@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/supervision.go

@@ -0,0 +1,107 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"syscall"
+	"time"
+)
+
+// Also runs after exec: the parent can die between fork's prctl and exec.
+func armParentDeath(expected int, set func() error, parent func() int) error {
+	if expected <= 1 || parent() != expected {
+		return errTrust
+	}
+	if err := set(); err != nil {
+		return err
+	}
+	if parent() != expected {
+		return errTrust
+	}
+	return nil
+}
+
+type supervisedChild interface {
+	exited() (bool, error)
+	signal(syscall.Signal) error
+}
+
+// Caller is the sole reaper and signal owner. A zombie retains its PID until
+// exited() reaps it; a background Wait goroutine would invalidate this proof.
+func stopChild(ctx context.Context, child supervisedChild, grace time.Duration) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	done, err := child.exited()
+	if err != nil || done {
+		return err
+	}
+	if err := child.signal(syscall.SIGTERM); err != nil {
+		return err
+	}
+	escalate := time.Now().Add(grace)
+	killed := false
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		done, err := child.exited()
+		if err != nil || done {
+			return err
+		}
+		if !killed && !time.Now().Before(escalate) {
+			if err := child.signal(syscall.SIGKILL); err != nil {
+				return err
+			}
+			killed = true
+		}
+		timer := time.NewTimer(time.Millisecond)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return ctx.Err()
+		case <-timer.C:
+		}
+	}
+}
+
+// Read to actual connection EOF. A LimitReader's synthetic EOF at the size
+// cap can never certify supervisor exit, so reaching that cap is a refusal.
+func readSupervisorReply(reader io.Reader, want Inventory, nonce string) error {
+	res, err := decodeSupervisorReply(reader, want, nonce)
+	if err != nil || !res.OK || res.Error != "" {
+		return errTrust
+	}
+	return nil
+}
+
+// Parsing authenticates the entire bounded reply; readiness and stop ACKs
+// retain separate acceptance rules. No refusal can certify supervisor exit.
+func decodeSupervisorReply(reader io.Reader, want Inventory, nonce string) (Response, error) {
+	var res Response
+	b, err := io.ReadAll(io.LimitReader(reader, 4097))
+	if err != nil || len(b) > 4096 {
+		return res, errTrust
+	}
+	d := json.NewDecoder(bytes.NewReader(b))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil || d.Decode(new(any)) != io.EOF || res.Inventory != want || res.Nonce != nonce {
+		return Response{}, errTrust
+	}
+	return res, nil
+}
+
+// A pending health refusal cannot be used as a successful admission or stop ACK.
+func supervisorReadiness(res Response, err error) string {
+	if err == nil {
+		if res.OK && res.Error == "" {
+			return "ready"
+		}
+		if !res.OK && res.Error == "reload-revalidating" {
+			return res.Error
+		}
+	}
+	return "fenced"
+}

