diff options
author | Jörg Thalheim <joerg@higgsboson.tk> | 2016-08-29 15:18:25 +0200 |
---|---|---|
committer | Jörg Thalheim <joerg@higgsboson.tk> | 2016-08-29 15:34:30 +0200 |
commit | 2ed6529444c6048f5a6d70399046842e0112d75b (patch) | |
tree | b30cd9caa20c830c0ea167482945e069d0377e06 /nixos/tests/ferm.nix | |
parent | 3a98be5e1981b193092ee900bd3a3bc7ae32d126 (diff) |
ferm: add integration test
Diffstat (limited to 'nixos/tests/ferm.nix')
-rw-r--r-- | nixos/tests/ferm.nix | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/nixos/tests/ferm.nix b/nixos/tests/ferm.nix new file mode 100644 index 000000000000..c0271269ca05 --- /dev/null +++ b/nixos/tests/ferm.nix @@ -0,0 +1,71 @@ + +import ./make-test.nix ({ pkgs, ...} : { + name = "ferm"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ mic92 ]; + }; + + nodes = + { client = + { config, pkgs, ... }: + with pkgs.lib; + { + networking = { + interfaces.eth1.ip6 = mkOverride 0 [ { address = "fd00::2"; prefixLength = 64; } ]; + interfaces.eth1.ip4 = mkOverride 0 [ { address = "192.168.1.2"; prefixLength = 24; } ]; + }; + }; + server = + { config, pkgs, ... }: + with pkgs.lib; + { + networking = { + interfaces.eth1.ip6 = mkOverride 0 [ { address = "fd00::1"; prefixLength = 64; } ]; + interfaces.eth1.ip4 = mkOverride 0 [ { address = "192.168.1.1"; prefixLength = 24; } ]; + }; + + services = { + ferm.enable = true; + ferm.config = '' + domain (ip ip6) table filter chain INPUT { + interface lo ACCEPT; + proto tcp dport 8080 REJECT reject-with tcp-reset; + } + ''; + nginx.enable = true; + nginx.httpConfig = '' + server { + listen 80; + listen [::]:80; + listen 8080; + listen [::]:8080; + + location /status { stub_status on; } + } + ''; + }; + }; + }; + + testScript = + '' + startAll; + + $client->waitForUnit("network.target"); + $server->waitForUnit("ferm.service"); + $server->waitForUnit("nginx.service"); + + subtest "port 80 is allowed", sub { + $client->succeed("curl --fail -g http://192.168.1.1:80/status"); + $client->succeed("curl --fail -g http://[fd00::1]:80/status"); + }; + + subtest "port 8080 is not allowed", sub { + $server->succeed("curl --fail -g http://192.168.1.1:8080/status"); + $server->succeed("curl --fail -g http://[fd00::1]:8080/status"); + + $client->fail("curl --fail -g http://192.168.1.1:8080/status"); + $client->fail("curl --fail -g http://[fd00::1]:8080/status"); + }; + ''; +}) |