Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193

2026-10-24 09:18:44 +02:00
parent 3363ffa89a
commit 1a788f332d
24 changed files with 328 additions and 21 deletions
@@ -1,3 +1,12 @@
+## 2026-10-24 — `ep0-iperf3/`: the tunnel-only line-speed test server on ep0 (R-1247; operator ruling 2026-10-24 07:26)
+
+- **`ep0-iperf3/felhom-iperf3.service`** (new, installed by hand on ep0 2026-10-24): Debian's `iperf3 --server` bound to
+  `10.77.0.1:5201` as a DynamicUser with systemd hardening and caps (MemoryMax 128M, TasksMax 16, CPUQuota 50 %, a daily
+  restart); one nftables line admits TCP from `wg0` `10.77.0.0/24` only. Debian's own `iperf3.service` stays disabled.
+  `README.md`: install, the firewall line, the proof, the two open no-DSA CVEs of 3.18 and how they are bounded, removal.
+  Proven: no answer from the internet (`:22` as the control), an answer through the tunnel from demo-hp's host, and a
+  10-second test of 90.7 Mbit/s (`documentation/audits/line-test-2026-10-24/`).
+
 ## 2026-10-23 — `release-copy/`: the released images and agent packages leave DooPlex nightly (D33, R-1227); `hub-db-backup/`: every 6 hours (D34)

 - **`release-copy/felhom-release-copy`** (new, DooPlex root, timer 01:40): the newest 3 release tags of felhom-controller, felhom-hub and felhom-samba (`skopeo copy --all --preserve-digests` into `dir:` — the registry's own bytes, so a push back gives the SAME digest; a `docker save` tar would not) and the newest 5 agent versions (binary + config bundle). Before anything leaves: the top manifest hashes to the registry's digest, every blob and child manifest to its name, every named blob is present, each agent file matches the registry's sha256; the staged tree ≤ the cap (3072 MB). Then `rsync --delete` to ep0's limited user `felhom-relcopy` (rrsync, one directory), and a `--checksum --dry-run` must show no difference before the success signal. Spoiled tags (0.315.0, 0.316.3) are never copied. 13 tests (`test_release_copy.py`), four red-proved.
@@ -0,0 +1,22 @@
+# ep0 — the line-speed test server (R-1247)
+
+Operator ruling 2026-10-24 07:26: a box's agent runs a weekly 10-second upload test to an iperf3 server on ep0,
+**inside the WireGuard tunnel only**. Installed 2026-10-24 (evidence `documentation/audits/line-test-2026-10-24/`).
+
+- Package: Debian `iperf3` (3.18-2+deb13u2 at install; it was already present since 2026-07-03). Debian's own
+  `iperf3.service` stays **disabled**.
+- Unit: `felhom-iperf3.service` (this folder) → `/etc/systemd/system/`, `systemctl enable --now felhom-iperf3`.
+  Listens on `10.77.0.1:5201` only, as a DynamicUser, with memory/task/CPU caps.
+- Firewall: one line in `/etc/nftables.conf`'s `input` chain, after the PBS line, and the same rule live:
+
+      tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept
+
+  Live: `nft add rule inet filter input position <handle of the 8007 rule> tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept`.
+- Proof that it never answers on the internet: a TCP connect from any public address to `167.233.158.164:5201` gets
+  no answer (with `:22` as the control); from a box host through the tunnel it answers.
+- Known server issues of 3.18 (no Debian advisory, „minor"): CVE-2026-71217 (resource exhaustion by oversized
+  parameters) and CVE-2026-102253 (a UDP worker spins). Bounded by: tunnel peers only, TCP only, the unit's caps, a daily
+  restart. Re-check when Debian ships 3.22.
+- Remove: `systemctl disable --now felhom-iperf3; rm /etc/systemd/system/felhom-iperf3.service`; delete the nft line
+  (live `nft delete rule inet filter input handle <n>`, and in the file). The backup of the file before the change is
+  `/etc/nftables.conf.bak-20261024-iperf3`.
@@ -0,0 +1,49 @@
+# The line-speed test server on ep0 (R-1247; operator ruling 2026-10-24 07:26). A box's agent runs a 10-second
+# upload test against it once a week, inside the WireGuard tunnel. Installed by hand on ep0 as
+# /etc/systemd/system/felhom-iperf3.service; the firewall line that opens it is in README.md beside this file.
+#
+# Bound to the tunnel address only, TCP only (the nftables line admits TCP from wg0 10.77.0.0/24). Debian's own
+# iperf3.service stays disabled. The caps bound the two open no-DSA server issues of iperf3 3.18 (CVE-2026-71217:
+# oversized parameters exhaust memory and threads; CVE-2026-102253: a UDP worker spins — UDP never reaches it):
+# MemoryMax/TasksMax/CPUQuota keep PBS safe, RuntimeMaxSec restarts a stuck server once a day.
+[Unit]
+Description=Felhom: iperf3 line-speed test server, tunnel only (R-1247)
+Documentation=https://gitea.dooplex.hu/admin/felhom.eu/src/branch/main/scripts/ep0-iperf3/README.md
+After=wg-quick@wg0.service
+Wants=wg-quick@wg0.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/iperf3 --server --bind 10.77.0.1 --port 5201 --interval 0 --idle-timeout 120 --rcv-timeout 15000
+SuccessExitStatus=1
+Restart=always
+RestartSec=10
+RuntimeMaxSec=1d
+DynamicUser=yes
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+MemoryMax=128M
+TasksMax=16
+CPUQuota=50%
+
+[Install]
+WantedBy=multi-user.target
@@ -135,6 +135,7 @@ MIRRORS = {
 # built first, against a provisional shape — and is neither a pass nor a conviction of the subtree.
 SUBTREE_MIRRORS = {
    ("agent -> hub   (POST /host-report)", "guest_disk_trim"): ("internal/sysfacts", "DiskTrim"),
+    ("agent -> hub   (POST /host-report)", "line_test"): ("internal/sysfacts", "LineTest"),
 }

 # Tag names whose literal string carries no information in a repo-wide search. NOT CHECKED.