mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-02 21:06:14 +00:00
Johnathan Corgan
60e5fefb1f
Add fips-gateway binary: a separate daemon that allows unmodified LAN hosts to reach FIPS mesh destinations via DNS-allocated virtual IPs and kernel nftables NAT. Gateway DNS resolver: forwarding proxy on [::]:53 that intercepts .fips queries, forwards to daemon resolver (localhost:5354), allocates virtual IPs from pool, returns AAAA records. Always sends AAAA upstream regardless of client query type, returns proper NODATA for non-AAAA. Virtual IP pool: fd01::/112 pool with state machine lifecycle (Allocated → Active → Draining → Free), TTL-based reclamation, conntrack integration for session tracking. NAT manager: nftables DNAT/SNAT rules via rustables netlink API, per-mapping rule lifecycle, fips0 masquerade for LAN client source address rewriting. Network setup: local pool route, proxy NDP for virtual IPs on LAN interface, IPv6 forwarding validation. Control socket at /run/fips/gateway.sock with show_gateway and show_mappings queries. fipstop Gateway tab with pool summary gauge and mappings table. Gateway config section in fips.yaml with pool CIDR, LAN interface, DNS upstream, TTL, and grace period settings. Design doc at docs/design/fips-gateway.md. Integration test (testing/static/scripts/gateway-test.sh): three containers verifying DNS resolution, end-to-end HTTP, NAT state, TTL expiration, SERVFAIL fallback, and clean shutdown.
50 lines
1.9 KiB
Docker
50 lines
1.9 KiB
Docker
# Unified test image for all FIPS integration test harnesses.
|
|
#
|
|
# Supports multiple modes via FIPS_TEST_MODE environment variable:
|
|
# default — static/basic: dnsmasq + sshd + iperf3 + http + fips
|
|
# chaos — above + ethernet interface wait loop + TCP ECN
|
|
# sidecar — config from env vars + iptables isolation + fips
|
|
# tor-socks5 — dnsmasq + sshd + fips (tor daemon is separate container)
|
|
# tor-directory — dnsmasq + tor (directory mode) + wait for .onion + fips
|
|
|
|
FROM debian:trixie-slim
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
iproute2 iputils-ping dnsutils \
|
|
openssh-client openssh-server \
|
|
dnsmasq iptables tor \
|
|
iperf3 curl python3 nftables conntrack \
|
|
tcpdump netcat-openbsd rsync && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# SSH server with no authentication (test only!)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
ssh-keygen -A && \
|
|
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
|
|
passwd -d root
|
|
|
|
# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
|
|
RUN printf '%s\n' \
|
|
'port=53' \
|
|
'listen-address=127.0.0.1' \
|
|
'bind-interfaces' \
|
|
'server=/fips/127.0.0.1#5354' \
|
|
'server=127.0.0.11' \
|
|
'no-resolv' \
|
|
>> /etc/dnsmasq.conf
|
|
|
|
COPY fips fipsctl fipstop fips-gateway /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/fips-gateway
|
|
|
|
# Static web page for HTTP server (chaos/static modes)
|
|
RUN printf 'Fuck IPs!\n' > /root/index.html
|
|
|
|
COPY resolv.conf /etc/resolv.conf
|
|
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
|
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|