From ee4e004cc49a665f1afa7a64f91f94b824d09b4c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Fri, 11 Mar 2011 13:38:52 +0000
Subject: [PATCH] * Add a test for the firewall.

svn path=/nixos/trunk/; revision=26276
---
 modules/testing/test-instrumentation.nix |  5 ++-
 tests/default.nix                        |  1 +
 tests/firewall.nix                       | 47 ++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 tests/firewall.nix

diff --git a/modules/testing/test-instrumentation.nix b/modules/testing/test-instrumentation.nix
index 5fff8fc84e84..78ce250675d1 100644
--- a/modules/testing/test-instrumentation.nix
+++ b/modules/testing/test-instrumentation.nix
@@ -24,7 +24,10 @@ in
   config = {
 
     jobs.backdoor =
-      { startOn = "ip-up";
+      { # If the firewall is enabled, this job must start *after* the
+        # firewall, otherwise connection tracking won't know about
+        # this connection.
+        startOn = if config.networking.firewall.enable then "started firewall" else "ip-up";
         stopOn = "never";
         
         script =
diff --git a/tests/default.nix b/tests/default.nix
index 081a47730848..d156db58c5c9 100644
--- a/tests/default.nix
+++ b/tests/default.nix
@@ -9,6 +9,7 @@ with import ../lib/testing.nix { inherit nixpkgs services system; };
   avahi = makeTest (import ./avahi.nix);
   bittorrent = makeTest (import ./bittorrent.nix);
   firefox = makeTest (import ./firefox.nix);
+  firewall = makeTest (import ./firewall.nix);
   installer = makeTests (import ./installer.nix);
   ipv6 = makeTest (import ./ipv6.nix);
   kde4 = makeTest (import ./kde4.nix);
diff --git a/tests/firewall.nix b/tests/firewall.nix
new file mode 100644
index 000000000000..82071e2d0407
--- /dev/null
+++ b/tests/firewall.nix
@@ -0,0 +1,47 @@
+# Test the firewall module.
+
+{ pkgs, ... }:
+
+{
+
+  nodes =
+    { walled = 
+        { config, pkgs, nodes, ... }:
+        { networking.firewall.enable = true;
+          networking.firewall.logRefusedPackets = true;
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+        };
+
+      attacker = 
+        { config, pkgs, ... }:
+        { services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+        };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      startAll;
+
+      $walled->waitForJob("firewall");
+      $walled->waitForJob("httpd");
+
+      # Local connections should still work.
+      $walled->succeed("curl -v http://localhost/ >&2");
+
+      # Connections to the firewalled machine should fail.
+      $attacker->fail("curl -v http://walled/ >&2");
+      $attacker->fail("ping -c 1 walled >&2");
+
+      # Outgoing connections/pings should still work.
+      $walled->succeed("curl -v http://attacker/ >&2");
+      $walled->succeed("ping -c 1 attacker >&2");
+
+      # If we stop the firewall, then connections should succeed.
+      $walled->succeed("stop firewall");
+      $attacker->succeed("curl -v http://walled/ >&2");
+    '';
+
+}