mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
5a11cf091d
The scenario listed four success criteria "verified via post-run congestion snapshot". Nothing read the snapshot, so the scenario could not fail on any of them. Add a congestion_signals assertion taking a floor on the number of nodes reporting each counter, and encode three of the four. The floors are one node each because that is what the criteria say; tightening them to the counts recently observed would assert something nobody wrote down. The fourth criterion is not encoded, and that is the finding rather than an omission. No node has reported a non-zero kernel_drop_events in any of the 182 archived runs, so asserting it would red the scenario permanently. It is recorded at the site as an unmet criterion and a coverage gap: the transport drop-detection path the scenario names as its second signal is exercised by nothing. Two things about the corpus are worth carrying, both recorded in the scenario. Only six archived runs carry a status.txt and are therefore provably completed; all six meet the three encoded criteria with five to nine nodes reporting each signal. The 176 older runs meet none of them, and they are not invalid samples: each reached teardown far enough to write an analysis.txt, and ECN landed before all but one of them. What changed on 2026-07-22 is not established, since neither the scenario nor netem.py, traffic.py or control.py has been touched. Count the nodes reporting a signal rather than the magnitude of any one counter, since a single node with a large count would satisfy a magnitude test while proving the signal never propagated. A missing snapshot fails rather than reading as an absence of congestion.
143 lines
4.4 KiB
YAML
143 lines
4.4 KiB
YAML
# Congestion Stress: exercise both MMP-based and kernel-drop congestion detection
|
|
#
|
|
# Topology: 10-node tree with all links bandwidth-limited to 1 Mbps
|
|
# (egress HTB + ingress policing). Heavy iperf3 traffic (8 concurrent
|
|
# sessions, 8 parallel streams) combined with 5-10% netem loss.
|
|
#
|
|
# Congestion detection signals exercised:
|
|
# 1. MMP loss detection: netem loss exceeds the 5% loss_threshold,
|
|
# triggering detect_congestion() via MMP metrics on transit nodes.
|
|
# 2. Kernel socket drops: small recv_buf_size (8KB) combined with
|
|
# traffic saturation causes SO_RXQ_OVFL on the UDP socket,
|
|
# triggering the transport drop detection path.
|
|
# 3. Ingress policing: tc policer on the receive side drops excess
|
|
# inbound packets, creating bursty arrival patterns.
|
|
#
|
|
# ECN is explicitly enabled via fips_overrides.
|
|
#
|
|
# Success criteria (verified via post-run congestion snapshot):
|
|
# - congestion_detected > 0 on at least one forwarding node
|
|
# - kernel_drop_events > 0 on at least one node
|
|
# - ce_forwarded > 0 on transit nodes
|
|
# - ce_received > 0 on destination nodes
|
|
#
|
|
# Topology:
|
|
#
|
|
# n01 (root)
|
|
# / \
|
|
# n02 n03
|
|
# / \ / \
|
|
# n04 n05 n06 n07
|
|
# | |
|
|
# n08 n09
|
|
# |
|
|
# n10
|
|
|
|
scenario:
|
|
name: "congestion-stress"
|
|
seed: 7
|
|
duration_secs: 120
|
|
|
|
topology:
|
|
algorithm: explicit
|
|
num_nodes: 10
|
|
params:
|
|
adjacency:
|
|
- [n01, n02]
|
|
- [n01, n03]
|
|
- [n02, n04]
|
|
- [n02, n05]
|
|
- [n03, n06]
|
|
- [n03, n07]
|
|
- [n04, n08]
|
|
- [n05, n09]
|
|
- [n08, n10]
|
|
subnet: "172.20.0.0/24"
|
|
ip_start: 10
|
|
|
|
bandwidth:
|
|
enabled: true
|
|
tiers_mbps: [1]
|
|
|
|
ingress:
|
|
enabled: true
|
|
tiers_kbps: [1000]
|
|
burst_bytes: 16000
|
|
|
|
netem:
|
|
enabled: true
|
|
default_policy:
|
|
delay_ms: [2, 5]
|
|
jitter_ms: [0, 1]
|
|
loss_pct: [5, 10]
|
|
mutation:
|
|
interval_secs: {min: 9999, max: 9999}
|
|
fraction: 0.0
|
|
policies:
|
|
baseline:
|
|
delay_ms: [2, 5]
|
|
loss_pct: [5, 10]
|
|
|
|
link_flaps:
|
|
enabled: false
|
|
|
|
traffic:
|
|
enabled: true
|
|
max_concurrent: 8
|
|
interval_secs: {min: 2, max: 5}
|
|
duration_secs: {min: 30, max: 60}
|
|
parallel_streams: 8
|
|
|
|
node_churn:
|
|
enabled: false
|
|
|
|
# Three of the four success criteria above, encoded. Until now all four
|
|
# existed only as that comment and were checked by nothing, so the scenario
|
|
# could not fail on any of them.
|
|
#
|
|
# The floors are 1 node each because that is what the criteria say ("on at
|
|
# least one forwarding node", "on transit nodes", "on destination nodes").
|
|
# They are deliberately not tightened to the observed counts: the criterion
|
|
# is the spec, and a floor invented from six runs would assert something
|
|
# nobody wrote down.
|
|
#
|
|
# What the floors are worth, from the archived corpus. The six runs that
|
|
# carry a status.txt -- the only ones provably completed, all between
|
|
# 2026-07-22 22:14 and 2026-07-23 02:02 -- meet all three with 5 to 9 nodes
|
|
# reporting each signal, so the margin over a floor of 1 is comfortable.
|
|
# The 176 older runs meet none of them. Those older runs did reach teardown
|
|
# (each wrote an analysis.txt), and ECN landed 2026-03-05, before all but
|
|
# one of them, so they are valid runs that observed no congestion rather
|
|
# than runs that died early. What changed on 2026-07-22 is not established:
|
|
# this file has not been touched since it was created, and neither have
|
|
# netem.py, traffic.py or control.py. Worth knowing before trusting a green
|
|
# result here, and worth its own investigation.
|
|
assertions:
|
|
congestion_signals:
|
|
min_nodes_detected: 1
|
|
min_nodes_ce_forwarded: 1
|
|
min_nodes_ce_received: 1
|
|
|
|
# The fourth criterion, "kernel_drop_events > 0 on at least one node", is
|
|
# NOT asserted, because the implementation does not meet it: across all 182
|
|
# archived runs of this scenario, including the six that meet the other
|
|
# three, no node has ever reported a non-zero kernel_drop_events. Asserting
|
|
# it would red the scenario permanently, and asserting a weakened version
|
|
# would assert nothing. It stands here as an unmet criterion: either the
|
|
# 4 KB recv_buf_size no longer provokes SO_RXQ_OVFL under this traffic, or
|
|
# the counter does not reach the snapshot. Until that is settled it is a
|
|
# coverage gap, because the transport drop-detection path this scenario
|
|
# names as signal 2 is exercised by nothing.
|
|
|
|
logging:
|
|
rust_log: "info"
|
|
output_dir: "./sim-results"
|
|
|
|
fips_overrides:
|
|
node:
|
|
ecn:
|
|
enabled: true
|
|
transports:
|
|
udp:
|
|
recv_buf_size: 4096
|