nixpkgs/nixos/tests/libreswan-nat.nix

# This test sets up an IPsec VPN server that allows a client behind an IPv4 NAT
# router to access the IPv6 internet. We check that the client initially can't
# ping an IPv6 hosts and its connection to the server can be eavesdropped by
# the router, but once the IPsec tunnel is enstablished it can talk to an
# IPv6-only host and the connection is secure.
#
# Notes:
#   - the VPN is implemented using policy-based routing.
#   - the client is assigned an IPv6 address from the same /64 subnet
#     of the server, without DHCPv6 or SLAAC.
#   - the server acts as NDP proxy for the client, so that the latter
#     becomes reachable at its assigned IPv6 via the server.
#   - the client falls back to TCP if UDP is blocked

{ lib, pkgs, ... }:

let

  # Common network setup
  baseNetwork = {
    # shared hosts file
    networking.extraHosts = lib.mkVMOverride ''
      203.0.113.1 router
      203.0.113.2 server
      2001:db8::2 inner
      192.168.1.1 client
    '';
    # open a port for testing
    networking.firewall.allowedUDPPorts = [ 1234 ];
  };

  # Common IPsec configuration
  baseTunnel = {
    services.libreswan.enable = true;
    environment.etc."ipsec.d/tunnel.secrets" = {
      text = ''@server %any : PSK "j1JbIi9WY07rxwcNQ6nbyThKCf9DGxWOyokXIQcAQUnafsNTUJxfsxwk9WYK8fHj"'';
      mode = "600";
    };
  };

  # Helpers to add a static IP address on an interface
  setAddress4 = iface: addr: {
    networking.interfaces.${iface}.ipv4.addresses = lib.mkVMOverride [
      {
        address = addr;
        prefixLength = 24;
      }
    ];
  };
  setAddress6 = iface: addr: {
    networking.interfaces.${iface}.ipv6.addresses = lib.mkVMOverride [
      {
        address = addr;
        prefixLength = 64;
      }
    ];
  };

in

{
  name = "libreswan-nat";
  meta = with lib.maintainers; {
    maintainers = [ rnhmjoj ];
  };

  nodes.router =
    { pkgs, ... }:
    lib.mkMerge [
      baseNetwork
      (setAddress4 "eth1" "203.0.113.1")
      (setAddress4 "eth2" "192.168.1.1")
      {
        virtualisation.vlans = [
          1
          2
        ];
        environment.systemPackages = [ pkgs.tcpdump ];
        networking.nat = {
          enable = true;
          externalInterface = "eth1";
          internalInterfaces = [ "eth2" ];
        };
        networking.firewall.trustedInterfaces = [ "eth2" ];
      }
    ];

  nodes.inner = lib.mkMerge [
    baseNetwork
    (setAddress6 "eth1" "2001:db8::2")
    { virtualisation.vlans = [ 3 ]; }
  ];

  nodes.server = lib.mkMerge [
    baseNetwork
    baseTunnel
    (setAddress4 "eth1" "203.0.113.2")
    (setAddress6 "eth2" "2001:db8::1")
    {
      virtualisation.vlans = [
        1
        3
      ];
      networking.firewall.allowedUDPPorts = [
        500
        4500
      ];
      networking.firewall.allowedTCPPorts = [ 993 ];

      # see https://github.com/NixOS/nixpkgs/pull/310857
      networking.firewall.checkReversePath = false;

      boot.kernel.sysctl = {
        # enable forwarding packets
        "net.ipv6.conf.all.forwarding" = 1;
        "net.ipv4.conf.all.forwarding" = 1;
        # enable NDP proxy for VPN clients
        "net.ipv6.conf.all.proxy_ndp" = 1;
      };

      services.libreswan.configSetup = "listen-tcp=yes";
      services.libreswan.connections.tunnel = ''
        # server
        left=203.0.113.2
        leftid=@server
        leftsubnet=::/0
        leftupdown=${pkgs.writeScript "updown" ''
          # act as NDP proxy for VPN clients
          if test "$PLUTO_VERB" = up-client-v6; then
            ip neigh add proxy "$PLUTO_PEER_CLIENT_NET" dev eth2
          fi
          if test "$PLUTO_VERB" = down-client-v6; then
            ip neigh del proxy "$PLUTO_PEER_CLIENT_NET" dev eth2
          fi
        ''}

        # clients
        right=%any
        rightaddresspool=2001:db8:0:0:c::/97
        modecfgdns=2001:db8::1

        # clean up vanished clients
        dpddelay=30

        auto=add
        keyexchange=ikev2
        rekey=no
        narrowing=yes
        fragmentation=yes
        authby=secret

        leftikeport=993
        retransmit-timeout=10s
      '';
    }
  ];

  nodes.client = lib.mkMerge [
    baseNetwork
    baseTunnel
    (setAddress4 "eth1" "192.168.1.2")
    {
      virtualisation.vlans = [ 2 ];
      networking.defaultGateway = {
        address = "192.168.1.1";
        interface = "eth1";
      };
      services.libreswan.connections.tunnel = ''
        # client
        left=%defaultroute
        leftid=@client
        leftmodecfgclient=yes
        leftsubnet=::/0

        # server
        right=203.0.113.2
        rightid=@server
        rightsubnet=::/0

        auto=add
        narrowing=yes
        rekey=yes
        fragmentation=yes
        authby=secret

        # fallback when UDP is blocked
        enable-tcp=fallback
        tcp-remoteport=993
        retransmit-timeout=5s
      '';
    }
  ];

  testScript = ''
    def client_to_host(machine, msg: str):
        """
        Sends a message from client to server
        """
        machine.execute("nc -lu :: 1234 >/tmp/msg &")
        client.sleep(1)
        client.succeed(f"echo '{msg}' | nc -uw 0 {machine.name} 1234")
        client.sleep(1)
        machine.succeed(f"grep '{msg}' /tmp/msg")


    def eavesdrop():
        """
        Starts eavesdropping on the router
        """
        match = "udp port 1234"
        router.execute(f"tcpdump -i eth1 -c 1 -Avv {match} >/tmp/log &")


    start_all()

    with subtest("Network is up"):
        client.wait_until_succeeds("ping -c1 server")
        client.succeed("systemctl restart ipsec")
        server.succeed("systemctl restart ipsec")

    with subtest("Router can eavesdrop cleartext traffic"):
        eavesdrop()
        client_to_host(server, "I secretly love turnip")
        router.sleep(1)
        router.succeed("grep turnip /tmp/log")

    with subtest("Libreswan is ready"):
        client.wait_for_unit("ipsec")
        server.wait_for_unit("ipsec")
        client.succeed("ipsec checkconfig")
        server.succeed("ipsec checkconfig")

    with subtest("Client can't ping VPN host"):
        client.fail("ping -c1 inner")

    with subtest("Client can start the tunnel"):
        client.succeed("ipsec start tunnel")
        client.succeed("ip -6 addr show lo | grep -q 2001:db8:0:0:c")

    with subtest("Client can ping VPN host"):
        client.wait_until_succeeds("ping -c1 2001:db8::1")
        client.succeed("ping -c1 inner")

    with subtest("Eve no longer can eavesdrop"):
        eavesdrop()
        client_to_host(inner, "Just kidding, I actually like rhubarb")
        router.sleep(1)
        router.fail("grep rhubarb /tmp/log")

    with subtest("TCP fallback is available"):
        server.succeed("iptables -I nixos-fw -p udp -j DROP")
        client.succeed("ipsec restart")
        client.execute("ipsec start tunnel")
        client.wait_until_succeeds("ping -c1 inner")
  '';
}