Alexandra Østermark
791 lines
29 KiB
Nix
791 lines
29 KiB
Nix
/*
|
|
VPN Confinement Integration Test
|
|
|
|
This test validates that Nixarr services are properly confined to a VPN namespace
|
|
and cannot leak traffic when the VPN connection fails. It uses a 3-VM topology
|
|
to simulate real-world network conditions.
|
|
|
|
Network Topology:
|
|
┌──────────────┐ VLAN 2 ┌─────────────┐ VLAN 1 ┌─────────────┐
|
|
│internetClient│ ◄──────────── │ gateway │ ◄──────────── │ nixarrHost │
|
|
│ 10.0.1.2 │ │ 10.0.1.1 │ │192.168.1.2 │
|
|
│ fd00:2::2 │ │192.168.1.1 │ │ fd00:1::2 │
|
|
└──────────────┘ │ fd00:2::1 │ └─────────────┘
|
|
│ fd00:1::1 │ │
|
|
└─────────────┘ │
|
|
│ │
|
|
WireGuard tunnel │
|
|
10.100.0.1 ◄────────────────────────┘
|
|
fd00:100::1 VPN namespace
|
|
(10.100.0.2, fd00:100::2)
|
|
|
|
Test Coverage:
|
|
- VPN namespace isolation (transmission confined to wg namespace)
|
|
- IPv4 and IPv6 traffic routing through VPN tunnel
|
|
- Traffic leak prevention when VPN is down
|
|
- Port forwarding from external clients through gateway to VPN services
|
|
- DNS configuration in VPN namespace
|
|
- Service recovery after VPN reconnection
|
|
|
|
The test ensures that:
|
|
1. All transmission traffic goes through the VPN tunnel
|
|
2. Source IP is preserved (shows VPN client IP: 10.100.0.2/fd00:100::2)
|
|
3. No traffic leaks to host network when VPN fails
|
|
4. External port forwarding works correctly
|
|
5. Both IPv4 and IPv6 work identically through the tunnel
|
|
*/
|
|
{
|
|
pkgs,
|
|
nixosModules,
|
|
lib ? pkgs.lib,
|
|
}: let
|
|
# WireGuard configuration for the VPN gateway
|
|
wgGatewayPort = 51820;
|
|
|
|
# Generate real WireGuard keys
|
|
wgGatewayPrivateKey =
|
|
pkgs.runCommand "wg-gateway-private" {buildInputs = [pkgs.wireguard-tools];}
|
|
''
|
|
wg genkey > $out
|
|
'';
|
|
wgGatewayPublicKey =
|
|
pkgs.runCommand "wg-gateway-public" {buildInputs = [pkgs.wireguard-tools];}
|
|
''
|
|
cat ${wgGatewayPrivateKey} | wg pubkey > $out
|
|
'';
|
|
|
|
wgClientPrivateKey =
|
|
pkgs.runCommand "wg-client-private" {buildInputs = [pkgs.wireguard-tools];}
|
|
''
|
|
wg genkey > $out
|
|
'';
|
|
wgClientPublicKey =
|
|
pkgs.runCommand "wg-client-public" {buildInputs = [pkgs.wireguard-tools];}
|
|
''
|
|
cat ${wgClientPrivateKey} | wg pubkey > $out
|
|
'';
|
|
|
|
# Network configuration
|
|
wgGatewayAddr = "10.100.0.1";
|
|
wgClientAddr = "10.100.0.2";
|
|
wgSubnet = "10.100.0.0/24";
|
|
|
|
# Fixed VM IPs
|
|
gatewayIP = "192.168.1.1";
|
|
nixarrHostIP = "192.168.1.2";
|
|
|
|
# Internet client IPs
|
|
internetClientIP = "10.0.1.2";
|
|
internetGatewayIP = "10.0.1.1";
|
|
|
|
# IPv6 addresses
|
|
gatewayIPv6 = "fd00:1::1";
|
|
nixarrHostIPv6 = "fd00:1::2";
|
|
internetClientIPv6 = "fd00:2::2";
|
|
internetGatewayIPv6 = "fd00:2::1";
|
|
wgGatewayAddrV6 = "fd00:100::1";
|
|
wgClientAddrV6 = "fd00:100::2";
|
|
|
|
# Generate WireGuard config file for client
|
|
wgClientConfig = pkgs.writeText "wg-client.conf" ''
|
|
[Interface]
|
|
PrivateKey = ${builtins.readFile wgClientPrivateKey}
|
|
Address = ${wgClientAddr}/24, ${wgClientAddrV6}/64
|
|
DNS = ${wgGatewayAddr}
|
|
|
|
[Peer]
|
|
PublicKey = ${builtins.readFile wgGatewayPublicKey}
|
|
