@mark1russell7/harness 0.11.24 → 0.11.26

package/build/schema.d.ts

@@ -1,4 +1,4 @@
-import { $ as Subject, S as ImageSource, i as ClientImage, r as Client } from "./cell-wInJC-GH.js";
+import { C as ImageSource, et as Subject, i as ClientImage, r as Client } from "./cell-D4HZ1off.js";
 import { z } from "zod";
 //#region src/schema.d.ts
 /**

package/image/grpc-go/main.go

@@ -7,6 +7,7 @@
 //	               [--permit-without-stream] [--max-connection-idle D] [--max-connection-age D]
 //	               [--max-connection-age-grace D] [--listener-keepalive D]
 //	               [--listener-keepalive-interval D] [--listener-keepalive-count N]
+//	               [--name S] [--clock ns|ms]
 //
 // Each D is a duration of Go, for example 20s. A setting at 0 is the default of grpc-go or of Go. A
 // negative --listener-keepalive turns the TCP keepalive of the accepted connections off.
@@ -16,7 +17,13 @@
 // NOT_FOUND. Watch sends SERVING and then holds the stream open until the client ends it.
 //
 // The lines: listening (the ready line of the target), accept (each connection, with its addresses),
-// hold, held and hold-ended (a held reply), watch and watch-ended, and stopping.
+// hold, held and hold-ended (a held reply), watch and watch-ended, and stopping. At SIGTERM or SIGINT,
+// the server writes stopping and then calls GracefulStop: it closes its listener, sends GOAWAY on each
+// connection and waits for each call in flight.
+//
+// A kind cell runs the server in a pod. --name gives the name of the pod: each line has it in the
+// field p, and each reply of Check has it in the header x-pod. --clock ms gives t in milliseconds, the
+// unit of the lines of a kind cell.
 package main
 
 import (
@@ -37,6 +44,7 @@ import (
 	"google.golang.org/grpc/codes"
 	healthpb "google.golang.org/grpc/health/grpc_health_v1"
 	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 )
 
@@ -47,11 +55,28 @@ func now() int64 {
 	return ts.Nano()
 }
 
+// name is the name of the server in its lines and its replies (--name), or "" for none.
+var name string
+
+// millis tells if t of each line is in milliseconds (--clock ms) and not in nanoseconds.
+var millis bool
+
+// stamp gives t of a line: the time on CLOCK_MONOTONIC in the unit of --clock.
+func stamp() any {
+	if millis {
+		return float64(now()) / 1e6
+	}
+	return now()
+}
+
 // emit writes one JSON line with its event and its time.
 func emit(ev string, fields map[string]any) {
-	line := map[string]any{"ev": ev, "t": now()}
-	for name, value := range fields {
-		line[name] = value
+	line := map[string]any{"ev": ev, "t": stamp()}
+	if name != "" {
+		line["p"] = name
+	}
+	for field, value := range fields {
+		line[field] = value
 	}
 	out, err := json.Marshal(line)
 	if err != nil {
@@ -67,6 +92,11 @@ type health struct {
 
 func (health) Check(ctx context.Context, request *healthpb.HealthCheckRequest) (*healthpb.HealthCheckResponse, error) {
 	service := request.GetService()
+	if name != "" {
+		if err := grpc.SetHeader(ctx, metadata.Pairs("x-pod", name)); err != nil {
+			return nil, err
+		}
+	}
 	if service == "" {
 		return &healthpb.HealthCheckResponse{Status: healthpb.HealthCheckResponse_SERVING}, nil
 	}
@@ -128,7 +158,14 @@ func main() {
 	keepIdle := flag.Duration("listener-keepalive", 0, "the TCP keepalive idle of each accepted connection (0: 15 s, negative: off)")
 	keepInterval := flag.Duration("listener-keepalive-interval", 0, "the TCP keepalive interval (0: 15 s)")
 	keepCount := flag.Int("listener-keepalive-count", 0, "the TCP keepalive count (0: 9)")
+	flag.StringVar(&name, "name", "", "the name of the server in each line (p) and each reply of Check (x-pod)")
+	clock := flag.String("clock", "ns", "the unit of t: ns or ms")
 	flag.Parse()
+	if *clock != "ns" && *clock != "ms" {
+		emit("fail", map[string]any{"why": "--clock ns|ms"})
+		os.Exit(1)
+	}
+	millis = *clock == "ms"
 
