server: self-test — sysctl audit + egress-MTU self-proof ("server proven good")
A measurement server must prove its own host isn't distorting results:
- sysctl audit (/proc/sys): flags accept_ra on a static host, ICMP
redirects, ICMP rate-limiting of the server's own errors, and disabled
TCP options — each a measurement-fidelity hazard, with the "why".
- egress-MTU self-proof: DF PMTUD probe (IP_MTU_DISCOVER + getsockopt
IP_MTU, no root — Linux-only, stub elsewhere) to external anchors. If the
server's own uplink is below 1500, client MTU tests measure THIS server,
so we say so.
Exposed at GET /admin/selftest (full report) and as server_selftest
{mtu_ok, sysctl_ok} in the profile so clients can trust or skip MTU tests.
Recommended deploy/99-echolot-sysctl.conf + README section.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrambossek
co-authored by
Claude Opus 5
Claude Opus 5
parent
c9e0d06ea2
commit
4ae744aae5
@@ -0,0 +1,103 @@
|
||||
// SPDX-FileCopyrightText: 2026 Echolot contributors
|
||||
// SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
//go:build linux
|
||||
|
||||
package selftest
|
||||
|
||||
import (
|
||||
"net"
|
||||
"net/netip"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Linux IP-level constants for PMTU discovery. Not all are exported by the
|
||||
// stdlib syscall package across versions, so they are pinned here (stable
|
||||
// kernel ABI) — same rationale as the prober's OsAbi.
|
||||
const (
|
||||
ipMTUDiscover = 10 // IP_MTU_DISCOVER
|
||||
ipMTU = 14 // IP_MTU
|
||||
ipPMTUDiscDo = 2 // IP_PMTUDISC_DO (set DF, honor PMTU)
|
||||
ipv6MTUDiscover = 23 // IPV6_MTU_DISCOVER
|
||||
ipv6MTU = 24 // IPV6_MTU
|
||||
ipv6PMTUDiscDo = 2 // IPV6_PMTUDISC_DO
|
||||
)
|
||||
|
||||
// probeEgressMTU sends a DF-flagged full-size UDP datagram toward target and
|
||||
// reads back the kernel's discovered path MTU. A reduction below 1500 means
|
||||
// the SERVER's own uplink can't carry full-size packets — so client MTU
|
||||
// results would measure the server, not the client. No root, no raw socket:
|
||||
// IP_MTU_DISCOVER + a getsockopt on IP_MTU, mirroring the prober's approach.
|
||||
func probeEgressMTU(target string) MTUResult {
|
||||
res := MTUResult{Target: target}
|
||||
addr, err := netip.ParseAddr(target)
|
||||
if err != nil {
|
||||
// allow "host" that resolves
|
||||
ips, e := net.LookupIP(target)
|
||||
if e != nil || len(ips) == 0 {
|
||||
res.Err = "resolve: " + errStr(err)
|
||||
return res
|
||||
}
|
||||
addr, _ = netip.AddrFromSlice(ips[0])
|
||||
}
|
||||
addr = addr.Unmap()
|
||||
|
||||
is4 := addr.Is4()
|
||||
fam := syscall.AF_INET6
|
||||
if is4 {
|
||||
fam = syscall.AF_INET
|
||||
}
|
||||
fd, err := syscall.Socket(fam, syscall.SOCK_DGRAM, 0)
|
||||
if err != nil {
|
||||
res.Err = "socket: " + errStr(err)
|
||||
return res
|
||||
}
|
||||
defer syscall.Close(fd)
|
||||
|
||||
if is4 {
|
||||
_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_IP, ipMTUDiscover, ipPMTUDiscDo)
|
||||
} else {
|
||||
_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_IPV6, ipv6MTUDiscover, ipv6PMTUDiscDo)
|
||||
}
|
||||
|
||||
// Full-size probe: 1500 total − IP/UDP headers (28 v4, 48 v6).
