mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 00:04:54 +00:00
Add static and stochastic Docker test harnesses
Move examples/docker-network/ to testing/static/ and add testing/chaos/ as a new stochastic simulation harness. testing/static/ — Static 5-node test harness: - Fixed mesh, chain, and mesh-public topologies with docker compose - Manual test scripts (ping, iperf, netem) - Build script, config generation, key derivation testing/chaos/ — Stochastic network simulation: - Python orchestrator generating N-node FIPS meshes with dynamic network conditions, driven by reproducible YAML scenarios - Topology generation: random geometric, Erdos-Renyi, or chain graphs with BFS connectivity guarantee - Per-link netem: HTB classful qdiscs with u32 filters for per-peer impairment (delay, loss, jitter), stochastic mutation across configurable policy profiles - Per-link bandwidth pacing: HTB rate limiting with configurable tiers (1/10/100/1000 mbps) randomly assigned per edge - Link flaps: tc netem 100% loss with graph connectivity protection - Node churn: docker stop/start with netem re-application on restart, shared down_nodes tracking across all managers - Traffic generation: random iperf3 sessions between node pairs - Down-node guards: all docker exec callers check container liveness, auto-detect crashed containers via is_container_running() safety net - Log collection and post-run analysis (panics, errors, sessions, MMP metrics, tree reconvergence) - chaos.sh wrapper with --seed, --duration, --verbose, --list options - Four scenarios: smoke-10, chaos-10, churn-10, churn-20
This commit is contained in:
Johnathan Corgan
Executable
+71
@@ -0,0 +1,71 @@
|
||||
#!/bin/bash
|
||||
# Build the FIPS binary, generate configs, and build Docker images.
|
||||
# Supports cross-compilation from macOS to Linux using cargo-zigbuild.
|
||||
# Usage: ./build.sh [topology] [mesh-name]
|
||||
# topology: mesh, mesh-public, chain, etc. (default: mesh)
|
||||
# mesh-name: optional; derives unique node identities via sha256(mesh-name|node-id)
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
DOCKER_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
# Topology to use (default: mesh)
|
||||
TOPOLOGY="${1:-mesh}"
|
||||
MESH_NAME="${2:-}"
|
||||
|
||||
# Find project root (directory containing Cargo.toml)
|
||||
PROJECT_ROOT="$(cd "$DOCKER_DIR/../.." && pwd)"
|
||||
if [ ! -f "$PROJECT_ROOT/Cargo.toml" ]; then
|
||||
echo "Error: Cannot find Cargo.toml at $PROJECT_ROOT" >&2
|
||||
echo "Expected layout: <project-root>/testing/static/scripts/build.sh" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Using topology: $TOPOLOGY"
|
||||
|
||||
# Detect host OS
|
||||
UNAME_S=$(uname -s)
|
||||
CARGO_TARGET="x86_64-unknown-linux-musl"
|
||||
|
||||
# Check for cross-compilation tooling on macOS
|
||||
if [ "$UNAME_S" = "Darwin" ]; then
|
||||
echo "Detected macOS host - using cross-compilation for Linux..."
|
||||
|
||||
# Check if cargo-zigbuild is installed
|
||||
if ! command -v cargo-zigbuild &> /dev/null; then
|
||||
echo "Error: cargo-zigbuild not found." >&2
|
||||
echo "Please install it: cargo install cargo-zigbuild" >&2
|
||||
echo "" >&2
|
||||
echo "Or install zig directly: brew install zig" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if target is installed
|
||||
if ! rustup target list --installed | grep -q "$CARGO_TARGET"; then
|
||||
echo "Installing Rust target $CARGO_TARGET..."
|
||||
rustup target add "$CARGO_TARGET"
|
||||
fi
|
||||
|
||||
echo "Building FIPS for Linux (release) using cargo-zigbuild..."
|
||||
cargo zigbuild --release --target "$CARGO_TARGET" --manifest-path="$PROJECT_ROOT/Cargo.toml"
|
||||
|
||||
echo "Copying binary to docker context..."
|
||||
cp "$PROJECT_ROOT/target/$CARGO_TARGET/release/fips" "$DOCKER_DIR/fips"
|
||||
else
|
||||
# Native Linux build
|
||||
echo "Building FIPS (release)..."
|
||||
cargo build --release --manifest-path="$PROJECT_ROOT/Cargo.toml"
|
||||
|
||||
echo "Copying binary to docker context..."
|
||||
cp "$PROJECT_ROOT/target/release/fips" "$DOCKER_DIR/fips"
|
||||
fi
|
||||
|
||||
echo "Done. Binary at $DOCKER_DIR/fips"
|
||||
echo ""
|
||||
echo "Generating node configurations from templates..."
|
||||
"$SCRIPT_DIR/generate-configs.sh" "$TOPOLOGY" $MESH_NAME
|
||||
echo ""
|
||||
echo "Building Docker images..."
