lib.getExe' pkgs.iproute2 "ip"; in '' - ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0 - ${iproute2}/bin/ip route replace fc00::1/128 dev wg0 + ${ip} route replace 10.23.42.1/32 dev wg0 + ${ip} route replace fc00::1/128 dev wg0 ''; inherit extraOptions; }; }; - }; }; + }; - testScript = '' - start_all() + testScript = '' + start_all() - peer0.wait_for_unit("wireguard-wg0.service") - peer1.wait_for_unit("wireguard-wg0.service") + peer0.wait_for_unit("wireguard-wg0.service") + peer1.wait_for_unit("wireguard-wg0.service") - peer1.succeed("ping -c5 fc00::1") - peer1.succeed("ping -c5 10.23.42.1") - ''; - } -) + peer1.succeed("ping -c5 fc00::1") + peer1.succeed("ping -c5 10.23.42.1") + ''; +} diff --git a/nixos/tests/wireguard/basic.nix b/nixos/tests/wireguard/basic.nix index f0ef97b55fdc..7966aa2c0125 100644 --- a/nixos/tests/wireguard/basic.nix +++ b/nixos/tests/wireguard/basic.nix @@ -1,26 +1,24 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - peer = (import ./make-peer.nix) { inherit lib; }; - in - { - name = "wireguard"; - meta = with pkgs.lib.maintainers; { - maintainers = [ ma27 ]; - }; +{ + lib, + kernelPackages ? null, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; + peer = import ./make-peer.nix; +in +{ + name = "wireguard"; + meta.maintainers = with lib.maintainers; [ ma27 ]; - nodes = { - peer0 = peer { - ip4 = "192.168.0.1"; - ip6 = "fd00::1"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + nodes = { + peer0 = peer { + ip4 = "192.168.0.1"; + ip6 = "fd00::1"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 23542 ]; networking.wireguard.interfaces.wg0 = { ips = [ @@ -41,13 +39,15 @@ import ../make-test-python.nix ( }; }; }; - }; + }; - peer1 = peer { - ip4 = "192.168.0.2"; - ip6 = "fd00::2"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + peer1 = peer { + ip4 = "192.168.0.2"; + ip6 = "fd00::2"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { ips = [ "10.23.42.2/32" @@ -71,25 +71,24 @@ import ../make-test-python.nix ( postSetup = let - inherit (pkgs) iproute2; + ip = lib.getExe' pkgs.iproute2 "ip"; in '' - ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0 - ${iproute2}/bin/ip route replace fc00::1/128 dev wg0 + ${ip} route replace 10.23.42.1/32 dev wg0 + ${ip} route replace fc00::1/128 dev wg0 ''; }; }; - }; }; + }; - testScript = '' - start_all() + testScript = '' + start_all() - peer0.wait_for_unit("wireguard-wg0.service") - peer1.wait_for_unit("wireguard-wg0.service") + peer0.wait_for_unit("wireguard-wg0.service") + peer1.wait_for_unit("wireguard-wg0.service") - peer1.succeed("ping -c5 fc00::1") - peer1.succeed("ping -c5 10.23.42.1") - ''; - } -) + peer1.succeed("ping -c5 fc00::1") + peer1.succeed("ping -c5 10.23.42.1") + ''; +} diff --git a/nixos/tests/wireguard/default.nix b/nixos/tests/wireguard/default.nix index 93d0efaf0889..0a64869c1ae5 100644 --- a/nixos/tests/wireguard/default.nix +++ b/nixos/tests/wireguard/default.nix @@ -1,46 +1,49 @@ { - system ? builtins.currentSystem, - config ? { }, - pkgs ? import ../../.. { inherit system config; }, + runTest, + lib, + pkgs, # Test current default (LTS) and latest kernel kernelVersionsToTest ? [ - (pkgs.lib.versions.majorMinor pkgs.linuxPackages.kernel.version) + (lib.versions.majorMinor pkgs.linuxPackages.kernel.version) "latest" ], }: -with pkgs.lib; - let tests = let - callTest = p: args: import p ({ inherit system pkgs; } // args); + callTest = + p: args: + runTest { + imports = [ p ]; + _module = { inherit args; }; + }; in { basic = callTest ./basic.nix; amneziawg = callTest ./amneziawg.nix; namespaces = callTest ./namespaces.nix; networkd = callTest ./networkd.nix; - wg-quick = callTest ./wg-quick.nix; + wg-quick = args: callTest ./wg-quick.nix ({ nftables = false; } // args); wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args); - amneziawg-quick = callTest ./amneziawg-quick.nix; + amneziawg-quick = args: callTest ./amneziawg-quick.nix ({ nftables = false; } // args); generated = callTest ./generated.nix; - dynamic-refresh = callTest ./dynamic-refresh.nix; + dynamic-refresh = args: callTest ./dynamic-refresh.nix ({ useNetworkd = false; } // args); dynamic-refresh-networkd = args: callTest ./dynamic-refresh.nix ({ useNetworkd = true; } // args); }; in -listToAttrs ( - flip concatMap kernelVersionsToTest ( +lib.listToAttrs ( + lib.flip lib.concatMap kernelVersionsToTest ( version: let - v' = replaceStrings [ "." ] [ "_" ] version; + v' = lib.replaceString "." "_" version; in - flip mapAttrsToList tests ( + lib.flip lib.mapAttrsToList tests ( name: test: - nameValuePair "wireguard-${name}-linux-${v'}" (test { + lib.nameValuePair "wireguard-${name}-linux-${v'}" (test { kernelPackages = - if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}"; + pkgs: if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}"; }) ) ) diff --git a/nixos/tests/wireguard/dynamic-refresh.nix b/nixos/tests/wireguard/dynamic-refresh.nix index 2a8fb0598833..fe7fcb5305c4 100644 --- a/nixos/tests/wireguard/dynamic-refresh.nix +++ b/nixos/tests/wireguard/dynamic-refresh.nix @@ -1,27 +1,25 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - useNetworkd ? false, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - in - { - name = "wireguard-dynamic-refresh"; - meta = with lib.maintainers; { - maintainers = [ majiir ]; - }; +{ + lib, + kernelPackages ? null, + useNetworkd ? false, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; +in +{ + name = "wireguard-dynamic-refresh"; + meta.maintainers = with lib.maintainers; [ majiir ]; - nodes = { - server = { + nodes = { + server = + { lib, pkgs, ... }: + { virtualisation.vlans = [ 1 2 ]; - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 23542 ]; networking.useDHCP = false; networking.wireguard.useNetworkd = useNetworkd; @@ -40,66 +38,70 @@ import ../make-test-python.nix ( }; }; - client = - { nodes, ... }: - { - virtualisation.vlans = [ - 1 - 2 - ]; - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; - networking.useDHCP = false; - networking.wireguard.useNetworkd = useNetworkd; - networking.wireguard.interfaces.wg0 = { - ips = [ "10.23.42.2/32" ]; + client = + { + nodes, + lib, + pkgs, + ... + }: + { + virtualisation.vlans = [ + 1 + 2 + ]; + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); + networking.useDHCP = false; + networking.wireguard.useNetworkd = useNetworkd; + networking.wireguard.interfaces.wg0 = { + ips = [ "10.23.42.2/32" ]; - # !!! Don't do this with real keys. The /nix store is world-readable! - privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey); + # !!! Don't do this with real keys. The /nix store is world-readable! + privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey); - dynamicEndpointRefreshSeconds = 2; + dynamicEndpointRefreshSeconds = 2; - peers = lib.singleton { - allowedIPs = [ - "0.0.0.0/0" - "::/0" - ]; - endpoint = "server:23542"; + peers = lib.singleton { + allowedIPs = [ + "0.0.0.0/0" + "::/0" + ]; + endpoint = "server:23542"; - inherit (wg-snakeoil-keys.peer0) publicKey; - }; - }; - - specialisation.update-hosts.configuration = { - networking.extraHosts = - let - testCfg = nodes.server.virtualisation.test; - in - lib.mkForce "192.168.2.${toString testCfg.nodeNumber} ${testCfg.nodeName}"; + inherit (wg-snakeoil-keys.peer0) publicKey; }; }; - }; - testScript = - { nodes, ... }: - '' - start_all() + specialisation.update-hosts.configuration = { + networking.extraHosts = + let + testCfg = nodes.server.virtualisation.test; + in + lib.mkForce "192.168.2.