mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
70dba3d2f0
On Linux the check before creating the TUN read only net.ipv6.conf.all.disable_ipv6. A new interface takes its own disable_ipv6 from net.ipv6.conf.default, and a reopened persistent TUN keeps its own, so with default set and all clear the check passed, the kernel refused the address, and the node ran without a TUN after logging a netlink "Permission denied". With the ipv6.disable=1 boot parameter there is no /proc/sys/net/ipv6 at all, the failed read counted as enabled, and the node logged "Operation not supported" from removing a leftover route. Create now refuses a kernel with no /proc/sys/net/ipv6 before making the device, and after making it reads the device's own disable_ipv6, the value the kernel acts on. The error says which setting is to blame and how to clear it. The check on all alone is gone: it refused a TUN whose own setting had been cleared since, which the kernel accepts. TunError::Ipv6Disabled now carries the reason as a string, so code matching the variant needs a pattern for it. On macOS and FreeBSD the reason names their own sysctls rather than the Linux ones. The panel's only test of the name it judges the firewall against used the default, fips0, so a panel that always used fips0, or used tun.name while the kernel had given the TUN another name, passed it. Two tests now give it a configured name other than fips0 with no TUN up, and a TUN up under a name other than the configured one. Every case in the firewall suite ran with the TUN named fips0, the name fips.nft ships with. Removing the daemon's startup check of the loaded table, or judging the listener report against fips0 instead of the TUN's name, left the suite green. A third node now names its TUN mesh0 and loads the shipped fips.nft before its daemon starts. The suite requires the startup warning naming fips0 and mesh0 exactly once, a listener report saying the table does not police the TUN, and one saying it does once the file is reloaded scoped to mesh0. GitHub's failure step lists the third node's table beside the second's. The tests that create network namespaces to check TUN startup, its fd00::/8 policy rule and the IPv6-disabled refusal need root, so they are ignored and no CI job ran them. Removing the device check from create, moving it before the device exists, or bringing back the check on net.ipv6.conf.all alone passed every run. The Linux unit-test job now builds the library tests as the runner user and runs these thirteen under sudo, failing unless all thirteen pass. Local CI still does not run them.
84 lines
10 KiB
Plaintext
84 lines
10 KiB
Plaintext
# Every ignored test in the workspace, one line each. Checked against the
|
|
# sources by testing/check-ignored-tests.py; the known-defect entries are run
|
|
# by testing/known-defect-lane.sh, which expects each to fail.
|
|
#
|
|
# Fields, separated by whitespace:
|
|
# class environment needs root, a network namespace, hardware or a
|
|
# permission the unit-test lane does not have
|
|
# benchmark a measurement run by hand, nothing asserted for CI
|
|
# long-running correct and runnable, too slow for every run
|
|
# helper not a test of its own; another test drives it
|
|
# known-defect asserts the correct behaviour and fails today; the
|
|
# lane reds when one passes, so the fix removes both
|
|
# the ignore and this line
|
|
# crate the package: fips-mesh or fips-core
|
|
# test the test's path inside its crate's library tests, as
|
|
# `cargo test -- --list` prints it
|
|
# file the source file holding the test
|
|
|
|
# fips-core
|
|
benchmark fips-core proto::link::tests::bench_session_datagram_decode_owned_vs_ref core/src/proto/tests/link.rs
|
|
|
|
# fips-mesh
|
|
environment fips-mesh gateway::nat::tests::kernel_rejection_retries_latest_state_without_another_mapping_event src/gateway/nat.rs
|
|
environment fips-mesh gateway::dns::mesh_tests::a_dns_query_arriving_on_fips0_is_not_answered_and_mints_no_mapping src/gateway/tests/dns.rs
|
|
environment fips-mesh gateway::dns::mesh_tests::a_lan_query_from_a_forged_mesh_source_is_not_answered_into_the_mesh src/gateway/tests/dns.rs