Endpoint = ${gatewayIP}:${toString wgGatewayPort}
|
|
AllowedIPs = 0.0.0.0/0, ::/0
|
|
PersistentKeepalive = 25
|
|
'';
|
|
in
|
|
pkgs.testers.nixosTest {
|
|
name = "nixarr-vpn-confinement-test";
|
|
|
|
# Disable interactive mode to avoid hanging
|
|
interactive = false;
|
|
|
|
nodes = {
|
|
# Internet client VM - Simulates external services and clients
|
|
internetClient = {
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
virtualisation.vlans = [2]; # Connect to VLAN 2 (Internet)
|
|
|
|
networking = {
|
|
firewall.enable = false;
|
|
};
|
|
|
|
# Add route to VPN subnet
|
|
boot.kernel.sysctl."net.ipv4.ip_forward" = 0; # internetClient doesn't forward
|
|
|
|
# Enable systemd-networkd for proper route management
|
|
systemd.network.enable = true;
|
|
networking.useNetworkd = true;
|
|
|
|
# Configure static routes to VPN subnet using systemd-networkd
|
|
systemd.network.networks."40-eth1" = {
|
|
matchConfig.Name = "eth1";
|
|
networkConfig = {
|
|
DHCP = "no";
|
|
};
|
|
address = [
|
|
"${internetClientIP}/24"
|
|
"${internetClientIPv6}/64"
|
|
];
|
|
gateway = [
|
|
"${internetGatewayIP}"
|
|
"${internetGatewayIPv6}"
|
|
];
|
|
routes = [
|
|
{
|
|
Destination = "${wgSubnet}";
|
|
Gateway = "${internetGatewayIP}";
|
|
}
|
|
{
|
|
Destination = "fd00:100::/64";
|
|
Gateway = "${internetGatewayIPv6}";
|
|
}
|
|
];
|
|
};
|
|
|
|
# Web server that returns source IP for testing
|
|
systemd.services.source-ip-server = {
|
|
enable = true;
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network.target"];
|
|
serviceConfig = {
|
|
Type = "exec";
|
|
ExecStart = let
|
|
server = pkgs.writeText "server.py" ''
|
|
import http.server
|
|
import socketserver
|
|
import socket
|
|
|
|
class DualStackHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
|
|
address_family = socket.AF_INET6
|
|
def server_bind(self):
|
|
# Enable dual-stack support
|
|
self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
|
|
super().server_bind()
|
|
|
|
class MyHandler(http.server.BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
self.send_response(200)
|
|
self.end_headers()
|
|
self.wfile.write(f"Source: {self.client_address[0]}".encode())
|
|
|
|
# Listen on all interfaces
|
|
with DualStackHTTPServer(("::", 8080), MyHandler) as httpd:
|
|
httpd.serve_forever()
|
|
'';
|
|
in "${pkgs.python3}/bin/python3 ${server}";
|
|
Restart = "always";
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
netcat-gnu
|
|
curl
|
|
python3
|
|
];
|
|
};
|
|
|
|
# VPN Gateway VM - Acts as WireGuard server and internet gateway
|
|
gateway = {
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
virtualisation.vlans = [
|
|
1
|
|
2
|
|
]; # VLAN 1 for LAN, VLAN 2 for Internet
|
|
|
|
networking = {
|
|
interfaces.eth1 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = gatewayIP;
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
ipv6.addresses = [
|
|
{
|
|
address = gatewayIPv6;
|
|
prefixLength = 64;
|
|
}
|
|
];
|
|
};
|
|
|
|
interfaces.eth2 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = internetGatewayIP;
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
ipv6.addresses = [
|
|
{
|
|
address = internetGatewayIPv6;
|
|
prefixLength = 64;
|
|
}
|
