Let the firewall suite float its docker subnet

The compose pinned 172.32.0.0/24 with a per-container ipv4_address, so two
concurrent runs asked docker for the same address space and the second failed
with a pool-overlap error. Request no subnet and let docker assign one from the
daemon pool. Peers address each other by the docker hostname the compose already
sets (host-a, host-b) rather than by literal IP; docker's embedded DNS is
per-network, so the same hostname in two runs resolves inside each run's own
subnet. Nothing this suite asserts on moves as a result: its checks run over the
fips0 overlay, whose addresses are derived from node npubs and are independent of
docker addressing, and the packaged nftables ruleset matches on interface rather
than on any address.

The generated config directory moves under the run suffix for the same reason it
did in the acl suite, and the run teardown gains the matching removal so a run
no longer leaves its directory behind.

Case (b) also wrote curl's output to a fixed path under /tmp. Two concurrent
runs shared that one file, and either run's cleanup landing between the other's
write and read left an empty read, failing the http_code check for a reason
having nothing to do with the firewall. It uses mktemp now.

As in the acl suite, the floating subnet removes one of the two obstacles to
concurrent runs. The compose project name is still fixed; the local CI runner
scopes it externally, a bare hand run does not, and the comment at the site says
so rather than claiming the file is self-sufficient.

testing/ci-local.sh

@@ -390,15 +390,20 @@ ci_teardown() {
         --images "$CI_IMAGE_TEST $CI_IMAGE_APP" \
         --veth-suffixes "${_suffixes[*]}" >/dev/null || true
 
-    # 3. The static suite's generated configs are per-run (a shared directory
+    # 3. The static and firewall suites' generated configs are per-run (a
-    #    would let concurrent runs overwrite each other's node configs), so
+    #    shared directory would let concurrent runs overwrite each other's node
-    #    they are this run's to remove. Only on a green run: after a failure
+    #    configs), so they are this run's to remove. Only on a green run: after
-    #    they are the evidence of what the failing nodes were actually
+    #    a failure they are the evidence of what the failing nodes were actually
     #    configured with. Guarded on a non-empty suffix too, since without one
     #    the path is the unscoped working directory a developer uses by hand,
     #    which is not ours to delete.
+    #
+    #    Every suite whose configs become per-run owes a line here. acl-allowlist
+    #    also generates per-run now but is not in this runner's suite list, so
+    #    this teardown never creates its directory and must not remove one.
     if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then
         rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}"
+        rm -rf "$SCRIPT_DIR/firewall/generated-configs${CI_RUN_NAME_SUFFIX}"
     fi
 }
 

testing/firewall/.gitignore

@@ -1 +1 @@
-generated-configs
+generated-configs*

testing/firewall/README.md

@@ -24,10 +24,18 @@ actively DROP'd by the fips chain (not silently unrouted).
 
 Two FIPS nodes peered over UDP on a Docker bridge network:
 
-| Container               | Hostname | docker IPv4   | Firewall |
+| Container               | Hostname | Firewall |
-|-------------------------|----------|---------------|----------|
+|-------------------------|----------|----------|
-| `fips-fw-container-a`   | `host-a` | 172.32.0.10   | none (probe) |
+| `fips-fw-container-a`   | `host-a` | none (probe) |
-| `fips-fw-container-b`   | `host-b` | 172.32.0.11   | `fips.nft` + drop-in |
+| `fips-fw-container-b`   | `host-b` | `fips.nft` + drop-in |
+
+The bridge network requests no subnet, so docker assigns one from its own
+address pool and two concurrent runs never contend for a fixed range. No
+node's IPv4 address is therefore known before startup, and the generated peer
+stanzas address each other by docker hostname, resolved through the
+container's dnsmasq to docker's embedded DNS. The firewall assertions
+themselves are unaffected: they run over the fips0 overlay, whose addresses
+are derived from the node npubs.
 
 `node-b` mounts the production `packaging/common/fips.nft` read-only at
 `/etc/fips/fips.nft`, plus a drop-in at `/etc/fips/fips.d/services.nft`
@@ -108,4 +116,6 @@ docker compose -f testing/firewall/docker-compose.yml down
 
 ## Generated fixture location
 
-`testing/firewall/generated-configs/` (gitignored).
+`testing/firewall/generated-configs/` (gitignored), or
+`generated-configs<suffix>/` when `FIPS_CI_NAME_SUFFIX` is set, which is how
+concurrent runs keep their fixtures apart.

