mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 08:14:42 +00:00
Johnathan Corgan
0e42c789be
The compose pinned 172.32.0.0/24 with a per-container ipv4_address, so two concurrent runs asked docker for the same address space and the second failed with a pool-overlap error. Request no subnet and let docker assign one from the daemon pool. Peers address each other by the docker hostname the compose already sets (host-a, host-b) rather than by literal IP; docker's embedded DNS is per-network, so the same hostname in two runs resolves inside each run's own subnet. Nothing this suite asserts on moves as a result: its checks run over the fips0 overlay, whose addresses are derived from node npubs and are independent of docker addressing, and the packaged nftables ruleset matches on interface rather than on any address. The generated config directory moves under the run suffix for the same reason it did in the acl suite, and the run teardown gains the matching removal so a run no longer leaves its directory behind. Case (b) also wrote curl's output to a fixed path under /tmp. Two concurrent runs shared that one file, and either run's cleanup landing between the other's write and read left an empty read, failing the http_code check for a reason having nothing to do with the firewall. It uses mktemp now. As in the acl suite, the floating subnet removes one of the two obstacles to concurrent runs. The compose project name is still fixed; the local CI runner scopes it externally, a bare hand run does not, and the comment at the site says so rather than claiming the file is self-sufficient.
122 lines
4.1 KiB
Markdown
122 lines
4.1 KiB
Markdown
# Firewall Baseline Test
|
|
|
|
End-to-end exercise of the production fips0 nftables baseline at
|
|
`packaging/common/fips.nft`. Closes the v0.3.0 audit gap that the
|
|
default-deny + conntrack + drop-in semantics had no integration coverage.
|
|
|
|
## What this exercises
|
|
|
|
The `fips.nft` baseline polices ONLY the fips0 mesh interface and
|
|
implements default-deny inbound. This suite asserts the four behaviors
|
|
documented in the file's header are actually true on a live mesh:
|
|
|
|
- **(a)** Unallowed inbound on fips0 is **dropped**
|
|
- **(b)** Outbound-initiated flows get their reply via the
|
|
`ct state established,related accept` rule
|
|
- **(c)** ICMPv6 echo-request is **accepted** (ping6 reachability)
|
|
- **(d)** A drop-in `.nft` file under `/etc/fips/fips.d/` adds an
|
|
allowlisted port and that port is **accepted**
|
|
|
|
A drop-counter check after case (a) confirms the connection was
|
|
actively DROP'd by the fips chain (not silently unrouted).
|
|
|
|
## Topology
|
|
|
|
Two FIPS nodes peered over UDP on a Docker bridge network:
|
|
|
|
| Container | Hostname | Firewall |
|
|
|-------------------------|----------|----------|
|
|
| `fips-fw-container-a` | `host-a` | none (probe) |
|
|
| `fips-fw-container-b` | `host-b` | `fips.nft` + drop-in |
|
|
|
|
The bridge network requests no subnet, so docker assigns one from its own
|
|
address pool and two concurrent runs never contend for a fixed range. No
|
|
node's IPv4 address is therefore known before startup, and the generated peer
|
|
stanzas address each other by docker hostname, resolved through the
|
|
container's dnsmasq to docker's embedded DNS. The firewall assertions
|
|
themselves are unaffected: they run over the fips0 overlay, whose addresses
|
|
are derived from the node npubs.
|
|
|
|
`node-b` mounts the production `packaging/common/fips.nft` read-only at
|
|
`/etc/fips/fips.nft`, plus a drop-in at `/etc/fips/fips.d/services.nft`
|
|
containing `tcp dport 22 accept`. `node-a` is unfirewalled and serves
|
|
as the probe origin.
|
|
|
|
Both containers run the unified test image's `default` mode, which
|
|
starts dnsmasq + sshd (port 22) + iperf3 + python http.server on
|
|
port 8000 + the FIPS daemon.
|
|
|
|
## fips-firewall.service activation
|
|
|
|
The production unit's ExecStart is:
|
|
|
|
```text
|
|
ExecStart=/usr/sbin/nft -f /etc/fips/fips.nft
|
|
```
|
|
|
|
The unified test image does not run systemd, so `test.sh` invokes the
|
|
same `nft -f` command directly inside `node-b` after fips0 is up and
|
|
peering has converged. The deb-install harness covers the systemd
|
|
unit-enablement path under real systemd separately.
|
|
|
|
## Run
|
|
|
|
Build the Linux binaries and test image:
|
|
|
|
```bash
|
|
./testing/scripts/build.sh --no-docker
|
|
```
|
|
|
|
Run the suite:
|
|
|
|
```bash
|
|
./testing/firewall/test.sh
|
|
```
|
|
|
|
`test.sh` regenerates fixtures automatically before starting Docker.
|
|
Use `--skip-build` to reuse the existing release binaries. Use
|
|
`--keep-up` to leave the containers running for inspection.
|
|
|
|
## Expected output shape
|
|
|
|
```text
|
|
=== Generating firewall fixtures
|
|
=== Starting firewall harness
|
|
=== Waiting for fips0 on both nodes
|
|
=== Waiting for peer convergence
|
|
=== Resolving fips0 addresses
|
|
node-a: fd97:...
|
|
node-b: fd97:...
|
|
=== Activating fips-firewall on fips-fw-container-b
|
|
PASS: fips-fw-container-b: fips.nft baseline + drop-in loaded
|
|
=== Case (c): ICMPv6 echo-request to firewalled node
|
|
PASS: (c) ICMPv6 ping node-a → node-b accepted
|
|
=== Case (a): unallowed inbound TCP/8000 from node-a → node-b
|
|
PASS: (a) inbound TCP/8000 dropped (curl rc=28, timed out as expected)
|
|
=== Case (b): node-b initiates outbound TCP, expects reply via conntrack
|
|
PASS: (b) outbound from node-b got HTTP 200 via conntrack reply path
|
|
=== Case (d): drop-in allowlisted TCP/22 from node-a → node-b
|
|
PASS: (d) drop-in allowlisted TCP/22 reachable
|
|
=== Drop counter incremented (case a should have ticked it)
|
|
PASS: drop counter = N (case a was actually dropped, not just unrouted)
|
|
=== Firewall integration test passed
|
|
```
|
|
|
|
## Inspect the loaded ruleset
|
|
|
|
```bash
|
|
docker exec fips-fw-container-b nft list table inet fips
|
|
```
|
|
|
|
## Stop and clean up
|
|
|
|
```bash
|
|
docker compose -f testing/firewall/docker-compose.yml down
|
|
```
|
|
|
|
## Generated fixture location
|
|
|
|
`testing/firewall/generated-configs/` (gitignored), or
|
|
`generated-configs<suffix>/` when `FIPS_CI_NAME_SUFFIX` is set, which is how
|
|
concurrent runs keep their fixtures apart.
|