centra
559d6d2c6e
Some checks are pending
linux-lab / core-fast (push) Waiting to run
linux-lab / core-nat (push) Waiting to run
linux-lab / core-netem (push) Waiting to run
linux-lab / extended-auth-url (push) Waiting to run
linux-lab / extended-nat-churn (push) Waiting to run
linux-lab / extended-relay-switch (push) Waiting to run
linux-lab / extended-soak (push) Waiting to run
linux-lab / extended-standalone (push) Waiting to run
202 lines
7.5 KiB
Nix
202 lines
7.5 KiB
Nix
{ pkgs, serverPkg, clientPkg }:
|
|
{
|
|
name = "lightscale-lab-netem";
|
|
nodes = {
|
|
node1 = { ... }: {
|
|
networking.hostName = "node1";
|
|
networking.usePredictableInterfaceNames = false;
|
|
virtualisation.vlans = [ 1 ];
|
|
networking.interfaces.eth1.useDHCP = false;
|
|
networking.interfaces.eth1.ipv4.addresses = [
|
|
{ address = "10.0.0.1"; prefixLength = 24; }
|
|
];
|
|
networking.firewall.enable = false;
|
|
boot.kernelModules = [ "wireguard" ];
|
|
environment.systemPackages = [
|
|
serverPkg
|
|
clientPkg
|
|
pkgs.wireguard-tools
|
|
pkgs.iproute2
|
|
pkgs.iputils
|
|
pkgs.netcat-openbsd
|
|
pkgs.curl
|
|
];
|
|
};
|
|
|
|
natgw = { ... }: {
|
|
networking.hostName = "natgw";
|
|
networking.usePredictableInterfaceNames = false;
|
|
virtualisation.vlans = [ 1 2 ];
|
|
networking.interfaces.eth1.useDHCP = false;
|
|
networking.interfaces.eth1.ipv4.addresses = [
|
|
{ address = "10.0.0.2"; prefixLength = 24; }
|
|
];
|
|
networking.interfaces.eth2.useDHCP = false;
|
|
networking.interfaces.eth2.ipv4.addresses = [
|
|
{ address = "192.168.50.1"; prefixLength = 24; }
|
|
];
|
|
networking.firewall.enable = false;
|
|
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
|
environment.systemPackages = [
|
|
pkgs.iproute2
|
|
pkgs.iputils
|
|
pkgs.iptables
|
|
pkgs.conntrack-tools
|
|
];
|
|
};
|
|
|
|
node3 = { ... }: {
|
|
networking.hostName = "node3";
|
|
networking.usePredictableInterfaceNames = false;
|
|
virtualisation.vlans = [ 2 ];
|
|
networking.interfaces.eth1.useDHCP = false;
|
|
networking.interfaces.eth1.ipv4.addresses = [
|
|
{ address = "192.168.50.10"; prefixLength = 24; }
|
|
];
|
|
networking.defaultGateway = {
|
|
address = "192.168.50.1";
|
|
interface = "eth1";
|
|
};
|
|
networking.firewall.enable = false;
|
|
boot.kernelModules = [ "wireguard" ];
|
|
environment.systemPackages = [
|
|
clientPkg
|
|
pkgs.wireguard-tools
|
|
pkgs.iproute2
|
|
pkgs.iputils
|
|
pkgs.curl
|
|
];
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
node1.wait_for_unit("multi-user.target")
|
|
natgw.wait_for_unit("multi-user.target")
|
|
node3.wait_for_unit("multi-user.target")
|
|
|
|
node1.wait_until_succeeds("ip -4 addr show dev eth1 | grep -q '10.0.0.1/24'")
|
|
natgw.wait_until_succeeds("ip -4 addr show dev eth1 | grep -q '10.0.0.2/24'")
|
|
natgw.wait_until_succeeds("ip -4 addr show dev eth2 | grep -q '192.168.50.1/24'")
|
|
node3.wait_until_succeeds("ip -4 addr show dev eth1 | grep -q '192.168.50.10/24'")
|
|
node3.wait_until_succeeds("ip -4 route show default | grep -q 'via 192.168.50.1'")
|
|
|
|
natgw.succeed("iptables -P FORWARD ACCEPT")
|
|
natgw.succeed("iptables -F")
|
|
natgw.succeed("iptables -t nat -F")
|
|
|
|
def set_nat_port(port):
|
|
natgw.succeed("iptables -t nat -F")
|
|
natgw.succeed(
|
|
f"iptables -t nat -A PREROUTING -i eth1 -p udp --dport {port} "
|
|
"-j DNAT --to-destination 192.168.50.10:51820"
|
|
)
|
|
natgw.succeed(
|
|
f"iptables -t nat -A POSTROUTING -o eth1 -p udp -s 192.168.50.10 "
|
|
f"--sport 51820 -j SNAT --to-source 10.0.0.2:{port}"
|
|
)
|
|
natgw.succeed("iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE")
|
|
natgw.execute("conntrack -F || true")
|
|
|
|
set_nat_port(40000)
|
|
|
|
node1.succeed("touch /tmp/lightscale-server.log")
|
|
node1.execute("sh -c 'tail -n +1 -f /tmp/lightscale-server.log >/dev/console 2>&1 &'")
|
|
node1.succeed(
|
|