|
||||
docker compose -f "$DOCKER_DIR/docker-compose.yml" --profile "$TOPOLOGY" build
|
||||
echo ""
|
||||
echo "Ready: docker compose -f testing/static/docker-compose.yml --profile $TOPOLOGY up -d"
|
||||
Executable
+111
@@ -0,0 +1,111 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Derive deterministic nostr nsec/npub from mesh-name and node-name.
|
||||
|
||||
Usage: derive-keys.py <mesh-name> <node-name>
|
||||
Output: nsec=<hex>\nnpub=<bech32>
|
||||
|
||||
Derivation: nsec = sha256(mesh_name + "|" + node_name)
|
||||
npub = bech32("npub", secp256k1_pubkey_x(nsec))
|
||||
|
||||
Pure Python, no external dependencies.
|
||||
"""
|
||||
|
||||
import hashlib
|
||||
import sys
|
||||
|
||||
# --- secp256k1 ---
|
||||
|
||||
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
|
||||
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
|
||||
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
|
||||
|
||||
|
||||
def _modinv(a, m):
|
||||
return pow(a, m - 2, m)
|
||||
|
||||
|
||||
def _point_add(p1, p2):
|
||||
if p1 is None:
|
||||
return p2
|
||||
if p2 is None:
|
||||
return p1
|
||||
x1, y1 = p1
|
||||
x2, y2 = p2
|
||||
if x1 == x2 and y1 != y2:
|
||||
return None
|
||||
if x1 == x2:
|
||||
lam = (3 * x1 * x1) * _modinv(2 * y1, P) % P
|
||||
else:
|
||||
lam = (y2 - y1) * _modinv(x2 - x1, P) % P
|
||||
x3 = (lam * lam - x1 - x2) % P
|
||||
y3 = (lam * (x1 - x3) - y1) % P
|
||||
return (x3, y3)
|
||||
|
||||
|
||||
def _scalar_mult(k, point):
|
||||
result = None
|
||||
addend = point
|
||||
while k:
|
||||
if k & 1:
|
||||
result = _point_add(result, addend)
|
||||
addend = _point_add(addend, addend)
|
||||
k >>= 1
|
||||
return result
|
||||
|
||||
|
||||
# --- bech32 (BIP-173) ---
|
||||
|
||||
_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
|
||||
|
||||
|
||||
def _bech32_polymod(values):
|
||||
gen = [0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3]
|
||||
chk = 1
|
||||
for v in values:
|
||||
b = chk >> 25
|
||||
chk = (chk & 0x1FFFFFF) << 5 ^ v
|
||||
for i in range(5):
|
||||
chk ^= gen[i] if ((b >> i) & 1) else 0
|
||||
return chk
|
||||
|
||||
|
||||
def _bech32_encode(hrp, data_5bit):
|
||||
hrp_expand = [ord(x) >> 5 for x in hrp] + [0] + [ord(x) & 31 for x in hrp]
|
||||
polymod = _bech32_polymod(hrp_expand + data_5bit + [0] * 6) ^ 1
|
||||
checksum = [(polymod >> 5 * (5 - i)) & 31 for i in range(6)]
|
||||
return hrp + "1" + "".join(_CHARSET[d] for d in data_5bit + checksum)
|
||||
|
||||
|
||||
def _convertbits(data, frombits, tobits):
|
||||
acc, bits, ret = 0, 0, []
|
||||
maxv = (1 << tobits) - 1
|
||||
for value in data:
|
||||
acc = (acc << frombits) | value
|
||||
bits += frombits
|
||||
while bits >= tobits:
|
||||
bits -= tobits
|
||||
ret.append((acc >> bits) & maxv)
|
||||
if bits:
|
||||
ret.append((acc << (tobits - bits)) & maxv)
|
||||
return ret
|
||||
|
||||
|
||||
# --- public API ---
|
||||
|
||||
def derive(mesh_name, node_name):
|
||||
nsec_hex = hashlib.sha256(f"{mesh_name}|{node_name}".encode()).hexdigest()
|
||||
k = int(nsec_hex, 16)
|
||||
pub = _scalar_mult(k, (Gx, Gy))
|
||||
x_hex = format(pub[0], "064x")
|
||||
data_5bit = _convertbits(list(bytes.fromhex(x_hex)), 8, 5)
|
||||
npub = _bech32_encode("npub", data_5bit)
|
||||
return nsec_hex, npub
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) != 3:
|
||||
print(f"Usage: {sys.argv[0]} <mesh-name> <node-name>", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
nsec, npub = derive(sys.argv[1], sys.argv[2])
|
||||
print(f"nsec={nsec}")
|
||||
print(f"npub={npub}")
