mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00

Files

T

Johnathan Corgan 33a2063672 Add firewall integration suite covering fips0 default-deny baseline

End-to-end exercise the v0.3.0 nftables firewall baseline so the
security claim — "services on fips0 are not exposed by default" — is
validated in CI rather than by operator opt-in. The packaging postinst
state is pinned by the deb-install matrix; this suite pins the actual
ruleset behavior.

testing/firewall/ — new directory mirroring the acl-allowlist
precedent (kept in its own directory, not extending testing/static):

  docker-compose.yml (52 lines): two FIPS containers on bridge
  172.32.0.0/24, peered over UDP/2121. node-b mounts
  packaging/common/fips.nft RO at /etc/fips/fips.nft and a generated
  drop-in services.nft at /etc/fips/fips.d/.

  test.sh (247 lines): four-case asserter
    (a) curl from node-a to node-b:8000 → DROP (port not allowlisted;
        terminal counter drop fires)
    (b) curl from node-b to node-a:8000 → 200 OK (reply traverses
        node-b's ct state established,related accept)
    (c) ping6 a→b → success (icmpv6 echo-request accept)
    (d) nc -z a→b:22 → success (drop-in tcp dport 22 accept honored
        via include "/etc/fips/fips.d/*.nft")
  Plus drop-counter check after case (a) confirms the dropped
  connection actually hit the chain's terminal counter drop.

  generate-configs.sh (111 lines): mirrors acl-allowlist generator,
  produces the drop-in services.nft + fips configs.

  README.md (111 lines): how to run, expected output, design notes.

  .gitignore: ignores generated-configs/.

testing/ci-local.sh: FIREWALL_SUITES=(firewall) array + run_firewall
runner; dispatch in run_integration and run_suite mirroring
run_acl_allowlist.

.github/workflows/ci.yml: matrix row {suite: firewall, type:
firewall} + 3 steps gated on matrix.type == 'firewall' between
acl-allowlist and gateway. Reuses fips-linux artifact + fips-test:
latest image.

Activation note: the unified test image does not run systemd, so
test.sh invokes the fips-firewall.service ExecStart
(/usr/sbin/nft -f /etc/fips/fips.nft) directly. The systemd-unit
enablement path is covered by the deb-install matrix; this suite
exercises what the unit configures, not how it gets started.

2026-05-03 21:06:09 +00:00

3.6 KiB

Raw Blame History

Firewall Baseline Test

End-to-end exercise of the production fips0 nftables baseline at packaging/common/fips.nft. Closes the v0.3.0 audit gap that the default-deny + conntrack + drop-in semantics had no integration coverage.

What this exercises

The fips.nft baseline polices ONLY the fips0 mesh interface and implements default-deny inbound. This suite asserts the four behaviors documented in the file's header are actually true on a live mesh:

(a) Unallowed inbound on fips0 is dropped
(b) Outbound-initiated flows get their reply via the ct state established,related accept rule
(c) ICMPv6 echo-request is accepted (ping6 reachability)
(d) A drop-in .nft file under /etc/fips/fips.d/ adds an allowlisted port and that port is accepted

A drop-counter check after case (a) confirms the connection was actively DROP'd by the fips chain (not silently unrouted).

Topology

Two FIPS nodes peered over UDP on a Docker bridge network:

Container	Hostname	docker IPv4	Firewall
`fips-fw-container-a`	`host-a`	172.32.0.10	none (probe)
`fips-fw-container-b`	`host-b`	172.32.0.11	`fips.nft` + drop-in

node-b mounts the production packaging/common/fips.nft read-only at /etc/fips/fips.nft, plus a drop-in at /etc/fips/fips.d/services.nft containing tcp dport 22 accept. node-a is unfirewalled and serves as the probe origin.

Both containers run the unified test image's default mode, which starts dnsmasq + sshd (port 22) + iperf3 + python http.server on port 8000 + the FIPS daemon.

fips-firewall.service activation

The production unit's ExecStart is:

ExecStart=/usr/sbin/nft -f /etc/fips/fips.nft

The unified test image does not run systemd, so test.sh invokes the same nft -f command directly inside node-b after fips0 is up and peering has converged. The deb-install harness covers the systemd unit-enablement path under real systemd separately.

Run

Build the Linux binaries and test image:

./testing/scripts/build.sh --no-docker

Run the suite:

./testing/firewall/test.sh

test.sh regenerates fixtures automatically before starting Docker. Use --skip-build to reuse the existing release binaries. Use --keep-up to leave the containers running for inspection.

Expected output shape

=== Generating firewall fixtures
=== Starting firewall harness
=== Waiting for fips0 on both nodes
=== Waiting for peer convergence
=== Resolving fips0 addresses
  node-a: fd97:...
  node-b: fd97:...
=== Activating fips-firewall on fips-fw-container-b
PASS: fips-fw-container-b: fips.nft baseline + drop-in loaded
=== Case (c): ICMPv6 echo-request to firewalled node
PASS: (c) ICMPv6 ping node-a → node-b accepted
=== Case (a): unallowed inbound TCP/8000 from node-a → node-b
PASS: (a) inbound TCP/8000 blocked (curl rc=28)
=== Case (b): node-b initiates outbound TCP, expects reply via conntrack
PASS: (b) outbound from node-b got HTTP 200 via conntrack reply path
=== Case (d): drop-in allowlisted TCP/22 from node-a → node-b
PASS: (d) drop-in allowlisted TCP/22 reachable
=== Drop counter incremented (case a should have ticked it)
PASS: drop counter = N (case a was actually dropped, not just unrouted)
=== Firewall integration test passed

Inspect the loaded ruleset

docker exec fips-fw-container-b nft list table inet fips

Stop and clean up

docker compose -f testing/firewall/docker-compose.yml down

Generated fixture location

testing/firewall/generated-configs/ (gitignored).

3.6 KiB Raw Blame History