|
|
environment fips-mesh gateway::dns::mesh_tests::a_lan_query_from_a_forged_mesh_source_is_not_answered_into_the_mesh_on_a_specific_bind src/gateway/tests/dns.rs
|
|
environment fips-mesh gateway::dns::mesh_tests::a_lan_query_on_a_wildcard_listener_is_still_answered_with_a_pool_address src/gateway/tests/dns.rs
|
|
environment fips-mesh gateway::dns::mesh_tests::a_query_arriving_on_a_recreated_fips0_is_still_not_answered src/gateway/tests/dns.rs
|
|
environment fips-mesh ipv6tun::bsdnet::tests::a_route_added_twice_through_the_same_interface_is_accepted src/ipv6tun/tests/bsdnet.rs
|
|
environment fips-mesh ipv6tun::bsdnet::tests::a_route_present_through_another_interface_is_refused_and_left_in_place src/ipv6tun/tests/bsdnet.rs
|
|
environment fips-mesh ipv6tun::bsdnet::tests::a_tun_device_created_twice_in_turn_comes_up_configured_both_times src/ipv6tun/tests/bsdnet.rs
|
|
environment fips-mesh ipv6tun::bsdnet::tests::configuring_a_configured_tun_device_again_accepts_its_own_address_and_route src/ipv6tun/tests/bsdnet.rs
|
|
environment fips-mesh ipv6tun::winnet::tests::a_route_added_twice_on_one_interface_is_accepted src/ipv6tun/tests/winnet.rs
|
|
environment fips-mesh ipv6tun::winnet::tests::a_wintun_adapter_created_twice_in_turn_comes_up_configured_both_times src/ipv6tun/tests/winnet.rs
|
|
environment fips-mesh ipv6tun::winnet::tests::an_address_added_twice_on_one_interface_is_accepted src/ipv6tun/tests/winnet.rs
|
|
environment fips-mesh ipv6tun::winnet::tests::an_interface_mtu_written_through_its_ipv6_row_reads_back_changed src/ipv6tun/tests/winnet.rs
|
|
environment fips-mesh ipv6tun::dns::tests::a_lan_query_with_a_forged_mesh_source_is_not_answered_into_the_mesh src/ipv6tun/dns.rs
|
|
environment fips-mesh ipv6tun::dns::tests::a_lan_query_with_a_forged_mesh_source_is_not_answered_into_the_mesh_on_a_specific_bind src/ipv6tun/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_forged_mesh_source_on_a_specific_bind_with_no_mesh_index_is_not_answered_into_the_mesh src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_global_lan_client_on_a_specific_bind_with_no_mesh_index_is_answered src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_local_client_sending_from_the_mesh_address_on_a_specific_bind_is_answered src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::an_on_link_ula_client_on_a_specific_bind_with_no_mesh_index_is_answered src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_query_to_the_node_mesh_address_from_a_mesh_source_is_not_answered_when_the_mesh_index_is_unknown src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_local_process_querying_its_own_mesh_address_is_still_answered_when_the_mesh_index_is_unknown src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_lan_client_on_a_wildcard_bind_is_still_answered_when_the_mesh_index_is_unknown src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_forged_mesh_source_on_a_specific_bind_is_not_answered_into_an_addressless_mesh_interface src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::an_on_link_ula_client_on_a_specific_bind_is_answered_with_an_addressless_mesh_interface src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::dns::reply_tests::a_forged_mesh_source_still_reaches_a_bare_mesh_interface_when_the_mesh_address_is_on_another_interface src/ipv6tun/tests/dns.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::create_reports_ipv6_disabled_when_only_conf_default_disables_it src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::create_reports_ipv6_disabled_on_a_persistent_tun_whose_own_knob_is_set src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::create_succeeds_when_all_is_set_but_default_was_cleared_after_it src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::create_succeeds_on_a_persistent_tun_whose_own_knob_is_clear_under_all_and_default_set src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::startup_refuses_and_keeps_a_dummy_link_that_has_the_configured_tun_name src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::a_second_create_on_a_held_tun_name_fails_and_leaves_the_first_device_in_place