nixos/testing: Add ipv6 configuration

This contribution enables a working IPv6 setup by default. This works
analog to the current automatic IPv4 setup.

13 files changed, 84 insertions, 43 deletions

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 7e1127ba6cb1..d83b5661cafe 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -224,6 +224,8 @@
 
 - [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
 
+- `nixosTests` now provide a working IPv6 setup for VLAN 1 by default.
+
 - To facilitate dependency injection, the `imgui` package now builds a static archive using vcpkg' CMake rules.
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 0f1615a0ad3b..8e6d383e6257 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -32,10 +32,19 @@ let
       # Automatically assign IP addresses to requested interfaces.
       assignIPs = lib.filter (i: i.assignIP) interfaces;
       ipInterfaces = forEach assignIPs (i:
-        nameValuePair i.name { ipv4.addresses =
-          [ { address = "192.168.${toString i.vlan}.${toString config.virtualisation.test.nodeNumber}";
+        nameValuePair i.name {
+          ipv4.addresses = [
+            {
+              address = "192.168.${toString i.vlan}.${toString config.virtualisation.test.nodeNumber}";
               prefixLength = 24;
-            }];
+            }
+          ];
+          ipv6.addresses = [
+            {
+              address = "2001:db8:${toString i.vlan}::${toString config.virtualisation.test.nodeNumber}";
+              prefixLength = 64;
+            }
+          ];
         });
 
       qemuOptions = lib.flatten (forEach interfacesNumbered ({ fst, snd }:
@@ -53,6 +62,9 @@ let
           networking.primaryIPAddress =
             optionalString (ipInterfaces != [ ]) (head (head ipInterfaces).value.ipv4.addresses).address;
 
+          networking.primaryIPv6Address =
+            optionalString (ipInterfaces != [ ]) (head (head ipInterfaces).value.ipv6.addresses).address;
+
           # Put the IP addresses of all VMs in this machine's
           # /etc/hosts file.  If a machine has multiple
           # interfaces, use the IP address corresponding to
@@ -60,12 +72,16 @@ let
           # virtualisation.vlans option).
           networking.extraHosts = flip concatMapStrings (attrNames nodes)
             (m':
-              let config = nodes.${m'}; in
+              let
+                config = nodes.${m'};
+                hostnames =
+                  optionalString (config.networking.domain != null) "${config.networking.hostName}.${config.networking.domain} " +
+                  "${config.networking.hostName}\n";
+              in
               optionalString (config.networking.primaryIPAddress != "")
-                ("${config.networking.primaryIPAddress} " +
-                  optionalString (config.networking.domain != null)
-                    "${config.networking.hostName}.${config.networking.domain} " +
-                  "${config.networking.hostName}\n"));
+                "${config.networking.primaryIPAddress} ${hostnames}" +
+              optionalString (config.networking.primaryIPv6Address != "")
+                ("${config.networking.primaryIPv6Address} ${hostnames}"));
 
           virtualisation.qemu.options = qemuOptions;
           boot.initrd.services.udev.rules = concatMapStrings (x: x + "\n") udevRules;
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index d1dc6404d4f5..428cca4adcf8 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -665,6 +665,14 @@ in
         description = "Primary IP address used in /etc/hosts.";
       };
 
+    networking.primaryIPv6Address =
+      mkOption {
+        type = types.str;
+        default = "";
+        internal = true;
+        description = "Primary IPv6 address used in /etc/hosts.";
+      };
+
     virtualisation.host.pkgs = mkOption {
       type = options.nixpkgs.pkgs.type;
       default = pkgs;
diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix
index 34e8bda60eef..ad418bb3341f 100644
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -36,7 +36,7 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
     };
 
   testScript = { nodes, ... }: let
-    newSystem = nodes.walled2.config.system.build.toplevel;
+    newSystem = nodes.walled2.system.build.toplevel;
     unit = if nftables then "nftables" else "firewall";
   in ''
     start_all()
diff --git a/nixos/tests/ipv6.nix b/nixos/tests/ipv6.nix
index 7f91457fa5ea..8fa7eec8ffb2 100644
--- a/nixos/tests/ipv6.nix
+++ b/nixos/tests/ipv6.nix
@@ -39,6 +39,8 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
         { services.httpd.enable = true;
           services.httpd.adminAddr = "foo@example.org";
           networking.firewall.allowedTCPPorts = [ 80 ];
+          # disable testing driver's default IPv6 address.
+          networking.interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
         };
 
       router =
diff --git a/nixos/tests/iscsi-root.nix b/nixos/tests/iscsi-root.nix
index 0d7c48464eec..6953b6ce9a06 100644
--- a/nixos/tests/iscsi-root.nix
+++ b/nixos/tests/iscsi-root.nix
@@ -59,7 +59,7 @@ import ./make-test-python.nix (
                         ];
                         portals = [
                           {
-                            ip_address = "0.0.0.0";
+                            ip_address = "[::]";
                             iser = false;
                             offload = false;
                             port = 3260;
@@ -93,7 +93,7 @@ import ./make-test-python.nix (
               xfsprogs
             ];
 
