blob: 188c3840178cbe23faf4235bcc42a3e766ced2d4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
# This is a distributed test of the Squid as a forward proxy
# - "external" -- i.e. the internet, where the proxy and server communicate
# - "internal" -- i.e. an office LAN, where the client and proxy communicat
{
pkgs,
lib,
...
}:
# VLANS:
# 1 -- simulates the internal network
# 2 -- simulates the external network
let
commonConfig = {
# Disable eth0 autoconfiguration
networking.useDHCP = false;
environment.systemPackages = [
(pkgs.writeScriptBin "check-connection" ''
#!/usr/bin/env bash
set -e
if [[ "$2" == "" || "$1" == "--help" || "$1" == "-h" ]];
then
echo "check-connection <target-address> <[expect-success|expect-failure]>"
exit 1
fi
ADDRESS="$1"
function test_icmp() { timeout 3 ping -c 1 "$ADDRESS"; }
if [[ "$2" == "expect-success" ]];
then
test_icmp
else
! test_icmp
fi
'')
];
};
in
{
name = "squid";
node.pkgsReadOnly = false;
nodes = {
client =
{ ... }:
lib.mkMerge [
commonConfig
{
virtualisation.vlans = [ 1 ];
networking.firewall.enable = true;
# NOTE: the client doesn't need a HTTP server, this is here to allow a validation of the proxy acl
networking.firewall.allowedTCPPorts = [ 80 ];
services.nginx = {
enable = true;
virtualHosts."server" = {
root = "/etc";
locations."/".index = "hostname";
listen = [
{
addr = "0.0.0.0";
port = 80;
}
];
};
};
}
];
proxy =
{ config, nodes, ... }:
let
clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
in
lib.mkMerge [
commonConfig
{
nixpkgs.config.permittedInsecurePackages = [ "squid-7.0.1" ];
virtualisation.vlans = [
1
2
];
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ config.services.squid.proxyPort ];
services.squid = {
enable = true;
extraConfig = ''
acl client src ${clientIp}
acl server dst ${serverIp}
http_access allow client server
http_access deny all
'';
};
}
];
server =
{ ... }:
lib.mkMerge [
commonConfig
{
virtualisation.vlans = [ 2 ];
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 80 ];
services.nginx = {
enable = true;
virtualHosts."server" = {
root = "/etc";
locations."/".index = "hostname";
listen = [
{
addr = "0.0.0.0";
port = 80;
}
];
};
};
}
];
};
testScript =
{ nodes, ... }:
let
clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
proxyExternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth2.ipv4.addresses).address;
proxyInternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth1.ipv4.addresses).address;
in
''
client.start()
proxy.start()
server.start()
proxy.wait_for_unit("network.target")
proxy.wait_for_unit("squid.service")
client.wait_for_unit("network.target")
server.wait_for_unit("network.target")
server.wait_for_unit("nginx.service")
# Topology checks.
with subtest("proxy connectivity"):
## The proxy should have direct access to the server and client
proxy.succeed("check-connection ${serverIp} expect-success")
proxy.succeed("check-connection ${clientIp} expect-success")
with subtest("server connectivity"):
## The server should have direct access to the proxy
server.succeed("check-connection ${proxyExternalIp} expect-success")
## ... and not have access to the client
server.succeed("check-connection ${clientIp} expect-failure")
with subtest("client connectivity"):
# The client should be also able to connect to the proxy
client.succeed("check-connection ${proxyInternalIp} expect-success")
# but not the client to the server
client.succeed("check-connection ${serverIp} expect-failure")
with subtest("HTTP"):
# the client cannot reach the server directly over HTTP
client.fail('[[ `timeout 3 curl --fail-with-body http://${serverIp}` ]]')
# ... but can with the proxy
client.succeed('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyInternalIp}:3128 http://${serverIp}` == "server" ]]')
# and cannot from the server (with a 4xx error code) and ...
server.fail('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
# .. not the client hostname
server.fail('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
# with an explicit deny message (no --fail because we want to parse the returned message)
server.succeed('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == *"ERR_ACCESS_DENIED"* ]]')
'';
}
|