package/templates/native-go/backend/internal/helper/supervision_test.go

@@ -0,0 +1,124 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestParentDeathSetupChecksBeforeAndAfterPrctl(t *testing.T) {
+	for _, tc := range []struct {
+		before, after int
+		setErr        error
+		ok            bool
+	}{
+		{42, 42, nil, true}, {1, 1, nil, false}, {42, 1, nil, false}, {42, 42, syscall.EPERM, false},
+	} {
+		calls, sets := 0, 0
+		err := armParentDeath(42, func() error { sets++; return tc.setErr }, func() int {
+			calls++
+			if calls == 1 {
+				return tc.before
+			}
+			return tc.after
+		})
+		if (err == nil) != tc.ok {
+			t.Fatalf("%+v: %v", tc, err)
+		}
+		if tc.before != 42 && sets != 0 {
+			t.Fatal("already reparented child armed")
+		}
+		if tc.ok && calls != 2 {
+			t.Fatal("parent race not checked")
+		}
+	}
+}
+
+type childFixture struct {
+	reaped  bool
+	err     error
+	signals []syscall.Signal
+	exitOn  syscall.Signal
+}
+
+func (c *childFixture) exited() (bool, error) { return c.reaped, c.err }
+func (c *childFixture) signal(s syscall.Signal) error {
+	if c.reaped {
+		panic("signalled a reaped child")
+	}
+	c.signals = append(c.signals, s)
+	if s == c.exitOn {
+		c.reaped = true
+	}
+	return nil
+}
+func TestOnlyUnreapedOwnedChildCanBeSignalled(t *testing.T) {
+	for _, tc := range []struct {
+		reaped bool
+		err    error
+		exit   syscall.Signal
+		count  int
+		ok     bool
+	}{
+		{true, nil, 0, 0, true}, {false, syscall.ECHILD, 0, 0, false}, {false, nil, syscall.SIGTERM, 1, true}, {false, nil, syscall.SIGKILL, 2, true}, {false, nil, 0, 2, false},
+	} {
+		c := &childFixture{reaped: tc.reaped, err: tc.err, exitOn: tc.exit}
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+		err := stopChild(ctx, c, time.Millisecond)
+		cancel()
+		if (err == nil) != tc.ok || len(c.signals) != tc.count {
+			t.Fatalf("%+v: err=%v signals=%v", tc, err, c.signals)
+		}
+		if c.reaped {
+			n := len(c.signals)
+			if stopChild(context.Background(), c, time.Millisecond) != nil || len(c.signals) != n {
+				t.Fatal("reaped PID reused")
+			}
+		}
+	}
+}
+func TestCancelledStopCannotSignal(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	c := &childFixture{}
+	if stopChild(ctx, c, time.Millisecond) == nil || len(c.signals) != 0 {
+		t.Fatal("cancelled operation signalled")
+	}
+}
+
+func TestSupervisorReplyRequiresRealEOFAndStrictBoundedAcknowledgement(t *testing.T) {
+	i := fixture(t).Expected
+	nonce := strings.Repeat("c", 64)
+	good, _ := json.Marshal(Response{Inventory: i, Nonce: nonce, OK: true})
+	for _, tc := range []struct {
+		data []byte
+		ok   bool
+	}{
+		{good, true}, {append(append([]byte{}, good...), []byte(" {}")...), false},
+		{bytes.Replace(good, []byte(nonce), []byte(strings.Repeat("d", 64)), 1), false},
+		{append(append([]byte{}, good[:len(good)-1]...), []byte(",\"unknown\":true}")...), false},
+		{append(append([]byte{}, good...), bytes.Repeat([]byte(" "), 4097)...), false},
+	} {
+		if (readSupervisorReply(bytes.NewReader(tc.data), i, nonce) == nil) != tc.ok {
+			t.Fatalf("reply accepted=%v expected=%v", !tc.ok, tc.ok)
+		}
+	}
+	if readSupervisorReply(&brokenReplyReader{data: good}, i, nonce) == nil {
+		t.Fatal("read error treated as cooperative exit")
+	}
+}
+
+type brokenReplyReader struct{ data []byte }
+
+func (r *brokenReplyReader) Read(p []byte) (int, error) {
+	if len(r.data) == 0 {
+		return 0, syscall.ECONNRESET
+	}
+	n := copy(p, r.data)
+	r.data = r.data[n:]
+	return n, nil
+}

