mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-03 21:36:16 +00:00
Johnathan Corgan
43639fecb9
Cover the previously untested STUN client behavior under server
unreachable, response timeout, and packet loss. The 3 NAT scenarios
test happy paths only; if the STUN client mishandled a fault (panic,
hang, missing log signal), it would silently degrade NAT traversal
without surfacing in CI.
testing/nat/scripts/stun-faults-test.sh (new, 244 lines):
Phase 1 (drop, ~12s): tc prio + netem loss 100% band + u32 filter on
dst 172.31.10.40 udp 3478. Falls back to iptables -j DROP if netem
isn't available. Asserts daemon process alive, no panic, log line
matching stun.*(timed?out|fail|fallback|unreachable|no address)
within the phase window.
Phase 2 (delay then clear, ~17s): tc qdisc add dev eth0 root netem
delay 5000ms for 7s, then deleted. 10s settle. Asserts process alive,
no panic, AND "STUN observation succeeded" log line after clear
(recovery proof).
Phase 3 (kill, ~12s): docker stop fips-nat-stun. Asserts process
alive, no panic, fault evidence in logs.
testing/nat/docker-compose.yml: stun-faults profile adds two
services. stun-fault-node is fips-test:latest on shared-lan at
172.31.10.50. stun-fault-shim is fips-test:latest sharing the
daemon's network namespace via network_mode: service:stun-fault-
node, with cap_add NET_ADMIN, NET_RAW; entrypoint sleep infinity so
the script can docker exec into it. Reuses existing stun
(172.31.10.40:3478) and relay (172.31.10.30:7777) services.
testing/nat/scripts/generate-configs.sh: 3-hunk update so the
generator accepts the new scenario and points its peer config at the
existing relay/STUN. The peer is configured for connect_peer() so
the daemon retries traversal on a loop, repeatedly invoking
observe_traversal_addresses() — which is the fault-injection target.
testing/ci-local.sh: STUN_FAULTS_SUITES=(stun-faults) array,
run_stun_faults runner, list/integration-loop/--only-dispatch hooks.
.github/workflows/ci.yml: matrix row {suite: stun-faults, type:
stun-faults} + 3 steps gated on matrix.type == 'stun-faults' between
nostr-publish-consume and any chaos suite. Reuses fips-linux
artifact + fips-test:latest image.
Approach: script-driven via docker exec stun-fault-shim. Sharing
network namespace means tc rules on the shim's eth0 affect daemon
egress. No timing logic in the shim itself.
338 lines
9.8 KiB
YAML
338 lines
9.8 KiB
YAML
networks:
|
|
wan:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.254.0/24
|
|
shared-lan:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.10.0/24
|
|
|
|
volumes:
|
|
relay-data:
|
|
|
|
x-fips-common: &fips-common
|
|
image: fips-test:latest
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
|
|
services:
|
|
relay:
|
|
build:
|
|
context: ../..
|
|
dockerfile: examples/sidecar-nostr-relay/Dockerfile.app
|
|
container_name: fips-nat-relay
|
|
restart: "no"
|
|
volumes:
|
|
- relay-data:/usr/src/app/strfry-db
|
|
- ./relay/strfry.conf:/usr/src/app/strfry.conf:ro
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.30
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.30
|
|
|
|
stun:
|
|
build:
|
|
context: ./stun
|
|
container_name: fips-nat-stun
|
|
restart: "no"
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.40
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.40
|
|
|
|
nat-a:
|
|
build:
|
|
context: ./router
|
|
profiles: ["cone", "symmetric"]
|
|
container_name: fips-nat-router-a
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
restart: "no"
|
|
environment:
|
|
- NAT_MODE=${NAT_MODE_A:-cone}
|
|
- TCP_FORWARD_PORTS=8443
|
|
- LAN_IF=eth1
|
|
- WAN_IF=eth0
|
|
- LAN_HOST=172.31.1.10
|
|
- LAN_SUBNET=172.31.1.0/24
|
|
- WAN_SUBNET=172.31.254.0/24
|
|
- WAN_GATEWAY=172.31.254.1
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.10
|
|
|
|
nat-b:
|
|
build:
|
|
context: ./router
|
|
profiles: ["cone", "symmetric"]
|
|
container_name: fips-nat-router-b
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
restart: "no"
|
|
environment:
|
|
- NAT_MODE=${NAT_MODE_B:-cone}
|
|
- TCP_FORWARD_PORTS=8443
|
|
- LAN_IF=eth1
|
|
- WAN_IF=eth0
|
|
- LAN_HOST=172.31.2.10
|
|
- LAN_SUBNET=172.31.2.0/24
|
|
- WAN_SUBNET=172.31.254.0/24
|
|
- WAN_GATEWAY=172.31.254.1
|
|
networks:
|
|
wan:
|
|
ipv4_address: 172.31.254.11
|
|
|
|
cone-a:
|
|
<<: *fips-common
|
|
profiles: ["cone"]
|
|
container_name: fips-nat-cone-a
|
|
hostname: fips-nat-cone-a
|
|
depends_on:
|
|
- nat-a
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.1.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/cone/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
cone-b:
|
|
<<: *fips-common
|
|
profiles: ["cone"]
|
|
container_name: fips-nat-cone-b
|
|
hostname: fips-nat-cone-b
|
|
depends_on:
|
|
- nat-b
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.2.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/cone/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
symmetric-a:
|
|
<<: *fips-common
|
|
profiles: ["symmetric"]
|
|
container_name: fips-nat-symmetric-a
|
|
hostname: fips-nat-symmetric-a
|
|
depends_on:
|
|
- nat-a
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.1.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
symmetric-b:
|
|
<<: *fips-common
|
|
profiles: ["symmetric"]
|
|
container_name: fips-nat-symmetric-b
|
|
hostname: fips-nat-symmetric-b
|
|
depends_on:
|
|
- nat-b
|
|
- relay
|
|
- stun
|
|
entrypoint:
|
|
- /usr/local/bin/nat-node-entrypoint.sh
|
|
environment:
|
|
- RUST_LOG=info,fips::discovery::nostr=debug,fips::node::lifecycle=debug
|
|
- DATA_IF=eth0
|
|
- ROUTE_SUBNET=172.31.254.0/24
|
|
- ROUTE_VIA=172.31.2.254
|
|
- RELAY_HOST=172.31.254.30
|
|
- RELAY_PORT=7777
|
|
- STUN_HOST=172.31.254.40
|
|
- STUN_PORT=3478
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
|
|
- ./generated-configs/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
network_mode: none
|
|
|
|
lan-a:
|
|
<<: *fips-common
|
|
profiles: ["lan"]
|
|
container_name: fips-nat-lan-a
|
|
hostname: fips-nat-lan-a
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/lan/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.10
|
|
|
|
lan-b:
|
|
<<: *fips-common
|
|
profiles: ["lan"]
|
|
container_name: fips-nat-lan-b
|
|
hostname: fips-nat-lan-b
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/lan/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.11
|
|
|
|
# ── Nostr publish/consume profile ──────────────────────────────────────
|
|
# Two FIPS daemons + the existing strfry relay, exercising the overlay
|
|
# advert publish → relay → consumer round-trip end-to-end. Both nodes
|
|
# share the same LAN bridge as the relay (no NAT in the way) so the
|
|
# focus of the test is the Nostr discovery layer rather than NAT
|
|
# traversal mechanics. Phase 3 (malformed advert) is driven by a
|
|
# one-shot publish from the test runner via the relay's WebSocket.
|
|
nostr-pub-a:
|
|
<<: *fips-common
|
|
profiles: ["nostr-publish-consume"]
|
|
container_name: fips-nat-nostr-pub-a
|
|
hostname: fips-nat-nostr-pub-a
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.20
|
|
|
|
nostr-pub-b:
|
|
<<: *fips-common
|
|
profiles: ["nostr-publish-consume"]
|
|
container_name: fips-nat-nostr-pub-b
|
|
hostname: fips-nat-nostr-pub-b
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.21
|
|
|
|
# ── STUN fault-injection profile ───────────────────────────────────────
|
|
# One FIPS daemon + a netns-sharing shim that injects tc/iptables faults
|
|
# against UDP egress to the STUN service. The runner script drives the
|
|
# shim via `docker exec` (Approach A) — no scripted timing inside the
|
|
# shim itself. Three phases:
|
|
# 1. drop — 100% UDP egress drop to STUN; assert daemon notices the
|
|
# observation timeout and retries.
|
|
# 2. delay — ~5s netem delay; assert daemon recovers and STUN succeeds
|
|
# again once the rule is removed.
|
|
# 3. kill — `docker stop fips-nat-stun`; assert daemon stays up and
|
|
# continues to handle "STUN unreachable" gracefully.
|
|
# The shim shares the daemon's network namespace so `tc qdisc add dev
|
|
# eth0 ...` operates on the daemon's egress path. The shim therefore
|
|
# has its own NET_ADMIN cap; the daemon already has one for TUN.
|
|
stun-fault-node:
|
|
<<: *fips-common
|
|
profiles: ["stun-faults"]
|
|
container_name: fips-nat-stun-fault-node
|
|
hostname: fips-nat-stun-fault-node
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.50
|
|
|
|
# Fault-free peer that publishes a valid overlay advert, so the
|
|
# fault-node's NAT-traversal attempt actually reaches
|
|
# observe_traversal_addresses() (the STUN client). Without this peer the
|
|
# daemon would abort with "no overlay advert" and never generate the
|
|
# STUN egress that the shim's tc/iptables rules are meant to drop.
|
|
# Intentionally has NO fault shim sharing its netns; runs cleanly.
|
|
stun-fault-peer:
|
|
<<: *fips-common
|
|
profiles: ["stun-faults"]
|
|
container_name: fips-nat-stun-fault-peer
|
|
hostname: fips-nat-stun-fault-peer
|
|
depends_on:
|
|
- relay
|
|
- stun
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
shared-lan:
|
|
ipv4_address: 172.31.10.51
|
|
|
|
stun-fault-shim:
|
|
image: fips-test:latest
|
|
profiles: ["stun-faults"]
|
|
container_name: fips-nat-stun-fault-shim
|
|
depends_on:
|
|
- stun-fault-node
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
network_mode: "service:stun-fault-node"
|
|
restart: "no"
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- "exec sleep infinity"
|