|
||||
payload := 1472
|
||||
sa := sockaddr(addr, 33434)
|
||||
if !is4 {
|
||||
payload = 1452
|
||||
}
|
||||
// A DF send larger than the local MTU fails immediately with EMSGSIZE; a
|
||||
// path reduction updates IP_MTU after the ICMP frag-needed returns, so we
|
||||
// send, briefly wait, and read the discovered MTU.
|
||||
_ = syscall.Sendto(fd, make([]byte, payload), 0, sa)
|
||||
time.Sleep(700 * time.Millisecond)
|
||||
_ = syscall.Sendto(fd, make([]byte, payload), 0, sa) // second send observes any reduction
|
||||
|
||||
level, opt := syscall.IPPROTO_IP, ipMTU
|
||||
if !is4 {
|
||||
level, opt = syscall.IPPROTO_IPV6, ipv6MTU
|
||||
}
|
||||
mtu, err := syscall.GetsockoptInt(fd, level, opt)
|
||||
if err != nil || mtu <= 0 {
|
||||
res.Err = "getsockopt IP_MTU: " + errStr(err)
|
||||
return res
|
||||
}
|
||||
res.DiscoveredMTU = mtu
|
||||
res.FullMTU = mtu >= 1500
|
||||
return res
|
||||
}
|
||||
|
||||
func sockaddr(a netip.Addr, port int) syscall.Sockaddr {
|
||||
if a.Is4() {
|
||||
return &syscall.SockaddrInet4{Port: port, Addr: a.As4()}
|
||||
}
|
||||
return &syscall.SockaddrInet6{Port: port, Addr: a.As16()}
|
||||
}
|
||||
|
||||
func errStr(err error) string {
|
||||
if err == nil {
|
||||
return "nil"
|
||||
}
|
||||
return err.Error()
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
// SPDX-FileCopyrightText: 2026 Echolot contributors
|
||||
// SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
//go:build !linux
|
||||
|
||||
package selftest
|
||||
|
||||
// probeEgressMTU: PMTUD via IP_MTU_DISCOVER is Linux-specific. Off-Linux the
|
||||
// self-test reports MTU as unproven rather than guessing (the daemon runs on
|
||||
// Linux in production; this keeps dev builds compiling).
|
||||
func probeEgressMTU(target string) MTUResult {
|
||||
return MTUResult{Target: target, Err: "egress MTU probe is Linux-only"}
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
// SPDX-FileCopyrightText: 2026 Echolot contributors
|
||||
// SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
// Package selftest lets the daemon prove its own host is a clean measurement
|
||||
// target: the kernel isn't silently altering what clients measure, and the
|
||||
// server's own egress reaches full MTU. If the server side is already broken,
|
||||
// client-side results (especially MTU/PMTUD) measure the server, not the
|
||||
// client — so the daemon says so.
|
||||
package selftest
|
||||
|
||||
import (
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Severity of a check result.
|
||||
type Severity string
|
||||
|
||||
const (
|
||||
OK Severity = "ok"
|
||||
Warn Severity = "warn"
|
||||
)
|
||||
|
||||
// Check is one sysctl (or derived) assertion.
|
||||
type Check struct {
|
||||
Name string `json:"name"`
|
||||
Got string `json:"got"`
|
||||
Want string `json:"want"`
|
||||
Severity Severity `json:"severity"`
|
||||
Why string `json:"why"`
|
||||
}
|
||||
|
||||
// MTUResult is one egress path-MTU probe outcome.
|
||||
type MTUResult struct {
|
||||
Target string `json:"target"`
|
||||
DiscoveredMTU int `json:"discovered_mtu"`
|
||||
FullMTU bool `json:"full_mtu"` // >= 1500
|
||||
Err string `json:"err,omitempty"`
|
||||
}
|
||||
|
||||
// Report is the whole self-test.
|
||||
type Report struct {
|
||||
Sysctls []Check `json:"sysctls"`
|
||||
EgressMTU []MTUResult `json:"egress_mtu"`
|
||||
// SysctlOK / MTUOK are the compact "server proven good" signals; the
|
||||
// profile surfaces these so a client can skip MTU tests the server can't
|
||||
// support honestly.