|
];
|
|
};
|
|
|
|
firewall = {
|
|
enable = true;
|
|
allowedUDPPorts = [
|
|
wgGatewayPort
|
|
51413
|
|
];
|
|
allowedTCPPorts = [51413];
|
|
};
|
|
|
|
wireguard.interfaces.wg0 = {
|
|
ips = [
|
|
"${wgGatewayAddr}/24"
|
|
"${wgGatewayAddrV6}/64"
|
|
];
|
|
listenPort = wgGatewayPort;
|
|
privateKeyFile = "${wgGatewayPrivateKey}";
|
|
|
|
peers = [
|
|
{
|
|
publicKey = builtins.readFile wgClientPublicKey;
|
|
allowedIPs = [
|
|
"${wgClientAddr}/32"
|
|
"${wgClientAddrV6}/128"
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Enable IP forwarding
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
# Port forwarding and firewall rules
|
|
networking.firewall.extraCommands = ''
|
|
# Allow WireGuard and testing traffic (IPv4)
|
|
iptables -A INPUT -i eth1 -j ACCEPT
|
|
iptables -A INPUT -i eth2 -j ACCEPT
|
|
iptables -A INPUT -i wg0 -j ACCEPT
|
|
|
|
# Allow WireGuard and testing traffic (IPv6)
|
|
ip6tables -A INPUT -i eth1 -j ACCEPT
|
|
ip6tables -A INPUT -i eth2 -j ACCEPT
|
|
ip6tables -A INPUT -i wg0 -j ACCEPT
|
|
|
|
# IPv6 forwarding rules - Allow forwarding between interfaces
|
|
ip6tables -A FORWARD -i wg0 -o eth2 -j ACCEPT
|
|
ip6tables -A FORWARD -i eth2 -o wg0 -j ACCEPT
|
|
ip6tables -A FORWARD -i wg0 -o eth1 -j ACCEPT
|
|
ip6tables -A FORWARD -i eth1 -o wg0 -j ACCEPT
|
|
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Note: No masquerading - we want to preserve source IPs for testing
|
|
|
|
# Forward transmission peer port from internet to VPN client (this is the key test)
|
|
iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 51413 -j DNAT --to-destination ${wgClientAddr}:51413
|
|
iptables -t nat -A PREROUTING -i eth2 -p udp --dport 51413 -j DNAT --to-destination ${wgClientAddr}:51413
|
|
|
|
# Allow forwarded traffic
|
|
iptables -A FORWARD -p tcp --dport 51413 -d ${wgClientAddr} -j ACCEPT
|
|
iptables -A FORWARD -p udp --dport 51413 -d ${wgClientAddr} -j ACCEPT
|
|
|
|
# Accept return traffic for established connections
|
|
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
'';
|
|
|
|
# Simple DNS server for testing
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
interface = "wg0";
|
|
bind-interfaces = true;
|
|
listen-address = wgGatewayAddr;
|
|
# Log DNS queries for leak detection
|
|
log-queries = true;
|
|
log-facility = "/var/log/dnsmasq-queries.log";
|
|
# Static DNS entries for testing
|
|
address = [
|
|
"/test.vpn.local/${wgGatewayAddr}"
|
|
"/leak.test.local/1.2.3.4"
|
|
"/transmission.local/${wgClientAddr}"
|
|
];
|
|
};
|
|
};
|
|
|
|
# Ensure dnsmasq starts after WireGuard
|
|
systemd.services.dnsmasq = {
|
|
after = ["wireguard-wg0.service"];
|
|
wants = ["wireguard-wg0.service"];
|
|
};
|
|
|
|
# No additional routing needed on gateway - it has direct interfaces to both networks
|
|
|
|
# Install test utilities
|
|
environment.systemPackages = with pkgs; [
|
|
iptables
|
|
netcat-gnu
|
|
python3
|
|
iproute2 # for ss command
|
|
tcpdump
|
|
];
|
|
};
|
|
|
|
# Nixarr host with VPN-confined transmission
|
|
nixarrHost = {
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
imports = [nixosModules.default];
|
|
|
|
virtualisation.vlans = [1]; # Connect to VLAN 1
|
|
|
|
networking = {
|
|
