diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7420709..b74943b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -382,10 +382,6 @@ jobs: - suite: rekey-outbound-only type: rekey-outbound-only topology: rekey-outbound-only - # ── Inbound max_peers admission-cap test ─────────────────────── - - suite: admission-cap - type: admission-cap - topology: mesh # ── Firewall baseline (fips0 nftables default-deny) ──────────── - suite: firewall type: firewall @@ -754,42 +750,6 @@ jobs: docker compose -f testing/static/docker-compose.yml \ --profile gateway down --volumes --remove-orphans - # ── Inbound max_peers admission-cap integration test ──────────────── - # Lowers node.max_peers on one mesh node and asserts the inbound cap - # holds under sustained retry pressure: denied peers keep retrying but - # are never promoted to an active session. The admission-cap-test.sh - # assertions are tailored per link-layer handshake variant; the leg - # itself is uniform. Static-style harness on the shared mesh profile. - - name: Generate configs (admission-cap) - if: matrix.type == 'admission-cap' - run: bash testing/static/scripts/generate-configs.sh mesh - - - name: Inject admission-cap config (admission-cap) - if: matrix.type == 'admission-cap' - run: bash testing/static/scripts/admission-cap-test.sh inject-config - - - name: Start containers (admission-cap) - if: matrix.type == 'admission-cap' - run: | - docker compose -f testing/static/docker-compose.yml \ - --profile mesh up -d - - - name: Run admission-cap test - if: matrix.type == 'admission-cap' - run: bash testing/static/scripts/admission-cap-test.sh - - - name: Collect logs on failure (admission-cap) - if: matrix.type == 'admission-cap' && failure() - run: | - docker compose -f testing/static/docker-compose.yml \ - --profile mesh logs --no-color | tail -300 - - - name: Stop containers (admission-cap) - if: matrix.type == 'admission-cap' && always() - run: | - docker compose -f testing/static/docker-compose.yml \ - --profile mesh down --volumes --remove-orphans - # ── Real-deb install integration ──────────────────────────────────── # The deb-install harness builds its own .deb from source in a # cargo-deb builder image; the pre-built Linux binary from the diff --git a/testing/ci-local.sh b/testing/ci-local.sh index fa2ba0a..f879ff4 100755 --- a/testing/ci-local.sh +++ b/testing/ci-local.sh @@ -28,7 +28,7 @@ # Integration suites (default coverage): # static-mesh, static-chain, rekey, rekey-accept-off, # rekey-outbound-only, gateway, -# admission-cap, firewall, nat-cone, nat-symmetric, +# firewall, nat-cone, nat-symmetric, # nat-lan, nostr-publish-consume, stun-faults, # chaos-churn-mixed-10, chaos-ethernet-mesh, # chaos-ethernet-only, chaos-tcp-mesh, chaos-congestion-stress, @@ -64,6 +64,16 @@ # coverage was real-UDP admission, exercised by every other # real-transport suite. Still runnable by hand: # bash testing/acl-allowlist/test.sh +# admission-cap Retired from CI 2026-07-24 as redundant, not unrunnable. +# The inbound max_peers early-gate in handle_msg1 is unit- +# tested over a real UDP socket by +# handle_msg1_silent_drops_at_cap_for_new_peer in +# src/node/tests/unit.rs: it sends a Msg1 from a fresh +# identity at saturation and polls the sender socket to +# assert no Msg2 returns — the same wire-observable +# discriminator the Docker tcpdump used — plus a sibling +# test for the existing-peer bypass. Still runnable by hand: +# bash testing/static/scripts/admission-cap-test.sh # ecn-ab-on, ecn-ab-off, maelstrom, maelstrom-sparse # Chaos scenarios excluded from CHAOS_SUITES. The two # ecn-ab ones are halves of the manual comparison above. @@ -124,7 +134,6 @@ ONLY_SUITE="" # All integration suites matching ci.yml STATIC_SUITES=(static-mesh static-chain) REKEY_SUITES=(rekey rekey-accept-off rekey-outbound-only) -ADMISSION_SUITES=(admission-cap) # Each entry: "display-name scenario [--flag value ...]" CHAOS_SUITES=( "churn-mixed-10 churn-mixed --nodes 10 --duration 120" @@ -192,9 +201,6 @@ list_suites() { echo " Rekey:" for s in "${REKEY_SUITES[@]}"; do echo " $s"; done echo "" - echo " Admission cap:" - for s in "${ADMISSION_SUITES[@]}"; do echo " $s"; done - echo "" echo " Gateway:" for s in "${GATEWAY_SUITES[@]}"; do echo " $s"; done echo "" @@ -568,35 +574,6 @@ run_rekey() { record "rekey" $rc } -# Run the admission-cap integration test -# Verifies the inbound max_peers early-gate silent-drops at scale by -# lowering node.max_peers on one mesh node and asserting via tcpdump -# that no Msg2 responses go to the sustained-retrying denied peers. -run_admission_cap() { - local compose="testing/static/docker-compose.yml" - local rc=0 - export COMPOSE_PROJECT_NAME="$(ci_project static)" - - info "[admission-cap] Generating configs" - bash testing/static/scripts/generate-configs.sh mesh || { record "admission-cap" 1; return; } - bash testing/static/scripts/admission-cap-test.sh inject-config || { record "admission-cap" 1; return; } - - info "[admission-cap] Starting containers (mesh profile)" - docker compose -f "$compose" --profile mesh up -d || { record "admission-cap" 1; return; } - - info "[admission-cap] Running admission-cap test" - if bash testing/static/scripts/admission-cap-test.sh; then - rc=0 - else - rc=1 - info "[admission-cap] Collecting failure logs" - docker compose -f "$compose" --profile mesh logs --no-color 2>&1 | tail -100 - fi - - docker compose -f "$compose" --profile mesh down --volumes --remove-orphans 2>/dev/null - record "admission-cap" $rc -} - # Run a chaos scenario run_chaos() { local name="$1" @@ -925,11 +902,6 @@ run_integration() { run_rekey_accept_off run_rekey_outbound_only - # Admission cap (mesh profile, max_peers=1 on one node) - for _suite in "${ADMISSION_SUITES[@]}"; do - run_admission_cap - done - # Gateway run_gateway @@ -1043,8 +1015,6 @@ run_suite() { run_rekey_accept_off ;; rekey-outbound-only) run_rekey_outbound_only ;; - admission-cap) - run_admission_cap ;; gateway) run_gateway ;; firewall)