@celilo/e2e 0.11.3 → 0.13.0

package/src/types.ts

@@ -55,6 +55,15 @@ export interface NetworkConfig {
   domain: string;
   ddnsPassword: string;
   verifyRouting: boolean;
+  /**
+   * Which real ISP router the `fw-isp` simulator stands in for, expressed as
+   * its TR-181 vendor extension prefix. `X_GWS_` (the default) is the GreenWave
+   * C4000XG that `modules/greenwave` drives; `X_AXON_` is the Axon Networks
+   * Q1000K that `modules/axon` drives. The CGI protocol is identical across the
+   * two — this prefix IS the entire difference, which is why one simulator
+   * serves both rather than a near-duplicate second one.
+   */
+  routerVendorPrefix?: string;
   /** Extra volume mounts for the management container (host:container format) */
   managementVolumes: string[];
   /** Include a DHCP client container on the internal network */
@@ -354,7 +363,12 @@ export interface NetworkHandle {
    * Targets fw-main (the customer firewall) using the standard topology
    * subnets from ZONE_SUBNETS / ZONE_GATEWAYS.
    *
-   * @param opts.zones - zones to provide (default: dmz, app, secure)
+   * `opts.zones` says which zones get `provided_networks` written to system
+   * config. It does NOT declare which NICs the firewall has — the topology
+   * decides that, and `deployFirewall` derives the declared list from it, so a
+   * test cannot under-declare the box's hardware by omission.
+   *
+   * @param opts.zones - zones to PROVIDE (default: dmz, app, secure)
    * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
   deployFirewall(opts?: {
@@ -362,6 +376,22 @@ export interface NetworkHandle {
     natIp?: string;
   }): Promise<void>;
 
+  /**
+   * Deploy the `greenwave` module against the ISP router (`fw-isp`) — the box
+   * that actually owns the WAN in the `default` topology.
+   *
+   * This is what makes the production shape work end to end. celilo's own
+   * firewall is DOWNSTREAM: it holds only RFC1918 legs, reports no external
+   * edge, and `exposeService` therefore has to delegate up the chain to a
+   * provider whose firewall capability declares `has_external: true`. greenwave
+   * is that provider. Without it a `default`-topology test that exposes
+   * anything publicly fails at the delegation step, which is correct — there is
+   * genuinely nothing that knows the fleet's public address.
+   *
+   * Not needed under `direct-internet`, where fw-main owns the edge itself.
+   */
+  deployGreenwave(): Promise<void>;
+
   /** Tear down the entire network */
   stop(): Promise<void>;
 
@@ -502,7 +532,7 @@ export function greenwaveRouterIp(): string {
  * by construction. Reference this instead of hardcoding it.
  */
 export function externalWanIp(): string {
-  return '100.100.0.100';
+  return '203.0.113.100';
 }
 
 /**
@@ -511,7 +541,7 @@ export function externalWanIp(): string {
  * WAN address when it reaches a public service.
  */
 export function externalWanSubnet(): string {
-  return '100.100.0.0/24';
+  return '203.0.113.0/24';
 }
 
 /** The internal split-horizon DNS resolver (dns-int) in the e2e topology. */
@@ -521,5 +551,5 @@ export function internalResolverIp(): string {
 
 /** The public upstream recursive resolver (the comcast-resolver sim). */
 export function publicResolverIp(): string {
-  return '100.100.0.1';
+  return '203.0.113.1';
 }

package/src/vantage.test.ts

@@ -86,7 +86,7 @@ describe('assertResolvesInZone — the killer verb', () => {
 
   test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
     const ok = new VantageProbe(
-      fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }),
+      fakeTransport({ resolve: async () => ({ ips: ['203.0.113.100'] }) }),
     );
     await ok.assertResolvesInZone({
       from: 'publicInternet',

package/src/zone-classifier.test.ts

@@ -1,11 +1,6 @@
 import { describe, expect, test } from 'bun:test';
-import {
-  classifyIp,
-  inCidr,
-  isPublicLeakSafe,
-  isSegmentedZoneIp,
-  parseIpv4,
-} from './zone-classifier';
+import { parseIpv4, subnetContains } from '@celilo/capabilities';
+import { classifyIp, isPublicLeakSafe, isSegmentedZoneIp } from './zone-classifier';
 
 describe('parseIpv4', () => {
   test('parses dotted-quad to unsigned 32-bit', () => {
@@ -25,17 +20,17 @@ describe('parseIpv4', () => {
   });
 });
 
