mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
5611e976ad
Cover the previously untested overlay advert publish/relay/consume
round-trip. The bilateral publish/subscribe path was a v0.3.0 release
gap: malformed adverts could panic consumers, broken signatures could
go undetected, and reverse-direction subscription was unverified.
Adds testing/nat/scripts/nostr-relay-test.sh (290 lines):
Phase 1+2 (combined): wait_for_peers on both nodes; pass on
bidirectional advert publish/subscribe round-trip + dial completed;
ping6 both directions confirms TUN-level reachability.
Phase 3 (malformed advert resilience): stdlib-only Python WebSocket
client publishes a syntactically valid Schnorr-signed Kind-37195
event whose `content` is gibberish (cannot deserialize as
OverlayAdvert). The relay enforces BIP-340 signature validity, so the
event reaches the consumers (rather than being dropped at the relay)
— a trivially-junk content payload is the right adversarial input.
Required ~80 lines of stdlib-only secp256k1 + BIP-340 in the script
(no new container deps). Asserts pidof fips on both nodes after the
publish, scans logs for panic markers, re-pings to prove the existing
peer link survives.
testing/nat/docker-compose.yml: new profile nostr-publish-consume
with two daemon services (nostr-pub-a 172.31.10.20, nostr-pub-b
172.31.10.21) on shared-lan, reusing the existing strfry relay
(172.31.10.30:7777) and STUN service (172.31.10.40:3478).
testing/nat/scripts/generate-configs.sh: 2-line allowlist update so
the new scenario flows through the existing config generator (rather
than forking a parallel one). Generated node-{a,b}.yaml + npubs.env
smoke-tested cleanly.
testing/ci-local.sh: NOSTR_RELAY_SUITES=(nostr-publish-consume)
array, run_nostr_publish_consume runner, dispatch in run_integration
and run_suite. Mirrors existing run_nat shape.
.github/workflows/ci.yml: one matrix row + 3 steps in the integration
job, gated on matrix.type == 'nostr-publish-consume'. Consumes the
same fips-linux artifact and fips-test:latest image as the existing
NAT suites.
Tor/TCP transport variants kept out of v0.3.0 scope; the structure
leaves room for nostr-publish-consume-tcp/-tor siblings later without
disturbing this baseline.
138 lines
3.0 KiB
Bash
Executable File
138 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
NAT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)"
|
|
DERIVE_KEYS="$ROOT_DIR/testing/lib/derive_keys.py"
|
|
OUTPUT_DIR="$NAT_DIR/generated-configs"
|
|
SCENARIO="${1:?usage: generate-configs.sh <cone|symmetric|lan> [mesh-name]}"
|
|
MESH_NAME="${2:-nat-lab-$(date +%s)-$$}"
|
|
|
|
case "$SCENARIO" in
|
|
cone|symmetric|lan|nostr-publish-consume) ;;
|
|
*)
|
|
echo "Unknown scenario: $SCENARIO" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
mkdir -p "$OUTPUT_DIR/$SCENARIO"
|
|
|
|
keys_a="$(python3 "$DERIVE_KEYS" "$MESH_NAME" "a")"
|
|
keys_b="$(python3 "$DERIVE_KEYS" "$MESH_NAME" "b")"
|
|
|
|
nsec_a="$(echo "$keys_a" | awk -F= '/^nsec=/{print $2}')"
|
|
npub_a="$(echo "$keys_a" | awk -F= '/^npub=/{print $2}')"
|
|
nsec_b="$(echo "$keys_b" | awk -F= '/^nsec=/{print $2}')"
|
|
npub_b="$(echo "$keys_b" | awk -F= '/^npub=/{print $2}')"
|
|
|
|
relay_addr="ws://172.31.254.30:7777"
|
|
stun_addr="stun:172.31.254.40:3478"
|
|
if [ "$SCENARIO" = "lan" ] || [ "$SCENARIO" = "nostr-publish-consume" ]; then
|
|
relay_addr="ws://172.31.10.30:7777"
|
|
stun_addr="stun:172.31.10.40:3478"
|
|
fi
|
|
|
|
peer_block_a=$(cat <<EOF
|
|
- npub: "$npub_b"
|
|
alias: "node-b"
|
|
addresses:
|
|
- transport: udp
|
|
addr: "nat"
|
|
priority: 1
|
|
EOF
|
|
)
|
|
|
|
peer_block_b=$(cat <<EOF
|
|
- npub: "$npub_a"
|
|
alias: "node-a"
|
|
addresses:
|
|
- transport: udp
|
|
addr: "nat"
|
|
priority: 1
|
|
EOF
|
|
)
|
|
|
|
if [ "$SCENARIO" = "symmetric" ]; then
|
|
peer_block_a="$peer_block_a"$'\n'" - transport: tcp
|
|
addr: \"172.31.254.11:8443\"
|
|
priority: 20"
|
|
peer_block_b="$peer_block_b"$'\n'" - transport: tcp
|
|
addr: \"172.31.254.10:8443\"
|
|
priority: 20"
|
|
fi
|
|
|
|
write_config() {
|
|
local output_file="$1"
|
|
local nsec="$2"
|
|
local peer_block="$3"
|
|
|
|
cat > "$output_file" <<EOF
|
|
node:
|
|
identity:
|
|
nsec: "$nsec"
|
|
retry:
|
|
max_retries: 3
|
|
base_interval_secs: 2
|
|
max_backoff_secs: 8
|
|
discovery:
|
|
nostr:
|
|
enabled: true
|
|
advertise: true
|
|
app: "fips.nat.lab.v1"
|
|
advert_relays:
|
|
- "$relay_addr"
|
|
dm_relays:
|
|
- "$relay_addr"
|
|
stun_servers:
|
|
- "$stun_addr"
|
|
signal_ttl_secs: 30
|
|
attempt_timeout_secs: 6
|
|
replay_window_secs: 60
|
|
punch_start_delay_ms: 500
|
|
punch_interval_ms: 100
|
|
punch_duration_ms: 2500
|
|
advert_ttl_secs: 60
|
|
advert_refresh_secs: 20
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
mtu: 1472
|
|
advertise_on_nostr: true
|
|
public: false
|
|
tcp:
|
|
bind_addr: "0.0.0.0:8443"
|
|
|
|
peers:
|
|
$peer_block
|
|
connect_policy: auto_connect
|
|
auto_reconnect: true
|
|
EOF
|
|
}
|
|
|
|
write_config "$OUTPUT_DIR/$SCENARIO/node-a.yaml" "$nsec_a" "$peer_block_a"
|
|
write_config "$OUTPUT_DIR/$SCENARIO/node-b.yaml" "$nsec_b" "$peer_block_b"
|
|
|
|
cat > "$OUTPUT_DIR/$SCENARIO/npubs.env" <<EOF
|
|
NPUB_A=$npub_a
|
|
NPUB_B=$npub_b
|
|
MESH_NAME=$MESH_NAME
|
|
SCENARIO=$SCENARIO
|
|
EOF
|
|
|
|
echo "Generated NAT lab configs for scenario=$SCENARIO mesh=$MESH_NAME"
|
|
echo "NPUB_A=$npub_a"
|
|
echo "NPUB_B=$npub_b"
|