-            system.extraDependencies = [ nodes.initiatorRootDisk.config.system.build.toplevel ];
+            system.extraDependencies = [ nodes.initiatorRootDisk.system.build.toplevel ];
 
             nix.settings = {
               substituters = lib.mkForce [];
@@ -108,7 +108,7 @@ import ./make-test-python.nix (
               [
                 "boot.shell_on_fail"
                 "console=tty1"
-                "ip=${config.networking.primaryIPAddress}:::255.255.255.0::ens9:none"
+                "ip=${config.networking.primaryIPAddress}:::255.255.255.0::eth1:none"
               ]
             );
 
diff --git a/nixos/tests/jool.nix b/nixos/tests/jool.nix
index 93575f07b1c8..37a4ad6ce011 100644
--- a/nixos/tests/jool.nix
+++ b/nixos/tests/jool.nix
@@ -165,9 +165,12 @@ in
       virtualisation.vlans = [ 1 ];
 
       networking.interfaces.eth1.ipv6 = {
-        addresses = [ { address = "2001:db8::8"; prefixLength = 96; } ];
-        routes    = [ { address = "64:ff9b::";   prefixLength = 96;
-                        via = "2001:db8::1"; } ];
+        addresses = lib.mkForce [ { address = "2001:db8::8"; prefixLength = 96; } ];
+        routes = lib.mkForce [ {
+          address = "64:ff9b::";
+          prefixLength = 96;
+          via = "2001:db8::1";
+        } ];
       };
     };
 
@@ -177,9 +180,12 @@ in
 
       virtualisation.vlans = [ 1 ];
       networking.interfaces.eth1.ipv6 = {
-        addresses = [ { address = "2001:db8::9"; prefixLength = 96; } ];
-        routes    = [ { address = "64:ff9b::";   prefixLength = 96;
-                        via = "2001:db8::1"; } ];
+        addresses = lib.mkForce [ { address = "2001:db8::9"; prefixLength = 96; } ];
+        routes    = lib.mkForce [ {
+          address = "64:ff9b::";
+          prefixLength = 96;
+          via = "2001:db8::1";
+        } ];
       };
     };
 
diff --git a/nixos/tests/mediatomb.nix b/nixos/tests/mediatomb.nix
index 9c84aa3e92a5..5718a9a4a299 100644
--- a/nixos/tests/mediatomb.nix
+++ b/nixos/tests/mediatomb.nix
@@ -30,15 +30,22 @@ import ./make-test-python.nix {
     client = {};
   };
 
-  testScript = ''
-    start_all()
+  testScript = { nodes, ... }:
+    let
+      serverIP = nodes.server.networking.primaryIPAddress;
+      serverIPv6 = nodes.server.networking.primaryIPv6Address;
+    in
+    ''
+      start_all()
 
-    server.wait_for_unit("mediatomb")
-    server.wait_until_succeeds("nc -z 192.168.1.2 49152")
-    server.succeed("curl -v --fail http://server:49152/")
+      server.wait_for_unit("mediatomb")
+      server.wait_until_succeeds("nc -z ${serverIP} 49152")
+      server.succeed("curl -v --fail http://${serverIP}:49152/")
+      server.succeed("curl -v --fail http://[${serverIPv6}]:49152/")
 
-    client.wait_for_unit("multi-user.target")
-    page = client.succeed("curl -v --fail http://server:49152/")
-    assert "Gerbera" in page and "MediaTomb" not in page
-  '';
+      client.wait_for_unit("multi-user.target")
+      page = client.succeed("curl -v --fail http://${serverIP}:49152/")
+      page = client.succeed("curl -v --fail http://[${serverIPv6}]:49152/")
+      assert "Gerbera" in page and "MediaTomb" not in page
+    '';
 }
diff --git a/nixos/tests/nat.nix b/nixos/tests/nat.nix
index 8b682a8b3aa7..550c5a2d14f3 100644
--- a/nixos/tests/nat.nix
+++ b/nixos/tests/nat.nix
@@ -31,7 +31,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ...
           lib.mkMerge [
             { virtualisation.vlans = [ 1 ];
               networking.defaultGateway =
-                (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ipv4.addresses).address;
+                (pkgs.lib.head nodes.router.networking.interfaces.eth2.ipv4.addresses).address;
               networking.nftables.enable = nftables;
             }
           ];
@@ -61,8 +61,8 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ...
 
