mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
56d39f223b
Implement hop-by-hop ECN congestion signaling through the FMP layer, transport-level congestion detection via kernel drop counters, and chaos harness integration for end-to-end validation. FMP/session ECN plumbing: - Thread ce_flag parsed at link layer through dispatch_link_message, handle_session_datagram, handle_session_payload, and handle_encrypted_session_msg to session delivery - Replace hardcoded false in session-layer record_recv() with actual ce_flag, activating ecn_ce_count tracking in session MMP ECN congestion detection and CE relay: - Add EcnConfig (node.ecn.*) with configurable loss_threshold (5%) and etx_threshold (3.0) for transit congestion detection - Add send_encrypted_link_message_with_ce() that ORs FLAG_CE into FMP header flags; original method delegates with ce_flag=false - Compute outgoing_ce = incoming_ce || local congestion on next-hop link, enabling hop-by-hop CE relay through transit nodes IPv6 ECN-CE marking: - Mark ECN-CE (0b11) in IPv6 Traffic Class on received DataPackets before TUN delivery when FMP CE flag is set - Only marks ECN-capable packets (ECT(0)/ECT(1)); Not-ECT packets unchanged per RFC 3168 Transport congestion abstraction and UDP kernel drop detection: - Add TransportCongestion struct to transport layer for transport- agnostic local congestion indicators - Replace tokio::UdpSocket with AsyncFd<socket2::Socket> using libc::recvmsg() with ancillary data parsing - Enable SO_RXQ_OVFL for kernel receive buffer drop counter on every packet, wiring up previously-stubbed UdpStats.kernel_drops - Add TransportDropState for per-transport delta tracking with 1s tick sampling via sample_transport_congestion() - Extend detect_congestion() with transport kernel drop check alongside MMP loss metrics Congestion monitoring and control: - Add CongestionStats (ce_forwarded, ce_received, congestion_detected, kernel_drop_events) to NodeStats with snapshot serialization - Wire counters into forwarding path, session handler, and transport drop sampling with rate-limited warn logging (5s interval) - Expose congestion data in show_routing control query and ecn_ce_count in show_mmp peer entries - Add congestion counters to fipstop routing tab in two-column layout Chaos harness integration: - Add query_routing(), query_transports(), snapshot_all_congestion() to chaos control module - Add congestion/kernel-drop log analysis in logs module - Add congestion-stress scenario: 10-node tree, 1 Mbps bandwidth, 5-10% netem loss, heavy iperf3 traffic - Add IngressConfig for tc ingress policing with per-peer policer filters simulating upstream bandwidth bottlenecks - Add iperf3 JSON result capture to traffic manager for throughput measurement across scenarios - Add ECN A/B test scenarios (ecn-ab-on/off.yaml) with ingress policing and comparison script - Enable TCP ECN negotiation (tcp_ecn=1 sysctl) in container entrypoint for end-to-end CE propagation Tests: - 10 ECN unit/integration tests: mark_ipv6_ecn_ce variants, CE relay chain (3-node propagation), EcnConfig serde roundtrip - 3 transport drop congestion detection unit tests Documentation: - Update fips-mesh-layer.md: replace outdated CE Echo stub with full ECN Congestion Signaling section covering detection logic, CE relay, IPv6 marking, session tracking, and monitoring counters - Update fips-configuration.md: add node.ecn.* parameter table and ecn block in complete reference YAML - Update fips-transport-layer.md: add Congestion Reporting section with TransportCongestion struct, congestion() trait method, and per-transport status; document AsyncFd/recvmsg/SO_RXQ_OVFL in UDP - Update chaos README: add congestion/ECN scenario docs, ingress traffic control, and iperf3 JSON capture sections - Update README.md: add ECN to features list and "What works today"; update transport and tooling entries
58 lines
1.7 KiB
Bash
Executable File
58 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Container entrypoint: start services and wait for Ethernet interfaces.
|
|
#
|
|
# If the FIPS config references Ethernet transports, wait for the
|
|
# interfaces to appear before starting the FIPS daemon. This handles
|
|
# the case where veth pairs are created from the host after the
|
|
# container starts.
|
|
|
|
set -e
|
|
|
|
# Enable TCP ECN negotiation for both IPv4 and IPv6 connections.
|
|
# Despite the "ipv4" name, this sysctl controls ECN for all TCP.
|
|
# Without this, IPv6 packets traversing the FIPS mesh carry ECN=0b00
|
|
# (Not-ECT), and mark_ipv6_ecn_ce() is a no-op per RFC 3168.
|
|
sysctl -w net.ipv4.tcp_ecn=1 >/dev/null 2>&1 || true
|
|
|
|
# Start background services
|
|
dnsmasq
|
|
/usr/sbin/sshd
|
|
iperf3 -s -D
|
|
python3 -m http.server 8000 -d /root -b :: &>/dev/null &
|
|
|
|
CONFIG="/etc/fips/fips.yaml"
|
|
|
|
# Extract Ethernet interface names from the config file.
|
|
# Matches "interface: <name>" lines that appear under transports.ethernet.
|
|
# The sed strips the key prefix and any whitespace.
|
|
ETH_IFACES=""
|
|
if grep -q 'ethernet:' "$CONFIG" 2>/dev/null; then
|
|
ETH_IFACES=$(grep '^\s*interface:' "$CONFIG" \
|
|
| sed 's/.*interface:\s*//' \
|
|
| tr -d ' ' || true)
|
|
fi
|
|
|
|
if [ -n "$ETH_IFACES" ]; then
|
|
echo "Waiting for Ethernet interfaces: $ETH_IFACES"
|
|
DEADLINE=$((SECONDS + 30))
|
|
while [ $SECONDS -lt $DEADLINE ]; do
|
|
ALL_FOUND=true
|
|
for iface in $ETH_IFACES; do
|
|
if [ ! -e "/sys/class/net/$iface" ]; then
|
|
ALL_FOUND=false
|
|
break
|
|
fi
|
|
done
|
|
if $ALL_FOUND; then
|
|
echo "All Ethernet interfaces ready"
|
|
break
|
|
fi
|
|
sleep 0.2
|
|
done
|
|
if ! $ALL_FOUND; then
|
|
echo "WARNING: Timed out waiting for Ethernet interfaces"
|
|
fi
|
|
fi
|
|
|
|
exec fips --config "$CONFIG"
|