${toString testCfg.nodeNumber} ${testCfg.nodeName}"; + }; + }; + }; - server.systemctl("start network-online.target") - server.wait_for_unit("network-online.target") + testScript = + { nodes, ... }: + '' + start_all() - client.systemctl("start network-online.target") - client.wait_for_unit("network-online.target") + server.systemctl("start network-online.target") + server.wait_for_unit("network-online.target") - client.succeed("ping -n -w 1 -c 1 10.23.42.1") + client.systemctl("start network-online.target") + client.wait_for_unit("network-online.target") - client.succeed("ip link set down eth1") + client.succeed("ping -n -w 1 -c 1 10.23.42.1") - client.fail("ping -n -w 1 -c 1 10.23.42.1") + client.succeed("ip link set down eth1") - with client.nested("update hosts file"): - client.succeed("${nodes.client.system.build.toplevel}/specialisation/update-hosts/bin/switch-to-configuration test") + client.fail("ping -n -w 1 -c 1 10.23.42.1") - client.succeed("sleep 5 && ping -n -w 1 -c 1 10.23.42.1") - ''; - } -) + with client.nested("update hosts file"): + client.succeed("${nodes.client.system.build.toplevel}/specialisation/update-hosts/bin/switch-to-configuration test") + + client.succeed("sleep 5 && ping -n -w 1 -c 1 10.23.42.1") + ''; +} diff --git a/nixos/tests/wireguard/generated.nix b/nixos/tests/wireguard/generated.nix index 31ecd9643ffc..9efeee228062 100644 --- a/nixos/tests/wireguard/generated.nix +++ b/nixos/tests/wireguard/generated.nix @@ -1,22 +1,20 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - ... - }: - { - name = "wireguard-generated"; - meta = with pkgs.lib.maintainers; { - maintainers = [ - ma27 - grahamc - ]; - }; +{ + lib, + kernelPackages ? null, + ... +}: +{ + name = "wireguard-generated"; + meta.maintainers = with lib.maintainers; [ + ma27 + grahamc + ]; - nodes = { - peer1 = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + nodes = { + peer1 = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 12345 ]; networking.wireguard.interfaces.wg0 = { ips = [ "10.10.10.1/24" ]; @@ -27,8 +25,10 @@ import ../make-test-python.nix ( }; }; - peer2 = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + peer2 = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 12345 ]; networking.wireguard.interfaces.wg0 = { ips = [ "10.10.10.2/24" ]; @@ -37,38 +37,37 @@ import ../make-test-python.nix ( generatePrivateKeyFile = true; }; }; - }; + }; - testScript = '' - start_all() + testScript = '' + start_all() - peer1.wait_for_unit("wireguard-wg0.service") - peer2.wait_for_unit("wireguard-wg0.service") + peer1.wait_for_unit("wireguard-wg0.service") + peer2.wait_for_unit("wireguard-wg0.service") - retcode, peer1pubkey = peer1.execute("wg pubkey < /etc/wireguard/private") - if retcode != 0: - raise Exception("Could not read public key from peer1") + retcode, peer1pubkey = peer1.execute("wg pubkey < /etc/wireguard/private") + if retcode != 0: + raise Exception("Could not read public key from peer1") - retcode, peer2pubkey = peer2.execute("wg pubkey < /etc/wireguard/private") - if retcode != 0: - raise Exception("Could not read public key from peer2") + retcode, peer2pubkey = peer2.execute("wg pubkey < /etc/wireguard/private") + if retcode != 0: + raise Exception("Could not read public key from peer2") - peer1.succeed( - "wg set wg0 peer {} allowed-ips 10.10.10.2/32 endpoint 192.168.1.2:12345 persistent-keepalive 1".format( - peer2pubkey.strip() - ) - ) - peer1.succeed("ip route replace 10.10.10.2/32 dev wg0 table main") + peer1.succeed( + "wg set wg0 peer {} allowed-ips 10.10.10.2/32 endpoint 192.168.1.2:12345 persistent-keepalive 1".format( + peer2pubkey.strip() + ) + ) + peer1.succeed("ip route replace 10.10.10.2/32 dev wg0 table main") - peer2.succeed( - "wg set