     testScript =
       { nodes, ... }: let
-        routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
-        routerClosure = nodes.router.config.system.build.toplevel;
+        routerDummyNoNatClosure = nodes.routerDummyNoNat.system.build.toplevel;
+        routerClosure = nodes.router.system.build.toplevel;
       in ''
         client.start()
         router.start()
@@ -72,13 +72,13 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ...
         server.wait_for_unit("network.target")
         server.wait_for_unit("httpd")
         router.wait_for_unit("network.target")
-        router.succeed("curl --fail http://server/ >&2")
+        router.succeed("curl -4 --fail http://server/ >&2")
 
         # The client should be also able to connect via the NAT router.
         router.wait_for_unit("${unit}")
         client.wait_for_unit("network.target")
         client.succeed("curl --fail http://server/ >&2")
-        client.succeed("ping -c 1 server >&2")
+        client.succeed("ping -4 -c 1 server >&2")
 
         # Test whether passive FTP works.
         server.wait_for_unit("vsftpd")
@@ -89,15 +89,15 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ...
         client.fail("curl -v -P - ftp://server/foo.txt >&2")
 
         # Test ICMP.
-        client.succeed("ping -c 1 router >&2")
-        router.succeed("ping -c 1 client >&2")
+        client.succeed("ping -4 -c 1 router >&2")
+        router.succeed("ping -4 -c 1 client >&2")
 
         # If we turn off NAT, the client shouldn't be able to reach the server.
         router.succeed(
             "${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1"
         )
-        client.fail("curl --fail --connect-timeout 5 http://server/ >&2")
-        client.fail("ping -c 1 server >&2")
+        client.fail("curl -4 --fail --connect-timeout 5 http://server/ >&2")
+        client.fail("ping -4 -c 1 server >&2")
 
         # And make sure that reloading the NAT job works.
         router.succeed(
@@ -109,7 +109,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, nftables ? false, ...
         ${lib.optionalString (!withFirewall && !nftables) ''
           router.succeed("systemctl start nat.service")
         ''}
-        client.succeed("curl --fail http://server/ >&2")
-        client.succeed("ping -c 1 server >&2")
+        client.succeed("curl -4 --fail http://server/ >&2")
+        client.succeed("ping -4 -c 1 server >&2")
       '';
-  })
+})
diff --git a/nixos/tests/nvmetcfg.nix b/nixos/tests/nvmetcfg.nix
index a4c459a343cf..169e5e9d7b0c 100644
--- a/nixos/tests/nvmetcfg.nix
+++ b/nixos/tests/nvmetcfg.nix
@@ -27,7 +27,7 @@ import ./make-test-python.nix ({ lib, ... }: {
 
     with subtest("Bind subsystem to port"):
       server.wait_for_unit("network-online.target")
-      server.succeed("nvmet port add 1 tcp 0.0.0.0:4420")
+      server.succeed("nvmet port add 1 tcp [::]:4420")
       server.succeed("nvmet port add-subsystem 1 ${subsystem}")
 
     with subtest("Discover and connect to available subsystems"):
diff --git a/nixos/tests/step-ca.nix b/nixos/tests/step-ca.nix
index 184c35f6b85c..68364e278d56 100644
--- a/nixos/tests/step-ca.nix
+++ b/nixos/tests/step-ca.nix
@@ -16,7 +16,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
           { config, pkgs, ... }: {
             services.step-ca = {
               enable = true;
-              address = "0.0.0.0";
+              address = "[::]";
               port = 8443;
               openFirewall = true;
               intermediatePasswordFile = "${test-certificates}/intermediate-password-file";
diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix
index a011afee6017..914bae50df64 100644
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -133,7 +133,7 @@ let
             enable = true;
             dbBackend = backend;
             config = {
-              rocketAddress = "0.0.0.0";
+              rocketAddress = "::";
               rocketPort = 8080;
             };
           };
diff --git a/nixos/tests/vector/dnstap.nix b/nixos/tests/vector/dnstap.nix
index 15d643311b60..5143fd938fde 100644
--- a/nixos/tests/vector/dnstap.nix
+++ b/nixos/tests/vector/dnstap.nix
@@ -49,7 +49,7 @@ in
         settings = {
           server = {
             interface = [ "0.0.0.0" "::" ];
-            access-control = [ "192.168.1.0/24 allow" ];
+            access-control = [ "192.168.0.0/24 allow" "::/0 allow" ];
 
             domain-insecure = "local";
             private-domain = "local";