 	// at the defaults this is net.Listen: Go turns the keepalive on with its own defaults (15 s, 15 s, 9)
 	config := net.ListenConfig{KeepAlive: *keepIdle}

package/image/native/src/bin/inject.rs

@@ -32,6 +32,9 @@
 //!   CONT freeze a server and thaw it while its kernel stays up; KILL stops it, and its kernel
 //!   closes its sockets; HUP asks a pooler to read its configuration again. The stamps bracket the
 //!   kill(2) calls.
+//! - `write NAME PATH CONTENT`: CONTENT to the file PATH in the root of the process NAME, through
+//!   /proc/PID/root, by a rename in one step. A proxy that watches its configuration file reloads
+//!   it, as after an edit. The stamps bracket the rename.
 //! - `resp ADDR:PORT ARG...`: one command to a Redis-protocol server, for example
 //!   `SENTINEL FAILOVER mymaster` to a Sentinel. The stamps bracket the write of the command and
 //!   the first line of its reply, so a planned failover starts at a known instant.
@@ -323,6 +326,41 @@ fn signal(args: &[String]) -> Result<(), Box<dyn Error>> {
     Ok(())
 }
 
+/// an absolute path of letters, digits, dots, dashes, underscores and slashes, with no `..`
+fn file_path(path: &str) -> Result<&str, Box<dyn Error>> {
+    if path.starts_with('/')
+        && path.len() <= 255
+        && !path.split('/').any(|part| part == "..")
+        && path.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | '/'))
+    {
+        Ok(path)
+    } else {
+        Err(format!("not a path that this injector writes: {path}").into())
+    }
+}
+
+/// `write NAME PATH CONTENT [--at NS]`: the file at PATH in the root of the oldest process whose name
+/// is NAME, through /proc/PID/root. The content goes to PATH.inject first, and a rename puts it at
+/// PATH in one step, as a program that watches the folder sees an edit. The stamps bracket the rename.
+fn write(args: &[String]) -> Result<(), Box<dyn Error>> {
+    let name = process_name(args.get(1).ok_or("write NAME PATH CONTENT [--at NS]")?)?;
+    let path = file_path(args.get(2).ok_or("and the path in its root")?)?;
+    let content = args.get(3).ok_or("and the content")?;
+    let opts = options(&args[4..])?;
+    let pid = *processes(name)?.first().ok_or_else(|| format!("no process {name} in this process namespace"))?;
+    let target = format!("/proc/{pid}/root{path}");
+    let staged = format!("{target}.inject");
+    std::fs::write(&staged, content)?;
+    if let Some(at) = opts.at {
+        until(at)?;
+    }
+    let t0 = monotonic_ns();
+    std::fs::rename(&staged, &target)?;
+    let t1 = monotonic_ns();
+    println!("{}", json!({ "action": "write", "name": name, "pid": pid, "path": path, "bytes": content.len(), "t0": t0, "t1": t1 }));
+    Ok(())
+}
+
 /// a command in the Redis protocol: an array of bulk strings
 fn resp_command(args: &[String]) -> Vec<u8> {
     let mut out = format!("*{}\r\n", args.len()).into_bytes();
@@ -473,6 +511,9 @@ fn run() -> Result<(), Box<dyn Error>> {
     if action == "signal" {
         return signal(&args);
     }
+    if action == "write" {
+        return write(&args);
+    }
     if action == "resp" {
         return resp(&args);
     }
@@ -638,6 +679,15 @@ mod tests {
         assert!(!zombie("814 (a) Z) S 1"));
     }
 
+    #[test]
+    fn a_written_path_is_absolute_and_plain() {
+        assert!(file_path("/etc/traefik/dynamic.yml").is_ok());
+        assert!(file_path("/config/dynamic_1.yaml").is_ok());
+        for path in ["", "etc/x", "/etc/../root", "/a b", "/a;b", "/$(x)", "/a\nb"] {
+            assert!(file_path(path).is_err(), "{path:?}");
+        }
+    }
+
     #[test]
     fn a_resp_command_is_an_array_of_bulk_strings() {
         let args: Vec<String> = ["SENTINEL", "FAILOVER", "mymaster"].iter().map(|a| a.to_string()).collect();

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/harness",
-  "version": "0.11.24",
+  "version": "0.11.26",
   "description": "A fault-injection harness for connection timers: a cell runs a client against a stock target in Docker, through a topology of routers and proxies, a replicated group under Sentinels or a replica set, injects a fault, measures the kernel's own records and judges a prediction. HTTP clients of Go, Node and undici race the keep-alive of a Node server, and the MongoDB driver meets the faults of a replica set. The WebSocket client of @procedures/client drops a silent connection on its own heartbeat, and the harness times that detection and the reconnect from the program's lines and the kernel's stamps.",
   "keywords": [
     "fault-injection",