wg0 peer {} allowed-ips 10.10.10.1/32 endpoint 192.168.1.1:12345 persistent-keepalive 1".format( - peer1pubkey.strip() - ) - ) - peer2.succeed("ip route replace 10.10.10.1/32 dev wg0 table main") + peer2.succeed( + "wg set wg0 peer {} allowed-ips 10.10.10.1/32 endpoint 192.168.1.1:12345 persistent-keepalive 1".format( + peer1pubkey.strip() + ) + ) + peer2.succeed("ip route replace 10.10.10.1/32 dev wg0 table main") - peer1.succeed("ping -c1 10.10.10.2") - peer2.succeed("ping -c1 10.10.10.1") - ''; - } -) + peer1.succeed("ping -c1 10.10.10.2") + peer2.succeed("ping -c1 10.10.10.1") + ''; +} diff --git a/nixos/tests/wireguard/make-peer.nix b/nixos/tests/wireguard/make-peer.nix index aaee4b650761..f02a5227d2d8 100644 --- a/nixos/tests/wireguard/make-peer.nix +++ b/nixos/tests/wireguard/make-peer.nix @@ -1,32 +1,33 @@ -{ lib, ... }: { ip4, ip6, extraConfig, }: -lib.mkMerge [ - { - boot.kernel.sysctl = { - "net.ipv6.conf.all.forwarding" = "1"; - "net.ipv6.conf.default.forwarding" = "1"; - "net.ipv4.ip_forward" = "1"; - }; +{ + imports = [ + { + boot.kernel.sysctl = { + "net.ipv6.conf.all.forwarding" = "1"; + "net.ipv6.conf.default.forwarding" = "1"; + "net.ipv4.ip_forward" = "1"; + }; - networking.useDHCP = false; - networking.interfaces.eth1 = { - ipv4.addresses = [ - { - address = ip4; - prefixLength = 24; - } - ]; - ipv6.addresses = [ - { - address = ip6; - prefixLength = 64; - } - ]; - }; - } - extraConfig -] + networking.useDHCP = false; + networking.interfaces.eth1 = { + ipv4.addresses = [ + { + address = ip4; + prefixLength = 24; + } + ]; + ipv6.addresses = [ + { + address = ip6; + prefixLength = 64; + } + ]; + }; + } + extraConfig + ]; +} diff --git a/nixos/tests/wireguard/namespaces.nix b/nixos/tests/wireguard/namespaces.nix index f88ac1eb2dfa..44a9918d5238 100644 --- a/nixos/tests/wireguard/namespaces.nix +++ b/nixos/tests/wireguard/namespaces.nix @@ -1,3 +1,8 @@ +{ + lib, + kernelPackages ? null, + ... +}: let listenPort = 12345; socketNamespace = "foo"; @@ -10,27 +15,18 @@ let generatePrivateKeyFile = true; }; }; - in +{ + name = "wireguard-with-namespaces"; + meta.maintainers = with lib.maintainers; [ asymmetric ]; -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - ... - }: - { - name = "wireguard-with-namespaces"; - meta = with pkgs.lib.maintainers; { - maintainers = [ asymmetric ]; - }; - - nodes = { - # interface should be created in the socketNamespace - # and not moved from there - peer0 = pkgs.lib.attrsets.recursiveUpdate node { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + nodes = { + # interface should be created in the socketNamespace + # and not moved from there + peer0 = + { lib, pkgs, ... }: + lib.attrsets.recursiveUpdate node { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { preSetup = '' ip netns add ${socketNamespace} @@ -38,10 +34,12 @@ import ../make-test-python.nix ( inherit socketNamespace; }; }; - # interface should be created in the init namespace - # and moved to the interfaceNamespace - peer1 = pkgs.lib.attrsets.recursiveUpdate node { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + # interface should be created in the init namespace + # and moved to the interfaceNamespace + peer1 = + { lib, pkgs, ... }: + lib.attrsets.recursiveUpdate node { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { preSetup = '' ip netns add ${interfaceNamespace} @@ -50,10 +48,12 @@ import ../make-test-python.nix ( inherit interfaceNamespace; }; }; - # interface should be created in the socketNamespace - # and moved to the interfaceNamespace - peer2 = pkgs.lib.attrsets.recursiveUpdate node { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + # interface should be created in the socketNamespace + # and moved to the interfaceNamespace + peer2 = + { lib, pkgs, ... }: + lib.attrsets.recursiveUpdate node { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { preSetup = '' ip netns add ${socketNamespace} @@ -62,10 +62,12 @@ import ../make-test-python.nix ( inherit socketNamespace interfaceNamespace; }; }; - # interface should be created in the socketNamespace - # and moved to the init namespace - peer3 = pkgs.lib.attrsets.recursiveUpdate node { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + # interface should be created in the socketNamespace + # and moved to the init namespace + peer3 = + { lib, pkgs, ... }: + lib.attrsets.recursiveUpdate node { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.interfaces.wg0 = { preSetup = '' ip netns add ${socketNamespace} @@ -74,18 +76,17 @@ import ../make-test-python.nix ( interfaceNamespace = "init"; }; }; - }; + }; - testScript = '' - start_all() + testScript = '' + start_all() - for machine in peer0, peer1, peer2, peer3: - machine.wait_for_unit("wireguard-wg0.service") + for machine in peer0, peer1, peer2, peer3: + machine.wait_for_unit("wireguard-wg0.service") - peer0.succeed("ip -n ${socketNamespace} link show wg0") - peer1.succeed("ip -n ${interfaceNamespace} link show wg0") - peer2.succeed("ip -n ${interfaceNamespace} link show wg0") - peer3.succeed("ip link show wg0") - ''; - } -) + peer0.succeed("ip -n ${socketNamespace} link show wg0") + peer1.succeed("ip -n ${interfaceNamespace} link show wg0") + peer2.succeed("ip -n ${interfaceNamespace} link show wg0") + peer3.succeed("ip link show wg0") + ''; +} diff --git a/nixos/tests/wireguard/networkd.nix b/nixos/tests/wireguard/networkd.nix index 20305bc2ab12..f353d241600a 100644 --- a/nixos/tests/wireguard/networkd.nix +++ b/nixos/tests/wireguard/networkd.nix @@ -1,26 +1,24 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - peer = (import ./make-peer.nix) { inherit lib; }; - in - { - name = "wireguard-networkd"; - meta = with pkgs.lib.maintainers; { - maintainers = [ majiir ]; - }; +{ + lib, + kernelPackages ? null, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; + peer = import ./make-peer.nix; +in +{ + name = "wireguard-networkd"; + meta.maintainers = with lib.maintainers; [ majiir ]; - nodes = { - peer0 = peer { - ip4 = "192.168.0.1"; - ip6 = "fd00::1"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + nodes = { + peer0 = peer { + ip4 = "192.168.0.1"; + ip6 = "fd00::1"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.firewall.allowedUDPPorts = [ 23542 ]; networking.wireguard.useNetworkd = true; networking.wireguard.interfaces.wg0 = { @@ -46,13 +44,15 @@ import ../make-test-python.nix ( }; }; }; - }; + }; - peer1 = peer { - ip4 = "192.168.0.2"; - ip6 = "fd00::2"; - extraConfig = { - boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; }; + peer1 = peer { + ip4 = "192.168.0.2"; + ip6 = "fd00::2"; + extraConfig = + { lib, pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.wireguard.useNetworkd = true; networking.wireguard.interfaces.wg0 = { ips = [ @@ -79,24 +79,23 @@ import ../make-test-python.nix ( }; }; }; - }; }; + }; - testScript = '' - start_all() + testScript = '' + start_all() - peer0.systemctl("start network-online.target") - peer0.wait_for_unit("network-online.target") + peer0.systemctl("start network-online.target") + peer0.wait_for_unit("network-online.target") - peer1.systemctl("start network-online.target") - peer1.wait_for_unit("network-online.target") + peer1.systemctl("start network-online.target") + peer1.wait_for_unit("network-online.target") - peer1.succeed("ping -c5 fc00::1") - peer1.succeed("ping -c5 10.23.42.1") + peer1.succeed("ping -c5 fc00::1") + peer1.succeed("ping -c5 10.23.42.1") - with subtest("Has PSK set"): - peer0.succeed("wg | grep 'preshared