mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
bf117df0ca
Implement periodic full rekey at both protocol layers using fresh DH key exchanges. Uses the existing K-bit flag (FLAG_KEY_EPOCH / FSP_FLAG_K) to coordinate cutover between peers. FMP layer (IK pattern): - ActivePeer gains rekey state: pending/previous sessions, K-bit epoch tracking, drain window, dampening timer - Handshake state stored on ActivePeer with msg1 sent on existing link - Encrypted frame handler detects K-bit flips, promotes pending sessions, falls back to previous session during drain - Handshake handlers distinguish rekey from new connections using addr_to_link lookup with identity-based fallback - Free all session indices (current, rekey, pending, previous) on peer removal FSP layer (XK pattern): - SessionEntry gains parallel rekey fields with XK-specific state for the 3-message handshake - Route availability check before FSP rekey initiation - Encrypted session handler adds K-bit flip detection and dual-session decrypt fallback - SessionSetup/Ack/Msg3 handlers extended for rekey paths Defense-in-depth: - Consecutive decryption failure detector (threshold=20) triggers forced peer removal instead of waiting for link-dead timeout - Identity-based rekey detection as fallback when addr_to_link doesn't match (e.g., TCP ephemeral ports) Configuration: RekeyConfig with enabled flag, after_secs (default 120), and after_messages (default 65536) thresholds. Logging: info for successful K-bit cutover completions, warn for failures, debug for intermediate handshake steps, trace for routine operations (resends, drain cleanup). Rekey lifecycle: 1. Timer/counter fires -> initiator starts new handshake 2. Old session continues handling traffic during handshake 3. Handshake completes -> initiator cuts over, flips K-bit 4. Responder sees flipped K-bit -> promotes new session 5. Both keep old session for 10s drain window 6. After drain, old session discarded Integration test: Docker-based multi-phase test exercising both FMP and FSP rekey with aggressive timers (35s). Verifies connectivity across all 20 directed pairs survives two consecutive rekey cycles. Includes rekey topology, docker-compose profile, and CI matrix entry. Increase ping test convergence wait from 3s to 5s for CI reliability.
304 lines
7.7 KiB
YAML
304 lines
7.7 KiB
YAML
networks:
|
|
fips-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.20.0.0/24
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
context: .
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
env_file:
|
|
- ./generated-configs/npubs.env
|
|
environment:
|
|
- RUST_LOG=info
|
|
|
|
services:
|
|
# ── Mesh topology ──────────────────────────────────────────────
|
|
node-a:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
node-b:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
node-c:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
node-d:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
node-e:
|
|
<<: *fips-common
|
|
profiles: ["mesh"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Mesh-public topology (mesh + external public node) ────────
|
|
pub-a:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
pub-b:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
pub-c:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
pub-d:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
pub-e:
|
|
<<: *fips-common
|
|
profiles: ["mesh-public"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Chain topology (A-B-C-D-E) ────────────────────────────────
|
|
chain-a:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
chain-b:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
chain-c:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
chain-d:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
chain-e:
|
|
<<: *fips-common
|
|
profiles: ["chain"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── Rekey integration test (mesh + aggressive rekey timers) ──
|
|
rekey-a:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
rekey-b:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
rekey-c:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|
|
|
|
rekey-d:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-d
|
|
hostname: node-d
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.13
|
|
|
|
rekey-e:
|
|
<<: *fips-common
|
|
profiles: ["rekey"]
|
|
container_name: fips-node-e
|
|
hostname: node-e
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.14
|
|
|
|
# ── TCP chain topology (A-B-C) ───────────────────────────────
|
|
tcp-a:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-a
|
|
hostname: node-a
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.10
|
|
|
|
tcp-b:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-b
|
|
hostname: node-b
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.11
|
|
|
|
tcp-c:
|
|
<<: *fips-common
|
|
profiles: ["tcp-chain"]
|
|
container_name: fips-node-c
|
|
hostname: node-c
|
|
volumes:
|
|
- ./resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: 172.20.0.12
|