|
||||
Executable
+219
@@ -0,0 +1,219 @@
|
||||
#!/bin/bash
|
||||
# Generate FIPS node configuration files from template and topology definition.
|
||||
#
|
||||
# Usage: ./generate-configs.sh <topology> [mesh-name]
|
||||
# topology: mesh, mesh-public, chain, etc.
|
||||
# mesh-name: optional; when given, docker node identities are derived
|
||||
# deterministically via sha256(mesh-name|node-id)
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CONFIG_DIR="$SCRIPT_DIR/../configs"
|
||||
GENERATED_DIR="$SCRIPT_DIR/../generated-configs"
|
||||
TEMPLATE_FILE="$CONFIG_DIR/node.template.yaml"
|
||||
DERIVE_KEYS="$SCRIPT_DIR/derive-keys.py"
|
||||
|
||||
# Parse topology YAML to extract node attributes
|
||||
# Usage: get_node_attr <topology_file> <node_id> <attr_name>
|
||||
get_node_attr() {
|
||||
local topology_file="$1"
|
||||
local node_id="$2"
|
||||
local attr="$3"
|
||||
# Handle both docker_ip and external_ip as "address"
|
||||
if [ "$attr" = "address" ]; then
|
||||
local ip=$(grep -A 10 "^ $node_id:" "$topology_file" | grep "docker_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
|
||||
if [ -z "$ip" ]; then
|
||||
ip=$(grep -A 10 "^ $node_id:" "$topology_file" | grep "external_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
|
||||
fi
|
||||
echo "$ip"
|
||||
else
|
||||
grep -A 10 "^ $node_id:" "$topology_file" | grep "${attr}:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/'
|
||||
fi
|
||||
}
|
||||
|
||||
# Check if a node is external (has external_ip instead of docker_ip)
|
||||
is_external_node() {
|
||||
local topology_file="$1"
|
||||
local node_id="$2"
|
||||
local docker_ip=$(grep -A 10 "^ $node_id:" "$topology_file" | grep "docker_ip:" | head -1)
|
||||
[ -z "$docker_ip" ]
|
||||
}
|
||||
|
||||
# Get peers list from topology
|
||||
get_peers() {
|
||||
local topology_file="$1"
|
||||
local node_id="$2"
|
||||
grep -A 10 "^ $node_id:" "$topology_file" | grep "peers:" | head -1 | \
|
||||
sed 's/.*: *\[\(.*\)\].*/\1/' | \
|
||||
sed 's/,/ /g' | \
|
||||
tr -s ' ' | \
|
||||
sed 's/^ *//;s/ *$//'
|
||||
}
|
||||
|
||||
# Get all node IDs from topology file
|
||||
get_node_ids() {
|
||||
local topology_file="$1"
|
||||
grep "^ [a-z][a-z0-9_-]*:" "$topology_file" | sed 's/^ \([a-z][a-z0-9_-]*\):.*/\1/'
|
||||
}
|
||||
|
||||
# Resolve nsec and npub for a node.
|
||||
# If MESH_NAME is set and node is not external, derive from mesh-name.
|
||||
# Otherwise use the value from the topology YAML.
|
||||
# Output: two lines: nsec=<hex>\nnpub=<bech32>
|
||||
resolve_keys() {
|
||||
local topology_file="$1"
|
||||
local node_id="$2"
|
||||
|
||||
if [ -n "$MESH_NAME" ] && ! is_external_node "$topology_file" "$node_id"; then
|
||||
python3 "$DERIVE_KEYS" "$MESH_NAME" "$node_id"
|
||||
else
|
||||
local nsec
|
||||
local npub
|
||||
nsec=$(get_node_attr "$topology_file" "$node_id" "nsec")
|
||||
npub=$(get_node_attr "$topology_file" "$node_id" "npub")
|
||||
echo "nsec=$nsec"
|
||||
echo "npub=$npub"
|
||||
fi
|
||||
}
|
||||
|
||||
generate_peer_block() {
|
||||
local topology_file="$1"
|
||||
local peer_id="$2"
|
||||
|
||||
local peer_npub="$(get_key RESOLVED_NPUB "$peer_id")"
|
||||
local peer_ip=$(get_node_attr "$topology_file" "$peer_id" "address")
|
||||
|
||||
cat <<EOF
|
||||
- npub: "$peer_npub"
|
||||
alias: "node-$peer_id"
|
||||
addresses:
|
||||
- transport: udp
|
||||
addr: "$peer_ip:4000"
|
||||
connect_policy: auto_connect
|
||||
EOF
|
||||
}
|
||||
|
||||
generate_config() {
|
||||
local node_id="$1"
|
||||
local topology_file="$2"
|
||||
local output_file="$3"
|
||||
|
||||
local node_npub
|
||||
node_npub="$(get_key RESOLVED_NPUB "$node_id")"
|
||||
local node_nsec
|
||||
node_nsec="$(get_key RESOLVED_NSEC "$node_id")"
|
||||
local peers=$(get_peers "$topology_file" "$node_id")
|
||||
|
||||
# Generate peers section
|