interfaces.eth1 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = nixarrHostIP;
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
ipv6.addresses = [
|
|
{
|
|
address = nixarrHostIPv6;
|
|
prefixLength = 64;
|
|
}
|
|
];
|
|
};
|
|
|
|
# Disable firewall for testing
|
|
firewall.enable = false;
|
|
|
|
# Add route to gateway
|
|
defaultGateway = {
|
|
address = gatewayIP;
|
|
interface = "eth1";
|
|
};
|
|
defaultGateway6 = {
|
|
address = gatewayIPv6;
|
|
interface = "eth1";
|
|
};
|
|
};
|
|
|
|
# Copy WireGuard config to the expected location
|
|
system.activationScripts.setupWgConfig = ''
|
|
mkdir -p /etc/wireguard
|
|
cp ${wgClientConfig} /etc/wireguard/wg0.conf
|
|
chmod 600 /etc/wireguard/wg0.conf
|
|
'';
|
|
|
|
# Minimal nixarr configuration with VPN
|
|
nixarr = {
|
|
enable = true;
|
|
|
|
# Required directories
|
|
mediaDir = "/data/media";
|
|
stateDir = "/data/.state/nixarr";
|
|
|
|
# Enable VPN
|
|
vpn = {
|
|
enable = true;
|
|
wgConf = "/etc/wireguard/wg0.conf";
|
|
};
|
|
|
|
# Enable transmission with VPN
|
|
transmission = {
|
|
enable = true;
|
|
vpn.enable = true;
|
|
# Use specific peer port for testing
|
|
peerPort = 51413;
|
|
# Disable firewall opening since we're in VPN
|
|
openFirewall = false;
|
|
};
|
|
|
|
# Disable all other services
|
|
sonarr.enable = false;
|
|
radarr.enable = false;
|
|
lidarr.enable = false;
|
|
readarr.enable = false;
|
|
bazarr.enable = false;
|
|
prowlarr.enable = false;
|
|
jellyfin.enable = false;
|
|
plex.enable = false;
|
|
sabnzbd.enable = false;
|
|
autobrr.enable = false;
|
|
recyclarr.enable = false;
|
|
jellyseerr.enable = false;
|
|
};
|
|
|
|
# Add IPv6 route for VPN namespace to reach internetClient via WireGuard
|
|
systemd.network.networks."10-eth1" = {
|
|
matchConfig.Name = "eth1";
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Destination = "fd00:2::/64"; # Route to internetClient network
|
|
Gateway = gatewayIPv6; # Via gateway IPv6
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
# Install test utilities
|
|
environment.systemPackages = with pkgs; [
|
|
wireguard-tools
|
|
dig
|
|
curl
|
|
iproute2
|
|
iptables
|
|
netcat-gnu
|
|
tcpdump
|
|
];
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
|
|
print("=== Waiting for VMs to boot ===")
|
|
# Wait for all VMs to be ready
|
|
internetClient.wait_for_unit("multi-user.target", timeout=60)
|
|
gateway.wait_for_unit("multi-user.target", timeout=60)
|
|
nixarrHost.wait_for_unit("multi-user.target", timeout=60)
|
|
|
|
# Wait for web server on internetClient
|
|
internetClient.wait_for_unit("source-ip-server.service")
|
|
internetClient.wait_for_open_port(8080)
|
|
|
|
# Wait for systemd-networkd to set up routes
|
|
internetClient.wait_for_unit("systemd-networkd.service")
|
|
|
|
|
|
print("=== Test 1: Basic connectivity between VMs ===")
|
|
# First verify that nixarrHost can reach the gateway
|
|
nixarrHost.succeed("ping -c 1 ${gatewayIP}")
|
|
gateway.succeed("ping -c 1 ${nixarrHostIP}")
|
|
|
|
|
|
print("=== Test 2: Check VPN namespace setup ===")
|
|
# Check that wg namespace exists
|
|
nixarrHost.succeed("ip netns list | grep -q wg")
|
|
|
|
# The VPN namespace service should be running
|
|