src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::startup_reopens_an_unheld_persistent_tun_with_the_configured_name src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::restart_with_the_same_identity_reconfigures_a_persistent_tun_left_by_an_unclean_exit src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::restart_with_a_new_identity_reconfigures_a_persistent_tun_left_by_an_unclean_exit src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::stopping_the_tun_removes_the_fd00_rule_it_added src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::a_tun_device_shutdown_removes_the_fd00_rule src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::a_rule_left_by_an_exit_without_stop_sends_other_ula_traffic_to_its_own_table src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh ipv6tun::tun::name_tests::startup_replaces_an_older_rule_rather_than_adding_beside_it src/ipv6tun/tests/tun.rs
|
|
environment fips-mesh transport::ethernet::rebind_tests::beacons_resume_and_frames_are_received_after_the_interface_is_recreated src/transport/ethernet/tests/rebind.rs
|
|
environment fips-mesh transport::ethernet::rebind_tests::a_recreated_interface_is_rebound_for_sending_and_receiving_with_announce_off src/transport/ethernet/tests/rebind.rs
|
|
environment fips-mesh transport::ethernet::rebind_tests::an_interface_that_returns_with_the_same_index_is_rebound src/transport/ethernet/tests/rebind.rs
|
|
environment fips-mesh mdns::tests::matched_scope_peers_observe_each_other src/mdns/tests.rs
|
|
environment fips-mesh node::netmon::tests::a_route_change_alone_reaches_the_watcher src/node/netmon/tests.rs
|
|
environment fips-mesh node::netmon::tests::an_interface_going_down_is_reported_only_when_a_peer_was_reached_over_it src/node/netmon/tests.rs
|
|
environment fips-mesh node::netmon::tests::an_interface_no_peer_is_reached_through_does_not_move_the_fingerprint src/node/netmon/tests.rs
|
|
environment fips-mesh node::tests::claim_slots::a_dropped_peer_is_redialled_on_its_first_retry_after_claims_of_a_connected_peer_stop_at_the_drop src/node/tests/claim_slots.rs
|
|
environment fips-mesh node::tests::claim_slots::a_dropped_peer_is_redialled_on_its_first_retry_when_its_retries_fall_between_slot_releases src/node/tests/claim_slots.rs
|
|
environment fips-mesh node::tests::claim_slots::a_dropped_peer_is_redialled_on_its_first_retry_when_no_claims_are_made src/node/tests/claim_slots.rs
|
|
environment fips-mesh node::tests::claim_slots::a_dropped_peer_is_redialled_on_its_first_retry_while_claims_of_a_connected_peer_continue src/node/tests/claim_slots.rs
|
|
environment fips-mesh node::tests::tun_warning::start_with_a_system_tun_warns_once_when_the_udp_mtu_is_too_small_for_a_1280_byte_ipv6_packet_and_not_at_the_default src/node/tests/tun_warning.rs
|
|
environment fips-mesh transport::ble::io_macos::corebluetooth::tests::the_radio_comes_up_on_hardware src/transport/ble/io_macos/corebluetooth.rs
|
|
environment fips-mesh transport::ble::io_macos::corebluetooth::tests::dials_a_peer_on_hardware src/transport/ble/io_macos/corebluetooth.rs
|
|
environment fips-mesh transport::ble::io_macos::corebluetooth::tests::a_blocked_reader_exits_when_its_stream_is_dropped_on_hardware src/transport/ble/io_macos/corebluetooth.rs
|
|
environment fips-mesh transport::ble::io_macos::corebluetooth::tests::a_blocked_writer_exits_when_its_stream_is_dropped_on_hardware src/transport/ble/io_macos/corebluetooth.rs
|
|
helper fips-mesh transport::ble::io_macos::corebluetooth::tests::sink_on_hardware src/transport/ble/io_macos/corebluetooth.rs
|
|
long-running fips-mesh node::tests::discovery::test_discovery_100_nodes src/node/tests/discovery.rs
|
|
benchmark fips-mesh node::tests::app_tun::app_owned_tun_throughput_between_two_nodes src/node/tests/app_tun.rs
|
|
benchmark fips-mesh transport::udp::io::tests::bench_udp_recv_amortization src/transport/udp/io/mod.rs
|
|
benchmark fips-mesh transport::udp::io::tests::measure_duplicate_ephemeral_ports_for_reuse_flags_set_before_and_after_bind src/transport/udp/io/mod.rs
|
|
known-defect fips-mesh transport::ethernet::io::tests::blocking_send_parks_past_a_shutdown_request_when_the_channel_is_full src/transport/ethernet/io.rs
|