movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/{firewall, nat}: add a nftables based implementation

Browse source
This commit is contained in:
Rvfg 2022-12-23 00:23:23 +08:00
parent 2379de680d
commit a43c7b2a70
No known key found for this signature in database
15 changed files with 1158 additions and 723 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nixos/tests/firewall.nix
View file

@ -1,7 +1,7 @@
# Test the firewall module.
import ./make-test-python.nix ( { pkgs, ... } : {
name = "firewall";
import ./make-test-python.nix ( { pkgs, nftables, ... } : {
name = "firewall" + pkgs.lib.optionalString nftables "-nftables";
meta = with pkgs.lib.maintainers; {
maintainers = [ eelco ];
};
@ -11,6 +11,7 @@ import ./make-test-python.nix ( { pkgs, ... } : {
{ ... }:
{ networking.firewall.enable = true;
networking.firewall.logRefusedPackets = true;
networking.nftables.enable = nftables;
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
@ -23,6 +24,7 @@ import ./make-test-python.nix ( { pkgs, ... } : {
{ ... }:
{ networking.firewall.enable = true;
networking.firewall.rejectPackets = true;
networking.nftables.enable = nftables;
};
attacker =
@ -35,10 +37,11 @@ import ./make-test-python.nix ( { pkgs, ... } : {
testScript = { nodes, ... }: let
newSystem = nodes.walled2.config.system.build.toplevel;
unit = if nftables then "nftables" else "firewall";
in ''
start_all()
walled.wait_for_unit("firewall")
walled.wait_for_unit("${unit}")
walled.wait_for_unit("httpd")
attacker.wait_for_unit("network.target")
@ -54,12 +57,12 @@ import ./make-test-python.nix ( { pkgs, ... } : {
walled.succeed("ping -c 1 attacker >&2")
# If we stop the firewall, then connections should succeed.
walled.stop_job("firewall")
walled.stop_job("${unit}")
attacker.succeed("curl -v http://walled/ >&2")
# Check whether activation of a new configuration reloads the firewall.
walled.succeed(
"${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF firewall.service"
"${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
)
'';
})