||||
local peers_config=""
|
||||
if [ -n "$peers" ]; then
|
||||
for peer_id in $peers; do
|
||||
if [ -n "$peers_config" ]; then
|
||||
peers_config="$peers_config"$'\n'
|
||||
fi
|
||||
peers_config="$peers_config$(generate_peer_block "$topology_file" "$peer_id")"
|
||||
done
|
||||
else
|
||||
peers_config=" []"
|
||||
fi
|
||||
|
||||
# Read and process template
|
||||
local template=$(cat "$TEMPLATE_FILE")
|
||||
local config="$template"
|
||||
|
||||
config="${config//\{\{NODE_NAME\}\}/$(echo "$node_id" | tr '[:lower:]' '[:upper:]')}"
|
||||
config="${config//\{\{TOPOLOGY\}\}/$(basename "$topology_file" .yaml)}"
|
||||
config="${config//\{\{NPUB\}\}/$node_npub}"
|
||||
config="${config//\{\{NSEC\}\}/$node_nsec}"
|
||||
config="${config//\{\{PEERS\}\}/$peers_config}"
|
||||
|
||||
echo "$config" > "$output_file"
|
||||
}
|
||||
|
||||
# Key storage for bash 3.2 compatibility (using prefixed variables instead of associative arrays)
|
||||
# Usage: set_key NSEC a "value" / get_key NSEC a
|
||||
set_key() {
|
||||
local prefix="$1"
|
||||
local key="$2"
|
||||
local value="$3"
|
||||
eval "${prefix}_${key}=\"${value}\""
|
||||
}
|
||||
|
||||
get_key() {
|
||||
local prefix="$1"
|
||||
local key="$2"
|
||||
eval "echo \"\$${prefix}_${key}\""
|
||||
}
|
||||
|
||||
generate_topology() {
|
||||
local topology_name="$1"
|
||||
local topology_file="$CONFIG_DIR/topologies/$topology_name.yaml"
|
||||
local output_dir="$GENERATED_DIR/$topology_name"
|
||||
|
||||
if [ ! -f "$topology_file" ]; then
|
||||
echo "Error: Topology file not found: $topology_file"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Generating $topology_name topology configs..."
|
||||
if [ -n "$MESH_NAME" ]; then
|
||||
echo " Mesh name: $MESH_NAME (deriving docker node identities)"
|
||||
fi
|
||||
mkdir -p "$output_dir"
|
||||
|
||||
# Phase 1: resolve keys for all nodes
|
||||
for node_id in $(get_node_ids "$topology_file"); do
|
||||
local keys=""
|
||||
keys=$(resolve_keys "$topology_file" "$node_id")
|
||||
set_key RESOLVED_NSEC "$node_id" "$(echo "$keys" | grep "^nsec=" | cut -d= -f2)"
|
||||
set_key RESOLVED_NPUB "$node_id" "$(echo "$keys" | grep "^npub=" | cut -d= -f2)"
|
||||
done
|
||||
|
||||
# Phase 2: generate config files for docker nodes
|
||||
for node_id in $(get_node_ids "$topology_file"); do
|
||||
# Skip external nodes (they don't need Docker config files)
|
||||
if is_external_node "$topology_file" "$node_id"; then
|
||||
echo " ⚠ Skipping $node_id (external node)"
|
||||
continue
|
||||
fi
|
||||
|
||||
local output_file="$output_dir/node-$node_id.yaml"
|
||||
generate_config "$node_id" "$topology_file" "$output_file"
|
||||
echo " ✓ Generated $output_file"
|
||||
done
|
||||
|
||||
# Phase 3: write npubs.env
|
||||
local env_file="$GENERATED_DIR/npubs.env"
|
||||
echo "# Generated by generate-configs.sh (topology: $topology_name)" > "$env_file"
|
||||
if [ -n "$MESH_NAME" ]; then
|
||||
echo "# Mesh name: $MESH_NAME" >> "$env_file"
|
||||
fi
|
||||
for node_id in $(get_node_ids "$topology_file"); do
|
||||
local var_name="NPUB_$(echo "$node_id" | tr '[:lower:]' '[:upper:]')"
|
||||
echo "${var_name}=$(get_key RESOLVED_NPUB "$node_id")" >> "$env_file"
|
||||
done
|
||||
echo " ✓ Generated $env_file"
|
||||
}
|
||||
|
||||
main() {
|
||||
local requested="${1:-mesh}"
|
||||
|
||||
# Support any topology file in the topologies directory
|
||||
if [ -f "$CONFIG_DIR/topologies/$requested.yaml" ]; then
|
||||
generate_topology "$requested"
|
||||
else
|
||||
echo "Error: Unknown topology '$requested'"
|
||||
echo "Usage: $0 <topology> [mesh-name]"
|
||||
echo ""
|
||||
echo "Available topologies:"
|
||||
ls -1 "$CONFIG_DIR/topologies/" | sed 's/\.yaml$//' | sed 's/^/ - /'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "✓ All configurations generated successfully!"