|
||||
SysctlOK bool `json:"sysctl_ok"`
|
||||
MTUOK bool `json:"mtu_ok"`
|
||||
}
|
||||
|
||||
// readSysctl reads /proc/sys/<dotted.name>. Empty string if unavailable.
|
||||
func readSysctl(name string) string {
|
||||
p := "/proc/sys/" + strings.ReplaceAll(name, ".", "/")
|
||||
b, err := os.ReadFile(p)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return strings.TrimSpace(string(b))
|
||||
}
|
||||
|
||||
// sysctlChecks are the measurement-fidelity assertions. Each closure returns
|
||||
// OK/Warn given the read value; a missing value (non-Linux / restricted) is
|
||||
// reported as Warn "unreadable" but never fatal.
|
||||
var sysctlChecks = []struct {
|
||||
name string
|
||||
want string
|
||||
why string
|
||||
ok func(v string) bool
|
||||
}{
|
||||
{"net.ipv6.conf.all.accept_ra", "0", "static v6 host must not let RAs mutate routing (the very thing Echolot detects)", eq("0")},
|
||||
{"net.ipv4.conf.all.accept_redirects", "0", "ICMP redirects could alter routing mid-measurement", eq("0")},
|
||||
{"net.ipv4.conf.all.send_redirects", "0", "an endpoint should not emit ICMP redirects", eq("0")},
|
||||
{"net.ipv4.icmp_echo_ignore_all", "0", "server must answer ping so clients can measure to it", eq("0")},
|
||||
{"net.ipv4.ip_no_pmtu_disc", "0", "server must honor path MTU on its own sends", eq("0")},
|
||||
{"net.ipv4.tcp_sack", "1", "so a missing SACK in mss_observed is the path's fault, not the server's", eq("1")},
|
||||
{"net.ipv4.tcp_timestamps", "1", "so TCP-timestamp absence reflects the path, not the server", eq("1")},
|
||||
{"net.ipv4.tcp_window_scaling", "1", "so wscale absence reflects the path, not the server", eq("1")},
|
||||
{"net.ipv4.icmp_ratelimit", "0", "nonzero throttles the server's ICMP errors → false loss/black-hole readings", eq("0")},
|
||||
}
|
||||
|
||||
func eq(want string) func(string) bool { return func(v string) bool { return v == want } }
|
||||
|
||||
// Sysctls runs the sysctl audit.
|
||||
func Sysctls() []Check {
|
||||
out := make([]Check, 0, len(sysctlChecks))
|
||||
for _, c := range sysctlChecks {
|
||||
got := readSysctl(c.name)
|
||||
sev := Warn
|
||||
switch {
|
||||
case got == "":
|
||||
got = "(unreadable)"
|
||||
case c.ok(got):
|
||||
sev = OK
|
||||
}
|
||||
out = append(out, Check{Name: c.name, Got: got, Want: c.want, Severity: sev, Why: c.why})
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// Run performs the full self-test: sysctl audit + egress MTU probes to the
|
||||
// given targets (each "host" — port is irrelevant for PMTUD).
|
||||
func Run(mtuTargets []string) Report {
|
||||
r := Report{Sysctls: Sysctls()}
|
||||
r.SysctlOK = true
|
||||
for _, c := range r.Sysctls {
|
||||
if c.Severity == Warn {
|
||||
r.SysctlOK = false
|
||||
}
|
||||
}
|
||||
r.MTUOK = true
|
||||
for _, t := range mtuTargets {
|
||||
res := probeEgressMTU(t)
|
||||
r.EgressMTU = append(r.EgressMTU, res)
|
||||
if !res.FullMTU {
|
||||
r.MTUOK = false
|
||||
}
|
||||
}
|
||||
if len(r.EgressMTU) == 0 {
|
||||
r.MTUOK = false // couldn't prove it
|
||||
}
|
||||
return r
|
||||
}
|
||||
|
||||
var _ = strconv.Atoi
|
||||
Reference in New Issue
Block a user