Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187# This is a distributed test of the Squid as a forward proxy# - "external" -- i.e. the internet, where the proxy and server communicate# - "internal" -- i.e. an office LAN, where the client and proxy communicat
{ pkgs, lib, ...}:# VLANS:# 1 -- simulates the internal network# 2 -- simulates the external networklet commonConfig = { # Disable eth0 autoconfiguration networking.useDHCP = false;
environment.systemPackages = [ (pkgs.writeScriptBin "check-connection" '' #!/usr/bin/env bash
set -e
if [[ "$2" == "" || "$1" == "--help" || "$1" == "-h" ]]; then echo "check-connection <target-address> <[expect-success|expect-failure]>" exit 1 fi
ADDRESS="$1"
function test_icmp() { timeout 3 ping -c 1 "$ADDRESS"; }
if [[ "$2" == "expect-success" ]]; then test_icmp else ! test_icmp fi '') ]; };in{ name = "squid"; meta.maintainers = with lib.maintainers; [ cobalt ];
node.pkgsReadOnly = false;
nodes = { client = { ... }: lib.mkMerge [ commonConfig { virtualisation.vlans = [ 1 ]; networking.firewall.enable = true;
# NOTE: the client doesn't need a HTTP server, this is here to allow a validation of the proxy acl networking.firewall.allowedTCPPorts = [ 80 ];
services.nginx = { enable = true;
virtualHosts."server" = { root = "/etc"; locations."/".index = "hostname"; listen = [ { addr = "0.0.0.0"; port = 80; } ]; }; }; } ];
proxy = { config, nodes, ... }: let clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address; serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address; in lib.mkMerge [ commonConfig { nixpkgs.config.permittedInsecurePackages = [ "squid-7.0.1" ];
virtualisation.vlans = [ 1 2 ]; networking.firewall.enable = true; networking.firewall.allowedTCPPorts = [ config.services.squid.proxyPort ];
services.squid = { enable = true;
extraConfig = '' acl client src ${clientIp} acl server dst ${serverIp} http_access allow client server http_access deny all ''; }; } ];
server = { ... }: lib.mkMerge [ commonConfig { virtualisation.vlans = [ 2 ]; networking.firewall.enable = true; networking.firewall.allowedTCPPorts = [ 80 ];
services.nginx = { enable = true;
virtualHosts."server" = { root = "/etc"; locations."/".index = "hostname"; listen = [ { addr = "0.0.0.0"; port = 80; } ]; }; }; } ]; };
testScript = { nodes, ... }: let clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address; serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address; proxyExternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth2.ipv4.addresses).address; proxyInternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth1.ipv4.addresses).address; in '' client.start() proxy.start() server.start()
proxy.wait_for_unit("network.target") proxy.wait_for_unit("squid.service") client.wait_for_unit("network.target") server.wait_for_unit("network.target") server.wait_for_unit("nginx.service")
# Topology checks. with subtest("proxy connectivity"): ## The proxy should have direct access to the server and client proxy.succeed("check-connection ${serverIp} expect-success") proxy.succeed("check-connection ${clientIp} expect-success")
with subtest("server connectivity"): ## The server should have direct access to the proxy server.succeed("check-connection ${proxyExternalIp} expect-success") ## ... and not have access to the client server.succeed("check-connection ${clientIp} expect-failure")
with subtest("client connectivity"): # The client should be also able to connect to the proxy client.succeed("check-connection ${proxyInternalIp} expect-success") # but not the client to the server client.succeed("check-connection ${serverIp} expect-failure")
with subtest("HTTP"): # the client cannot reach the server directly over HTTP client.fail('[[ `timeout 3 curl --fail-with-body http://${serverIp}` ]]') # ... but can with the proxy client.succeed('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyInternalIp}:3128 http://${serverIp}` == "server" ]]') # and cannot from the server (with a 4xx error code) and ... server.fail('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]') # .. not the client hostname server.fail('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]') # with an explicit deny message (no --fail because we want to parse the returned message) server.succeed('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == *"ERR_ACCESS_DENIED"* ]]') '';}