mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
0e42c789be
The compose pinned 172.32.0.0/24 with a per-container ipv4_address, so two concurrent runs asked docker for the same address space and the second failed with a pool-overlap error. Request no subnet and let docker assign one from the daemon pool. Peers address each other by the docker hostname the compose already sets (host-a, host-b) rather than by literal IP; docker's embedded DNS is per-network, so the same hostname in two runs resolves inside each run's own subnet. Nothing this suite asserts on moves as a result: its checks run over the fips0 overlay, whose addresses are derived from node npubs and are independent of docker addressing, and the packaged nftables ruleset matches on interface rather than on any address. The generated config directory moves under the run suffix for the same reason it did in the acl suite, and the run teardown gains the matching removal so a run no longer leaves its directory behind. Case (b) also wrote curl's output to a fixed path under /tmp. Two concurrent runs shared that one file, and either run's cleanup landing between the other's write and read left an empty read, failing the http_code check for a reason having nothing to do with the firewall. It uses mktemp now. As in the acl suite, the floating subnet removes one of the two obstacles to concurrent runs. The compose project name is still fixed; the local CI runner scopes it externally, a bare hand run does not, and the comment at the site says so rather than claiming the file is self-sufficient.
63 lines
2.4 KiB
YAML
63 lines
2.4 KiB
YAML
networks:
|
|
# No subnet is requested: docker assigns one from the daemon's address pool.
|
|
# A fixed request is honoured verbatim, so two runs asking for the same range
|
|
# collide on "Pool overlaps" — which is why the generated peer addresses are
|
|
# docker hostnames (host-a, host-b) rather than literal IPs. Docker's embedded
|
|
# DNS is per-network, so the same hostname in two concurrent runs resolves
|
|
# inside each run's own subnet.
|
|
#
|
|
# That removes one of the two obstacles to running this suite twice at once,
|
|
# not both. The compose project name is still fixed, so two runs that do not
|
|
# set COMPOSE_PROJECT_NAME share a project, and the second `up` recreates the
|
|
# first's containers while either `down` removes both. The local CI runner
|
|
# scopes it externally (run_firewall in ci-local.sh); a bare hand run does
|
|
# not. Do not read the floating subnet as making concurrent bare runs safe.
|
|
fw-net:
|
|
driver: bridge
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
context: ../docker
|
|
image: fips-test:latest
|
|
entrypoint: ["/usr/local/bin/entrypoint.sh"]
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- FIPS_TEST_MODE=default
|
|
- RUST_LOG=info,fips::node=debug
|
|
|
|
services:
|
|
service-a:
|
|
<<: *fips-common
|
|
container_name: fips-fw-container-a${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- fw-net
|
|
|
|
service-b:
|
|
<<: *fips-common
|
|
container_name: fips-fw-container-b${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro
|
|
- ../../packaging/common/fips.nft:/etc/fips/fips.nft:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.d:/etc/fips/fips.d:ro
|
|
networks:
|
|
- fw-net
|