mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Martti MalmiandJohnathan Corgan
b05c80e5f5
New testing/boringtun/ harness runs two Cloudflare BoringTun userspace WireGuard containers with iperf3 between them, giving a single-hop userspace tunnel baseline for comparison against FIPS throughput numbers. Local WG key generation runs through the harness image so the host needs no wireguard-tools. New testing/static/scripts/iperf-compare-refs.sh builds two git refs into separate fips-test:* images via git worktree and runs the same static iperf topology against both, with RUNS-based repetition and aggregate avg/min/max reporting. testing/static/scripts/iperf-test.sh gains DURATION, PARALLEL, SETTLE_SECONDS, IPERF_TIMEOUT env knobs and a per-path iperf timeout. testing/static/docker-compose.yml selects the image under test via FIPS_TEST_IMAGE; testing/scripts/build.sh respects CARGO_TARGET_DIR. Author benchmark on aarch64 Docker Desktop: boringtun bob -> alice : 1000.13 Mbits/sec
29 lines
1.1 KiB
Docker
29 lines
1.1 KiB
Docker
# Minimal boringtun-cli image for throughput benchmarking against FIPS.
|
|
# Userspace WireGuard (boringtun) + wireguard-tools + iperf3 in one
|
|
# image. Run two containers on a docker bridge, configure a WG peer
|
|
# between them, then iperf3 client→server across the tunnel.
|
|
|
|
FROM rust:1-bookworm AS build
|
|
# 0.6.0 (crates.io HEAD) is from 2022 and turns in ~1.7 Mbps in
|
|
# this harness — clearly broken. Pull the boringtun-cli binary from
|
|
# the cloudflare HEAD instead; it gets the post-0.6 perf fixes and
|
|
# the multi-threaded recv loop.
|
|
RUN git clone --depth 1 https://github.com/cloudflare/boringtun /usr/src/boringtun \
|
|
&& cargo install --path /usr/src/boringtun/boringtun-cli
|
|
|
|
FROM debian:bookworm-slim
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
iperf3 \
|
|
iproute2 \
|
|
wireguard-tools \
|
|
iputils-ping \
|
|
netcat-openbsd \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=build /usr/local/cargo/bin/boringtun-cli /usr/local/bin/boringtun-cli
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
ENTRYPOINT ["/entrypoint.sh"]
|