tests: add netns to testing framework

test/test-script.py

@@ -38,13 +38,13 @@ def assert_running(unit):
 assert_matches("su operator -c 'bitcoin-cli getnetworkinfo' | jq", '"version"')
 
 assert_running("electrs")
-machine.wait_for_open_port(4224)  # prometeus metrics provider
+machine.wait_until_succeeds("ip netns exec nb-electrs nc -z localhost 4224")
 # Check RPC connection to bitcoind
 machine.wait_until_succeeds(log_has_string("electrs", "NetworkInfo"))
 assert_running("nginx")
 # SSL stratum server via nginx. Only check for open port, no content is served here
 # as electrs isn't ready.
-machine.wait_for_open_port(50003)
+machine.wait_until_succeeds("ip netns exec nb-nginx nc -z localhost 50003")
 # Stop electrs from spamming the test log with 'wait for bitcoind sync' messages
 succeed("systemctl stop electrs")
 
@@ -58,31 +58,49 @@ def assert_running(unit):
 
 assert_running("spark-wallet")
 spark_auth = re.search("login=(.*)", succeed("cat /secrets/spark-wallet-login"))[1]
-machine.wait_for_open_port(9737)
-assert_matches(f"curl -s {spark_auth}@localhost:9737", "Spark")
+machine.wait_until_succeeds("ip netns exec nb-clightning nc -z 169.254.1.17 9737")
+assert_matches(f"ip netns exec nb-clightning curl -s {spark_auth}@169.254.1.17:9737", "Spark")
 
 assert_running("lightning-charge")
 charge_auth = re.search("API_TOKEN=(.*)", succeed("cat /secrets/lightning-charge-env"))[1]
-machine.wait_for_open_port(9112)
-assert_matches(f"curl -s api-token:{charge_auth}@localhost:9112/info | jq", '"id"')
+machine.wait_until_succeeds("ip netns exec nb-nanopos nc -z 169.254.1.18 9112")
+assert_matches(
+    f"ip netns exec nb-nanopos curl -s api-token:{charge_auth}@169.254.1.18:9112/info | jq", '"id"',
+)
 
 assert_running("nanopos")
-machine.wait_for_open_port(9116)
-assert_matches("curl localhost:9116", "tshirt")
+machine.wait_until_succeeds("ip netns exec nb-lightning-charge nc -z 169.254.1.19 9116")
+assert_matches("ip netns exec nb-lightning-charge curl 169.254.1.19:9116", "tshirt")
 
 assert_running("onion-chef")
 
 # FIXME: use 'wait_for_unit' because 'create-web-index' always fails during startup due
 # to incomplete unit dependencies.
 # 'create-web-index' implicitly tests 'nodeinfo'.
 machine.wait_for_unit("create-web-index")
-machine.wait_for_open_port(80)
-assert_matches("curl localhost", "nix-bitcoin")
-assert_matches("curl -L localhost/store", "tshirt")
+machine.wait_until_succeeds("ip netns exec nb-nginx nc -z localhost 80")
+assert_matches("ip netns exec nb-nginx curl localhost", "nix-bitcoin")
+assert_matches("ip netns exec nb-nginx curl -L localhost/store", "tshirt")
 
 machine.wait_until_succeeds(log_has_string("bitcoind-import-banlist", "Importing node banlist"))
 assert_no_failure("bitcoind-import-banlist")
 
+### Security tests
+
+machine.fail("ip netns exec nb-bitcoind ping -c 1 169.254.1.17")
+machine.fail("ip netns exec nb-bitcoind ping -c 1 169.254.1.18")
+machine.fail("ip netns exec nb-bitcoind ping -c 1 169.254.1.19")
+machine.fail("ip netns exec nb-bitcoind ping -c 1 169.254.1.20")
+machine.fail("ip netns exec nb-bitcoind ping -c 1 169.254.1.21")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.12")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.13")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.14")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.15")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.16")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.17")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.19")
+machine.fail("ip netns exec nb-nanopos ping -c 1 169.254.1.20")
+
 ### Additional tests
 
 # Current time in µs

test/test.nix

@@ -19,6 +19,8 @@ import ./make-test.nix rec {
     services.bitcoind.extraConfig = mkForce "connect=0";
 
     services.clightning.enable = true;
+    # spark-wallet tests are running from nb-clightning
+    nix-bitcoin.netns-isolation.services.spark-wallet.connections = [ "clightning" ];
     services.spark-wallet.enable = true;
     services.lightning-charge.enable = true;
     services.nanopos.enable = true;