nixarrHost.wait_for_unit("wg.service")
|
|
|
|
# Check if transmission is running
|
|
nixarrHost.wait_for_unit("transmission.service", timeout=30)
|
|
|
|
|
|
print("=== Test 3: Check WireGuard connectivity ===")
|
|
# Check if WireGuard interface exists in namespace
|
|
nixarrHost.succeed("ip netns exec wg ip link show wg0")
|
|
|
|
# Check WireGuard status
|
|
nixarrHost.succeed("ip netns exec wg wg show")
|
|
|
|
# Test VPN tunnel connectivity
|
|
nixarrHost.succeed("ip netns exec wg ping -c 3 ${wgGatewayAddr}")
|
|
|
|
|
|
print("=== Test 4: Verify traffic routing through VPN ===")
|
|
# Debug: See what the web server actually returns
|
|
response = nixarrHost.succeed("ip netns exec wg curl -s http://${internetClientIP}:8080")
|
|
print(f"Web server response: {response}")
|
|
|
|
# Test traffic through VPN tunnel to internetClient - should show VPN client IP
|
|
nixarrHost.succeed("ip netns exec wg curl -s http://${internetClientIP}:8080 | grep -q '${wgClientAddr}'")
|
|
|
|
|
|
print("=== Test 5: Verify traffic routing through VPN ===")
|
|
# IPv4 traffic to host network should be blocked (specific route handling)
|
|
nixarrHost.fail("ip netns exec wg curl -s --max-time 2 http://${gatewayIP}:8080")
|
|
|
|
# Debug IPv6 connectivity before main test
|
|
print("=== Debug IPv6 connectivity ===")
|
|
|
|
# Check IPv6 addresses in VPN namespace
|
|
ipv6_addrs = nixarrHost.succeed("ip netns exec wg ip -6 addr show")
|
|
print(f"VPN namespace IPv6 addresses:\n{ipv6_addrs}")
|
|
|
|
# Check if VPN namespace can ping gateway IPv6
|
|
try:
|
|
nixarrHost.succeed("ip netns exec wg ping -6 -c 1 -W 3 ${wgGatewayAddrV6}")
|
|
print("✓ VPN namespace can ping WireGuard gateway IPv6")
|
|
except Exception as e:
|
|
print(f"✗ VPN namespace cannot ping WireGuard gateway IPv6: {e}")
|
|
|
|
# Check if VPN namespace can reach internetClient IPv6 (simple connectivity)
|
|
try:
|
|
result = nixarrHost.succeed("ip netns exec wg curl -6 -s --max-time 5 http://[${internetClientIPv6}]:8080")
|
|
print(f"✓ VPN namespace can reach internetClient IPv6: {result}")
|
|
except Exception as e:
|
|
print(f"✗ VPN namespace cannot reach internetClient IPv6: {e}")
|
|
|
|
# Check gateway IPv6 routes
|
|
gw_routes = gateway.succeed("ip -6 route show")
|
|
print(f"Gateway IPv6 routes:\n{gw_routes}")
|
|
|
|
# Check internetClient IPv6 routes
|
|
client_routes = internetClient.succeed("ip -6 route show")
|
|
print(f"InternetClient IPv6 routes:\n{client_routes}")
|
|
|
|
# IPv6 traffic should go through VPN tunnel (shows VPN client source)
|
|
nixarrHost.succeed("ip netns exec wg curl -6 -s --max-time 2 http://[${internetClientIPv6}]:8080 | grep -q 'Source: fd00:100::2'")
|
|
|
|
|
|
print("=== Test 6: Verify transmission is confined ===")
|
|
# Check transmission is running and confined to VPN namespace
|
|
nixarrHost.succeed("systemctl status transmission.service | grep -q 'Active: active'")
|
|
|
|
|
|
print("=== Test 7: Interrupt VPN - Verify no connectivity ===")
|
|
# Block WireGuard traffic on gateway using iptables
|
|
gateway.succeed("iptables -I INPUT -p udp --dport ${toString wgGatewayPort} -j DROP")
|
|
gateway.succeed("iptables -I OUTPUT -p udp --sport ${toString wgGatewayPort} -j DROP")