"systemd-run --no-block --unit=lightscale-server --service-type=simple "
|
|
"--property=Restart=on-failure --property=RestartSec=1 "
|
|
"--property=TimeoutStartSec=30 "
|
|
"--property=StandardOutput=append:/tmp/lightscale-server.log "
|
|
"--property=StandardError=append:/tmp/lightscale-server.log "
|
|
"--setenv=RUST_LOG=info --setenv=LIGHTSCALE_ADMIN_TOKEN=test-admin -- "
|
|
"lightscale-server --listen 10.0.0.1:8080 --state /tmp/lightscale-state.json"
|
|
)
|
|
node1.wait_for_unit("lightscale-server.service")
|
|
node1.wait_for_open_port(8080, addr="10.0.0.1", timeout=120)
|
|
|
|
import json
|
|
|
|
net = json.loads(node1.succeed(
|
|
"curl -sSf -X POST http://10.0.0.1:8080/v1/networks "
|
|
"-H 'authorization: Bearer test-admin' "
|
|
"-H 'content-type: application/json' "
|
|
"-d '{\"name\":\"netem\",\"bootstrap_token_ttl_seconds\":600,"
|
|
"\"bootstrap_token_uses\":10,\"bootstrap_token_tags\":[\"netem\"]}'"
|
|
))
|
|
token = net["bootstrap_token"]["token"]
|
|
|
|
def enroll(node, name, endpoints):
|
|
node.succeed(
|
|
"lightscale-client --profile netem --config /tmp/ls-config.json "
|
|
"init http://10.0.0.1:8080"
|
|
)
|
|
node.succeed(
|
|
f"lightscale-client --profile netem --config /tmp/ls-config.json "
|
|
f"--state-dir /tmp/ls-state register --node-name {name} -- {token}"
|
|
)
|
|
cmd = (
|
|
"lightscale-client --profile netem --config /tmp/ls-config.json "
|
|
"--state-dir /tmp/ls-state heartbeat"
|
|
)
|
|
for endpoint in endpoints:
|
|
cmd += f" --endpoint {endpoint}"
|
|
node.succeed(cmd)
|
|
|
|
enroll(node1, "node1", ["10.0.0.1:51820"])
|
|
enroll(node3, "node3", ["10.0.0.2:40000", "10.0.0.2:41000"])
|
|
|
|
def start_agent(node, endpoints):
|
|
node.succeed("touch /tmp/lightscale-agent.log")
|
|
cmd = (
|
|
"lightscale-client --profile netem --config /tmp/ls-config.json "
|
|
"--state-dir /tmp/ls-state agent --listen-port 51820 "
|
|
"--heartbeat-interval 5 --longpoll-timeout 5 "
|
|
"--endpoint-stale-after 5 --endpoint-max-rotations 2"
|
|
)
|
|
for endpoint in endpoints:
|
|
cmd += f" --endpoint {endpoint}"
|
|
node.succeed(
|
|
"systemd-run --no-block --unit=lightscale-agent --service-type=simple "
|
|
"--property=Restart=on-failure --property=RestartSec=1 "
|
|
"--property=TimeoutStartSec=30 "
|
|
"--property=StandardOutput=append:/tmp/lightscale-agent.log "
|
|
"--property=StandardError=append:/tmp/lightscale-agent.log -- "
|
|
+ cmd
|
|
)
|
|
node.wait_for_unit("lightscale-agent.service")
|
|
node.wait_until_succeeds("ip link show ls-netem", timeout=60)
|
|
|
|
start_agent(node1, ["10.0.0.1:51820"])
|
|
start_agent(node3, ["10.0.0.2:40000", "10.0.0.2:41000"])
|
|
|
|
data1 = json.loads(node1.succeed("cat /tmp/ls-state/state.json"))
|
|
data3 = json.loads(node3.succeed("cat /tmp/ls-state/state.json"))
|
|
node1_ip = data1["ipv4"]
|
|
node3_ip = data3["ipv4"]
|
|
|
|
node1.wait_until_succeeds(f"ping -c 3 {node3_ip}", timeout=180)
|
|
node3.wait_until_succeeds(f"ping -c 3 {node1_ip}", timeout=180)
|
|
|
|
# Impair WAN path between node1 and natgw to validate behavior under delay/loss.
|
|
natgw.succeed("tc qdisc replace dev eth1 root netem delay 120ms 20ms loss 8%")
|
|
natgw.succeed("tc -s qdisc show dev eth1 | grep -q netem")
|
|
|
|
def eventually_ping(src, dst):
|
|
src.wait_until_succeeds(
|
|
f"for i in $(seq 1 20); do ping -c 1 -W 1 {dst} && exit 0; sleep 1; done; exit 1",
|
|
timeout=180,
|
|
)
|
|
|
|
eventually_ping(node1, node3_ip)
|
|
eventually_ping(node3, node1_ip)
|
|
|
|
natgw.succeed("tc qdisc del dev eth1 root")
|
|
|
|
# Simulate NAT rebinding by changing external UDP port for node3.
|
|
set_nat_port(41000)
|
|
|
|
node1.wait_until_succeeds("wg show ls-netem endpoints | grep -q ':41000'", timeout=180)
|
|
node1.wait_until_succeeds(f"ping -c 3 {node3_ip}", timeout=180)
|
|
node3.wait_until_succeeds(f"ping -c 3 {node1_ip}", timeout=180)
|
|
'';
|
|
}
|