|
||||
}
|
||||
|
||||
MESH_NAME="${2:-}"
|
||||
main "$@"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/bash
|
||||
# End-to-end iperf3 bandwidth test between FIPS nodes via DNS resolution.
|
||||
# Usage: ./iperf-test.sh [mesh|chain] [--live]
|
||||
#
|
||||
# Requires containers to be running:
|
||||
# docker compose --profile mesh up -d
|
||||
# ./scripts/iperf-test.sh mesh
|
||||
# ./scripts/iperf-test.sh mesh --live # Show live iperf3 output
|
||||
set -e
|
||||
|
||||
# Exit entire script on Ctrl+C
|
||||
trap 'echo ""; echo "Test interrupted"; exit 130' INT
|
||||
|
||||
PROFILE="${1:-mesh}"
|
||||
LIVE_OUTPUT=false
|
||||
if [ "$2" = "--live" ] || [ "$1" = "--live" ]; then
|
||||
LIVE_OUTPUT=true
|
||||
[ "$1" = "--live" ] && PROFILE="mesh"
|
||||
fi
|
||||
|
||||
DURATION=10
|
||||
PARALLEL=8
|
||||
PASSED=0
|
||||
FAILED=0
|
||||
|
||||
# Node identities (from generated env file)
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
|
||||
if [ ! -f "$ENV_FILE" ]; then
|
||||
echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck source=../generated-configs/npubs.env
|
||||
source "$ENV_FILE"
|
||||
|
||||
iperf_test() {
|
||||
local server_node="$1"
|
||||
local client_node="$2"
|
||||
local dest_npub="$3"
|
||||
local label="$4"
|
||||
|
||||
echo ""
|
||||
echo "=== $label ==="
|
||||
|
||||
# iperf3 server is already running in daemon mode in each container
|
||||
|
||||
if [ "$LIVE_OUTPUT" = true ]; then
|
||||
# Show live output
|
||||
echo "Running iperf3 test (live output):"
|
||||
if docker exec "fips-$client_node" iperf3 -c "${dest_npub}.fips" -t "$DURATION" -P "$PARALLEL"; then
|
||||
PASSED=$((PASSED + 1))
|
||||
else
|
||||
echo "FAIL"
|
||||
FAILED=$((FAILED + 1))
|
||||
fi
|
||||
else
|
||||
# Capture and summarize output
|
||||
echo -n "Running iperf3 test... "
|
||||
local output
|
||||
if output=$(docker exec "fips-$client_node" iperf3 -c "${dest_npub}.fips" -t "$DURATION" -P "$PARALLEL" 2>&1); then
|
||||
# Check if we got valid results
|
||||
if echo "$output" | grep -q "sender"; then
|
||||
# Extract and display results (get SUM line for aggregate bandwidth)
|
||||
local bandwidth=$(echo "$output" | grep "\[SUM\].*sender" | tail -1 | awk '{for(i=1;i<=NF;i++) if($i ~ /bits\/sec/) {print $(i-1), $i; exit}}')
|
||||
echo "OK"
|
||||
echo "Bandwidth: $bandwidth"
|
||||
PASSED=$((PASSED + 1))
|
||||
else
|
||||
echo "FAIL (no bandwidth data)"
|
||||
echo "Output: $output"
|
||||
FAILED=$((FAILED + 1))
|
||||
fi
|
||||
else
|
||||
echo "FAIL"
|
||||
echo "Error output:"
|
||||
echo "$output" | head -10
|
||||
FAILED=$((FAILED + 1))
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
echo "=== FIPS iperf3 Bandwidth Test ($PROFILE topology) ==="
|
||||
echo ""
|
||||
|
||||
# Wait for nodes to converge
|
||||
echo "Waiting 3s for mesh convergence..."
