forked from mirrors/nixpkgs
nixos/tests: add qemu-vm-restrictnetwork test
This commit is contained in:
parent
e039cb9d97
commit
b25e0e8ebc
nixos/tests
|
@ -533,6 +533,7 @@ in {
|
||||||
public-inbox = handleTest ./public-inbox.nix {};
|
public-inbox = handleTest ./public-inbox.nix {};
|
||||||
pulseaudio = discoverTests (import ./pulseaudio.nix);
|
pulseaudio = discoverTests (import ./pulseaudio.nix);
|
||||||
qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
|
qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
|
||||||
|
qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};
|
||||||
quorum = handleTest ./quorum.nix {};
|
quorum = handleTest ./quorum.nix {};
|
||||||
quake3 = handleTest ./quake3.nix {};
|
quake3 = handleTest ./quake3.nix {};
|
||||||
rabbitmq = handleTest ./rabbitmq.nix {};
|
rabbitmq = handleTest ./rabbitmq.nix {};
|
||||||
|
|
36
nixos/tests/qemu-vm-restrictnetwork.nix
Normal file
36
nixos/tests/qemu-vm-restrictnetwork.nix
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
import ./make-test-python.nix ({
|
||||||
|
name = "qemu-vm-restrictnetwork";
|
||||||
|
|
||||||
|
nodes = {
|
||||||
|
unrestricted = { config, pkgs, ... }: {
|
||||||
|
virtualisation.restrictNetwork = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
restricted = { config, pkgs, ... }: {
|
||||||
|
virtualisation.restrictNetwork = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
import os
|
||||||
|
|
||||||
|
if os.fork() == 0:
|
||||||
|
# Start some HTTP server on the qemu host to test guest isolation.
|
||||||
|
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||||||
|
HTTPServer(("", 8000), BaseHTTPRequestHandler).serve_forever()
|
||||||
|
|
||||||
|
else:
|
||||||
|
start_all()
|
||||||
|
unrestricted.wait_for_unit("network-online.target")
|
||||||
|
restricted.wait_for_unit("network-online.target")
|
||||||
|
|
||||||
|
# Guests should be able to reach each other on the same VLAN.
|
||||||
|
unrestricted.succeed("ping -c1 restricted")
|
||||||
|
restricted.succeed("ping -c1 unrestricted")
|
||||||
|
|
||||||
|
# Only the unrestricted guest should be able to reach host services.
|
||||||
|
# 10.0.2.2 is the gateway mapping to the host's loopback interface.
|
||||||
|
unrestricted.succeed("curl -s http://10.0.2.2:8000")
|
||||||
|
restricted.fail("curl -s http://10.0.2.2:8000")
|
||||||
|
'';
|
||||||
|
})
|
Loading…
Reference in a new issue