leetcrypt
a78441b938
run_circuit_fixture stands up an isolated docker N-hop nested-SSH chain, pipes a seed-deterministic self-generated payload through it, verifies end-to-end delivery, captures + checksums a per-hop pcap, emits R3 events, and always tears the circuit down. Containment is load-bearing: assert_isolated refuses local/unknown engines up front, every hop is built through the ForwarderPlan guard, only our own fixture bytes move between our own containers, and the runner is wired for docker only (multipass e2e refused, not faked). Adds the sor-hop fixture image (alpine + sshd + tcpdump, lab-relay only) and a docker-gated acceptance test that skips where no daemon/image is present. Instrument-validation gate item 1 GREEN: live 3-hop delivery verified, 3 distinct hops, pcaps checksum. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
24 lines
1.3 KiB
Docker
24 lines
1.3 KiB
Docker
# R4 fixture — one isolated SOR relay hop.
|
|
#
|
|
# A minimal Alpine node running sshd, used ONLY as a lab relay for
|
|
# self-generated fixture traffic inside the isolated engine (docker). It never
|
|
# runs on the host (the forwarder guard refuses engine == local) and is torn
|
|
# down after each run. openssh-client + tcpdump are present so the node can be a
|
|
# nested-SSH jump host and so per-hop pcaps can be captured for the linkability
|
|
# measurement (all traffic is SSH-encrypted self-traffic).
|
|
FROM alpine:latest
|
|
|
|
# Alpine's stock sshd_config ships `AllowTcpForwarding no` (and sshd honours the
|
|
# FIRST occurrence of a keyword), so we strip any pre-set copies of the keywords
|
|
# we care about before appending our nested-SSH relay policy — otherwise the
|
|
# jump-host onward channel is refused ("stdio forwarding failed").
|
|
RUN apk add --no-cache openssh openssh-client tcpdump \
|
|
&& ssh-keygen -A \
|
|
&& mkdir -p /root/.ssh && chmod 700 /root/.ssh \
|
|
&& sed -i -E '/^[#[:space:]]*(AllowTcpForwarding|PermitRootLogin|PubkeyAuthentication|PasswordAuthentication|UseDNS)\b/d' /etc/ssh/sshd_config \
|
|
&& printf '\n# --- SOR relay policy ---\nPermitRootLogin prohibit-password\nPubkeyAuthentication yes\nPasswordAuthentication no\nAllowTcpForwarding yes\nUseDNS no\n' \
|
|
>> /etc/ssh/sshd_config
|
|
|
|
EXPOSE 22
|
|
CMD ["/usr/sbin/sshd", "-D", "-e"]
|