|
||||
sleep 3
|
||||
|
||||
if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
|
||||
# Test key paths in mesh topology
|
||||
echo ""
|
||||
echo "Testing mesh topology paths:"
|
||||
|
||||
# Direct peer links (client on A, server on D/E)
|
||||
iperf_test node-d node-a "$NPUB_D" "A → D (direct peer)"
|
||||
iperf_test node-e node-a "$NPUB_E" "A → E (direct peer)"
|
||||
|
||||
# Multi-hop paths (client on A, server on B/C)
|
||||
iperf_test node-b node-a "$NPUB_B" "A → B (multi-hop)"
|
||||
iperf_test node-c node-a "$NPUB_C" "A → C (multi-hop)"
|
||||
|
||||
# Reverse test (client on E, server on A)
|
||||
iperf_test node-a node-e "$NPUB_A" "E → A (direct peer)"
|
||||
|
||||
elif [ "$PROFILE" = "chain" ]; then
|
||||
echo ""
|
||||
echo "Testing chain topology paths:"
|
||||
|
||||
# Adjacent hop (client on A, server on B)
|
||||
iperf_test node-b node-a "$NPUB_B" "A → B (1 hop)"
|
||||
|
||||
# Multi-hop tests (client on A, server on C/D/E)
|
||||
iperf_test node-c node-a "$NPUB_C" "A → C (2 hops)"
|
||||
iperf_test node-d node-a "$NPUB_D" "A → D (3 hops)"
|
||||
iperf_test node-e node-a "$NPUB_E" "A → E (4 hops)"
|
||||
|
||||
# Reverse multi-hop (client on E, server on A)
|
||||
iperf_test node-a node-e "$NPUB_A" "E → A (4 hops)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Results: $PASSED passed, $FAILED failed ==="
|
||||
[ "$FAILED" -eq 0 ] && exit 0 || exit 1
|
||||
Executable
+245
@@ -0,0 +1,245 @@
|
||||
#!/bin/bash
|
||||
# Network impairment simulation using tc/netem on FIPS Docker containers.
|
||||
#
|
||||
# Usage: ./netem.sh <mesh|chain> <apply|remove|status> [options]
|
||||
#
|
||||
# Actions:
|
||||
# apply - Apply netem rules to all containers in the profile
|
||||
# remove - Remove netem rules from all containers
|
||||
# status - Show current tc qdisc state on each container
|
||||
#
|
||||
# Options (for apply):
|
||||
# --delay <ms> Fixed delay in milliseconds
|
||||
# --jitter <ms> Delay variation (requires --delay)
|
||||
# --loss <percent> Packet loss percentage
|
||||
# --loss-corr <percent> Loss correlation for bursty loss
|
||||
# --duplicate <percent> Packet duplication percentage
|
||||
# --reorder <percent> Packet reordering probability
|
||||
# --corrupt <percent> Bit-level corruption percentage
|
||||
#
|
||||
# Presets (shorthand for common combinations):
|
||||
# --preset lossy 5% loss, 25% correlation
|
||||
# --preset congested 50ms delay, 20ms jitter, 2% loss
|
||||
# --preset terrible 100ms delay, 40ms jitter, 10% loss, 1% dup, 5% reorder
|
||||
#
|
||||
# Examples:
|
||||
# ./netem.sh mesh apply --delay 50 --loss 5
|
||||
# ./netem.sh chain apply --preset congested
|
||||
# ./netem.sh mesh status
|
||||
# ./netem.sh mesh remove
|
||||
set -e
|
||||
|
||||
trap 'echo ""; echo "Interrupted"; exit 130' INT
|
||||
|
||||
NODES="a b c d e"
|
||||
IFACE="eth0"
|
||||
|
||||
# Defaults
|
||||
DELAY=0
|
||||
JITTER=0
|
||||
LOSS=0
|
||||
LOSS_CORR=0
|
||||
DUPLICATE=0
|
||||
REORDER=0
|
||||
CORRUPT=0
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 <mesh|chain> <apply|remove|status> [options]"
|
||||
echo ""
|
||||
echo "Actions:"
|
||||
echo " apply - Apply netem rules to all containers"
|
||||
echo " remove - Remove netem rules from all containers"
|
||||
echo " status - Show current tc qdisc on each container"
|
||||
echo ""
|
||||
echo "Options (for apply):"
|
||||
echo " --delay <ms> Fixed delay"
|
||||
echo " --jitter <ms> Delay variation (requires --delay)"
|
||||
echo " --loss <percent> Packet loss"
|
||||
echo " --loss-corr <percent> Loss correlation"
|
||||
echo " --duplicate <percent> Packet duplication"
|
||||
echo " --reorder <percent> Packet reordering"
|
||||
echo " --corrupt <percent> Bit-level corruption"
|
||||
echo " --preset <name> Use a named preset (lossy, congested, terrible)"
|
||||
exit 1
|
||||
}
|
||||
|
||||
apply_preset() {
|
||||
case "$1" in
|
||||
lossy)
|
||||
LOSS=5
|
||||
LOSS_CORR=25
|
||||
;;
|
||||
congested)
|
||||
DELAY=50
|
||||
JITTER=20
|
||||
LOSS=2
|
||||
;;
|
||||
terrible)
|
||||
DELAY=100
|
||||
JITTER=40
|
||||
LOSS=10
|
||||
DUPLICATE=1
|
||||
REORDER=5
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown preset '$1'" >&2
