mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 16:24:45 +00:00
Martti MalmiandJohnathan Corgan
b05c80e5f5
New testing/boringtun/ harness runs two Cloudflare BoringTun userspace WireGuard containers with iperf3 between them, giving a single-hop userspace tunnel baseline for comparison against FIPS throughput numbers. Local WG key generation runs through the harness image so the host needs no wireguard-tools. New testing/static/scripts/iperf-compare-refs.sh builds two git refs into separate fips-test:* images via git worktree and runs the same static iperf topology against both, with RUNS-based repetition and aggregate avg/min/max reporting. testing/static/scripts/iperf-test.sh gains DURATION, PARALLEL, SETTLE_SECONDS, IPERF_TIMEOUT env knobs and a per-path iperf timeout. testing/static/docker-compose.yml selects the image under test via FIPS_TEST_IMAGE; testing/scripts/build.sh respects CARGO_TARGET_DIR. Author benchmark on aarch64 Docker Desktop: boringtun bob -> alice : 1000.13 Mbits/sec
30 lines
1.1 KiB
Markdown
30 lines
1.1 KiB
Markdown
# BoringTun Throughput Baseline
|
|
|
|
This harness runs two userspace WireGuard peers with Cloudflare BoringTun and
|
|
measures single-stream TCP throughput with `iperf3`. It is intended as a simple
|
|
baseline for comparing FIPS tunnel throughput against another userspace tunnel.
|
|
|
|
```bash
|
|
docker build -t boringtun-test:latest testing/boringtun
|
|
testing/boringtun/scripts/generate-keys.sh
|
|
docker compose -f testing/boringtun/docker-compose.yml up -d
|
|
testing/boringtun/scripts/bench.sh
|
|
docker compose -f testing/boringtun/docker-compose.yml down
|
|
```
|
|
|
|
The generated WireGuard key material is written under
|
|
`testing/boringtun/generated/` and is ignored by git.
|
|
|
|
For FIPS-to-FIPS revision comparisons, use the static topology comparison
|
|
script:
|
|
|
|
```bash
|
|
testing/static/scripts/iperf-compare-refs.sh origin/master HEAD mesh
|
|
```
|
|
|
|
That script builds each ref into a separate `fips-test:*` image, runs the
|
|
same static `iperf3` topology against both images, and prints a bandwidth
|
|
summary for each path. Override `DURATION`, `PARALLEL`, `SETTLE_SECONDS`, or
|
|
`IPERF_TIMEOUT` in the environment when needed. Set `RUNS=3` or similar to
|
|
repeat each ref and print aggregate results.
|