mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 00:04:54 +00:00
Johnathan Corgan
5611e976ad
Cover the previously untested overlay advert publish/relay/consume
round-trip. The bilateral publish/subscribe path was a v0.3.0 release
gap: malformed adverts could panic consumers, broken signatures could
go undetected, and reverse-direction subscription was unverified.
Adds testing/nat/scripts/nostr-relay-test.sh (290 lines):
Phase 1+2 (combined): wait_for_peers on both nodes; pass on
bidirectional advert publish/subscribe round-trip + dial completed;
ping6 both directions confirms TUN-level reachability.
Phase 3 (malformed advert resilience): stdlib-only Python WebSocket
client publishes a syntactically valid Schnorr-signed Kind-37195
event whose `content` is gibberish (cannot deserialize as
OverlayAdvert). The relay enforces BIP-340 signature validity, so the
event reaches the consumers (rather than being dropped at the relay)
— a trivially-junk content payload is the right adversarial input.
Required ~80 lines of stdlib-only secp256k1 + BIP-340 in the script
(no new container deps). Asserts pidof fips on both nodes after the
publish, scans logs for panic markers, re-pings to prove the existing
peer link survives.
testing/nat/docker-compose.yml: new profile nostr-publish-consume
with two daemon services (nostr-pub-a 172.31.10.20, nostr-pub-b
172.31.10.21) on shared-lan, reusing the existing strfry relay
(172.31.10.30:7777) and STUN service (172.31.10.40:3478).
testing/nat/scripts/generate-configs.sh: 2-line allowlist update so
the new scenario flows through the existing config generator (rather
than forking a parallel one). Generated node-{a,b}.yaml + npubs.env
smoke-tested cleanly.
testing/ci-local.sh: NOSTR_RELAY_SUITES=(nostr-publish-consume)
array, run_nostr_publish_consume runner, dispatch in run_integration
and run_suite. Mirrors existing run_nat shape.
.github/workflows/ci.yml: one matrix row + 3 steps in the integration
job, gated on matrix.type == 'nostr-publish-consume'. Consumes the
same fips-linux artifact and fips-test:latest image as the existing
NAT suites.
Tor/TCP transport variants kept out of v0.3.0 scope; the structure
leaves room for nostr-publish-consume-tcp/-tor siblings later without
disturbing this baseline.
272 lines
7.2 KiB
YAML
272 lines
7.2 KiB
YAML
networks:
|
|
wan:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.254.0/24
|
|
shared-lan:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.10.0/24
|
|
|
|
volumes:
|
|
relay-data:
|
|
|
|
x-fips-common: &fips-common
|
|
image: fips-test:latest
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
|
|
services:
|
|
relay:
|
|
build:
|
|
context: ../..
|
|
dockerfile: examples/sidecar-nostr-relay/Dockerfile.app
|
|
container_name: fips-nat-relay
|
|
restart: "no"
|
|
volumes:
|
|
- relay-data:/usr/src/app/strfry-db
|
|
- ./relay/strfry.conf:/usr/src/app/strfry.conf:ro
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.30
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.30
|
|
|
|
stun:
|
|
build:
|
|
context: ./stun
|
|
container_name: fips-nat-stun
|
|
restart: "no"
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.40
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.40
|
|
|
|
nat-a:
|
|
build:
|
|
context: ./router
|
|
profiles: ["cone", "symmetric"]
|
|
container_name: fips-nat-router-a
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
restart: "no"
|
|
environment:
|
|
- NAT_MODE=${NAT_MODE_A:-cone}
|
|
- TCP_FORWARD_PORTS=8443
|
|
- LAN_IF=eth1
|
|
- WAN_IF=eth0
|
|
- LAN_HOST=172.31.1.10
|
|
- LAN_SUBNET=172.31.1.0/24
|
|
- WAN_SUBNET=172.31.254.0/24
|
|
- WAN_GATEWAY=172.31.254.1
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.10
|
|
|
|
nat-b:
|
|
build:
|
|
context: ./router
|
|
profiles: ["cone", "symmetric"]
|
|
container_name: fips-nat-router-b
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
restart: "no"
|
|
environment:
|
|
- NAT_MODE=${NAT_MODE_B:-cone}
|
|
- TCP_FORWARD_PORTS=8443
|
|
- LAN_IF=eth1
|
|
- WAN_IF=eth0
|
|
- LAN_HOST=172.31.2.10
|
|
- LAN_SUBNET=172.31.2.0/24
|
|
- WAN_SUBNET=172.31.254.0/24
|
|
- WAN_GATEWAY=172.31.254.1
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.11
|
|
|
|
cone-a:
|
|
<<: *fips-common
|
|
profiles: ["cone"]
|
|
container_name: fips-nat-cone-a
|
|
hostname: fips-nat-cone-a
|
|
depends_on:
|
|
- nat-a
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.1.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/cone/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
cone-b:
|
|
<<: *fips-common
|
|
profiles: ["cone"]
|
|
container_name: fips-nat-cone-b
|
|
hostname: fips-nat-cone-b
|
|
depends_on:
|
|
- nat-b
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.2.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/cone/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
symmetric-a:
|
|
<<: *fips-common
|
|
profiles: ["symmetric"]
|
|
container_name: fips-nat-symmetric-a
|
|
hostname: fips-nat-symmetric-a
|
|
depends_on:
|
|
- nat-a
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.1.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
symmetric-b:
|
|
<<: *fips-common
|
|
profiles: ["symmetric"]
|
|
container_name: fips-nat-symmetric-b
|
|
hostname: fips-nat-symmetric-b
|
|
depends_on:
|
|
- nat-b
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.2.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
lan-a:
|
|
<<: *fips-common
|
|
profiles: ["lan"]
|
|
container_name: fips-nat-lan-a
|
|
hostname: fips-nat-lan-a
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/lan/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.10
|
|
|
|
lan-b:
|
|
<<: *fips-common
|
|
profiles: ["lan"]
|
|
container_name: fips-nat-lan-b
|
|
hostname: fips-nat-lan-b
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/lan/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.11
|
|
|
|
# ── Nostr publish/consume profile ──────────────────────────────────────
|
|
# Two FIPS daemons + the existing strfry relay, exercising the overlay
|
|
# advert publish → relay → consumer round-trip end-to-end. Both nodes
|
|
# share the same LAN bridge as the relay (no NAT in the way) so the
|
|
# focus of the test is the Nostr discovery layer rather than NAT
|
|
# traversal mechanics. Phase 3 (malformed advert) is driven by a
|
|
# one-shot publish from the test runner via the relay's WebSocket.
|
|
nostr-pub-a:
|
|
<<: *fips-common
|
|
profiles: ["nostr-publish-consume"]
|
|
container_name: fips-nat-nostr-pub-a
|
|
hostname: fips-nat-nostr-pub-a
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.20
|
|
|
|
nostr-pub-b:
|
|
<<: *fips-common
|
|
profiles: ["nostr-publish-consume"]
|
|
container_name: fips-nat-nostr-pub-b
|
|
hostname: fips-nat-nostr-pub-b
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.21
|