nixpkgs/nixos/tests/tayga.nix

# This test verifies that we can ping an IPv4-only server from an IPv6-only
# client via a NAT64 router. The hosts and networks are configured as follows:
#
#        +------
# Client | eth1    Address: 2001:db8::2/64
#        |  |      Route:   64:ff9b::/96 via 2001:db8::1
#        +--|---
#           | VLAN 3
#        +--|---
#        | eth2    Address: 2001:db8::1/64
# Router |
#        | nat64   Address: 64:ff9b::1/128
#        |         Route:   64:ff9b::/96
#        |         Address: 192.0.2.0/32
#        |         Route:   192.0.2.0/24
#        |
#        | eth1    Address: 100.64.0.1/24
#        +--|---
#           | VLAN 2
#        +--|---
# Server | eth1    Address: 100.64.0.2/24
#        |         Route:   192.0.2.0/24 via 100.64.0.1
#        +------

import ./make-test-python.nix (
  { pkgs, lib, ... }:

  {
    name = "tayga";
    meta = with pkgs.lib.maintainers; {
      maintainers = [ hax404 ];
    };

    nodes = {
      # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
      # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
      # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
      # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
      # RFC 6589 (Carrier Grade NAT) is used here.
      # To reach the IPv4 address pool of the NAT64 gateway, there is a static
      # route configured. In normal cases, where the router would also source NAT
      # the pool addresses to one IPv4 addresses, this would not be needed.
      server = {
        virtualisation.vlans = [
          2 # towards router
        ];
        networking = {
          useDHCP = false;
          interfaces.eth1 = lib.mkForce { };
        };
        systemd.network = {
          enable = true;
          networks."vlan1" = {
            matchConfig.Name = "eth1";
            address = [
              "100.64.0.2/24"
            ];
            routes = [
              {
                Destination = "192.0.2.0/24";
                Gateway = "100.64.0.1";
              }
            ];
          };
        };
        programs.mtr.enable = true;
      };

      # The router is configured with static IPv4 addresses towards the server
      # and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
      # 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
      # tun-interface nat64 and does the translation over it. The IPv6 packets
      # are sent to this interfaces and received as IPv4 packets and vice versa.
      # As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
      # needs a pool of IPv4 addresses which must be at least as big as the
      # expected amount of clients. In this test, the packets from the pool are
      # directly routed towards the client. In normal cases, there would be a
      # second source NAT44 to map all clients behind one IPv4 address.
      router_systemd = {
        boot.kernel.sysctl = {
          "net.ipv4.ip_forward" = 1;
          "net.ipv6.conf.all.forwarding" = 1;
        };

        virtualisation.vlans = [
          2 # towards server
          3 # towards client
        ];

        networking = {
          useDHCP = false;
          useNetworkd = true;
          firewall.enable = false;
          interfaces.eth1 = lib.mkForce {
            ipv4 = {
              addresses = [
                {
                  address = "100.64.0.1";
                  prefixLength = 24;
                }
              ];
            };
          };
          interfaces.eth2 = lib.mkForce {
            ipv6 = {
              addresses = [
                {
                  address = "2001:db8::1";
                  prefixLength = 64;
                }
              ];
            };
          };
        };

        services.tayga = {
          enable = true;
          ipv4 = {
            address = "192.0.2.0";
            router = {
              address = "192.0.2.1";
            };
            pool = {
              address = "192.0.2.0";
              prefixLength = 24;
            };
          };
          ipv6 = {
            address = "2001:db8::1";
            router = {
              address = "64:ff9b::1";
            };
            pool = {
              address = "64:ff9b::";
              prefixLength = 96;
            };
          };
          mappings = {
            "192.0.2.42" = "2001:db8::2";
          };
        };
      };

      router_nixos = {
        boot.kernel.sysctl = {
          "net.ipv4.ip_forward" = 1;
          "net.ipv6.conf.all.forwarding" = 1;
        };

        virtualisation.vlans = [
          2 # towards server
          3 # towards client
        ];

        networking = {
          useDHCP = false;
          firewall.enable = false;
          interfaces.eth1 = lib.mkForce {
            ipv4 = {
              addresses = [
                {
                  address = "100.64.0.1";
                  prefixLength = 24;
                }
              ];
            };
          };
          interfaces.eth2 = lib.mkForce {
            ipv6 = {
              addresses = [
                {
                  address = "2001:db8::1";
                  prefixLength = 64;
                }
              ];
            };
          };
        };

        services.tayga = {
          enable = true;
          ipv4 = {
            address = "192.0.2.0";
            router = {
              address = "192.0.2.1";
            };
            pool = {
              address = "192.0.2.0";
              prefixLength = 24;
            };
          };
          ipv6 = {
            address = "2001:db8::1";
            router = {
              address = "64:ff9b::1";
            };
            pool = {
              address = "64:ff9b::";
              prefixLength = 96;
            };
          };
          mappings = {
            "192.0.2.42" = "2001:db8::2";
          };
        };
      };

      # The client is configured with static IPv6 addresses. It has also a static
      # route for the NAT64 IP space where the IPv4 addresses are mapped in. In
      # normal cases, there would be only a default route.
      client = {
        virtualisation.vlans = [
          3 # towards router
        ];

        networking = {
          useDHCP = false;
          interfaces.eth1 = lib.mkForce { };
        };

        systemd.network = {
          enable = true;
          networks."vlan1" = {
            matchConfig.Name = "eth1";
            address = [
              "2001:db8::2/64"
            ];
            routes = [
              {
                Destination = "64:ff9b::/96";
                Gateway = "2001:db8::1";
              }
            ];
          };
        };
        programs.mtr.enable = true;
      };
    };

    testScript = ''
      # start client and server
      for machine in client, server:
        machine.systemctl("start network-online.target")
        machine.wait_for_unit("network-online.target")
        machine.log(machine.execute("ip addr")[1])
        machine.log(machine.execute("ip route")[1])
        machine.log(machine.execute("ip -6 route")[1])

      # test systemd-networkd and nixos-scripts based router
      for router in router_systemd, router_nixos:
        router.start()
        router.systemctl("start network-online.target")
        router.wait_for_unit("network-online.target")
        router.wait_for_unit("tayga.service")
        router.log(machine.execute("ip addr")[1])
        router.log(machine.execute("ip route")[1])
        router.log(machine.execute("ip -6 route")[1])

        with subtest("Wait for tayga"):
          router.wait_for_unit("tayga.service")

        with subtest("Test ICMP server -> client"):
          server.wait_until_succeeds("ping -c 3 192.0.2.42 >&2")

        with subtest("Test ICMP and show a traceroute server -> client"):
          server.wait_until_succeeds("mtr --show-ips --report-wide 192.0.2.42 >&2")

        with subtest("Test ICMP client -> server"):
          client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")

        with subtest("Test ICMP and show a traceroute client -> server"):
          client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")

        router.log(router.execute("systemd-analyze security tayga.service")[1])
        router.shutdown()
    '';
  }
)