|
||||
echo "Available presets: lossy, congested, terrible" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Parse arguments
|
||||
[ $# -lt 2 ] && usage
|
||||
|
||||
PROFILE="$1"
|
||||
ACTION="$2"
|
||||
shift 2
|
||||
|
||||
case "$PROFILE" in
|
||||
mesh|chain) ;;
|
||||
*) echo "Error: Profile must be 'mesh' or 'chain'" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
case "$ACTION" in
|
||||
apply|remove|status) ;;
|
||||
*) echo "Error: Action must be 'apply', 'remove', or 'status'" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
# Parse options
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--delay) DELAY="$2"; shift 2 ;;
|
||||
--jitter) JITTER="$2"; shift 2 ;;
|
||||
--loss) LOSS="$2"; shift 2 ;;
|
||||
--loss-corr) LOSS_CORR="$2"; shift 2 ;;
|
||||
--duplicate) DUPLICATE="$2"; shift 2 ;;
|
||||
--reorder) REORDER="$2"; shift 2 ;;
|
||||
--corrupt) CORRUPT="$2"; shift 2 ;;
|
||||
--preset) apply_preset "$2"; shift 2 ;;
|
||||
*)
|
||||
echo "Error: Unknown option '$1'" >&2
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
# Build netem parameter string from non-zero values
|
||||
build_netem_params() {
|
||||
local params=""
|
||||
|
||||
if [ "$DELAY" != "0" ]; then
|
||||
params="delay ${DELAY}ms"
|
||||
if [ "$JITTER" != "0" ]; then
|
||||
params="$params ${JITTER}ms"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$LOSS" != "0" ]; then
|
||||
params="$params loss ${LOSS}%"
|
||||
if [ "$LOSS_CORR" != "0" ]; then
|
||||
params="$params ${LOSS_CORR}%"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DUPLICATE" != "0" ]; then
|
||||
params="$params duplicate ${DUPLICATE}%"
|
||||
fi
|
||||
|
||||
if [ "$REORDER" != "0" ]; then
|
||||
if [ "$DELAY" = "0" ]; then
|
||||
echo "Error: --reorder requires --delay (reordering needs a delay queue)" >&2
|
||||
exit 1
|
||||
fi
|
||||
params="$params reorder ${REORDER}%"
|
||||
fi
|
||||
|
||||
if [ "$CORRUPT" != "0" ]; then
|
||||
params="$params corrupt ${CORRUPT}%"
|
||||
fi
|
||||
|
||||
echo "$params"
|
||||
}
|
||||
|
||||
# Check if a container is running
|
||||
container_running() {
|
||||
docker inspect -f '{{.State.Running}}' "$1" 2>/dev/null | grep -q true
|
||||
}
|
||||
|
||||
do_apply() {
|
||||
local params
|
||||
params=$(build_netem_params)
|
||||
|
||||
if [ -z "$params" ]; then
|
||||
echo "Error: No impairment parameters specified" >&2
|
||||
echo "Use --delay, --loss, --duplicate, --reorder, --corrupt, or --preset" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== Applying netem: $params ==="
|
||||
echo ""
|
||||
|
||||
for node in $NODES; do
|
||||
local container="fips-node-$node"
|
||||
echo -n " $container ... "
|
||||
if ! container_running "$container"; then
|
||||
echo "SKIP (not running)"
|
||||
continue
|
||||
fi
|
||||
if docker exec "$container" tc qdisc replace dev "$IFACE" root netem $params 2>&1; then
|
||||
echo "OK"
|
||||
else
|
||||
echo "FAIL"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
do_remove() {
|
||||
echo "=== Removing netem rules ==="
|
||||
echo ""
|
||||
|
||||
for node in $NODES; do
|
||||
local container="fips-node-$node"
|
||||
echo -n " $container ... "
|
||||
if ! container_running "$container"; then
|
||||
echo "SKIP (not running)"
|
||||
continue
|
||||
fi
|
||||
# Suppress error if no qdisc exists
|
||||
if docker exec "$container" tc qdisc del dev "$IFACE" root 2>/dev/null; then
|
||||
echo "OK"
|
||||
else
|
||||
echo "OK (no rules)"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
do_status() {
|
||||
echo "=== netem status ==="
|
||||
echo ""
|
||||
|
||||
for node in $NODES; do
|
||||
local container="fips-node-$node"
|
||||
echo " $container:"
|
||||
if ! container_running "$container"; then
|
||||
echo " (not running)"
|
||||
continue
|
||||
fi
|
||||
local output
|
||||
output=$(docker exec "$container" tc qdisc show dev "$IFACE" 2>&1)
|
||||
if echo "$output" | grep -q "netem"; then
|
||||
echo " $output"
|
||||
else
|
||||
echo " (no netem rules)"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
case "$ACTION" in
|
||||
apply) do_apply ;;
|
||||
remove) do_remove ;;
|
||||
status) do_status ;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Done."
