@celilo/e2e 0.10.4 → 0.11.0

package/src/types.ts

@@ -123,7 +123,7 @@ export interface NetworkConfig {
 
   /**
    * When set, brings up a SECOND management-class box named `celilo-mgr-2`
-   * (at 192.168.0.101 on `internal`) using the given image variant. Used by
+   * (at 10.226.1.101 on `internal`) using the given image variant. Used by
    * the migration restore e2e: the primary box is the backup source, the
    * second box is a fresh target that `apt install celilo` + `celilo restore`s
    * into. The second box is NOT auto-init'd by container-manager (which keys
@@ -355,7 +355,7 @@ export interface NetworkHandle {
    * subnets from ZONE_SUBNETS / ZONE_GATEWAYS.
    *
    * @param opts.zones - zones to provide (default: dmz, app, secure)
-   * @param opts.natIp - NAT IP for port-forwarded traffic (default 192.168.0.253)
+   * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
   deployFirewall(opts?: {
     zones?: Array<'dmz' | 'app' | 'secure'>;
@@ -407,22 +407,72 @@ export interface ResponderValues {
   aspects?: Record<string, boolean>;
 }
 
-export const ZONE_GATEWAYS: Record<Zone, string> = {
-  dmz: '10.0.10.1',
-  app: '10.0.20.1',
-  secure: '10.0.30.1',
-  internal: '192.168.0.254',
-  'secure-mgmt': '10.0.120.1',
+/**
+ * The parent block every simulated PRIVATE zone lives inside (#539).
+ *
+ * The sim used to number its zones exactly like a real celilo fleet: its dmz,
+ * app and secure /24s WERE the fleet's, and its internal LAN was the operator's.
+ * That is not a cosmetic overlap — celilo's own forgejo-builder lives in the
+ * REAL dmz, so a leaked stack put a second interface on the builder's own /24
+ * and blackholed every containerized CI job's route to the forge for ~135s.
+ * Twice in one afternoon. Teardown can't be made reliable enough to fix that (a
+ * SIGKILL runs no handler), so the fix is that a leak stops MATTERING.
+ *
+ * `10.226.0.0/16` — mnemonic `0xE2` = "e2", the e2e supernet. It must be
+ * RFC-1918 (the private zones model private networks — CLAUDE.md inviolable
+ * rules #1/#3), and this block collides with nothing plausible:
+ *   - the fleet numbers its zones out of the bottom of 10/8   → far away
+ *   - the operator's VPN sits at the very top of 10/8         → far away
+ *   - the operator's LAN is in 192.168/16                     → different block
+ *   - Docker's default address pools are 172.16/12 and
+ *     192.168/16                                              → different block
+ *
+ * The second reason matters more than the collision: there must be nothing
+ * magic about the octets production happens to use. A suite that only passes on
+ * those exact numbers is asserting one site's address plan rather than celilo's
+ * behaviour. Renumbering proves address-independence.
+ *
+ * Do not move a zone out of this block. `address-plan.test.ts` fails if you do,
+ * and fails if the retired fleet-colliding prefixes reappear anywhere in the
+ * suite.
+ */
+export const SIM_PRIVATE_SUPERNET = '10.226.0.0/16';
+
+/**
+ * Third-octet plan inside {@link SIM_PRIVATE_SUPERNET}. Host octets are
+ * unchanged from the pre-#539 numbering, so `caddy` is still `…10.10` and
+ * fw-main is still `…1.254` — only the network part moved.
+ */
+const ZONE_PREFIXES: Record<Zone, string> = {
+  internal: '10.226.1',
+  dmz: '10.226.10',
+  app: '10.226.20',
+  secure: '10.226.30',
+  'secure-mgmt': '10.226.120',
 };
 