|
|
|
|
# All connectivity should fail - no leaks!
|
|
nixarrHost.fail("ip netns exec wg ping -c 1 -W 2 ${wgGatewayAddr}")
|
|
nixarrHost.fail("ip netns exec wg curl -s --max-time 2 http://${internetClientIP}:8080")
|
|
|
|
# DNS should also fail completely when VPN is down
|
|
nixarrHost.fail("ip netns exec wg dig @${wgGatewayAddr} test.vpn.local +short +timeout=2")
|
|
nixarrHost.fail("ip netns exec wg dig leak.test.local +short +timeout=2")
|
|
print("✓ DNS queries fail when VPN is down - no fallback to host DNS")
|
|
|
|
# Verify no traffic leaks to host network
|
|
nixarrHost.fail("ip netns exec wg curl -s --max-time 2 http://${gatewayIP}:8080")
|
|
|
|
|
|
print("=== Test 8: Restore VPN - Verify recovery ===")
|
|
# Remove iptables blocks
|
|
gateway.succeed("iptables -D INPUT -p udp --dport ${toString wgGatewayPort} -j DROP")
|
|
gateway.succeed("iptables -D OUTPUT -p udp --sport ${toString wgGatewayPort} -j DROP")
|
|
|
|
# Restart the wg namespace service to force reconnection
|
|
nixarrHost.succeed("systemctl restart wg.service")
|
|
nixarrHost.wait_for_unit("wg.service")
|
|
|
|
# Verify VPN connectivity is restored
|
|
nixarrHost.succeed("ip netns exec wg ping -c 3 ${wgGatewayAddr}")
|
|
|
|
# Verify source IP is correct again - use internetClient since gateway has no web server
|
|
nixarrHost.succeed("ip netns exec wg curl -s http://${internetClientIP}:8080 | grep -q '${wgClientAddr}'")
|
|
|
|
|
|
print("=== Test 9: Verify DNS configuration ===")
|
|
# Check that resolv.conf in namespace uses VPN DNS
|
|
nixarrHost.succeed("ip netns exec wg cat /etc/resolv.conf | grep -q 'nameserver ${wgGatewayAddr}'")
|
|
|
|
# Verify no host DNS servers are present
|
|
nixarrHost.fail("ip netns exec wg cat /etc/resolv.conf | grep -q 'nameserver 10.0.2.3'")
|
|
|
|
|
|
print("=== Test 9b: DNS leak test ===")
|
|
|
|
# Debug: Check if dnsmasq is running on gateway
|
|
gateway.succeed("systemctl status dnsmasq")
|
|
gateway.succeed("ss -unpl | grep :53 || echo 'No DNS listener found'")
|
|
|
|
# Debug: Check connectivity to DNS server
|
|
nixarrHost.succeed("ip netns exec wg ping -c 1 ${wgGatewayAddr}")
|
|
|
|
# Start tcpdump on host interface to detect DNS leaks
|
|
nixarrHost.succeed("nohup tcpdump -i eth1 -n 'port 53' -w /tmp/dns-leak.pcap > /tmp/tcpdump-dns.log 2>&1 &")
|
|
|
|
# Clear dnsmasq query log
|
|
gateway.succeed("echo > /var/log/dnsmasq-queries.log || true")
|
|
|
|
# Use dig instead of nslookup for more reliable DNS queries
|
|
nixarrHost.succeed("ip netns exec wg dig @${wgGatewayAddr} test.vpn.local +short | grep -q ${wgGatewayAddr}")
|
|
nixarrHost.succeed("ip netns exec wg dig @${wgGatewayAddr} leak.test.local +short | grep -q '1.2.3.4'")
|
|
nixarrHost.succeed("ip netns exec wg dig @${wgGatewayAddr} transmission.local +short | grep -q ${wgClientAddr}")
|
|
|
|
# Also test without specifying server (uses resolv.conf)
|
|
nixarrHost.succeed("ip netns exec wg dig test.vpn.local +short | grep -q ${wgGatewayAddr}")
|
|
|
|
# Wait for any potential leaked packets
|
|
nixarrHost.succeed("pkill tcpdump || true")
|
|
|
|
# Check if any DNS packets were captured on host interface
|
|
dns_packets = nixarrHost.succeed("tcpdump -r /tmp/dns-leak.pcap -nn 2>/dev/null | wc -l").strip()
|
|
if int(dns_packets) > 0:
|
|
# Show what was captured for debugging
|
|
captured = nixarrHost.succeed("tcpdump -r /tmp/dns-leak.pcap -nn 2>/dev/null || echo 'No packets'")
|
|
print("DNS leak detected! Captured " + dns_packets + " packets:")
|
|
print(captured)
|
|
nixarrHost.fail("DNS queries leaked to host network")
|
|
|
|
# Verify queries went through VPN by checking gateway's dnsmasq log
|
|
gateway.succeed("grep -q 'test.vpn.local' /var/log/dnsmasq-queries.log")
|
|
