mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
d29da442ac
Implement raw Ethernet transport using AF_PACKET SOCK_DGRAM on Linux with EtherType 0x88B5 (IEEE experimental range) and 1-byte frame type prefix (0x00=data, 0x01=beacon). Transport implementation: - EthernetConfig with interface, ethertype, MTU, buffer sizes, and four independent discovery knobs (discovery, announce, auto_connect, accept_connections) - PacketSocket/AsyncPacketSocket wrappers with ioctl helpers for interface index, MAC address, and MTU queries - EthernetTransport with Transport trait impl, async start/stop/send, receive loop dispatching data frames and discovery beacons - Discovery beacons (34 bytes: type + version + x-only pubkey) with DiscoveryBuffer for peer accumulation and dedup - Atomic statistics counters (frames, bytes, errors, beacons) - Platform-gated with #[cfg(target_os = "linux")] Transport-layer discovery integration: - Promote auto_connect() and accept_connections() to Transport trait with default implementations and TransportHandle dispatch - Extract initiate_connection() so both static peer config and discovery auto-connect share the same handshake initiation path - Add poll_transport_discovery() to the tick handler to drain discovery buffers and auto-connect to discovered peers - Enforce accept_connections() in handle_msg1() — transports with accept_connections=false silently drop inbound handshakes Node integration: - create_transports() handles Ethernet named instances - resolve_ethernet_addr() parses "interface/mac" address format - transport_mtu() generalized for multi-transport operation Test harness: - VethPair RAII struct for veth pair lifecycle management - Three #[ignore] integration tests requiring root/CAP_NET_RAW: two-node handshake, data exchange, mixed transport coexistence - Chaos harness: transport-aware topology model, VethManager for veth pairs between Docker containers, Ethernet-aware config gen, netem split (HTB+u32 for UDP, root netem for veth), transport-aware link flaps and node churn with veth re-setup - Container entrypoint waits for configured Ethernet interfaces before starting FIPS (handles veth creation timing) - New scenarios: ethernet-only (4-node ring), ethernet-mesh (6-node mixed UDP+Ethernet with netem and link flaps) Documentation: - fips-transport-layer.md: Ethernet section, beacon discovery, WiFi compatibility, updated discovery state, trait surface additions, implementation status table - fips-configuration.md: Ethernet parameter table, named instances, peer address format, mixed UDP+Ethernet example, complete reference - fips-wire-formats.md: Ethernet frame type prefix note
52 lines
1.4 KiB
Bash
Executable File
52 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Container entrypoint: start services and wait for Ethernet interfaces.
|
|
#
|
|
# If the FIPS config references Ethernet transports, wait for the
|
|
# interfaces to appear before starting the FIPS daemon. This handles
|
|
# the case where veth pairs are created from the host after the
|
|
# container starts.
|
|
|
|
set -e
|
|
|
|
# Start background services
|
|
dnsmasq
|
|
/usr/sbin/sshd
|
|
iperf3 -s -D
|
|
python3 -m http.server 8000 -d /root -b :: &>/dev/null &
|
|
|
|
CONFIG="/etc/fips/fips.yaml"
|
|
|
|
# Extract Ethernet interface names from the config file.
|
|
# Matches "interface: <name>" lines that appear under transports.ethernet.
|
|
# The sed strips the key prefix and any whitespace.
|
|
ETH_IFACES=""
|
|
if grep -q 'ethernet:' "$CONFIG" 2>/dev/null; then
|
|
ETH_IFACES=$(grep '^\s*interface:' "$CONFIG" \
|
|
| sed 's/.*interface:\s*//' \
|
|
| tr -d ' ' || true)
|
|
fi
|
|
|
|
if [ -n "$ETH_IFACES" ]; then
|
|
echo "Waiting for Ethernet interfaces: $ETH_IFACES"
|
|
DEADLINE=$((SECONDS + 30))
|
|
while [ $SECONDS -lt $DEADLINE ]; do
|
|
ALL_FOUND=true
|
|
for iface in $ETH_IFACES; do
|
|
if [ ! -e "/sys/class/net/$iface" ]; then
|
|
ALL_FOUND=false
|
|
break
|
|
fi
|
|
done
|
|
if $ALL_FOUND; then
|
|
echo "All Ethernet interfaces ready"
|
|
break
|
|
fi
|
|
sleep 0.2
|
|
done
|
|
if ! $ALL_FOUND; then
|
|
echo "WARNING: Timed out waiting for Ethernet interfaces"
|
|
fi
|
|
fi
|
|
|
|
exec fips --config "$CONFIG"
|