mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
33a2063672
End-to-end exercise the v0.3.0 nftables firewall baseline so the
security claim — "services on fips0 are not exposed by default" — is
validated in CI rather than by operator opt-in. The packaging postinst
state is pinned by the deb-install matrix; this suite pins the actual
ruleset behavior.
testing/firewall/ — new directory mirroring the acl-allowlist
precedent (kept in its own directory, not extending testing/static):
docker-compose.yml (52 lines): two FIPS containers on bridge
172.32.0.0/24, peered over UDP/2121. node-b mounts
packaging/common/fips.nft RO at /etc/fips/fips.nft and a generated
drop-in services.nft at /etc/fips/fips.d/.
test.sh (247 lines): four-case asserter
(a) curl from node-a to node-b:8000 → DROP (port not allowlisted;
terminal counter drop fires)
(b) curl from node-b to node-a:8000 → 200 OK (reply traverses
node-b's ct state established,related accept)
(c) ping6 a→b → success (icmpv6 echo-request accept)
(d) nc -z a→b:22 → success (drop-in tcp dport 22 accept honored
via include "/etc/fips/fips.d/*.nft")
Plus drop-counter check after case (a) confirms the dropped
connection actually hit the chain's terminal counter drop.
generate-configs.sh (111 lines): mirrors acl-allowlist generator,
produces the drop-in services.nft + fips configs.
README.md (111 lines): how to run, expected output, design notes.
.gitignore: ignores generated-configs/.
testing/ci-local.sh: FIREWALL_SUITES=(firewall) array + run_firewall
runner; dispatch in run_integration and run_suite mirroring
run_acl_allowlist.
.github/workflows/ci.yml: matrix row {suite: firewall, type:
firewall} + 3 steps gated on matrix.type == 'firewall' between
acl-allowlist and gateway. Reuses fips-linux artifact + fips-test:
latest image.
Activation note: the unified test image does not run systemd, so
test.sh invokes the fips-firewall.service ExecStart
(/usr/sbin/nft -f /etc/fips/fips.nft) directly. The systemd-unit
enablement path is covered by the deb-install matrix; this suite
exercises what the unit configures, not how it gets started.
53 lines
1.4 KiB
YAML
53 lines
1.4 KiB
YAML
networks:
|
|
fw-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.32.0.0/24
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
context: ../docker
|
|
image: fips-test:latest
|
|
entrypoint: ["/usr/local/bin/entrypoint.sh"]
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- FIPS_TEST_MODE=default
|
|
- RUST_LOG=info,fips::node=debug
|
|
|
|
services:
|
|
service-a:
|
|
<<: *fips-common
|
|
container_name: fips-fw-container-a
|
|
hostname: host-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-a/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-a/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-a/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
fw-net:
|
|
ipv4_address: 172.32.0.10
|
|
|
|
service-b:
|
|
<<: *fips-common
|
|
container_name: fips-fw-container-b
|
|
hostname: host-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-b/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-b/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-b/fips.key:/etc/fips/fips.key:ro
|
|
- ../../packaging/common/fips.nft:/etc/fips/fips.nft:ro
|
|
- ./generated-configs/node-b/fips.d:/etc/fips/fips.d:ro
|
|
networks:
|
|
fw-net:
|
|
ipv4_address: 172.32.0.11
|