<commit_before>import ./make-test-python.nix {
  name = "sslh";

  nodes = {
    server = { pkgs, lib, ... }: {
      networking.firewall.allowedTCPPorts = [ 443 ];
      networking.interfaces.eth1.ipv6.addresses = [
        {
          address = "fc00:e968:6179::de52:7100";
          prefixLength = 64;
        }
      ];
      # sslh is really slow when reverse dns does not work
      networking.hosts = {
        "fc00:e968:6179::de52:7100" = [ "server" ];
        "fc00:e968:6179::de52:7100" = [ "client" ];
      };
      services.sslh = {
        enable = true;
        transparent = true;
        appendConfig = ''
          protocols:
          (
            { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
            { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
          );
        '';
      };
      services.openssh.enable = true;
      users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
      services.nginx = {
        enable = true;
        virtualHosts."localhost" = {
          addSSL = false;
          default = true;
          root = pkgs.runCommand "testdir" {} ''
            mkdir "$out"
            echo hello world > "$out/index.html"
          '';
        };
      };
    };
    client = { ... }: {
      networking.interfaces.eth1.ipv6.addresses = [
        {
          address = "fc00:e968:6179::de52:7100";
          prefixLength = 64;
        }
      ];
      networking.hosts."fc00:e968:6179::de52:7100" = [ "server" ];
      environment.etc.sshKey = {
        source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
        mode = "0600";
      };
    };
  };

  testScript = ''
    start_all()

    server.wait_for_unit("sslh.service")
    server.wait_for_unit("nginx.service")
    server.wait_for_unit("sshd.service")
    server.wait_for_open_port(80)
    server.wait_for_open_port(443)
    server.wait_for_open_port(22)

    for arg in ["-6", "-4"]:
        client.wait_until_succeeds(f"ping {arg} -c1 server")

        # check that ssh through sslh works
        client.succeed(
            f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
        )

        # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
        ip = "fc00:e968:6179::de52:7100" if arg == "-6" else "192.168.1."
        server.succeed(f"grep '{ip}' /tmp/foo{arg}")

        # check that http through sslh works
        assert client.succeed(f"curl {arg} http://server:443").strip() == "hello world"
  '';
}<commit_msg>nixos/tests/sslh: Use curl --fail<commit_after>import ./make-test-python.nix {
  name = "sslh";

  nodes = {
    server = { pkgs, lib, ... }: {
      networking.firewall.allowedTCPPorts = [ 443 ];
      networking.interfaces.eth1.ipv6.addresses = [
        {
          address = "fc00:e968:6179::de52:7100";
          prefixLength = 64;
        }
      ];
      # sslh is really slow when reverse dns does not work
      networking.hosts = {
        "fc00:e968:6179::de52:7100" = [ "server" ];
        "fc00:e968:6179::de52:7100" = [ "client" ];
      };
      services.sslh = {
        enable = true;
        transparent = true;
        appendConfig = ''
          protocols:
          (
            { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
            { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
          );
        '';
      };
      services.openssh.enable = true;
      users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
      services.nginx = {
        enable = true;
        virtualHosts."localhost" = {
          addSSL = false;
          default = true;
          root = pkgs.runCommand "testdir" {} ''
            mkdir "$out"
            echo hello world > "$out/index.html"
          '';
        };
      };
    };
    client = { ... }: {
      networking.interfaces.eth1.ipv6.addresses = [
        {
          address = "fc00:e968:6179::de52:7100";
          prefixLength = 64;
        }
      ];
      networking.hosts."fc00:e968:6179::de52:7100" = [ "server" ];
      environment.etc.sshKey = {
        source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
        mode = "0600";
      };
    };
  };

  testScript = ''
    start_all()

    server.wait_for_unit("sslh.service")
    server.wait_for_unit("nginx.service")
    server.wait_for_unit("sshd.service")
    server.wait_for_open_port(80)
    server.wait_for_open_port(443)
    server.wait_for_open_port(22)

    for arg in ["-6", "-4"]:
        client.wait_until_succeeds(f"ping {arg} -c1 server")

        # check that ssh through sslh works
        client.succeed(
            f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
        )

        # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
        ip = "fc00:e968:6179::de52:7100" if arg == "-6" else "192.168.1."
        server.succeed(f"grep '{ip}' /tmp/foo{arg}")

        # check that http through sslh works
        assert client.succeed(f"curl -f {arg} http://server:443").strip() == "hello world"
  '';
}
{'fraction_non_alphanumeric': 0.15141837309787715, 'fraction_numerical': 0.05448055607739996, 'mean_word_length': 2.018140589569161, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1264342', 'n_tokens_mistral': 1983, 'n_tokens_neox': 1800, 'n_words': 338}