-export const ZONE_SUBNETS: Record<Zone, string> = {
-  dmz: '10.0.10.0/24',
-  app: '10.0.20.0/24',
-  secure: '10.0.30.0/24',
-  internal: '192.168.0.0/24',
-  'secure-mgmt': '10.0.120.0/24',
+/**
+ * An address in a zone, by host octet. Reference this instead of writing an
+ * octet: it is what makes the whole plan a one-line change, and what makes a
+ * stray hardcoded address stand out as the anomaly it is.
+ */
+export function zoneIp(zone: Zone, host: number): string {
+  return `${ZONE_PREFIXES[zone]}.${host}`;
+}
+
+/** The router/firewall leg in each zone. `internal`'s is fw-main's LAN side. */
+export const ZONE_GATEWAYS: Record<Zone, string> = {
+  dmz: zoneIp('dmz', 1),
+  app: zoneIp('app', 1),
+  secure: zoneIp('secure', 1),
+  internal: zoneIp('internal', 254),
+  'secure-mgmt': zoneIp('secure-mgmt', 1),
 };
 
+export const ZONE_SUBNETS: Record<Zone, string> = Object.fromEntries(
+  (Object.keys(ZONE_PREFIXES) as Zone[]).map((zone) => [zone, `${ZONE_PREFIXES[zone]}.0/24`]),
+) as Record<Zone, string>;
+
 /**
  * The firewall's internal-side DNAT ingress (the natIp) in the e2e topology — the role by
  * which an internal device reaches a service that lives in a segmented zone. Single source
@@ -431,7 +481,7 @@ export const ZONE_SUBNETS: Record<Zone, string> = {
  * hardcoding the address in a test.
  */
 export function internalNatIp(): string {
-  return '192.168.0.253';
+  return zoneIp('internal', 253);
 }
 
 /**
@@ -441,7 +491,7 @@ export function internalNatIp(): string {
  * this instead of hardcoding the address in a test.
  */
 export function greenwaveRouterIp(): string {
-  return '192.168.0.1';
+  return zoneIp('internal', 1);
 }
 
 /**
@@ -466,7 +516,7 @@ export function externalWanSubnet(): string {
 
 /** The internal split-horizon DNS resolver (dns-int) in the e2e topology. */
 export function internalResolverIp(): string {
-  return '192.168.0.10';
+  return zoneIp('internal', 10);
 }
 
 /** The public upstream recursive resolver (the comcast-resolver sim). */

package/src/vantage-helpers.ts

@@ -8,7 +8,7 @@
  * here — they wait on real firewall isolation (ISS-0118).
  *
  * Topology prerequisite: inject the observers the assertion needs, e.g.
- *   network().dmz({ caddy: '10.0.10.10' }).observe('internalDevice', 'publicInternet')
+ *   network().dmz({ caddy: '10.226.10.10' }).observe('internalDevice', 'publicInternet')
  */
 
 import { createObserverTransport } from './observer';

package/src/vantage.test.ts

@@ -36,10 +36,10 @@ const LAN: Vantage = 'internalDevice';
 
 describe('resolveFrom', () => {
   test('defaults method to system, passes through ips', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
     const r = await probe.resolveFrom({ from: LAN, name: 'www.example.com' });
     expect(r.method).toBe('system');
-    expect(r.ips).toEqual(['192.168.0.253']);
+    expect(r.ips).toEqual(['10.226.1.253']);
   });
 });
 
@@ -51,7 +51,7 @@ describe('assertResolves / assertNxdomain', () => {
     );
   });
   test('assertNxdomain throws when a public vantage CAN see an internal-only name', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.20.5'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.20.5'] }) }));
     await expect(
       probe.assertNxdomain({ from: 'publicInternet', name: 'authentik.internal' }),
     ).rejects.toThrow(/expected NXDOMAIN/);
@@ -60,23 +60,23 @@ describe('assertResolves / assertNxdomain', () => {
 
 describe('assertResolvesInZone — the killer verb', () => {
   test('ISS-0101: www at caddy DMZ container IP FAILS from internalDevice', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.10.10'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.10.10'] }) }));
     await expect(
       probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
     ).rejects.toThrow(/ISS-0101/);
   });
 
   test('www at the firewall natIp PASSES from internalDevice (the right answer)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
     const r = await probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' });
-    expect(r.ips).toEqual(['192.168.0.253']);
+    expect(r.ips).toEqual(['10.226.1.253']);
   });
 
   test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
     const ok = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }));
     await ok.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' });
 