key'") - peer1.succeed("wg | grep 'preshared key'") - ''; - } -) + with subtest("Has PSK set"): + peer0.succeed("wg | grep 'preshared key'") + peer1.succeed("wg | grep 'preshared key'") + ''; +} diff --git a/nixos/tests/wireguard/wg-quick.nix b/nixos/tests/wireguard/wg-quick.nix index be258e1e7ed1..6a5969c7d216 100644 --- a/nixos/tests/wireguard/wg-quick.nix +++ b/nixos/tests/wireguard/wg-quick.nix @@ -1,104 +1,101 @@ -import ../make-test-python.nix ( - { - pkgs, - lib, - kernelPackages ? null, - nftables ? false, - ... - }: - let - wg-snakeoil-keys = import ./snakeoil-keys.nix; - peer = import ./make-peer.nix { inherit lib; }; - commonConfig = { - boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages; +{ + lib, + kernelPackages ? null, + nftables ? false, + ... +}: +let + wg-snakeoil-keys = import ./snakeoil-keys.nix; + peer = import ./make-peer.nix; + commonConfig = + { pkgs, ... }: + { + boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs); networking.nftables.enable = nftables; # Make sure iptables doesn't work with nftables enabled boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ]; }; - in - { - name = "wg-quick"; +in +{ + name = "wg-quick"; - nodes = { - peer0 = peer { - ip4 = "192.168.0.1"; - ip6 = "fd00::1"; - extraConfig = lib.mkMerge [ - commonConfig - { - networking.firewall.allowedUDPPorts = [ 23542 ]; - networking.wg-quick.interfaces.wg0 = { - address = [ - "10.23.42.1/32" - "fc00::1/128" - ]; - listenPort = 23542; + nodes = { + peer0 = peer { + ip4 = "192.168.0.1"; + ip6 = "fd00::1"; + extraConfig = { + imports = [ commonConfig ]; - inherit (wg-snakeoil-keys.peer0) privateKey; + networking.firewall.allowedUDPPorts = [ 23542 ]; + networking.wg-quick.interfaces.wg0 = { + address = [ + "10.23.42.1/32" + "fc00::1/128" + ]; + listenPort = 23542; - peers = lib.singleton { - allowedIPs = [ - "10.23.42.2/32" - "fc00::2/128" - ]; + inherit (wg-snakeoil-keys.peer0) privateKey; - inherit (wg-snakeoil-keys.peer1) publicKey; - }; + peers = lib.singleton { + allowedIPs = [ + "10.23.42.2/32" + "fc00::2/128" + ]; - dns = [ - "10.23.42.2" - "fc00::2" - "wg0" - ]; - }; - } - ]; - }; + inherit (wg-snakeoil-keys.peer1) publicKey; + }; - peer1 = peer { - ip4 = "192.168.0.2"; - ip6 = "fd00::2"; - extraConfig = lib.mkMerge [ - commonConfig - { - networking.useNetworkd = true; - networking.wg-quick.interfaces.wg0 = { - address = [ - "10.23.42.2/32" - "fc00::2/128" - ]; - inherit (wg-snakeoil-keys.peer1) privateKey; - - peers = lib.singleton { - allowedIPs = [ - "0.0.0.0/0" - "::/0" - ]; - endpoint = "192.168.0.1:23542"; - persistentKeepalive = 25; - - inherit (wg-snakeoil-keys.peer0) publicKey; - }; - - dns = [ - "10.23.42.1" - "fc00::1" - "wg0" - ]; - }; - } - ]; + dns = [ + "10.23.42.2" + "fc00::2" + "wg0" + ]; + }; }; }; - testScript = '' - start_all() + peer1 = peer { + ip4 = "192.168.0.2"; + ip6 = "fd00::2"; + extraConfig = { + imports = [ commonConfig ]; - peer0.wait_for_unit("wg-quick-wg0.service") - peer1.wait_for_unit("wg-quick-wg0.service") + networking.useNetworkd = true; + networking.wg-quick.interfaces.wg0 = { + address = [ + "10.23.42.2/32" + "fc00::2/128" + ]; + inherit (wg-snakeoil-keys.peer1) privateKey; - peer1.succeed("ping -c5 fc00::1") - peer1.succeed("ping -c5 10.23.42.1") - ''; - } -) + peers = lib.singleton { + allowedIPs = [ + "0.0.0.0/0" + "::/0" + ]; + endpoint = "192.168.0.1:23542"; + persistentKeepalive = 25; + + inherit (wg-snakeoil-keys.peer0) publicKey; + }; + + dns = [ + "10.23.42.1" + "fc00::1" + "wg0" + ]; + }; + }; + }; + }; + + testScript = '' + start_all() + + peer0.wait_for_unit("wg-quick-wg0.service") + peer1.wait_for_unit("wg-quick-wg0.service") + + peer1.succeed("ping -c5 fc00::1") + peer1.succeed("ping -c5 10.23.42.1") + ''; +}