gateway.succeed("grep -q 'leak.test.local' /var/log/dnsmasq-queries.log")
|
|
|
|
print("✓ No DNS leaks detected - all queries confined to VPN")
|
|
|
|
# Clean up
|
|
nixarrHost.succeed("rm -f /tmp/dns-leak.pcap /tmp/tcpdump-dns.log")
|
|
|
|
|
|
print("=== Test 10: Port forwarding test ===")
|
|
# Wait for transmission to be ready and listening
|
|
nixarrHost.wait_for_open_port(9091) # Web UI port
|
|
|
|
# Check that transmission peer port is listening in namespace
|
|
nixarrHost.succeed("ip netns exec wg ss -tlnp | grep -q ':51413'")
|
|
nixarrHost.succeed("ip netns exec wg ss -ulnp | grep -q ':51413'")
|
|
|
|
# Ensure WireGuard tunnel is active
|
|
nixarrHost.succeed("ip netns exec wg ping -c 1 ${wgGatewayAddr}")
|
|
|
|
# Debug: Print iptables rules and routing info
|
|
print("=== Gateway NAT OUTPUT rules ===")
|
|
output_rules = gateway.succeed("iptables -t nat -L OUTPUT -n -v")
|
|
print(output_rules)
|
|
|
|
print("=== Gateway NAT PREROUTING rules ===")
|
|
prerouting_rules = gateway.succeed("iptables -t nat -L PREROUTING -n -v")
|
|
print(prerouting_rules)
|
|
|
|
print("=== Gateway routing table ===")
|
|
routes = gateway.succeed("ip route show")
|
|
print(routes)
|
|
|
|
print("=== WireGuard status on gateway ===")
|
|
wg_gateway = gateway.succeed("wg show")
|
|
print(wg_gateway)
|
|
|
|
print("=== WireGuard status on client ===")
|
|
wg_client = nixarrHost.succeed("ip netns exec wg wg show")
|
|
print(wg_client)
|
|
|
|
# Test port forwarding through gateway
|
|
print("=== Testing port forwarding ===")
|
|
# First verify the NAT rules were actually applied
|
|
output_nat = gateway.succeed("iptables -t nat -L OUTPUT | grep 51413 || echo 'No OUTPUT NAT rules found'")
|
|
prerouting_nat = gateway.succeed("iptables -t nat -L PREROUTING | grep 51413 || echo 'No PREROUTING NAT rules found'")
|
|
print(f"OUTPUT NAT check: {output_nat}")
|
|
print(f"PREROUTING NAT check: {prerouting_nat}")
|
|
|
|
# Debug connectivity and routing
|
|
print("=== Testing connectivity from nixarrHost to gateway ===")
|
|
nixarrHost.succeed("ping -c 1 ${gatewayIP}")
|
|
|
|
# Debug FORWARD chain
|
|
forward_rules = gateway.succeed("iptables -L FORWARD -n -v")
|
|
print(f"Gateway FORWARD rules:\n{forward_rules}")
|
|
|
|
# Check if gateway can reach VPN client (after handshake)
|
|
gateway.succeed("wg show | grep -q 'latest handshake:'")
|
|
|
|
# Debug port forwarding connectivity
|
|
print("=== Debugging port forwarding ===")
|
|
|
|
# First, ensure WireGuard tunnel is fully established
|
|
gateway.succeed("wg") # Force handshake if needed
|
|
nixarrHost.succeed("ip netns exec wg wg")
|
|
|
|
# Skip direct gateway->client test after restart (WireGuard asymmetry)
|
|
print("=== Testing port forwarding ===")
|
|
|
|
# Test from nixarrHost (outside VPN) through gateway DNAT
|
|
print("Test: External client -> Gateway -> VPN Client (via DNAT)")
|
|
|
|
# First, ensure client initiates some traffic to establish WireGuard state
|
|
nixarrHost.succeed("ip netns exec wg ping -c 1 ${wgGatewayAddr}")
|
|
|
|
# Start tcpdump in background using nohup to properly detach it
|
|
gateway.succeed("nohup tcpdump -i any -n 'port 51413 or host ${wgClientAddr}' -w /tmp/capture.pcap > /tmp/tcpdump.log 2>&1 &")
|
|
|
|
# Verify tcpdump is running
|
|
gateway.succeed("pgrep tcpdump")
|
|
print("Tcpdump started, now testing connection...")
|
|
|
|
# Now test the connection - this should succeed through DNAT!
|
|
# Test from internetClient to gateway's internet IP - this simulates external traffic
|
|
# The connection should be forwarded through the VPN to nixarrHost's transmission
|
|
internetClient.succeed("timeout 5 nc -z -v ${internetGatewayIP} 51413")
|
|
print("Success: Port forwarding works!")