package/templates/native-go/backend/internal/helper/supervisor_frame.go

@@ -0,0 +1,76 @@
+package helper
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"net"
+	"time"
+)
+
+type supervisorRequest struct {
+	Process Process         `json:"process"`
+	Op      string          `json:"op"`
+	Nonce   string          `json:"nonce"`
+	Data    json.RawMessage `json:"data,omitempty"`
+}
+
+// Legacy M1 requests do not half-close; grant controls MUST half-close. Count
+// the entire v2 frame (including whitespace), reject duplicates and trailing
+// frames, and bound both time and memory. The outer process binds this socket.
+func decodeSupervisorRequest(reader io.Reader) (supervisorRequest, Code) {
+	var req supervisorRequest
+	limited := &io.LimitedReader{R: reader, N: MaxControlBytes + 1}
+	d := json.NewDecoder(limited)
+	var raw json.RawMessage
+	if d.Decode(&raw) != nil {
+		return req, ErrInvalid
+	}
+	if code := decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); code != "" {
+		return req, code
+	}
+	if req.Op == "grants" {
+		rest, err := io.ReadAll(io.MultiReader(d.Buffered(), limited))
+		if err != nil {
+			return req, ErrInvalid
+		}
+		if limited.N <= 0 {
+			return req, ErrLimit
+		}
+		if len(bytes.TrimSpace(rest)) != 0 {
+			return req, ErrInvalid
+		}
+	} else if d.InputOffset() > 4096 || len(req.Data) > 0 {
+		return req, ErrInvalid
+	}
+	if !allReferences(req.Nonce) || (req.Op != "admit" && req.Op != "stop" && req.Op != "grants") {
+		return req, ErrInvalid
+	}
+	return req, ""
+}
+
+const supervisorAttestationWait = time.Second
+const supervisorFrameBudget = 100 * time.Millisecond
+
+// The caller sends no frame bytes until its full post-connect hash succeeds.
+// Separate the bounded wait for that computation from the fixed frame budget.
+func receiveSupervisorRequest(conn net.Conn) (supervisorRequest, Code) {
+	firstDeadline := time.Now().Add(supervisorAttestationWait)
+	if err := conn.SetReadDeadline(firstDeadline); err != nil {
+		return supervisorRequest{}, ErrInvalid
+	}
+	reader := bufio.NewReader(conn)
+	if _, err := reader.Peek(1); err != nil || !time.Now().Before(firstDeadline) {
+		return supervisorRequest{}, ErrInvalid
+	}
+	frameDeadline := time.Now().Add(supervisorFrameBudget)
+	if err := conn.SetDeadline(frameDeadline); err != nil {
+		return supervisorRequest{}, ErrInvalid
+	}
+	req, code := decodeSupervisorRequest(reader)
+	if !time.Now().Before(frameDeadline) {
+		return supervisorRequest{}, ErrInvalid
+	}
+	return req, code
+}

package/templates/native-go/backend/internal/helper/supervisor_frame_linux_test.go

@@ -0,0 +1,69 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLinuxSupervisorFrameWaitPreservesStopFence(t *testing.T) {
+	p := linuxFixture(t)
+	process := startVMHelper(t, p)
+	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	time.Sleep(50 * time.Millisecond)
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err = waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
+	}); err != nil {
+		t.Fatal("stalled peer prevented owned fence/completion", err)
+	}
+	record, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(p.Client, record)
+	if err != nil || proof.Process != process {
+		t.Fatal("wrong completion", err)
+	}
+	t.Logf("stalled root peer lifecycle reason=%s", record.Lifecycle.Reason)
+	vmUnit(t, "start")
+	if p.Client.Status(context.Background()).State == "ready" {
+		t.Fatal("later active revived stopped epoch")
+	}
+}
+
+func TestLinuxSupervisorRejectsForeignFrameAfterWait(t *testing.T) {
+	p := linuxFixture(t)
+	process := startVMHelper(t, p)
+	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	time.Sleep(150 * time.Millisecond)
+	foreign := process
+	foreign.Start = "foreign"
+	req := supervisorRequest{Process: foreign, Op: "admit", Nonce: strings.Repeat("a", 64)}
+	conn.SetDeadline(time.Now().Add(time.Second))
+	if err = json.NewEncoder(conn).Encode(req); err != nil {
+		t.Fatal(err)
+	}
+	var response Response
+	if err = json.NewDecoder(conn).Decode(&response); err == nil || response.OK {
+		t.Fatal("foreign Process frame accepted", response)
+	}
+	if p.Client.Status(context.Background()).State != "ready" {
+		t.Fatal("foreign frame changed valid epoch")
+	}
+}