-    const leaked = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
+    const leaked = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
     await expect(
       leaked.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' }),
     ).rejects.toThrow(VantageAssertionError);
@@ -84,38 +84,38 @@ describe('assertResolvesInZone — the killer verb', () => {
 
   test('any one leaked IP among several fails the whole answer', async () => {
     const probe = new VantageProbe(
-      fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253', '10.0.30.9'] }) }),
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253', '10.226.30.9'] }) }),
     );
     await expect(
       probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
-    ).rejects.toThrow(/10\.0\.30\.9/);
+    ).rejects.toThrow(/10\.226\.30\.9/);
   });
 });
 
 describe('assertResolvesTo — exact-IP DNS correctness', () => {
   test('passes when the resolver returns the expected IP (via a specific server)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.53'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.53'] }) }));
     const r = await probe.assertResolvesTo({
       from: 'internalDevice',
       name: 'host.infra.example.com',
       method: 'dns',
-      server: '192.168.0.10',
-      expected: '192.168.0.53',
+      server: '10.226.1.10',
+      expected: '10.226.1.53',
     });
-    expect(r.ips).toEqual(['192.168.0.53']);
+    expect(r.ips).toEqual(['10.226.1.53']);
   });
 
   test('fails (naming the server) when the expected IP is absent', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.10.99'] }) }));
+    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.10.99'] }) }));
     await expect(
       probe.assertResolvesTo({
         from: 'internalDevice',
         name: 'host.infra.example.com',
         method: 'dns',
-        server: '192.168.0.10',
-        expected: '192.168.0.53',
+        server: '10.226.1.10',
+        expected: '10.226.1.53',
       }),
-    ).rejects.toThrow(/via 192\.168\.0\.10.*expected to include \[192\.168\.0\.53\]/);
+    ).rejects.toThrow(/via 10\.226\.1\.10.*expected to include \[10\.226\.1\.53\]/);
   });
 
   test('accepts an array of expected IPs (all must be present)', async () => {
@@ -136,15 +136,15 @@ describe('reachability + isolation (§D6)', () => {
   });
   test('assertUnreachable throws when isolation is violated', async () => {
     const probe = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
-    await expect(probe.assertUnreachable({ from: 'appSystem', host: '10.0.30.5', port: 443 })).rejects.toThrow(
+    await expect(probe.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 })).rejects.toThrow(
       /zone isolation/,
     );
   });
   test('the reachable/unreachable happy paths do not throw', async () => {
     const reachable = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
-    await reachable.assertReachable({ from: LAN, host: '192.168.0.253', port: 443 });
+    await reachable.assertReachable({ from: LAN, host: '10.226.1.253', port: 443 });
     const blocked = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: false }) }));
-    await blocked.assertUnreachable({ from: 'appSystem', host: '10.0.30.5', port: 443 });
+    await blocked.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 });
   });
 });
 
@@ -188,13 +188,13 @@ describe('inspectResolution', () => {
     const probe = new VantageProbe(
       fakeTransport({
         inspectResolution: async () => ({
-          resolvConf: 'nameserver 192.168.0.253',
-          hostsLines: ['10.0.10.10 auth.example.com'],
+          resolvConf: 'nameserver 10.226.1.253',
+          hostsLines: ['10.226.10.10 auth.example.com'],
         }),
       }),
     );
     const r = await probe.inspectResolution({ from: 'dmzSystem', name: 'auth.example.com' });
-    expect(r.hostsLines).toContain('10.0.10.10 auth.example.com');
-    expect(r.resolvConf).toContain('192.168.0.253');
+    expect(r.hostsLines).toContain('10.226.10.10 auth.example.com');
+    expect(r.resolvConf).toContain('10.226.1.253');
   });
 });

