nixpkgs/nixos/tests/scion/freestanding-deployment/default.nix

# implements https://github.com/scionproto/scion/blob/27983125bccac6b84d1f96f406853aab0e460405/doc/tutorials/deploy.rst
import ../../make-test-python.nix (
  { pkgs, ... }:
  let
    trust-root-configuration-keys = pkgs.runCommand "generate-trc-keys.sh" {
      buildInputs = [
        pkgs.scion
      ];
    } (builtins.readFile ./bootstrap.sh);

    imports = hostId: [
      ({
        services.scion = {
          enable = true;
          bypassBootstrapWarning = true;
        };
        networking = {
          useNetworkd = true;
          useDHCP = false;
        };
        systemd.network.networks."01-eth1" = {
          name = "eth1";
          networkConfig.Address = "192.168.1.${toString hostId}/24";
        };
        environment.etc = {
          "scion/topology.json".source = ./topology${toString hostId}.json;
          "scion/crypto/as".source = trust-root-configuration-keys + "/AS${toString hostId}";
          "scion/certs/ISD42-B1-S1.trc".source = trust-root-configuration-keys + "/ISD42-B1-S1.trc";
          "scion/keys/master0.key".text = "U${toString hostId}v4k23ZXjGDwDofg/Eevw==";
          "scion/keys/master1.key".text = "dBMko${toString hostId}qMS8DfrN/zP2OUdA==";
        };
        environment.systemPackages = [
          pkgs.scion
        ];
      })
    ];
  in
  {
    name = "scion-test";
    nodes = {
      scion01 =
        { ... }:
        {
          imports = (imports 1);
        };
      scion02 =
        { ... }:
        {
          imports = (imports 2);
        };
      scion03 =
        { ... }:
        {
          imports = (imports 3);
        };
      scion04 =
        { ... }:
        {
          imports = (imports 4);
          networking.interfaces."lo".ipv4.addresses = [
            {
              address = "172.16.1.1";
              prefixLength = 32;
            }
          ];
          services.scion.scion-ip-gateway = {
            enable = true;
            config = {
              tunnel = {
                src_ipv4 = "172.16.1.1";
              };
            };
            trafficConfig = {
              ASes = {
                "42-ffaa:1:5" = {
                  Nets = [
                    "172.16.100.0/24"
                  ];
                };
              };
              ConfigVersion = 9001;
            };
          };
        };
      scion05 =
        { ... }:
        {
          imports = (imports 5);
          networking.interfaces."lo".ipv4.addresses = [
            {
              address = "172.16.100.1";
              prefixLength = 32;
            }
          ];
          services.scion.scion-ip-gateway = {
            enable = true;
            config = {
              tunnel = {
                src_ipv4 = "172.16.100.1";
              };
            };
            trafficConfig = {
              ASes = {
                "42-ffaa:1:4" = {
                  Nets = [
                    "172.16.1.0/24"
                  ];
                };
              };
              ConfigVersion = 9001;
            };
          };
        };
    };
    testScript =
      let
        pingAll = pkgs.writeShellScript "ping-all-scion.sh" ''
          addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
          timeout=100
          wait_for_all() {
            ret=0
            for as in "$@"
            do
              scion showpaths $as --no-probe > /dev/null
              ret=$?
              if [ "$ret" -ne "0" ]; then
                break
              fi
            done
            return $ret
          }
          ping_all() {
            ret=0
            for as in "$@"
            do
              scion ping "$as,127.0.0.1" -c 3
              ret=$?
              if [ "$ret" -ne "0" ]; then
                break
              fi
            done
            return $ret
          }
          for i in $(seq 0 $timeout); do
            sleep 1
            wait_for_all $addresses || continue
            ping_all $addresses && exit 0
          done
          exit 1
        '';
      in
      ''
        # List of AS instances
        machines = [scion01, scion02, scion03, scion04, scion05]

        # Functions to avoid many for loops
        def start(allow_reboot=False):
            for i in machines:
                i.start(allow_reboot=allow_reboot)

        def wait_for_unit(service_name):
            for i in machines:
                i.wait_for_unit(service_name)

        def succeed(command):
            for i in machines:
                i.succeed(command)

        def reboot():
            for i in machines:
                i.reboot()

        def crash():
            for i in machines:
                i.crash()

        # Start all machines, allowing reboot for later
        start(allow_reboot=True)

        # Wait for scion-control.service on all instances
        wait_for_unit("scion-control.service")

        # Ensure cert is valid against TRC
        succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")

        # Execute pingAll command on all instances
        succeed("${pingAll} >&2")

        # Execute ICMP pings across scion-ip-gateway
        scion04.succeed("ping -c 3 172.16.100.1 >&2")
        scion05.succeed("ping -c 3 172.16.1.1 >&2")

        # Restart all scion services and ping again to test robustness
        succeed("systemctl restart scion-* >&2")
        succeed("${pingAll} >&2")

        # Reboot machines, wait for service, and ping again
        reboot()
        wait_for_unit("scion-control.service")
        succeed("${pingAll} >&2")

        # Crash, start, wait for service, and ping again
        crash()
        start()
        wait_for_unit("scion-control.service")
        succeed("pkill -9 scion-* >&2")
        wait_for_unit("scion-control.service")
        succeed("${pingAll} >&2")
      '';
  }
)