package/templates/native-go/backend/internal/helper/supervisor_frame_test.go

@@ -0,0 +1,107 @@
+package helper
+
+import (
+	"encoding/json"
+	"net"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSupervisorReceivePhases(t *testing.T) {
+	req := supervisorRequest{Op: "grants", Nonce: strings.Repeat("a", 64), Data: json.RawMessage(`{}`)}
+	frame, _ := json.Marshal(req)
+	for _, kind := range []string{"delayed-attestation", "late-attestation", "buffered-large", "empty-eof", "silent", "partial", "drip", "trailing", "oversize", "duplicate", "valid"} {
+		t.Run(kind, func(t *testing.T) {
+			server, client := supervisorSocketPair(t)
+			defer server.Close()
+			defer client.Close()
+			// Legacy server starts its receive clock before the caller's full hash.
+			if err := server.SetDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
+				t.Fatal(err)
+			}
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				switch kind {
+				case "silent":
+					return
+				case "late-attestation":
+					time.Sleep(1100 * time.Millisecond)
+					client.Write(frame)
+				case "buffered-large":
+					large := req
+					large.Data = json.RawMessage(`{"padding":"` + strings.Repeat("a", 8192) + `"}`)
+					raw, _ := json.Marshal(large)
+					client.Write(raw)
+				case "empty-eof":
+				case "delayed-attestation":
+					time.Sleep(150 * time.Millisecond)
+					client.Write(frame)
+				case "partial":
+					client.Write([]byte("{"))
+					time.Sleep(200 * time.Millisecond)
+				case "drip":
+					for n := 0; n < 8; n++ {
+						if _, e := client.Write([]byte(" ")); e != nil {
+							return
+						}
+						time.Sleep(30 * time.Millisecond)
+					}
+				case "trailing":
+					client.Write(append(frame, []byte(`{}`)...))
+				case "oversize":
+					client.Write(append(frame, []byte(strings.Repeat(" ", MaxControlBytes))...))
+				case "duplicate":
+					client.Write([]byte(`{"op":"grants","op":"grants","nonce":"` + req.Nonce + `","data":{}}`))
+				default:
+					client.Write(frame)
+				}
+				client.CloseWrite()
+			}()
+			started := time.Now()
+			got, code := receiveSupervisorRequest(server)
+			elapsed := time.Since(started)
+			server.Close()
+			client.Close()
+			<-done
+			if kind == "valid" || kind == "delayed-attestation" || kind == "buffered-large" {
+				if code != "" || got.Nonce != req.Nonce {
+					t.Fatalf("valid delayed/buffered frame refused: %s", code)
+				}
+			} else if code == "" {
+				t.Fatal("invalid/stalled frame accepted")
+			}
+			if kind == "silent" && (elapsed < 900*time.Millisecond || elapsed > 1500*time.Millisecond) {
+				t.Fatalf("first-byte bound: %s", elapsed)
+			}
+			if (kind == "partial" || kind == "drip") && elapsed > 180*time.Millisecond {
+				t.Fatalf("frame deadline was extended: %s", elapsed)
+			}
+		})
+	}
+}
+
+func TestSupervisorFrameBudgetAlsoBoundsLegacyReply(t *testing.T) {
+	// Keep the synchronous pipe here: an unread small Unix socket reply fits in
+	// the kernel buffer and would not exercise the bounded blocked-write path.
+	server, client := net.Pipe()
+	defer server.Close()
+	defer client.Close()
+	// A watchdog protects the test if reply writes accidentally lose their bound.
+	server.SetWriteDeadline(time.Now().Add(2 * time.Second))
+	req := supervisorRequest{Op: "admit", Nonce: strings.Repeat("b", 64)}
+	frame, _ := json.Marshal(req)
+	sent := make(chan struct{})
+	go func() { defer close(sent); time.Sleep(150 * time.Millisecond); client.Write(frame) }()
+	if _, code := receiveSupervisorRequest(server); code != "" {
+		t.Fatal(code)
+	}
+	<-sent
+	started := time.Now()
+	_, err := server.Write([]byte(`{"ok":true}`))
+	elapsed := time.Since(started)
+	if e, ok := err.(net.Error); !ok || !e.Timeout() || elapsed < 70*time.Millisecond || elapsed > 350*time.Millisecond {
+		t.Fatalf("unbounded/expired legacy reply: %s %v", elapsed, err)
+	}
+}