package/src/zone-classifier.test.ts

@@ -5,9 +5,12 @@ describe('parseIpv4', () => {
   test('parses dotted-quad to unsigned 32-bit', () => {
     expect(parseIpv4('0.0.0.0')).toBe(0);
     expect(parseIpv4('255.255.255.255')).toBe(0xffffffff);
-    // High first octet must not go negative (sign-bit overflow guard).
-    expect(parseIpv4('192.168.0.253')).toBe(((192 << 24) | (168 << 16) | (0 << 8) | 253) >>> 0);
-    expect(parseIpv4('192.168.0.253')).toBeGreaterThan(0);
+    // High first octet must not go negative (sign-bit overflow guard). A pure
+    // arithmetic fixture, deliberately NOT an address from the sim plan: it used
+    // to be the sim's internal natIp, so the guard would have quietly
+    // evaporated the moment that zone was renumbered into 10/8 (#539).
+    expect(parseIpv4('200.100.50.253')).toBe(((200 << 24) | (100 << 16) | (50 << 8) | 253) >>> 0);
+    expect(parseIpv4('200.100.50.253')).toBeGreaterThan(0);
   });
   test('rejects malformed / out-of-range', () => {
     expect(parseIpv4('not.an.ip')).toBeNull();
@@ -18,24 +21,26 @@ describe('parseIpv4', () => {
 
 describe('inCidr', () => {
   test('membership within /24', () => {
-    expect(inCidr('10.0.10.5', '10.0.10.0/24')).toBe(true);
-    expect(inCidr('10.0.10.255', '10.0.10.0/24')).toBe(true);
-    expect(inCidr('10.0.11.1', '10.0.10.0/24')).toBe(false);
+    expect(inCidr('10.226.10.5', '10.226.10.0/24')).toBe(true);
+    expect(inCidr('10.226.10.255', '10.226.10.0/24')).toBe(true);
+    expect(inCidr('10.226.11.1', '10.226.10.0/24')).toBe(false);
   });
-  test('high-octet subnet (192.168) — no sign-bit bug', () => {
-    expect(inCidr('192.168.0.253', '192.168.0.0/24')).toBe(true);
-    expect(inCidr('192.168.1.1', '192.168.0.0/24')).toBe(false);
+  test('high-octet subnet — no sign-bit bug', () => {
+    // Arithmetic fixture, not a sim address: a first octet >= 128 is what trips
+    // the sign bit, and no address in the sim plan has one any more.
+    expect(inCidr('200.100.50.253', '200.100.50.0/24')).toBe(true);
+    expect(inCidr('200.100.51.1', '200.100.50.0/24')).toBe(false);
   });
 });
 
 describe('classifyIp', () => {
   test('managed zones (the segmented ones)', () => {
-    expect(classifyIp('10.0.10.10')).toEqual({ kind: 'zone', zone: 'dmz' }); // caddy
-    expect(classifyIp('10.0.20.30')).toEqual({ kind: 'zone', zone: 'app' }); // authentik
-    expect(classifyIp('10.0.30.5')).toEqual({ kind: 'zone', zone: 'secure' });
+    expect(classifyIp('10.226.10.10')).toEqual({ kind: 'zone', zone: 'dmz' }); // caddy
+    expect(classifyIp('10.226.20.30')).toEqual({ kind: 'zone', zone: 'app' }); // authentik
+    expect(classifyIp('10.226.30.5')).toEqual({ kind: 'zone', zone: 'secure' });
   });
   test('internal zone (the LAN — natIp lives here)', () => {
-    expect(classifyIp('192.168.0.253')).toEqual({ kind: 'zone', zone: 'internal' });
+    expect(classifyIp('10.226.1.253')).toEqual({ kind: 'zone', zone: 'internal' });
   });
   test('public: the CGNAT stand-in and real public space', () => {
     expect(classifyIp('100.100.0.100')).toEqual({ kind: 'public' }); // sim firewall external
@@ -56,9 +61,9 @@ describe('classifyIp', () => {
 
