mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
b8b1bb03a0
Extend the gateway integration suite with three previously unexercised runtime paths. All three share testing/static/scripts/gateway-test.sh and testing/static/docker-compose.yml so they land as one commit. 6A — UDP port forwarding runtime path. Add udp 18081 -> [fd02::20]:8081 to inject_gateway_config() and a phase-7 case where gw-client runs an inline Python UDP echo server bound [::]:8081 and gw-server sends a UDP probe to [GW_MESH_IP]:18081 via inline python3, asserting the echoed payload prefix. The config layer already accepted proto: udp (test_port_forwards_same_port_different_proto_ok) but the UDP NAT rule shape and conntrack handling differ from TCP and were unverified. Uses Python rather than socat because fips-test:latest does not ship socat; nc -u IPv6 round-trip semantics are messier than a Python one-liner. 6B — Second simultaneous TCP forward. Add tcp 18082 -> [fd02::20]:8081 alongside the existing 18080 forward. Phase 7 now greps the daemon's nft DNAT table for all three rules (18080, 18082, 18081) and runs HTTP fetches through both TCP forwards with distinct backend payloads (inbound-forward-ok vs inbound-forward-ok-2) so a misrouted response fails the assertion. 11A — Concurrent multi-client flows. Add gw-client-2 service to docker-compose mirroring gw-client (IPv6 fd02::21, IPv4 172.20.1.21). Phase 3 sets the fd01::/112 route on both. Phase 4 issues DNS lookups from both, asserts they receive distinct virtual IPs, and queries the gateway control socket (show_mappings) to confirm exactly 2 active mappings (5-attempt retry loop tolerates snapshot-publish lag). Phase 5 launches both curl requests concurrently as background processes, asserts each response. Validates concurrent NAT mappings, pool contention, proxy NDP under simultaneous LAN-client traffic — all real-world deployment shape that was not pinned. Phase 8 reclamation timing unchanged (TTL=5s, grace=5s, 25s wait covers both mapping ticks generously even with a slight stagger).
28 lines
758 B
YAML
28 lines
758 B
YAML
# Gateway Integration Test Topology
|
|
#
|
|
# Three FIPS nodes:
|
|
# a (gw-gateway) — gateway with LAN interface
|
|
# b (gw-server) — first mesh destination (LAN client #1 target)
|
|
# c (gw-server-2) — second mesh destination (LAN client #2 target)
|
|
#
|
|
# Node `a` is directly peered with both `b` and `c`. Two distinct mesh
|
|
# destinations are required so the gateway-test multi-client phase can
|
|
# allocate distinct virtual-IP mappings (one per LAN client).
|
|
#
|
|
# A non-FIPS client container connects via the gateway's LAN interface.
|
|
#
|
|
# Uses deterministic key derivation (mesh-name: gateway-test).
|
|
|
|
nodes:
|
|
a:
|
|
docker_ip: "172.20.0.10"
|
|
peers: [b, c]
|
|
|
|
b:
|
|
docker_ip: "172.20.0.11"
|
|
peers: [a]
|
|
|
|
c:
|
|
docker_ip: "172.20.0.12"
|
|
peers: [a]
|