testing/firewall/docker-compose.yml

@@ -1,11 +1,21 @@
 networks:
+  # No subnet is requested: docker assigns one from the daemon's address pool.
+  # A fixed request is honoured verbatim, so two runs asking for the same range
+  # collide on "Pool overlaps" — which is why the generated peer addresses are
+  # docker hostnames (host-a, host-b) rather than literal IPs. Docker's embedded
+  # DNS is per-network, so the same hostname in two concurrent runs resolves
+  # inside each run's own subnet.
+  #
+  # That removes one of the two obstacles to running this suite twice at once,
+  # not both. The compose project name is still fixed, so two runs that do not
+  # set COMPOSE_PROJECT_NAME share a project, and the second `up` recreates the
+  # first's containers while either `down` removes both. The local CI runner
+  # scopes it externally (run_firewall in ci-local.sh); a bare hand run does
+  # not. Do not read the floating subnet as making concurrent bare runs safe.
   fw-net:
     driver: bridge
     labels:
       - "com.corganlabs.fips-ci=1"
-    ipam:
-      config:
-        - subnet: 172.32.0.0/24
 
 x-fips-common: &fips-common
   build:
@@ -31,12 +41,11 @@ services:
     hostname: host-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/node-a/hosts:/etc/fips/hosts:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/hosts:/etc/fips/hosts:ro
-      - ./generated-configs/node-a/fips.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro
-      - ./generated-configs/node-a/fips.key:/etc/fips/fips.key:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro
     networks:
-      fw-net:
+      - fw-net
-        ipv4_address: 172.32.0.10
 
   service-b:
     <<: *fips-common
@@ -44,11 +53,10 @@ services:
     hostname: host-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/node-b/hosts:/etc/fips/hosts:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/hosts:/etc/fips/hosts:ro
-      - ./generated-configs/node-b/fips.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro
-      - ./generated-configs/node-b/fips.key:/etc/fips/fips.key:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro
       - ../../packaging/common/fips.nft:/etc/fips/fips.nft:ro
-      - ./generated-configs/node-b/fips.d:/etc/fips/fips.d:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.d:/etc/fips/fips.d:ro
     networks:
-      fw-net:
+      - fw-net
-        ipv4_address: 172.32.0.11

testing/firewall/generate-configs.sh

@@ -9,7 +9,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-GENERATED_DIR="$SCRIPT_DIR/generated-configs"
+
+# Scoped by the per-run suffix because this directory is wiped and rewritten
+# below: two runs sharing one output directory would delete each other's
+# fixtures out from under running containers. Unset (a bare hand run, or the
+# GitHub-hosted path) it collapses to the historical "generated-configs".
+GENERATED_DIR="$SCRIPT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 
 # Deterministic test identities (mirrors the acl-allowlist style).
 NPUB_A="npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"
@@ -32,6 +37,10 @@ node-b $NPUB_B
 EOF
 }
 
+# Peers are addressed by the docker hostname the compose file assigns (host-a,
+# host-b), not by IP. The network requests no subnet so that two concurrent
+# runs cannot collide on one address range, which means neither node's address
+# is knowable before `docker compose up`.
 echo "Generating firewall fixtures..."
 rm -rf "$GENERATED_DIR"
 
@@ -58,7 +67,7 @@ peers:
     alias: "node-b"
     addresses:
       - transport: udp
-        addr: "172.32.0.11:2121"
+        addr: "host-b:2121"
     connect_policy: auto_connect
 EOF
 
@@ -89,7 +98,7 @@ peers:
     alias: "node-a"
     addresses:
       - transport: udp
-        addr: "172.32.0.10:2121"
+        addr: "host-a:2121"
     connect_policy: auto_connect
 EOF
 

testing/firewall/test.sh

@@ -230,14 +230,20 @@ log "Case (b): node-b initiates outbound TCP, expects reply via conntrack"
 # node-b → node-a:8000 on the fips overlay. node-a has http.server on
 # [::]:8000 and is NOT firewalled, so this is purely a test of node-b's
 # outbound + ct state established,related path on the way back.
+#
+# mktemp rather than a fixed /tmp name: two concurrent runs of this suite
+# would otherwise share one host file, and either one's `rm` between the
+# other's write and read leaves an empty read that fails the http_code check
+# for a reason that has nothing to do with the firewall.
+CURL_OUT="$(mktemp)"
 set +e
 docker exec "$CONTAINER_B" curl -6 --silent --max-time 5 \
     --output /dev/null --write-out '%{http_code}' \
-    "http://[${ADDR_A}]:${OUTBOUND_TARGET_PORT}/" >/tmp/fw_b_rc 2>/dev/null
+    "http://[${ADDR_A}]:${OUTBOUND_TARGET_PORT}/" >"$CURL_OUT" 2>/dev/null
 RC=$?
 set -e
-HTTP_CODE="$(cat /tmp/fw_b_rc 2>/dev/null || true)"
+HTTP_CODE="$(cat "$CURL_OUT" 2>/dev/null || true)"
-rm -f /tmp/fw_b_rc
+rm -f "$CURL_OUT"
 if [ "$RC" -ne 0 ]; then
     fail "(b) outbound from node-b failed (curl rc=$RC, http=$HTTP_CODE) — conntrack reply path broken"
 fi