41bd6d2614
When testing WireGuard updates, I usually run the VM-tests with different kernels to make sure we're not introducing accidental regressions for e.g. older kernels. I figured that we should automate this process to ensure continuously that WireGuard works fine on several kernels. For now I decided to test the latest LTS version (5.4) and the latest kernel (currently 5.6). We can add more kernels in the future, however this seems to significantly slow down evaluation and time. The list can be customized by running a command like this: nix-build nixos/tests/wireguard --arg kernelVersionsToTest '["4.19"]' The `kernelPackages` argument in the tests is null by default to make sure that it's still possible to invoke the test-files directly. In that case the default kernel of NixOS (currently 5.4) is used.
84 lines
2.5 KiB
Nix
84 lines
2.5 KiB
Nix
{ kernelPackages ? null }:
|
|
|
|
let
|
|
listenPort = 12345;
|
|
socketNamespace = "foo";
|
|
interfaceNamespace = "bar";
|
|
node = {
|
|
networking.wireguard.interfaces.wg0 = {
|
|
listenPort = listenPort;
|
|
ips = [ "10.10.10.1/24" ];
|
|
privateKeyFile = "/etc/wireguard/private";
|
|
generatePrivateKeyFile = true;
|
|
};
|
|
};
|
|
|
|
in
|
|
|
|
import ../make-test-python.nix ({ pkgs, lib, ... } : {
|
|
name = "wireguard-with-namespaces";
|
|
meta = with pkgs.stdenv.lib.maintainers; {
|
|
maintainers = [ asymmetric ];
|
|
};
|
|
|
|
nodes = {
|
|
# interface should be created in the socketNamespace
|
|
# and not moved from there
|
|
peer0 = pkgs.lib.attrsets.recursiveUpdate node {
|
|
boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
|
|
networking.wireguard.interfaces.wg0 = {
|
|
preSetup = ''
|
|
ip netns add ${socketNamespace}
|
|
'';
|
|
inherit socketNamespace;
|
|
};
|
|
};
|
|
# interface should be created in the init namespace
|
|
# and moved to the interfaceNamespace
|
|
peer1 = pkgs.lib.attrsets.recursiveUpdate node {
|
|
boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
|
|
networking.wireguard.interfaces.wg0 = {
|
|
preSetup = ''
|
|
ip netns add ${interfaceNamespace}
|
|
'';
|
|
inherit interfaceNamespace;
|
|
};
|
|
};
|
|
# interface should be created in the socketNamespace
|
|
# and moved to the interfaceNamespace
|
|
peer2 = pkgs.lib.attrsets.recursiveUpdate node {
|
|
boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
|
|
networking.wireguard.interfaces.wg0 = {
|
|
preSetup = ''
|
|
ip netns add ${socketNamespace}
|
|
ip netns add ${interfaceNamespace}
|
|
'';
|
|
inherit socketNamespace interfaceNamespace;
|
|
};
|
|
};
|
|
# interface should be created in the socketNamespace
|
|
# and moved to the init namespace
|
|
peer3 = pkgs.lib.attrsets.recursiveUpdate node {
|
|
boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
|
|
networking.wireguard.interfaces.wg0 = {
|
|
preSetup = ''
|
|
ip netns add ${socketNamespace}
|
|
'';
|
|
inherit socketNamespace;
|
|
interfaceNamespace = "init";
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
|
|
for machine in peer0, peer1, peer2, peer3:
|
|
machine.wait_for_unit("wireguard-wg0.service")
|
|
|
|
peer0.succeed("ip -n ${socketNamespace} link show wg0")
|
|
peer1.succeed("ip -n ${interfaceNamespace} link show wg0")
|
|
peer2.succeed("ip -n ${interfaceNamespace} link show wg0")
|
|
peer3.succeed("ip link show wg0")
|
|
'';
|
|
})
|