-describe('inCidr', () => {
+describe('subnetContains (shared, @celilo/capabilities)', () => {
   test('membership within /24', () => {
-    expect(inCidr('10.226.10.5', '10.226.10.0/24')).toBe(true);
-    expect(inCidr('10.226.10.255', '10.226.10.0/24')).toBe(true);
-    expect(inCidr('10.226.11.1', '10.226.10.0/24')).toBe(false);
+    expect(subnetContains('10.226.10.0/24', '10.226.10.5')).toBe(true);
+    expect(subnetContains('10.226.10.0/24', '10.226.10.255')).toBe(true);
+    expect(subnetContains('10.226.10.0/24', '10.226.11.1')).toBe(false);
   });
   test('high-octet subnet — no sign-bit bug', () => {
     // Arithmetic fixture, not a sim address: a first octet >= 128 is what trips
     // the sign bit, and no address in the sim plan has one any more.
-    expect(inCidr('200.100.50.253', '200.100.50.0/24')).toBe(true);
-    expect(inCidr('200.100.51.1', '200.100.50.0/24')).toBe(false);
+    expect(subnetContains('200.100.50.0/24', '200.100.50.253')).toBe(true);
+    expect(subnetContains('200.100.50.0/24', '200.100.51.1')).toBe(false);
   });
 });
 
@@ -49,7 +44,7 @@ describe('classifyIp', () => {
     expect(classifyIp('10.226.1.253')).toEqual({ kind: 'zone', zone: 'internal' });
   });
   test('public: the CGNAT stand-in and real public space', () => {
-    expect(classifyIp('100.100.0.100')).toEqual({ kind: 'public' }); // sim firewall external
+    expect(classifyIp('203.0.113.100')).toEqual({ kind: 'public' }); // sim firewall external
     expect(classifyIp('8.8.8.8')).toEqual({ kind: 'public' });
     expect(classifyIp('71.36.115.155')).toEqual({ kind: 'public' }); // the prod DDNS target
   });
@@ -70,13 +65,13 @@ describe('isSegmentedZoneIp', () => {
     expect(isSegmentedZoneIp('10.226.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
     expect(isSegmentedZoneIp('10.226.20.30')).toBe(true);
     expect(isSegmentedZoneIp('10.226.1.253')).toBe(false); // internal IS the LAN
-    expect(isSegmentedZoneIp('100.100.0.100')).toBe(false); // public
+    expect(isSegmentedZoneIp('203.0.113.100')).toBe(false); // public
   });
 });
 
 describe('isPublicLeakSafe (CLAUDE.md inviolable rule #1)', () => {
   test('only public addresses are leak-safe', () => {
-    expect(isPublicLeakSafe('100.100.0.100')).toBe(true);
+    expect(isPublicLeakSafe('203.0.113.100')).toBe(true);
     expect(isPublicLeakSafe('8.8.8.8')).toBe(true);
     expect(isPublicLeakSafe('10.226.10.10')).toBe(false); // managed segmented zone
     expect(isPublicLeakSafe('10.226.1.253')).toBe(false); // internal/RFC-1918 must not leak