 describe('isSegmentedZoneIp', () => {
   test('dmz/app/secure are segmented; internal and public are not', () => {
-    expect(isSegmentedZoneIp('10.0.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
-    expect(isSegmentedZoneIp('10.0.20.30')).toBe(true);
-    expect(isSegmentedZoneIp('192.168.0.253')).toBe(false); // internal IS the LAN
+    expect(isSegmentedZoneIp('10.226.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
+    expect(isSegmentedZoneIp('10.226.20.30')).toBe(true);
+    expect(isSegmentedZoneIp('10.226.1.253')).toBe(false); // internal IS the LAN
     expect(isSegmentedZoneIp('100.100.0.100')).toBe(false); // public
   });
 });
@@ -67,16 +72,16 @@ describe('isPublicLeakSafe (CLAUDE.md inviolable rule #1)', () => {
   test('only public addresses are leak-safe', () => {
     expect(isPublicLeakSafe('100.100.0.100')).toBe(true);
     expect(isPublicLeakSafe('8.8.8.8')).toBe(true);
-    expect(isPublicLeakSafe('10.0.10.10')).toBe(false); // managed segmented zone
-    expect(isPublicLeakSafe('192.168.0.253')).toBe(false); // internal/RFC-1918 must not leak
+    expect(isPublicLeakSafe('10.226.10.10')).toBe(false); // managed segmented zone
+    expect(isPublicLeakSafe('10.226.1.253')).toBe(false); // internal/RFC-1918 must not leak
     expect(isPublicLeakSafe('0.0.0.0')).toBe(false); // reserved sentinel
   });
 
   test('the ISS-0101 scenario: a fronted name resolving to caddy DMZ IP is NOT leak-safe', () => {
     // www.<domain> from a LAN device must be the natIp (internal) or public, never
     // caddy's DMZ container IP. The doctor + e2e share this judgment.
-    const wwwResolvedWrong = '10.0.10.10';
+    const wwwResolvedWrong = '10.226.10.10';
     expect(isSegmentedZoneIp(wwwResolvedWrong)).toBe(true);
-    expect(classifyIp('192.168.0.253').kind).toBe('zone'); // the RIGHT answer (natIp, internal)
+    expect(classifyIp('10.226.1.253').kind).toBe('zone'); // the RIGHT answer (natIp, internal)
   });
 });

package/src/zone-classifier.ts

@@ -10,9 +10,10 @@
  *
  * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check — deliberately
  * NOT a blanket RFC-1918/CGNAT ban: the sim's "public" IP is a CGNAT stand-in
- * (100.100.0.100), so in this topology 10.x / 192.168.x are *zones* and 100.x is
- * *public*. (A real deployment would additionally treat RFC-1918 + RFC-6598 as
- * non-public; that's the caller's policy, layered on top of this primitive.)
+ * (100.100.0.100), so in this topology the RFC-1918 zones under
+ * `SIM_PRIVATE_SUPERNET` are *zones* and 100.x is *public*. (A real deployment
+ * would additionally treat RFC-1918 + RFC-6598 as non-public; that's the
+ * caller's policy, layered on top of this primitive.)
  */
 
 import { type Zone, ZONE_SUBNETS } from './types';
@@ -52,7 +53,7 @@ export function parseIpv4(ip: string): number | null {
   return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
 }
 
-/** True if `ip` falls within `cidr` (e.g. "10.0.10.0/24"). */
+/** True if `ip` falls within `cidr` (e.g. "10.226.10.0/24"). */
 export function inCidr(ip: string, cidr: string): boolean {
   const [base, bitsStr] = cidr.split('/');
   const bits = Number(bitsStr);