mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
f444457270
Building a Destination Unreachable or Packet Too Big and writing it to the TUN is host-side IPv6 work, but the send logic lived in the node's session handler. Move it to ipv6tun::icmp behind IcmpContext, which borrows the TUN channel, our address and the Packet Too Big rate limiter for the length of one use. Borrowing rather than holding a clone of the TUN sender keeps teardown able to close the channel. The logic is unchanged. Packet Too Big still consults the per-source limiter before anything else, and Destination Unreachable is still unlimited. The discovery lookup timeout now hands its queued packets to the context as one no-route report instead of sending one reply per packet itself. Node keeps send_icmpv6_dest_unreachable and send_icmpv6_packet_too_big as wrappers over the context, so the outbound handler and the tests that drive it are unchanged; the Destination Unreachable wrapper now takes &mut self because the context borrows the limiter. The two Packet Too Big debug lines now log under fips::ipv6tun::icmp instead of fips::node::handlers::session. Add that target to the test harness filters that relied on fips::node=debug or the session trace filter to show them, and note the rename in the changelog.
122 lines
5.2 KiB
YAML
122 lines
5.2 KiB
YAML
networks:
|
|
# No subnet is requested: docker assigns one from the daemon's address pool.
|
|
# A fixed request is honoured verbatim, so two runs asking for the same range
|
|
# collide on "Pool overlaps" — which is why the generated peer addresses are
|
|
# docker hostnames (host-a … host-f) rather than literal IPs. Docker's
|
|
# embedded DNS is per-network, so the same hostname in two concurrent runs
|
|
# resolves inside each run's own subnet.
|
|
#
|
|
# That removes one of the two obstacles to running this suite twice at once,
|
|
# not both. The compose project name is still fixed, so two runs that do not
|
|
# set COMPOSE_PROJECT_NAME share a project, and the second `up` recreates the
|
|
# first's containers while either `down` removes both. Nothing scopes it for
|
|
# this suite: it is run by hand only, so the caller has to. Do not read the
|
|
# floating subnet as making concurrent bare runs safe.
|
|
acl-net:
|
|
driver: bridge
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
# The harness scopes its build context per run and passes it here; the
|
|
# shared directory is the hand-run default. Compose resolves a relative
|
|
# value against THIS file's directory, so the harness must export an
|
|
# absolute path.
|
|
context: ${FIPS_BUILD_CONTEXT:-../docker}
|
|
image: ${FIPS_TEST_IMAGE:-fips-test:latest}
|
|
entrypoint: ["/usr/local/bin/entrypoint.sh"]
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- FIPS_TEST_MODE=default
|
|
- RUST_LOG=info,fips::node=debug,fips::ipv6tun::icmp=debug
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
|
|
services:
|
|
service-a:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-a${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|
|
|
|
service-b:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-b${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|
|
|
|
service-c:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-c${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|
|
|
|
service-d:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-d${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|
|
|
|
service-e:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-e${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|
|
|
|
service-f:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-f${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-f
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
- acl-net
|