package/src/zone-classifier.ts

@@ -8,14 +8,15 @@
  * e.g. "www.<domain> resolved from internalDevice must NOT be a segmented-zone
  * container IP" — the ISS-0101 / ISS-0111 bug class.
  *
- * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check — deliberately
- * NOT a blanket RFC-1918/CGNAT ban: the sim's "public" IP is a CGNAT stand-in
- * (100.100.0.100), so in this topology the RFC-1918 zones under
- * `SIM_PRIVATE_SUPERNET` are *zones* and 100.x is *public*. (A real deployment
- * would additionally treat RFC-1918 + RFC-6598 as non-public; that's the
- * caller's policy, layered on top of this primitive.)
+ * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check. RFC-1918 is
+ * deliberately absent from the reserved list: in this topology those ranges are the
+ * managed zones. RFC-6598 (CGNAT) used to be absent too, because the sim's "public"
+ * edge was a CGNAT stand-in — that exemption is gone with the renumber to TEST-NET-3
+ * (RFC 5737), and a carrier address is now correctly non-public here as it is in
+ * `@celilo/capabilities`.
  */
 
+import { parseIpv4, subnetContains } from '@celilo/capabilities';
 import { ZONE_SUBNETS, type Zone } from './types';
 
 export type ZoneClass =
@@ -33,46 +34,30 @@ export const SEGMENTED_ZONES: readonly Zone[] = ['dmz', 'app', 'secure'];
 
 /**
  * Special-use IPv4 ranges that must never be a real service address (nor appear in
- * any DNS answer). RFC-1918 and RFC-6598 (CGNAT) are intentionally absent — in this
- * topology the former are the managed zones and the latter is the public stand-in.
+ * any DNS answer). RFC-1918 is intentionally absent — in this topology those ranges
+ * are the managed zones.
+ *
+ * The `internet-external` network still numbers its public simulators out of
+ * `100.64.0.0/24`; nothing classifies those addresses, and renumbering that network
+ * is not part of this change.
  */
 const RESERVED: ReadonlyArray<{ cidr: string; label: string }> = [
   { cidr: '0.0.0.0/8', label: 'unspecified/this-host (incl. the 0.0.0.0 sentinel)' },
+  { cidr: '100.64.0.0/10', label: 'carrier-grade NAT (RFC 6598)' },
   { cidr: '127.0.0.0/8', label: 'loopback' },
   { cidr: '169.254.0.0/16', label: 'link-local (RFC 3927)' },
   { cidr: '224.0.0.0/4', label: 'multicast' },
   { cidr: '240.0.0.0/4', label: 'reserved (RFC 1112)' },
 ];
 
-/** Parse a dotted-quad IPv4 to an unsigned 32-bit int, or null if malformed. */
-export function parseIpv4(ip: string): number | null {
-  const m = ip.trim().match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!m) return null;
-  const octets = m.slice(1, 5).map(Number);
-  if (octets.some((o) => o > 255)) return null;
-  return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
-}
-
-/** True if `ip` falls within `cidr` (e.g. "10.226.10.0/24"). */
-export function inCidr(ip: string, cidr: string): boolean {
-  const [base, bitsStr] = cidr.split('/');
-  const bits = Number(bitsStr);
-  const ipN = parseIpv4(ip);
-  const baseN = parseIpv4(base);
-  if (ipN === null || baseN === null || Number.isNaN(bits) || bits < 0 || bits > 32) return false;
-  if (bits === 0) return true;
-  const mask = (0xffffffff << (32 - bits)) >>> 0;
-  return (ipN & mask) >>> 0 === (baseN & mask) >>> 0;
-}
-
 /** Classify a resolved IPv4 against the e2e topology. */
 export function classifyIp(ip: string): ZoneClass {
   if (parseIpv4(ip) === null) return { kind: 'invalid' };
   for (const r of RESERVED) {
-    if (inCidr(ip, r.cidr)) return { kind: 'reserved', label: r.label };
+    if (subnetContains(r.cidr, ip)) return { kind: 'reserved', label: r.label };
   }
   for (const zone of Object.keys(ZONE_SUBNETS) as Zone[]) {
-    if (inCidr(ip, ZONE_SUBNETS[zone])) return { kind: 'zone', zone };
+    if (subnetContains(ZONE_SUBNETS[zone], ip)) return { kind: 'zone', zone };
   }
   return { kind: 'public' };
 }