|
|
|
|
# Stop tcpdump and analyze what happened
|
|
gateway.succeed("pkill tcpdump")
|
|
tcpdump_output = gateway.succeed("tcpdump -r /tmp/capture.pcap -nn 2>/dev/null || echo 'No packets captured'")
|
|
print(f"Tcpdump results:\n{tcpdump_output}")
|
|
|
|
# Verify transmission can reach external services through VPN tunnel
|
|
nixarrHost.succeed("ip netns exec wg curl -s http://${internetClientIP}:8080 | grep -q '${wgClientAddr}'")
|
|
|
|
# Verify port is NOT accessible from host network (outside VPN)
|
|
nixarrHost.fail("timeout 2 nc -z -v localhost 51413")
|
|
|
|
|
|
print("=== Test 11: IPv6 leak test ===")
|
|
# Verify IPv6 connectivity between VMs
|
|
nixarrHost.succeed("ping -6 -c 1 ${gatewayIPv6}")
|
|
gateway.succeed("ping -6 -c 1 ${nixarrHostIPv6}")
|
|
|
|
# Check if IPv6 is enabled in VPN namespace
|
|
nixarrHost.succeed("ip netns exec wg ip -6 addr show")
|
|
|
|
# Test IPv6 through VPN tunnel
|
|
nixarrHost.succeed("ip netns exec wg ping -6 -c 1 ${wgGatewayAddrV6}")
|
|
|
|
# Test IPv6 traffic routing - should go through VPN tunnel to internetClient
|
|
nixarrHost.succeed("ip netns exec wg curl -6 -s --max-time 2 http://[${internetClientIPv6}]:8080")
|
|
nixarrHost.succeed("ip netns exec wg curl -6 -s http://[${internetClientIPv6}]:8080 | grep -q '${wgClientAddrV6}'")
|
|
|
|
|
|
print("=== Test 12: IPv6 traffic test with VPN interruption ===")
|
|
# Since WireGuard tunnel uses IPv4, blocking it affects both IPv4 and IPv6 traffic
|
|
# The IPv6 traffic inside the tunnel should fail when we block the IPv4 WireGuard connection
|
|
# This test verifies IPv6 behavior is tied to the VPN tunnel
|
|
|
|
# Verify WireGuard is listening (debug what ports are actually open)
|
|
print("=== Gateway listening ports ===")
|
|
listening_ports = gateway.succeed("ss -unp")
|
|
print(listening_ports)
|
|
|
|
print("=== Looking for WireGuard port ${toString wgGatewayPort} ===")
|
|
wg_port_check = gateway.succeed("ss -unp | grep :${toString wgGatewayPort} || echo 'WireGuard port not found'")
|
|
print(wg_port_check)
|
|
|
|
# The previous test (Test 7) already blocked IPv4 WireGuard and verified it works
|
|
# So IPv6 through the tunnel should also be blocked after IPv4 VPN disruption
|
|
# Let's verify IPv6 still works before disruption
|
|
nixarrHost.succeed("ip netns exec wg ping -6 -c 1 ${wgGatewayAddrV6}")
|
|
|
|
# Now use the same IPv4 blocking as Test 7
|
|
gateway.succeed("iptables -I INPUT -p udp --dport ${toString wgGatewayPort} -j DROP")
|
|
gateway.succeed("iptables -I OUTPUT -p udp --sport ${toString wgGatewayPort} -j DROP")
|
|
|
|
# Both IPv4 and IPv6 connectivity through VPN should fail
|
|
nixarrHost.fail("ip netns exec wg ping -c 1 -W 2 ${wgGatewayAddr}")
|
|
nixarrHost.fail("ip netns exec wg ping -6 -c 1 -W 2 ${wgGatewayAddrV6}")
|
|
nixarrHost.fail("ip netns exec wg curl -6 -s --max-time 2 http://[${internetClientIPv6}]:8080")
|
|
|
|
|
|
print("=== Test 13: IPv6 VPN recovery ===")
|
|
# Remove iptables blocks (IPv4, since that's what WireGuard uses)
|
|
gateway.succeed("iptables -D INPUT -p udp --dport ${toString wgGatewayPort} -j DROP")
|
|
gateway.succeed("iptables -D OUTPUT -p udp --sport ${toString wgGatewayPort} -j DROP")
|
|
|
|
# Verify IPv6 VPN connectivity is restored
|
|
nixarrHost.succeed("ip netns exec wg ping -6 -c 3 ${wgGatewayAddrV6}")
|
|
|
|
# Verify source IPv6 is correct again
|
|
nixarrHost.succeed("ip netns exec wg curl -6 -s http://[${internetClientIPv6}]:8080 | grep -q '${wgClientAddrV6}'")
|
|
|
|
|
|
print("=== All tests passed! ===")
|
|
'';
|
|
}
|