|
||||
Executable
+115
@@ -0,0 +1,115 @@
|
||||
#!/bin/bash
|
||||
# End-to-end ping test between FIPS nodes via DNS resolution.
|
||||
# Usage: ./ping-test.sh [mesh|chain]
|
||||
#
|
||||
# Requires containers to be running:
|
||||
# docker compose --profile mesh up -d
|
||||
# ./scripts/ping-test.sh mesh
|
||||
set -e
|
||||
|
||||
# Exit entire script on Ctrl+C
|
||||
trap 'echo ""; echo "Test interrupted"; exit 130' INT
|
||||
|
||||
PROFILE="${1:-mesh}"
|
||||
COUNT=1
|
||||
TIMEOUT=5
|
||||
PASSED=0
|
||||
FAILED=0
|
||||
|
||||
# Node identities (from generated env file)
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
|
||||
if [ ! -f "$ENV_FILE" ]; then
|
||||
echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck source=../generated-configs/npubs.env
|
||||
source "$ENV_FILE"
|
||||
|
||||
ping_test() {
|
||||
local from="$1"
|
||||
local to_npub="$2"
|
||||
local label="$3"
|
||||
|
||||
echo -n " $label ... "
|
||||
local output
|
||||
if output=$(docker exec "fips-$from" ping6 -c "$COUNT" -W "$TIMEOUT" "${to_npub}.fips" 2>&1); then
|
||||
# Extract round-trip time from ping output
|
||||
local rtt=$(echo "$output" | grep -oE 'time=[0-9.]+' | cut -d= -f2)
|
||||
if [ -n "$rtt" ]; then
|
||||
echo "OK (${rtt}ms)"
|
||||
else
|
||||
echo "OK"
|
||||
fi
|
||||
PASSED=$((PASSED + 1))
|
||||
else
|
||||
echo "FAIL"
|
||||
FAILED=$((FAILED + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
echo "=== FIPS Ping Test ($PROFILE topology) ==="
|
||||
echo ""
|
||||
|
||||
# Wait for nodes to converge
|
||||
echo "Waiting 3s for mesh convergence..."
|
||||
sleep 3
|
||||
|
||||
if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
|
||||
# Sparse mesh topology: A-B, B-C, C-D, D-E, E-A, A-D
|
||||
# Test all 20 directed pairs (5 nodes × 4 targets each)
|
||||
echo ""
|
||||
echo "From node-a:"
|
||||
ping_test node-a "$NPUB_B" "A → B"
|
||||
ping_test node-a "$NPUB_C" "A → C"
|
||||
ping_test node-a "$NPUB_D" "A → D"
|
||||
ping_test node-a "$NPUB_E" "A → E"
|
||||
|
||||
echo ""
|
||||
echo "From node-b:"
|
||||
ping_test node-b "$NPUB_A" "B → A"
|
||||
ping_test node-b "$NPUB_C" "B → C"
|
||||
ping_test node-b "$NPUB_D" "B → D"
|
||||
ping_test node-b "$NPUB_E" "B → E"
|
||||
|
||||
echo ""
|
||||
echo "From node-c:"
|
||||
ping_test node-c "$NPUB_A" "C → A"
|
||||
ping_test node-c "$NPUB_B" "C → B"
|
||||
ping_test node-c "$NPUB_D" "C → D"
|
||||
ping_test node-c "$NPUB_E" "C → E"
|
||||
|
||||
echo ""
|
||||
echo "From node-d:"
|
||||
ping_test node-d "$NPUB_A" "D → A"
|
||||
ping_test node-d "$NPUB_B" "D → B"
|
||||
ping_test node-d "$NPUB_C" "D → C"
|
||||
ping_test node-d "$NPUB_E" "D → E"
|
||||
|
||||
echo ""
|
||||
echo "From node-e:"
|
||||
ping_test node-e "$NPUB_A" "E → A"
|
||||
ping_test node-e "$NPUB_B" "E → B"
|
||||
ping_test node-e "$NPUB_C" "E → C"
|
||||
ping_test node-e "$NPUB_D" "E → D"
|
||||
|
||||
elif [ "$PROFILE" = "chain" ]; then
|
||||
echo ""
|
||||
echo "Adjacent peer tests:"
|
||||
ping_test node-a "$NPUB_B" "A → B (1 hop)"
|
||||
ping_test node-b "$NPUB_C" "B → C (1 hop)"
|
||||
|
||||
echo ""
|
||||
echo "Multi-hop tests:"
|
||||
ping_test node-a "$NPUB_C" "A → C (2 hops)"
|
||||
ping_test node-a "$NPUB_D" "A → D (3 hops)"
|
||||
ping_test node-a "$NPUB_E" "A → E (4 hops)"
|
||||
|
||||
echo ""
|
||||
echo "Reverse multi-hop:"
|
||||
ping_test node-e "$NPUB_A" "E → A (4 hops)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Results: $PASSED passed, $FAILED failed ==="
|
||||
[ "$FAILED" -eq 0 ] && exit 0 || exit 1
|
||||
Reference in New Issue
Block a user