mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
c412646498
Mirrors systemd's RuntimeDirectory=fips so the daemon's resolve_default_socket() picks /run/fips/control.sock inside containers, matching production layout and the path that the chaos sim harness (testing/chaos/sim/control.py) probes. Without this, the resolver falls through to /tmp/fips-control.sock (no /run/fips, no XDG_RUNTIME_DIR), the daemon binds there, and the harness's hardcoded /run/fips/control.sock probe returns FileNotFoundError on every node. chaos-bloom-storm then fails its bloom_send_rate assertion with start=0 nodes, end=0 nodes; other chaos scenarios pass only because their tolerances absorb the empty samples. Production hosts always have /run/fips materialized by the fips.service unit's RuntimeDirectory directive before the daemon starts, which is why the regression hit only the containerized test path. Verified locally with chaos-bloom-storm: max per-node delta 27 <= ceiling 30 over the trailing 30s window.
55 lines
2.1 KiB
Docker
55 lines
2.1 KiB
Docker
# Unified test image for all FIPS integration test harnesses.
|
|
#
|
|
# Supports multiple modes via FIPS_TEST_MODE environment variable:
|
|
# default — static/basic: dnsmasq + sshd + iperf3 + http + fips
|
|
# chaos — above + ethernet interface wait loop + TCP ECN
|
|
# sidecar — config from env vars + iptables isolation + fips
|
|
# tor-socks5 — dnsmasq + sshd + fips (tor daemon is separate container)
|
|
# tor-directory — dnsmasq + tor (directory mode) + wait for .onion + fips
|
|
|
|
FROM debian:trixie-slim
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
iproute2 iputils-ping dnsutils \
|
|
openssh-client openssh-server \
|
|
dnsmasq iptables tor \
|
|
iperf3 curl python3 nftables conntrack \
|
|
tcpdump netcat-openbsd rsync && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# SSH server with no authentication (test only!)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
ssh-keygen -A && \
|
|
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
|
|
passwd -d root
|
|
|
|
# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
|
|
RUN printf '%s\n' \
|
|
'port=53' \
|
|
'listen-address=127.0.0.1' \
|
|
'bind-interfaces' \
|
|
'server=/fips/::1#5354' \
|
|
'server=127.0.0.11' \
|
|
'no-resolv' \
|
|
>> /etc/dnsmasq.conf
|
|
|
|
COPY fips fipsctl fipstop fips-gateway /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/fips-gateway
|
|
|
|
# Mirror systemd's RuntimeDirectory=fips so the daemon's resolver picks
|
|
# /run/fips/control.sock — matches production layout and the chaos sim
|
|
# harness probe path (testing/chaos/sim/control.py).
|
|
RUN mkdir -p /run/fips
|
|
|
|
# Static web page for HTTP server (chaos/static modes)
|
|
RUN printf 'Fuck IPs!\n' > /root/index.html
|
|
|
|
COPY resolv.conf /etc/resolv.conf
|
|
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
|
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|